diff --git a/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
index 39345cdc44e..e28a805471a 100644
--- a/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild
index 114d6d16b30..919bf668eb8 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild
@@ -31,7 +31,7 @@ fi
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ ${PV} != *_p* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="pic static"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index 9a395cd2f8a..2c9de7826ef 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,6 @@
 DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
 DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5
+DIST libarchive-3.8.0.tar.xz 5950876 BLAKE2B 7cdccd6b4cbb180dbd40fba3461fa98b53aaf05c0b4b71776d9bb26d1ed5329b8aff9cb534667334a4069bb6e1e629522b048ce859c408d48ba96cec9c41bddf SHA512 b0dcee8cb586ce2061987589067bbc063e326471fe36de64cc9c3e8b5eaaaedb85ef2b320be1671e008a32f39bdfc07db4e8abbde58328ab2655c2af0f0984f9
+DIST libarchive-3.8.0.tar.xz.asc 659 BLAKE2B 47893aa0770487b7f3902ae9950baec3cecf7d514ead57d83e2d0cd6feb2e96c55fe1a42020a70260d6958eee654633f01b1dd200b2ef718248d2c559905ad37 SHA512 62896d1995b9d05dc0d01829062fa954c1319764a7b7d1dc34cde456b303c115725921dbcfa3dd82384aa8f81df9c9b04abcf9fafa1457d31e581da7b7b2f642
+DIST libarchive-3.8.1.tar.xz 5950428 BLAKE2B 92ce11758ea050c7f5b3b2440566b71d29d4fe3ee90ee3455117585ef629eb7cfbe6f3c67bfb309c38d02118ef8f71c1c30ffe14466bfef7929c6d6134b11fc8 SHA512 c794d1c6e6a6dcf4072438dc4e8ce5b1530bbe9ad40afad18f4e6a444aa5d85e48c58cfbd8af41d4d25e93844956de3ce262cb1d68097d2e5f95bd87b5a982b7
+DIST libarchive-3.8.1.tar.xz.asc 659 BLAKE2B 0965437c5087b29c356280613fba546c0f08cbe3996c885957e1424304f3ea1cb4651168b34c3389ec6119bd5ab99160dc530dced31490cd2f6e8c3850e77223 SHA512 540ea8203920c1e8e6934f20c0f6b592a309c82f82561960d9adff3a3a09cf28c7a3d92070682b6b420ef82c6e30d6e9741d8c3e5473a78390da5137e61c05bd
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.0.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.0.ebuild
new file mode 100644
index 00000000000..442c8017e3e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.0.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.1.ebuild
new file mode 100644
index 00000000000..b957cea4b43
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.1.ebuild
@@ -0,0 +1,174 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r2.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r2.ebuild
index 05d8d642640..63e7fa8d665 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r2.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -71,6 +71,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -113,8 +118,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -189,6 +197,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1-r1.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1-r1.ebuild
index b4b85808bcc..21133d9dfaa 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1-r1.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -65,6 +65,16 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+
+	if tc-ld-is-lld ; then
+		export LDFLAGS="${LDFLAGS} -Wl,--undefined-version"
+	fi
+
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -107,8 +117,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -183,6 +196,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index b4b85808bcc..bce0a88b7ae 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -65,6 +65,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -107,8 +112,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -183,6 +191,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
index 5996706b0a4..b0dd3d3d669 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
@@ -1,2 +1 @@
-DIST zstd-1.5.6.tar.gz 2406875 BLAKE2B fe17cf0950f8ee2cc07bfa2b41e97f36a1832e396386cb94a55bede975dc974920578cf147b39eecbc5b53ff06fe0dc1fe781a4cab9bc9f767ea28c0e786422e SHA512 54a578f2484da0520a6e9a24f501b9540a3fe3806785d6bc9db79fc095b7c142a7c121387c7eecd460ca71446603584ef1ba4d29a33ca90873338c9ffbd04f14
 DIST zstd-1.5.7.tar.gz 2434947 BLAKE2B ef6bcf13bbb79edce2de21ef4860b01dcb4d2dd47ebd03657d5331c3bb1a207ef128e99ed907a32e787dca7bb51df225ebd8abb2097d03d02c003ca713e1e271 SHA512 b4de208f179b68d4c6454139ca60d66ed3ef3893a560d6159a056640f83d3ee67cdf6ffb88971cdba35449dba4b597eaa8b4ae908127ef7fd58c89f40bf9a705
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
deleted file mode 100644
index a2c7a56db95..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild
+++ /dev/null
@@ -1,79 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic meson-multilib
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-SRC_URI="https://github.com/facebook/zstd/releases/download/v${PV}/${P}.tar.gz"
-S="${WORKDIR}"/${P}/build/meson
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+lzma lz4 static-libs test zlib"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	lzma? ( app-arch/xz-utils )
-	lz4? ( app-arch/lz4:= )
-	zlib? ( sys-libs/zlib )
-"
-DEPEND="${RDEPEND}"
-
-MESON_PATCHES=(
-	# Workaround until Valgrind bugfix lands
-	"${FILESDIR}"/${PN}-1.5.4-no-find-valgrind.patch
-)
-
-PATCHES=(
-)
-
-src_prepare() {
-	cd "${WORKDIR}"/${P} || die
-	default
-
-	cd "${S}" || die
-	eapply "${MESON_PATCHES[@]}"
-}
-
-multilib_src_configure() {
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# This replaces the no-find-valgrind patch once bugfix lands in a meson
-	# release + we can BDEPEND on it (https://github.com/mesonbuild/meson/pull/11372)
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	valgrind='valgrind-falseified'
-	EOF
-
-	# Test suite validates that stack is not executable.  Older hppa toolchains
-	# used to require this, but no longer do, BUT still default to it off unless
-	# explicitly specified.  See #903923
-	# The cmake build sets these, but the meson build doesn't, so set it manually.
-	# https://github.com/facebook/zstd/blob/979b047/build/cmake/CMakeModules/AddZstdCompilationFlags.cmake#L77-L82
-	append-flags $(test-flags-CCLD "-Wa,--noexecstack")
-	append-ldflags $(test-flags-CCLD "-Wl,-z,noexecstack")
-
-	local emesonargs=(
-		-Ddefault_library=$(multilib_native_usex static-libs both shared)
-
-		$(meson_native_true bin_programs)
-		$(meson_native_true bin_contrib)
-		$(meson_use test bin_tests)
-
-		$(meson_native_use_feature zlib)
-		$(meson_native_use_feature lzma)
-		$(meson_native_use_feature lz4)
-
-		--native-file "${native_file}"
-	)
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	meson_src_test --timeout-multiplier=2
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
index 3a2543b064b..236702ff608 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit meson-multilib
+inherit dot-a meson-multilib
 
 DESCRIPTION="zstd fast compression library"
 HOMEPAGE="https://facebook.github.io/zstd/"
@@ -40,6 +40,11 @@ src_prepare() {
 	eapply "${MESON_PATCHES[@]}"
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
 
@@ -70,3 +75,8 @@ multilib_src_configure() {
 multilib_src_test() {
 	meson_src_test --timeout-multiplier=2
 }
+
+multilib_src_install_all() {
+	einstalldocs
+	strip-lto-bytecode
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
index 1ceb00deb79..58d58774588 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
@@ -2,3 +2,5 @@ DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46
 DIST containerd-2.0.3.tar.gz 10450757 BLAKE2B 5dec56a40dc2874fb0b6fd4d72704f6417858eefd983c8ec5dfb2c9ef8be1e9e309cff83395e03c2d5fef30ed5c0561329ffbcd3dfba91e40d8017f7a605771b SHA512 9528a65d9d9f13d15d861f7ce71ab483958020bda83947d18868b477204e9e2e33eccc69280502c54b2be9ce577724e3e2b1772229c99636099b04bac1079ac1
 DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9da8e33b1140c0b5866dcc61e17fe1040f31ef09bdb07ad98a52def5e9eb12cfeb635e96b2c5f64fdb4d8cfb6c84b885 SHA512 f84e0cc0b82313df010b95989faf56e81ebfbbc321585b968c8c706917b91a9f0d895692fa5046f24f1c370de7a74b50daf83da617fe0595e5a8ff69ed658727
 DIST containerd-2.0.5.tar.gz 10452563 BLAKE2B bf03316c9211eaa17a3b40b1fc9f9aca42fe3e621e086e612eb07c286c6b62bc7a0a2426ce7b6742dce2924d570ab599aefb43463c4fa6be277e562bad79668f SHA512 af89a5c9ad5f931c5fee33c75c13c296fc9ec966f2c64ec244897695eebb365bcb542f6b431e60d4ef7213f0ea11d3a8896d1b7f033ed445e6b521b7ddbffe6f
+DIST containerd-2.1.0.tar.gz 10610618 BLAKE2B 147c21b4650543af9b0e533e381a0505ba927d6e9270b9b03a09016eb3ccf29875db7fa274944fea2ff7b029b6a05a17d14c61e24b5f3426b31f320831eeb46a SHA512 e9bb128917bb6b2e21a8e05344af3fdcdda8620be20e54407bc2c73046278a88a77bcbed6ef7a59099c9ee3303283db46b90b71afdd45236d3c534749ba844e0
+DIST containerd-2.1.1.tar.gz 10610787 BLAKE2B acc2d769752c783643795d228c0d267b0802e09166dc783e84087da0029a822a64688f5e59c047c47b25f50ca2a1ccb7f5b6216ad6beeb4489df308e525e9716 SHA512 542f7cae61e1ef2e1b529b0bea66d7ad9016d4605de73de9c9c8a738e50ec6f470b939d1546482320515b77424bffe1cf24b721173ac0c0ecd0100c92817cfb1
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.0.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.0.ebuild
new file mode 100644
index 00000000000..82ff43895ce
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.0.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=061792f0ecf3684fb30a3a0eb006799b8c6638a7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.1.ebuild
new file mode 100644
index 00000000000..c697a6ff2bc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.1.ebuild
@@ -0,0 +1,95 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=cb1076646aa3740577fafbf3d914198b7fe8e3f7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
index 797cfd9fdb5..f5d4cefaa7d 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest
@@ -1,2 +1,3 @@
 DIST cri-tools-1.27.0.tar.gz 8465050 BLAKE2B d6c0429271ebc4085e75b54d7f3b9f75ab796e63bc9ae7562105296b13bbad8b512293a7d25abf1ab946f4bf54e672016fdb72696c12c730d21ac74724da465c SHA512 b94122e6401eb0c33b9c3d112274b7ab20cbbad05e76a54933e79d2e42ded2d684771cb9ed703a6c1afa381844142b6f1b4dc77d17e915f9a42c236fd8426b9b
 DIST cri-tools-1.32.0.tar.gz 7682096 BLAKE2B 125fc9014942e681353ef49d4d397af4fc77500c0fb37d2d1be0850839c37f51f2ef41b5c7d9ca422e814d1fe50f985bfd42d2bba11d391cea66b3bec381dc08 SHA512 654cfd4d546932d48c02e19071e137fa7565a5134ba1845498d61f2dfef45fca722a51dbadb7a467214f7424290c53cb79a2908684d1fbd3820836b55640f66d
+DIST cri-tools-1.33.0.tar.gz 7754304 BLAKE2B 42011726997a07842fd3c9769335a71e37e1689e443a0d1a99916b5729cc22092593928a6b94bbc3718a0e5f89f3818c3b6d6155970de21e8eee30fc979a294d SHA512 0252243147e32e06328c192f77397461a729aec621bee92083dcf3899e9ffbb62386a944795535cc4a0deb5c88d1017082db8bf221f6627feb7dcd100dc70457
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild
new file mode 100644
index 00000000000..92307d9fb67
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild
@@ -0,0 +1,38 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module shell-completion toolchain-funcs
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	local GOOS=$(go-env_goos)
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	if ! tc-is-cross-compiler; then
+		"${CRICTL}" completion bash > crictl.bash || die
+		"${CRICTL}" completion zsh > crictl.zsh || die
+	fi
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	if ! tc-is-cross-compiler; then
+		newbashcomp crictl.bash crictl
+		newzshcomp crictl.zsh _crictl
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
index dd1c3524811..ad1e3c5fa34 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
@@ -2,9 +2,7 @@ DIST incus-6.0.3.tar.xz 11916020 BLAKE2B d3d998bd50124604c52ff007eefed586c216ce1
 DIST incus-6.0.3.tar.xz.asc 833 BLAKE2B 38835ab036709161150992cb40df4ff1ae1887d4f3e0b037d0415f75d2bb711cb3c5945bffe1b91d289acfb7e19e726964278e5c2ab31731ba9f7534f139dec7 SHA512 7d5360ab91aafe1d047a60e38a07e24c3c7b158e753087a943ec5e59d6a27c19a872080c9007b6cf592040d3408845bc188d76f6e732408d0680a3782cebce47
 DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1b5487dc98901f000894b3781aec89f617d2246314cf9a95a7d65531e486c4092f8939722e1b3c2bf7d33063c8 SHA512 14a5cdad3f9365d58e526c8f451d9e7a57729010073caff31256e0b94d28206adc82ead4820278e7eac17b74d22a76d9f3b9f5f8424ddbfa6b74a5cea13e019f
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
-DIST incus-6.10.1.tar.xz 18023076 BLAKE2B c35c7a81448b17db6db8959458c23a58392d9e3dcfedaf6d1094964c0c35d46d551a4d6cbaab93cde4b9006bdeb064dcc50148fc2cded6c9ca122f635dab58cd SHA512 12566fef798b34e3d1f3abe4bebada50a99f0e30fd33e1c5ffab458a2ebdac484650e6bf35a48bc4680669d24c9fd912b549e43ed01318bdac52d1b1767cb275
-DIST incus-6.10.1.tar.xz.asc 833 BLAKE2B 2e2de67bae59502fdad66a7ac5b7771d4e305f87e4b3e35bc829a73bd053a7ca8256f9bfa8e4c2fc6ee2268cdc8bd9b9bac7ed319e5cda14829daeaa39108b51 SHA512 4f00405913b0d04a0eec407756928e59e477ecf4dfc07b063a13fc5683fcc6e18efe1d2947a6b9c12e5fb1b64d39dc076f4a41da129fe132d30e7cfc23af80a4
-DIST incus-6.11.tar.xz 11997736 BLAKE2B 8764c1189fceeb65caedc0b9cf562f8f78a4e905101022c4efe98693ed70ef069b580d10f74e1830e0225a5332b5b37a9068c636aec738a6496a01430d6074c3 SHA512 0d52e71ce55aa59bb2b3a4c9f7926d43a6dfae1809d42c2c0c591019eaef648a4e15159a826de382e06149aa3488d60c283f69055335124d85597199d231367f
-DIST incus-6.11.tar.xz.asc 833 BLAKE2B b399138638c2c503600b29899b81a4ce691af2ad16ab2d8f8994c92e317e0b48dc2021095346e9784f58a631b724c134186be026acb06fb9a63a01cc0d1cb970 SHA512 f2b108129fe3111e184544b4fce8d5503b59764b202582c901699602d3a7434e3876684ad0f625b7beeb8ca92e6cd9468ced804bcbb8e00336d48d4bce4de1fe
 DIST incus-6.12.tar.xz 12041616 BLAKE2B 25bb157839a6d86f45614f71cb8f61ec2d92ca96322e90dc9d4f47603aee8b246621b941cd223a3c9007bbb4dbb65ffe432a72d2e7af5fefae40bc398406424b SHA512 1234f54965f2b50fa04c286405dd3b7dcbf86f88f91dd38476695a57961dd13fbc8da3c698ce1c254da71239b4af64fda25b9de7c6db017e7728b5bc4db52bf4
 DIST incus-6.12.tar.xz.asc 833 BLAKE2B e74dbefea68db25458da3956e6b5fc99b2cc861d9a20c5d10a9fa2d1803068b2b36a350d35960bfb289e9e1e747baa8bc5d2fdb0a93fcfb8ee7b0ffcd65befe7 SHA512 11f63160366a17d7d2679eb52f318d3c0e2a6d91a76c968d6483db9fb45892006d831f85e30bedfa9237a55d9b517458b01c3d1311e7e5f9ea1c3b3bbc18975a
+DIST incus-6.13.tar.xz 12416404 BLAKE2B 0eca3b80762e9473be21f29157eb42d655a09db97084f6cccd1317595f96593c866110c19a4a42592ae556e8f2f3e40153a7430730373cdb777261bc4a8f0d5e SHA512 80411e23aa95f021f349463b15146444bba7f5cad42e094ff099ec70df8083d7b54d8374ef659d3f4d01afbcbf4287b7238e973d53fecd9a7af046df85b1b05f
+DIST incus-6.13.tar.xz.asc 833 BLAKE2B fbdb41110452716aa333f444801152456ec1196cbdb151c5dfdb940d3e82e39cbbc70990ec999b723938ec3986deafff0c1e77376cdd19fb862aa8c59083d363 SHA512 a29978fd9d9f89f7ae6585f150cf78ec7819360e189ce6bbb5559049cecd2b667a46857a852a77d22edba60fce083c2bfccbf89535dad7d415e82c0eec995700
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r1.ebuild
index 7262a4f6593..e7e99e8bc46 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r1.ebuild
@@ -158,8 +158,7 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
-	if [ "${GOARCH}" != "${GOHOSTARCH}" ]; then
+	if tc-is-cross-compiler ; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4-r1.ebuild
index 4703fda2057..b128d310292 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -153,7 +153,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.10.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.10.1-r1.ebuild
deleted file mode 100644
index 1a9b75f9040..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.10.1-r1.ebuild
+++ /dev/null
@@ -1,225 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
-
-DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
-HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
-SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
-	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
-
-LICENSE="Apache-2.0 BSD LGPL-3 MIT"
-SLOT="0/stable"
-KEYWORDS="~amd64 ~arm64"
-IUSE="apparmor fuidshift nls qemu"
-
-DEPEND="acct-group/incus
-	acct-group/incus-admin
-	app-arch/xz-utils
-	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
-	dev-db/sqlite:3
-	>=dev-libs/cowsql-1.15.7
-	dev-libs/lzo
-	>=dev-libs/raft-0.22.1:=[lz4]
-	>=dev-util/xdelta-3.0[lzma(+)]
-	net-dns/dnsmasq[dhcp]
-	sys-libs/libcap
-	virtual/udev"
-RDEPEND="${DEPEND}
-	|| (
-		net-firewall/iptables
-		net-firewall/nftables[json]
-	)
-	fuidshift? ( !app-containers/lxd )
-	net-firewall/ebtables
-	sys-apps/iproute2
-	sys-fs/fuse:*
-	>=sys-fs/lxcfs-5.0.0
-	sys-fs/squashfs-tools[lzma]
-	virtual/acl
-	qemu? (
-		app-cdr/cdrtools
-		app-emulation/qemu[spice,usbredir,virtfs]
-		sys-apps/gptfdisk
-	)"
-BDEPEND=">=dev-lang/go-1.21
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
-
-CONFIG_CHECK="
-	~AIO
-	~CGROUPS
-	~IPC_NS
-	~NET_NS
-	~PID_NS
-
-	~SECCOMP
-	~USER_NS
-	~UTS_NS
-
-	~KVM
-	~MACVTAP
-	~VHOST_VSOCK
-"
-
-ERROR_AIO="CONFIG_AIO is required."
-ERROR_IPC_NS="CONFIG_IPC_NS is required."
-ERROR_NET_NS="CONFIG_NET_NS is required."
-ERROR_PID_NS="CONFIG_PID_NS is required."
-ERROR_SECCOMP="CONFIG_SECCOMP is required."
-ERROR_UTS_NS="CONFIG_UTS_NS is required."
-
-WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
-WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
-WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
-
-# Go magic.
-QA_PREBUILT="/usr/bin/incus
-	/usr/bin/incus-agent
-	/usr/bin/incus-benchmark
-	/usr/bin/incus-migrate
-	/usr/bin/lxc-to-incus
-	/usr/sbin/fuidshift
-	/usr/sbin/incusd
-	/usr/sbin/lxd-to-incus"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
-
-# The testsuite must be run as root.
-# make: *** [Makefile:156: check] Error 1
-RESTRICT="test"
-
-GOPATH="${S}/_dist"
-
-src_unpack() {
-	verify-sig_src_unpack
-	go-module_src_unpack
-}
-
-src_prepare() {
-	export GOPATH="${S}/_dist"
-
-	default
-
-	sed -i \
-		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
-		-e "s:make:make ${MAKEOPTS}:g" \
-		Makefile || die
-
-	sed -i \
-		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
-		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
-		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
-
-	cp "${FILESDIR}"/incus-0.4.service "${T}"/incus.service || die
-	if use apparmor; then
-		sed -i \
-			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
-			"${T}"/incus.service || die
-	fi
-
-	# Disable -Werror's from go modules.
-	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
-}
-
-src_configure() { :; }
-
-src_compile() {
-	export GOPATH="${S}/_dist"
-	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
-
-	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
-		ego install -v -x "${S}/cmd/${k}"
-	done
-
-	if use fuidshift ; then
-		ego install -v -x "${S}/cmd/fuidshift"
-	fi
-
-	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
-
-	# Needs to be built statically
-	CGO_ENABLED=0 go install -v -tags netgo "${S}"/cmd/incus-migrate
-	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/cmd/incus-agent
-
-	use nls && emake build-mo
-}
-
-src_test() {
-	emake check
-}
-
-src_install() {
-	export GOPATH="${S}/_dist"
-
-	if tc-is-cross-compiler ; then
-		local bindir="_dist/bin/linux_${GOARCH}"
-	else
-		local bindir="_dist/bin"
-	fi
-
-	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
-
-	# Admin tools
-	for l in incusd incus-user lxd-to-incus ; do
-		dosbin ${bindir}/${l}
-	done
-
-	# User tools
-	for m in incus-agent incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
-		dobin ${bindir}/${m}
-	done
-
-	# fuidshift, should be moved under admin tools at some point
-	if use fuidshift ; then
-		dosbin ${bindir}/fuidshift
-	fi
-
-	newconfd "${FILESDIR}"/incus-6.0.confd incus
-	newinitd "${FILESDIR}"/incus-6.0.initd incus
-	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
-
-	systemd_dounit "${T}"/incus.service
-	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
-	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
-	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
-	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
-
-	if ! tc-is-cross-compiler; then
-		# Generate and install shell completion files.
-		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
-		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
-		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
-		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
-	else
-		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
-	fi
-
-	dodoc AUTHORS
-	dodoc -r doc/*
-	use nls && domo po/*.mo
-
-	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184
-	newenvd - 90incus <<- _EOF_
-		INCUS_EDK2_PATH=${EPREFIX}/usr/share/edk2-ovmf
-	_EOF_
-}
-
-pkg_postinst() {
-	elog
-	elog "Please see"
-	elog "  https://wiki.gentoo.org/wiki/Incus"
-	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
-	elog
-	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
-	optfeature "btrfs storage backend" sys-fs/btrfs-progs
-	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
-	optfeature "full incus-migrate support" net-misc/rsync
-	optfeature "lvm2 storage backend" sys-fs/lvm2
-	optfeature "zfs storage backend" sys-fs/zfs
-	elog
-	elog "Be sure to add your local user to the incus group."
-	elog
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12-r1.ebuild
index 92da209e83f..f0e16b062e4 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -155,7 +155,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.11.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.13.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.11.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.13.ebuild
index 172578e69bf..f0e16b062e4 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.13.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -39,6 +39,7 @@ RDEPEND="${DEPEND}
 	>=sys-fs/lxcfs-5.0.0
 	sys-fs/squashfs-tools[lzma]
 	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
 	qemu? (
 		app-cdr/cdrtools
 		app-emulation/qemu[spice,usbredir,virtfs]
@@ -154,7 +155,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
index 48951b8333d..9788fc59b6b 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
@@ -1,3 +1,4 @@
 DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
 DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
 DIST runc-1.2.6.tar.gz 2763135 BLAKE2B d5e40e95f8c0069073d0010d120aca1828e585b103ecd671fca072138ef3528a316414cfac5ca725f45cb84f23ab4216d9e6f466beb118fb2813ab4be3a18e92 SHA512 9a89295e001914726dfc1040729301f62ad6b630943c65f7ade6ed460ef4a2f5f35cf40662730a9e8a6c6d0301a3c9959a85973097ceb8db05c043f9c1a86248
+DIST runc-1.3.0.tar.gz 2858199 BLAKE2B c9402a074b816b9452763267a7ffdc69af6c0cd4cf54fbdfdc91ccbd8bbc5daa783259176775e90f6266fa6a02bf0bad7fbb8eb879b5764309f7f9cd2f246086 SHA512 63422501f6189d0d47f6b2f59565de572bc68b138a65c7dbcc8b5ad42dbc37245ee66e2683ab61971a84c076a15f54f484c37fde4a30815ee19edc9a0d97e9f4
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.0.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.0.ebuild
new file mode 100644
index 00000000000..28ebbb06b71
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.0.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=4ca628d1d4c974f92d24daccb901aa078aad748e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/argon2/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/argon2/Manifest
index cc1597d7b37..2e11cd96000 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/argon2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/argon2/Manifest
@@ -1 +1 @@
-DIST argon2-20190702.tar.gz 1505307 BLAKE2B fa9c3dde7b39c8d797a3d6b52992ebfe35f5eba1c7d7b3aa02c440edc36a3f5186cacee2e39e27ed7c6356dc1970dac0e8198d6f2065eb63ff77f9dfb2937cf8 SHA512 0a4cb89e8e63399f7df069e2862ccd05308b7652bf4ab74372842f66bcc60776399e0eaf979a7b7e31436b5e6913fe5b0a6949549d8c82ebd06e0629b106e85f
+DIST phc-winner-argon2-20190702.tar.gz 1505307 BLAKE2B fa9c3dde7b39c8d797a3d6b52992ebfe35f5eba1c7d7b3aa02c440edc36a3f5186cacee2e39e27ed7c6356dc1970dac0e8198d6f2065eb63ff77f9dfb2937cf8 SHA512 0a4cb89e8e63399f7df069e2862ccd05308b7652bf4ab74372842f66bcc60776399e0eaf979a7b7e31436b5e6913fe5b0a6949549d8c82ebd06e0629b106e85f
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/argon2/argon2-20190702-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/argon2/argon2-20190702-r1.ebuild
index fd4e03641a3..dc19e466350 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/argon2/argon2-20190702-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/argon2/argon2-20190702-r1.ebuild
@@ -1,21 +1,24 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit toolchain-funcs
 
+MY_P=phc-winner-${P}
 DESCRIPTION="Password hashing software that won the Password Hashing Competition (PHC)"
-HOMEPAGE="https://github.com/P-H-C/phc-winner-argon2"
-SRC_URI="https://github.com/P-H-C/phc-winner-argon2/archive/${PV}.tar.gz -> ${P}.tar.gz"
+HOMEPAGE="https://github.com/P-H-C/phc-winner-argon2/"
+SRC_URI="
+	https://github.com/P-H-C/phc-winner-argon2/archive/${PV}.tar.gz
+		-> ${MY_P}.tar.gz
+"
+S=${WORKDIR}/${MY_P}
 
 LICENSE="|| ( Apache-2.0 CC0-1.0 )"
 SLOT="0/1"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="static-libs"
 
-S="${WORKDIR}/phc-winner-${P}"
-
 DOCS=( argon2-specs.pdf CHANGELOG.md README.md )
 
 src_prepare() {
@@ -44,16 +47,26 @@ src_prepare() {
 }
 
 src_compile() {
-	emake OPTTEST="${OPTTEST}" LIBRARY_REL="$(get_libdir)" PREFIX="${EPREFIX}/usr" \
+	emake \
+		OPTTEST="${OPTTEST}" \
+		LIBRARY_REL="$(get_libdir)" \
+		PREFIX="${EPREFIX}/usr" \
 		ARGON2_VERSION="0~${PV}"
 }
 
 src_test() {
-	emake OPTTEST="${OPTTEST}" test
+	emake \
+		OPTTEST="${OPTTEST}" \
+		test
 }
 
 src_install() {
-	emake OPTTEST="${OPTTEST}" DESTDIR="${ED}" LIBRARY_REL="$(get_libdir)" install
+	emake \
+		OPTTEST="${OPTTEST}" \
+		DESTDIR="${ED}" \
+		LIBRARY_REL="$(get_libdir)" \
+		install
+
 	einstalldocs
 	doman man/argon2.1
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
index 84af256d783..21587b4c1e4 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest
@@ -2,5 +2,7 @@ DIST gnupg-2.2.45.tar.bz2 7447141 BLAKE2B 8fe2036325e31332166c0477ce9514152c8417
 DIST gnupg-2.2.45.tar.bz2.sig 119 BLAKE2B 6656747b2d640a95c4172a221952fa75f7d03c231b7c6d40ea57b43a5bcfbceb800023ca2f352ca09325aaf186a7bf31fcfe7104129c5d6628f0e1256994df76 SHA512 181195a76eede8113bd8f2a7f5bc20674226f6327cf8263389e3d178c205ed2d817b28f2d3b504dd9f852f22fc283d2c14e809ba1c05cfe88b66103845ff114c
 DIST gnupg-2.4.7.tar.bz2 8010244 BLAKE2B 4cdc6be4330b0c8f150d9d1a9ce9c7d34232ecf9b980b15fbd20e96ff6fcd8665688456d66f1c862b816472034eaa0796444357b1f36e75e8520a603a0e6b298 SHA512 3e84f1679904bf0efb789df6466e468bd2be9149d52561f35e2380038133479bebf1c61ee7adf6d3564b370915f32111098c052be6e6acaf3083a807f9f36019
 DIST gnupg-2.4.7.tar.bz2.sig 119 BLAKE2B e97012f433c2818dda953ccaa2f5e8e94492b306a7815b16d7a9f8bf165f11972114d94a1aaba6156baed0ee3566ad998ed74a9521c71464268f4c6f8f14306c SHA512 d944a57b21fa7a4058fb4f00e3c164220be038037010a07a43e48c881dd66d901f8ea249f5df183a1c7de811ecc3aa9ed1591c18baf201e338129eb7e28bddc4
+DIST gnupg-2.4.8.tar.bz2 8017685 BLAKE2B ab7126aac6c7bf323075c68084c963f75d93c729d8918b6ca10ef0a4466879636433c682a5437776d2ce9f5d432e1f66995dd94a4f44d7f184542f030087dbb2 SHA512 d7f07a258141a583bc8be18c0984d7dfe8508f12c624c053881ee63dfee11adcda8de216bcaaef9f5d24a1e217de70bf69ee2e3cc43b0da66a0e571ce9c4b436
+DIST gnupg-2.4.8.tar.bz2.sig 119 BLAKE2B 4f94b2abc40b17cfab44f28fc2a2ae5246f8356141a3932a92b5adb78002c7064bb132a6529079bc14900036f90d9d318d7d01818999150e2c875b88a3fca265 SHA512 9fb54be4e99ecee6c7b649d6f0ef24a25e81c0af57e07ccdd512a1ea2ebf7558dd25518b7b78347e4a216167849e6285bb91ec23d0968966aba0784d45f02a06
 DIST gnupg-2.5.1.tar.bz2 8126739 BLAKE2B 46955d2eebe14395adc0fdf81e89a32f3f9baaabfe1eee78f256a1fab25ce6fdb96b873678cfeb5e4abf4894c7ab4908359ed04cc6571ff442dcc5325b3ccd66 SHA512 733a11ff24145e23dd7d34d954a70c25bf70ecb1d517b8e15cc34bf690786c9f7007e4e99cde573500ac012852e91b29568fed00491f8c8254b3fb63ca5777cd
 DIST gnupg-2.5.1.tar.bz2.sig 238 BLAKE2B cd024a63ecb82a12e92444cbff8dbc9bef6a4e436d59957aae77927cce0baf9e282e63df7a5159a521c7c8694a0dbe96d6537ad3ec5f779c7c0dea8d02b5e70d SHA512 8ffd5cc72a2907972bf1854e804f6c215ff66ba2d6e91952700f49b2b5ba8bab035d0f42efdb0d3c3166301cda6e716394928bdd9c0d0d1e1789a02c7aa1a926
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.8.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.8.ebuild
new file mode 100644
index 00000000000..e010ff811b9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.8.ebuild
@@ -0,0 +1,196 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+# in-source builds are not supported: https://dev.gnupg.org/T6313#166339
+inherit flag-o-matic out-of-source multiprocessing systemd toolchain-funcs verify-sig
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="The GNU Privacy Guard, a GPL OpenPGP implementation"
+HOMEPAGE="https://gnupg.org/"
+SRC_URI="mirror://gnupg/gnupg/${MY_P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnupg/${P}.tar.bz2.sig )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test +tofu tpm tools usb user-socket wks-server"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test? ( tofu )"
+
+# Existence of executables is checked during configuration.
+# Note: On each bump, update dep bounds on each version from configure.ac!
+DEPEND="
+	>=dev-libs/libassuan-2.5.0:=
+	>=dev-libs/libgcrypt-1.9.1:=
+	>=dev-libs/libgpg-error-1.46
+	>=dev-libs/libksba-1.6.3
+	>=dev-libs/npth-1.2
+	sys-libs/zlib
+	bzip2? ( app-arch/bzip2 )
+	ldap? ( net-nds/openldap:= )
+	readline? ( sys-libs/readline:0= )
+	smartcard? ( usb? ( virtual/libusb:1 ) )
+	tofu? ( >=dev-db/sqlite-3.27 )
+	tpm? ( >=app-crypt/tpm2-tss-2.4.0:= )
+	ssl? ( >=net-libs/gnutls-3.2:0= )
+"
+RDEPEND="
+	${DEPEND}
+	nls? ( virtual/libintl )
+	selinux? ( sec-policy/selinux-gpg )
+	wks-server? ( virtual/mta )
+"
+PDEPEND="
+	app-crypt/pinentry
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( sys-apps/texinfo )
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+DOCS=(
+	ChangeLog NEWS README THANKS TODO VERSION
+	doc/FAQ doc/DETAILS doc/HACKING doc/TRANSLATE doc/OpenPGP doc/KEYSERVER
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
+)
+
+src_prepare() {
+	default
+
+	GNUPG_SYSTEMD_UNITS=(
+		dirmngr.service
+		dirmngr.socket
+		gpg-agent-browser.socket
+		gpg-agent-extra.socket
+		gpg-agent.service
+		gpg-agent.socket
+		gpg-agent-ssh.socket
+	)
+
+	cp "${GNUPG_SYSTEMD_UNITS[@]/#/${FILESDIR}/}" "${T}" || die
+
+	# Inject SSH_AUTH_SOCK into user's sessions after enabling gpg-agent-ssh.socket in systemctl --user mode,
+	# idea borrowed from libdbus, see
+	#   https://gitlab.freedesktop.org/dbus/dbus/-/blob/master/bus/systemd-user/dbus.socket.in#L6
+	#
+	# This cannot be upstreamed, as it requires determining the exact prefix of 'systemctl',
+	# which in turn requires discovery in Autoconf, something that upstream deeply resents.
+	sed -e "/DirectoryMode=/a ExecStartPost=-${EPREFIX}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/gnupg/S.gpg-agent.ssh" \
+		-i "${T}"/gpg-agent-ssh.socket || die
+}
+
+my_src_configure() {
+	# Upstream don't support LTO, bug #854222.
+	filter-lto
+
+	local myconf=(
+		$(use_enable bzip2)
+		$(use_enable nls)
+		$(use_enable smartcard scdaemon)
+		$(use_enable ssl gnutls)
+		$(use_enable test all-tests)
+		$(use_enable test tests)
+		$(use_enable tofu)
+		$(use_enable tofu keyboxd)
+		$(use_enable tofu sqlite)
+		$(usex tpm '--with-tss=intel' '--disable-tpm2d')
+		$(use smartcard && use_enable usb ccid-driver || echo '--disable-ccid-driver')
+		$(use_enable wks-server wks-tools)
+		$(use_with ldap)
+		$(use_with readline)
+
+		# Hardcode mailprog to /usr/libexec/sendmail even if it does not exist.
+		# As of GnuPG 2.3, the mailprog substitution is used for the binary called
+		# by wks-client & wks-server; and if it's autodetected but not not exist at
+		# build time, then then 'gpg-wks-client --send' functionality will not
+		# work. This has an unwanted side-effect in stage3 builds: there was a
+		# [R]DEPEND on virtual/mta, which also brought in virtual/logger, bloating
+		# the build where the install guide previously make the user chose the
+		# logger & mta early in the install.
+		--with-mailprog=/usr/libexec/sendmail
+
+		--disable-ntbtls
+		--enable-gpgsm
+		--enable-large-secmem
+
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	if use prefix && use usb; then
+		# bug #649598
+		append-cppflags -I"${ESYSROOT}/usr/include/libusb-1.0"
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# https://dev.gnupg.org/T7368
+		append-cppflags -D_XOPEN_SOURCE=500
+	fi
+
+	# bug #663142
+	if use user-socket; then
+		myconf+=( --enable-run-gnupg-user-socket )
+	fi
+
+	# glib fails and picks up clang's internal stdint.h causing weird errors
+	tc-is-clang && export gl_cv_absolute_stdint_h="${ESYSROOT}"/usr/include/stdint.h
+
+	econf "${myconf[@]}"
+}
+
+my_src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+my_src_test() {
+	export TESTFLAGS="--parallel=$(makeopts_jobs)"
+
+	default
+}
+
+my_src_install() {
+	emake DESTDIR="${D}" install
+
+	use tools && dobin tools/{gpgconf,gpgsplit,gpg-check-pattern} tools/make-dns-cert
+
+	dosym gpg /usr/bin/gpg2
+	dosym gpgv /usr/bin/gpgv2
+	echo ".so man1/gpg.1" > "${ED}"/usr/share/man/man1/gpg2.1 || die
+	echo ".so man1/gpgv.1" > "${ED}"/usr/share/man/man1/gpgv2.1 || die
+
+	dodir /etc/env.d
+	echo "CONFIG_PROTECT=/usr/share/gnupg/qualified.txt" >> "${ED}"/etc/env.d/30gnupg || die
+
+	use doc && dodoc doc/gnupg.html/*
+}
+
+my_src_install_all() {
+	einstalldocs
+
+	use tools && dobin tools/{convert-from-106,mail-signed-keys,lspgpot}
+	use doc && dodoc doc/*.png
+
+	# Dropped upstream in https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=eae28f1bd4a5632e8f8e85b7248d1c4d4a10a5ed.
+	dodoc "${FILESDIR}"/README-systemd
+	systemd_douserunit "${GNUPG_SYSTEMD_UNITS[@]/#/${T}/}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
index e7cad0d6665..128dcb81bc7 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
@@ -2,3 +2,5 @@ DIST gpgme-1.24.1.tar.bz2 1891695 BLAKE2B 8438291baec336c329deb9b864e1f3d2710066
 DIST gpgme-1.24.1.tar.bz2.sig 119 BLAKE2B 95232e31a8402cc5ec79d3a459ec6e35feb2d419dc7ac49b8e78103159ca472aac648e97acc3723dee4f2301e2333356e2b1f4376f423d8a3ef3734913249e69 SHA512 11650ea2af3e1c865eafc3c55632befeb036ce0435c32770dd6d6a03026ba7d343e9dcb3ab3597f6b6aae317f1aa26fa1e824f36caaf7214422b8b7ec76cc953
 DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
 DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855
+DIST gpgme-1.24.3.tar.bz2 1892862 BLAKE2B ace04d4fc803f6ce96f850a46b4b383ebdcbfe51d55fbe2a5ced10451310553c15ee5a603d1e6ffb78a8de75461fafacc296fec3e4f38d4908171a095cab185f SHA512 3b5fc22a2f83576058ac14e744333f46df362b39f742d6c9e54a5a66828194a1312f5f365bdc15683e148821f5d591fa92a2daad83fc116f65dccf14e817ca48
+DIST gpgme-1.24.3.tar.bz2.sig 238 BLAKE2B 5b8402b011899faae26bcba428e45a7bb7baf9b16e4c605cdae3d84dc1cbf52ccd524181ef0726e25075c42f9ccb72cd996707a2f96c04b7054cc9050270b586 SHA512 056b28b041dd83c86984e73c31403ea45d33db30c1b2b05e45b0cfb5bb723b25a0fa21ddee192c135cea5d93d934502085bc0fc94fa3c29858513e260c332948
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.1.ebuild
index 70de6a23a10..32458e4c9b7 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.1.ebuild
@@ -12,7 +12,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
 
 # in-source builds are not supported:
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
index 70de6a23a10..32458e4c9b7 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
@@ -12,7 +12,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
 
 # in-source builds are not supported:
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.3.ebuild
new file mode 100644
index 00000000000..7cc1a6a2bd0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.3.ebuild
@@ -0,0 +1,178 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+
+# in-source builds are not supported:
+# * https://dev.gnupg.org/T6313#166339
+# * https://dev.gnupg.org/T6673#174545
+inherit distutils-r1 libtool flag-o-matic out-of-source qmake-utils toolchain-funcs verify-sig
+
+DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
+HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
+SRC_URI="
+	mirror://gnupg/gpgme/${P}.tar.bz2
+	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
+"
+
+LICENSE="GPL-2 LGPL-2.1"
+# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
+# Use e.g. app-portage/iwdevtools integration with dev-libs/libabigail's abidiff.
+# Subslot: SONAME of each: <libgpgme.libgpgmepp.libqgpgme.FUDGE>
+# Bump FUDGE if a release is made which breaks ABI without changing SONAME.
+# (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
+SLOT="1/11.6.15.2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	qt5? ( cxx )
+	qt6? ( cxx )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+# - On each bump, update dep bounds on each version from configure.ac!
+RDEPEND="
+	>=app-crypt/gnupg-2
+	>=dev-libs/libassuan-2.5.3:=
+	>=dev-libs/libgpg-error-1.46-r1:=
+	python? ( ${PYTHON_DEPS} )
+	qt5? ( dev-qt/qtcore:5 )
+	qt6? ( dev-qt/qtbase:6 )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		qt5? ( dev-qt/qttest:5 )
+	)
+"
+#doc? ( app-text/doxygen[dot] )
+BDEPEND="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+	)
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
+	"${FILESDIR}"/${PN}-1.23.1-tests-gnupg-no-tofu.patch
+)
+
+src_prepare() {
+	default
+
+	elibtoolize
+
+	# bug #697456
+	addpredict /run/user/$(id -u)/gnupg
+
+	local MAX_WORKDIR=66
+	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
+		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
+		die "Could not run tests as requested with too-long WORKDIR."
+	fi
+
+	# Make best effort to allow longer PORTAGE_TMPDIR
+	# as usock limitation fails build/tests
+	ln -s "${P}" "${WORKDIR}/b" || die
+	S="${WORKDIR}/b"
+}
+
+my_src_configure() {
+	# bug #847955
+	append-lfs-flags
+
+	cd "${BUILD_DIR}" || die
+
+	local languages=(
+		$(usev common-lisp 'cl')
+		$(usev cxx 'cpp')
+		$(usev qt5 'qt5')
+		$(usev qt6 'qt6')
+	)
+
+	use qt5 && export MOC5="$(qt5_get_bindir)/moc"
+	use qt6 && export MOC6="$(qt6_get_libdir)/qt6/libexec/moc"
+
+	local myeconfargs=(
+		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
+		--enable-languages="${languages[*]}"
+		$(use_enable static-libs static)
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use python ; then
+		emake -C lang/python prepare
+
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_configure
+		popd > /dev/null || die
+	fi
+}
+
+my_src_compile() {
+	cd "${BUILD_DIR}" || die
+
+	emake
+
+	if use python ; then
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_compile
+		popd > /dev/null || die
+	fi
+}
+
+my_src_test() {
+	cd "${BUILD_DIR}" || die
+
+	emake check
+
+	if use python ; then
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	emake -C lang/python/tests check \
+		PYTHON=${EPYTHON} \
+		PYTHONS=${EPYTHON} \
+		TESTFLAGS="--python-libdir=${BUILD_DIR}/lib"
+}
+
+my_src_install() {
+	einstalldocs
+
+	cd "${BUILD_DIR}" || die
+
+	emake DESTDIR="${D}" install
+
+	if use python ; then
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_install
+		popd > /dev/null || die
+	fi
+
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	# Backward compatibility for gentoo
+	# (in the past, we had slots)
+	dodir /usr/include/gpgme
+	dosym -r /usr/include/gpgme.h /usr/include/gpgme/gpgme.h
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
index 9944edb4ef8..0b9b57b3994 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
@@ -1 +1,2 @@
 DIST rhash-1.4.5-src.tar.gz 444526 BLAKE2B 11021119e8af28e12491eabd55232e24a056bce79b624c970e4806c28fe707ea1395eb390572dba3453900d4512e5896d70642370d0c9340359e2fee95d62c8d SHA512 49bd6aa2497efc4871ae31eaca51d2dc78ceb7126311557d5280b14fafe9355eaecad37f0f78f865e4e1dd1aeb506d3301989cd2f9fff7b0091c81978e8c2f2e
+DIST rhash-1.4.6-src.tar.gz 461244 BLAKE2B 15ee0bc55745937a3e2f7d7e7b4193a19691e2678cdbc0a2caf19f16a7742100174e283edfef0449854fd24624e708078877643ce062c3babbc9b57992f73b81 SHA512 c125b71ec36cce2ec31057239cac8b987555f5e3b152dacb6386b905f8cc4d449c1de5b53e5a5206a2d87975681225c9b54e5826c10ffd91b3440f8595d22b15
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.6-r1.ebuild
new file mode 100644
index 00000000000..00e9f557a34
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.6-r1.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs multilib-minimal
+
+DESCRIPTION="Console utility and library for computing and verifying file hash sums"
+HOMEPAGE="https://rhash.sourceforge.net/"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
+S="${WORKDIR}/RHash-${PV}"
+
+LICENSE="0BSD"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="cpu_flags_x86_sha debug nls ssl static-libs"
+
+RDEPEND="
+	ssl? (
+		dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+)"
+
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+"
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
+		# we lack posix_memalign
+		sed -i -e '/if _POSIX_VERSION/s/if .*$/if 0/' \
+			librhash/util.h || die
+	fi
+
+	# upstream fix for BSD and others, but was only applied for BSD
+	# we need support for Solaris, where we use a GNU toolchain, so use
+	# the original hack, hopefully next release has this fixed
+	# https://github.com/rhash/RHash/issues/238
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/^elif linux; then/else/' configure || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	set -- \
+		./configure \
+		--target="${CHOST}" \
+		--cc="$(tc-getCC)" \
+		--ar="$(tc-getAR)" \
+		--extra-cflags="${CFLAGS}" \
+		--extra-ldflags="${LDFLAGS}" \
+		--prefix="${EPREFIX}"/usr \
+		--libdir="${EPREFIX}"/usr/$(get_libdir) \
+		--sysconfdir="${EPREFIX}"/etc \
+		--disable-openssl-runtime \
+		--disable-static \
+		--enable-lib-shared \
+		$(usev !cpu_flags_x86_sha '--disable-shani') \
+		$(use_enable debug) \
+		$(use_enable nls gettext) \
+		$(use_enable ssl openssl) \
+		$(use_enable static-libs lib-static)
+
+	echo "${@}"
+	"${@}" || die "configure failed"
+}
+
+multilib_src_compile() {
+	emake all \
+		$(multilib_is_native_abi && use nls && echo compile-gmo)
+}
+
+multilib_src_install() {
+	# -j1 needed due to race condition.
+	emake DESTDIR="${D}" -j1 \
+		install{,-lib-headers,-pkg-config} \
+		$(multilib_is_native_abi && use nls && echo install-gmo) \
+		install-lib-so-link
+}
+
+multilib_src_test() {
+	emake test
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
index e01ec1807ef..0f9e1ab9501 100644
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@@ -2,3 +2,4 @@ DIST eclass-manpages-20241115.tar.xz 456160 BLAKE2B eeaa4c964dbc784ae6351b89c4a8
 DIST eclass-manpages-20241117.tar.xz 456132 BLAKE2B 7111d9817b32ede80fb1e917f43e94b9342573684b715b874a2d880121840bbe67fa7c5aff95f5e7c99a25f2ae5beebadb3326c3a0df7117e99c0903cdcf3052 SHA512 73e28a2c40e89bbe2ba6611dc70c0b0320c8cf981b479ba3be86165d0b90c75f84c209d203d0ad612544709da881f7549d66560b4bccdb73209586d1a2cf8590
 DIST eclass-manpages-20241210.tar.xz 459680 BLAKE2B 076038d98bfae109ceaa1b14eff7f3e5ba575622243c60f59e7102d23d80e640c5e2932e2c614200cf3f653fc6cf4d0041dc4cc3011207273a690fc930e06091 SHA512 c3252f797ca71e9ca89b6d45715d763031733deb0f220aef65ddf750343693757f51d6535a22536b973c1c189b7cbe11306408c9c160e6ee3864e89af060ed8d
 DIST eclass-manpages-20250105.tar.xz 471540 BLAKE2B f21e783d233611349e036bb2e9ec52e3a8293891dcc56be15c628e9507b6bf5b650184eb7d57296a006f2a9764ac586257b61e1b810622bffff52c78708dfb9d SHA512 13c6ec0ad7251d287ba18dff6a362088c7e4f80036e225d1dc993cb467536566d88e588df0983207f26a06e39450c3072c436e391431df8d3e2b8a595a809022
+DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8d74b664b1f38e7f0555f812c25de494d8c18628f08e065738e6cfd2082769fc8367478a53849f1923d461027acca16f2a66a SHA512 99a361f0c4a144bf89f3dfdd02d298ef6c3a7138cd2b4e151449559fafaf6e83403ad73334494239c827bbc25eef30e701945b1783c9cc16aeff94fdf29679bb
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild
new file mode 100644
index 00000000000..0e318cc5afd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Instructions to make a dist tarball:
+# git clone https://github.com/projg2/eclass-to-manpage.git
+# cd eclass-to-manpage
+# make dist ECLASSDIR=~/g/eclass/
+
+DESCRIPTION="Collection of Gentoo eclass manpages"
+HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
+SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+# Keep the keywords stable. No need to change to ~arch.
+KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="sys-apps/gawk"
+
+src_install() {
+	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
index 0bc01680eb5..bda4a0eadd3 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	MY_P="${PN}-${PV/_}"
 	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="GNU GPL'd Pico clone with more functionality"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 62545c62295..4dc864d5d31 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -1,6 +1,9 @@
 DIST berkeley-softfloat-3-b64af41c3276f97f0e181920400ee056b9c88037.tar.bz2 84094 BLAKE2B 396f9df2e6ad559545054e89916915c3a3c8ff80e5e409498fec497b564d8b3ac9dd3cb966e26dce232ddff82af18a0e84e864ca18a80c2a2f4fe47e320249c2 SHA512 93c20d50a356c90f4293d8c7593611b2e0a9bc7567b6d946319f8ae06962ae1e297c8788f66fd38a1d3a0d44661bff9a07a63eaa84c8bb40ae01a45476be446c
 DIST berkeley-testfloat-3-e7af9751d9f9fd3b47911f51a5cfd08af256a9ab.tar.bz2 90020 BLAKE2B 3dda1ba90c4a5ad5cbce2acf35e93f7adbd387ae0e0f929b2cd4cbdf263f95183103118f32be38e8c80de49d7df44c26319ee2f465061d004ae7e64e43eeeb3e SHA512 65f41f42ea563b2cdceb6c71633f41e6694a79ffd02afed4540353a8e73668ae40118dfc108163aae751acbaa7c49630ed99f423465089503c03aee76b07f221
 DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B 0ed69ad24c53bd459c8753565814bcc1cd858f20d3a046c38912a35bcb0ba6d388ef5d2b93157cd028959284b330caf5467d82071c3df56a405dd8e08fd177c7 SHA512 8f2cc14e8bd46cb045e3ebfe32e463793ab7472ebda9b57b8ea0b06fa107a1a99c3ebcacb9c4548e30698d8ec154c0e56f789385201182b680819b8068a103f2
+DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
+DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
+DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.15.tar.xz 124418604 BLAKE2B 629cb5158cdd790947687a06f4c16bf838ae7b0eb5596bc16bb510dfe838bfcc6ed8e7776962bb6d5ab14379cba1a1f6b12683be370eb4e5debce1ecc446b156 SHA512 e8acc9ea6e70bd4dfb0956e01ee212c592c7b99f5dc0676824eb7cba0aeeb863c1d41df9174771fa775f58ca368c745b2fd7356a3c3fa901a11a33dae24d781a
 DIST qemu-7.2.16.tar.xz 124427328 BLAKE2B 25b69d3f47eef164b5bcb990edad7634f4602d08867cf62470b05005c5de496126064ad2eedfdf9b2d78eb724ae7832b93bc4d302140f14e5d77246cd04086eb SHA512 75623733f39396222e549498fd5dbbc1430593033f7480aa3a34c7e1c765eb5f7776d8827ee47b4b9c52cc1061232637742a8e31c5e5a9019945171d0c65ca7e
@@ -15,3 +18,4 @@ DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
 DIST qemu-9.2.2.tar.xz 134756816 BLAKE2B fe341d25010b02c47c263e6b1bf1a64f72226e188bd79901ec0072005994e305f5c75b8e5b3f36af1e3b3f776a04cd18b4084dc044952f34b131f3b94134f5b8 SHA512 b010876da9f91da01dbb9e06705a1358d5f062d0fdd4ad5c8cd8ce3fd43adcefcf72a61216eb8d415281f6607b945ce1cfb6b5fc5692ada9163e8f05b7fb5533
 DIST qemu-9.2.3.tar.xz 134755248 BLAKE2B cdc7300288d2efc50262c605707caab64638fbf1d7528576a0bce71efc1403ccd6aa647a984c84a5ab8ebca28ea9ee7cd8682b4098ca2e63a2f76d2de577c181 SHA512 941a4337a115c65de2fca042932efb31886114f4300226fcf55f04c2c5471bd2b5ce220c4b17e01c3679bd55ba08a1aa7ce399de15e3e5f28c17da52030b139e
+DIST qemu-9.2.4.tar.xz 134782772 BLAKE2B 40b85e1204da263da16031dd9edd833062d632e437c0699ac582a641e7a7f85525b800649591d57930eafd01b799cde306f62a236e1ff3b54648f3d28f7924b2 SHA512 5aa2ea23d234dd896de73f778defde93f3b490bd22947c396091fdd2231ce5ccd17767c910170a952be88a5593725f1c31b15a6d19b3d30637465d17fb69651c
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch
new file mode 100644
index 00000000000..7adff23b255
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch
@@ -0,0 +1,221 @@
+https://bugs.gentoo.org/955587
+https://gitlab.com/qemu-project/qemu/-/commit/ff765e490eef83480d07673e115060228b01d55e
+https://gitlab.com/qemu-project/qemu/-/commit/af01cf195ba106fe039ab320ce9e8074b4ddd841
+
+From ff765e490eef83480d07673e115060228b01d55e Mon Sep 17 00:00:00 2001
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
+Date: Wed, 8 Jan 2025 21:13:29 +0900
+Subject: [PATCH] virtio-net: Fix num_buffers for version 1
+
+The specification says the device MUST set num_buffers to 1 if
+VIRTIO_NET_F_MRG_RXBUF has not been negotiated.
+
+Fixes: df91055db5c9 ("virtio-net: enable virtio 1.0")
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Message-Id: <20250108-buffers-v1-1-a0c85ff31aeb@daynix.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Lei Yang <leiyang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit c17ad4b11bd268a35506cd976884562df6ca69d7)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index f8c6ccbec45..78b7d88756c 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1999,6 +1999,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                     offsetof(typeof(hdr),
+                                              virtio_net.hdr.num_buffers),
+                                     sizeof(hdr.virtio_net.hdr.num_buffers));
++            } else {
++                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+             guest_offset = n->has_vnet_hdr ?
+-- 
+GitLab
+
+From af01cf195ba106fe039ab320ce9e8074b4ddd841 Mon Sep 17 00:00:00 2001
+From: Antoine Damhet <adamhet@scaleway.com>
+Date: Tue, 8 Apr 2025 16:53:33 +0200
+Subject: [PATCH] Revert "virtio-net: Copy received header to buffer"
+
+This reverts commit 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce.
+
+The goal was to remove the need to patch the (const) input buffer
+with a recomputed UDP checksum by copying headers to a RW region and
+inject the checksum there. The patch computed the checksum only from the
+header fields (missing the rest of the payload) producing an invalid one
+and making guests fail to acquire a DHCP lease.
+
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2727
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Antoine Damhet <adamhet@scaleway.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20250408145345.142947-1-adamhet@scaleway.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit e28fbd1c525db21f0502b85517f49504c9f9dcd8)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 87 +++++++++++++++++++++------------------------
+ 1 file changed, 40 insertions(+), 47 deletions(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index 78b7d88756c..09ff80c9953 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1702,44 +1702,41 @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
+  * cache.
+  */
+ static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
+-                                        size_t *hdr_len, const uint8_t *buf,
+-                                        size_t buf_size, size_t *buf_offset)
++                                        uint8_t *buf, size_t size)
+ {
+     size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
+                        sizeof(struct udp_header);
+ 
+-    buf += *buf_offset;
+-    buf_size -= *buf_offset;
+-
+     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
+-        (buf_size >= csum_size && buf_size < 1500) && /* normal sized MTU */
++        (size >= csum_size && size < 1500) && /* normal sized MTU */
+         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
+         (buf[23] == 17) && /* ip.protocol == UDP */
+         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
+-        memcpy((uint8_t *)hdr + *hdr_len, buf, csum_size);
+-        net_checksum_calculate((uint8_t *)hdr + *hdr_len, csum_size, CSUM_UDP);
++        net_checksum_calculate(buf, size, CSUM_UDP);
+         hdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
+-        *hdr_len += csum_size;
+-        *buf_offset += csum_size;
+     }
+ }
+ 
+-static size_t receive_header(VirtIONet *n, struct virtio_net_hdr *hdr,
+-                             const void *buf, size_t buf_size,
+-                             size_t *buf_offset)
++static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
++                           const void *buf, size_t size)
+ {
+-    size_t hdr_len = n->guest_hdr_len;
+-
+-    memcpy(hdr, buf, sizeof(struct virtio_net_hdr));
+-
+-    *buf_offset = n->host_hdr_len;
+-    work_around_broken_dhclient(hdr, &hdr_len, buf, buf_size, buf_offset);
++    if (n->has_vnet_hdr) {
++        /* FIXME this cast is evil */
++        void *wbuf = (void *)buf;
++        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
++                                    size - n->host_hdr_len);
+ 
+-    if (n->needs_vnet_hdr_swap) {
+-        virtio_net_hdr_swap(VIRTIO_DEVICE(n), hdr);
++        if (n->needs_vnet_hdr_swap) {
++            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
++        }
++        iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
++    } else {
++        struct virtio_net_hdr hdr = {
++            .flags = 0,
++            .gso_type = VIRTIO_NET_HDR_GSO_NONE
++        };
++        iov_from_buf(iov, iov_cnt, 0, &hdr, sizeof hdr);
+     }
+-
+-    return hdr_len;
+ }
+ 
+ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
+@@ -1907,13 +1904,6 @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+     return (index == new_index) ? -1 : new_index;
+ }
+ 
+-typedef struct Header {
+-    struct virtio_net_hdr_v1_hash virtio_net;
+-    struct eth_header eth;
+-    struct ip_header ip;
+-    struct udp_header udp;
+-} Header;
+-
+ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                       size_t size)
+ {
+@@ -1923,15 +1913,15 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
+     size_t lens[VIRTQUEUE_MAX_SIZE];
+     struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
+-    Header hdr;
++    struct virtio_net_hdr_v1_hash extra_hdr;
+     unsigned mhdr_cnt = 0;
+     size_t offset, i, guest_offset, j;
+     ssize_t err;
+ 
+-    memset(&hdr.virtio_net, 0, sizeof(hdr.virtio_net));
++    memset(&extra_hdr, 0, sizeof(extra_hdr));
+ 
+     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+-        int index = virtio_net_process_rss(nc, buf, size, &hdr.virtio_net);
++        int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
+         if (index >= 0) {
+             nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
+         }
+@@ -1996,20 +1986,23 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+             if (n->mergeable_rx_bufs) {
+                 mhdr_cnt = iov_copy(mhdr_sg, ARRAY_SIZE(mhdr_sg),
+                                     sg, elem->in_num,
+-                                    offsetof(typeof(hdr),
+-                                             virtio_net.hdr.num_buffers),
+-                                    sizeof(hdr.virtio_net.hdr.num_buffers));
++                                    offsetof(typeof(extra_hdr), hdr.num_buffers),
++                                    sizeof(extra_hdr.hdr.num_buffers));
+             } else {
+-                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
++                extra_hdr.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+-            guest_offset = n->has_vnet_hdr ?
+-                           receive_header(n, (struct virtio_net_hdr *)&hdr,
+-                                          buf, size, &offset) :
+-                           n->guest_hdr_len;
+-
+-            iov_from_buf(sg, elem->in_num, 0, &hdr, guest_offset);
+-            total += guest_offset;
++            receive_header(n, sg, elem->in_num, buf, size);
++            if (n->rss_data.populate_hash) {
++                offset = offsetof(typeof(extra_hdr), hash_value);
++                iov_from_buf(sg, elem->in_num, offset,
++                             (char *)&extra_hdr + offset,
++                             sizeof(extra_hdr.hash_value) +
++                             sizeof(extra_hdr.hash_report));
++            }
++            offset = n->host_hdr_len;
++            total += n->guest_hdr_len;
++            guest_offset = n->guest_hdr_len;
+         } else {
+             guest_offset = 0;
+         }
+@@ -2035,11 +2028,11 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     }
+ 
+     if (mhdr_cnt) {
+-        virtio_stw_p(vdev, &hdr.virtio_net.hdr.num_buffers, i);
++        virtio_stw_p(vdev, &extra_hdr.hdr.num_buffers, i);
+         iov_from_buf(mhdr_sg, mhdr_cnt,
+                      0,
+-                     &hdr.virtio_net.hdr.num_buffers,
+-                     sizeof hdr.virtio_net.hdr.num_buffers);
++                     &extra_hdr.hdr.num_buffers,
++                     sizeof extra_hdr.hdr.num_buffers);
+     }
+ 
+     for (j = 0; j < i; j++) {
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
new file mode 100644
index 00000000000..c539d8c9d5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@@ -0,0 +1,1000 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3[wayland?,X?]
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
new file mode 100644
index 00000000000..c539d8c9d5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
@@ -0,0 +1,1000 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3[wayland?,X?]
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
index a76a8cce204..8c601062f67 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.15-r1.ebuild
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
index a5d40383777..ca3c4258525 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16-r1.ebuild
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
index 7ed9ddabff2..04e77d0306a 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
index 39674977ab6..0ae89ea3b38 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
index e2772508cea..0baa28f843d 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.7-r1.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
index b2853795f01..cbaab97545c 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9-r1.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
index 56ee61fd2f4..db34549fb92 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.2-r2.ebuild
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
index 22a0b0889e8..19613bf631f 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
index cc9db9b0a73..e184adcd746 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2-r1.ebuild
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
new file mode 100644
index 00000000000..d2aa81b37ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@@ -0,0 +1,1001 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3[wayland?,X?]
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+	"${FILESDIR}"/${PN}-9.2.3-virtio-net.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
index 91796454d6c..2ffaefa9ee0 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index da8cc2f4a1e..a53f9732ac1 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -320,7 +320,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
-
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/Manifest
index f7f1465d836..e30218c5589 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/Manifest
@@ -1,2 +1,2 @@
 DIST virt_firmware-24.11.tar.gz 115385 BLAKE2B 2edfe718fd60dcd8a13b143f9fcf5f6beb604737ef4855cb0f16376e625f5bf2965bb08b7ddd037a6b8b6420c928abceefe1034135ab66763695fa8c359786b5 SHA512 0c6b4d34d518835b4489404c784b263cd6ac8348834ba654d27ae3741d3d229ea5f6036870399390fa4fa33e01c8113d64faba0c6068e4b2fb5bbdd9429bf72f
-DIST virt_firmware-24.7.tar.gz 114229 BLAKE2B a5b6bf39a72ce68622bbc4f75505633b92c322e4a02ab0384bb3b618abfbeeb19cfb057b5333ae53042732b131dcaa475c2c920922c920b0d0c21ef4185ad5b9 SHA512 1cd209b500e0ec1a5b8284b72b499bd16e998fd9489db6c8f8e3b49befb6186c5c09c95b2761254696b479daff1afaf2bdccb6ca7e115b11eb9a5df847f43628
+DIST virt_firmware-25.4.1.tar.gz 120061 BLAKE2B ef22266944cae225cf817c9b67a7aae5ee95908be419b870f451f6eba391998be082b1cf8f2dad62ed84551323cb56854b785a93d0c0ff83340fdb9a5f571aeb SHA512 2f82299415a0bf5dd8874764fe7d71cfe9a12e489657237f6a889288294e69fed9076219ae91a2d60084ae1ffac6bc4f3e2760999e8030aad045cb59ea152367
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.11.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.11.ebuild
index d4f936ad880..23ca73207ad 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.11.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit distutils-r1 optfeature pypi systemd
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ~riscv x86"
 
 RDEPEND="
 	dev-python/cryptography[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.7.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-25.4.1.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.7.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-25.4.1.ebuild
index e50bf538bbb..3481311f677 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-25.4.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit distutils-r1 optfeature pypi systemd
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
 
 RDEPEND="
 	dev-python/cryptography[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-0.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-0.1.1-r1.ebuild
index 00bfc1bae24..fcc2006f92d 100644
--- a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-0.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-0.1.1-r1.ebuild
@@ -1,14 +1,18 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="An eselect library to manage executable symlinks"
 HOMEPAGE="https://github.com/projg2/eselect-lib-bin-symlink/"
-SRC_URI="https://github.com/projg2/eselect-lib-bin-symlink/releases/download/${P}/${P}.tar.bz2"
+SRC_URI="
+	https://github.com/projg2/eselect-lib-bin-symlink/releases/download/${P}/${P}.tar.bz2
+"
 
 LICENSE="GPL-2+"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
-RDEPEND="app-admin/eselect"
+RDEPEND="
+	app-admin/eselect
+"
diff --git a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-9999.ebuild
deleted file mode 100644
index d52de81af37..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-9999.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools git-r3
-
-DESCRIPTION="An eselect library to manage executable symlinks"
-HOMEPAGE="https://github.com/projg2/eselect-lib-bin-symlink/"
-EGIT_REPO_URI="https://github.com/projg2/eselect-lib-bin-symlink.git"
-
-LICENSE="GPL-2+"
-SLOT="0"
-
-RDEPEND="app-admin/eselect"
-
-src_prepare() {
-	default
-	eautoreconf
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-python/eselect-python-20200719.ebuild b/sdk_container/src/third_party/portage-stable/app-eselect/eselect-python/eselect-python-20200719.ebuild
index d49bcf33d4a..04fc71c7b9e 100644
--- a/sdk_container/src/third_party/portage-stable/app-eselect/eselect-python/eselect-python-20200719.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-eselect/eselect-python/eselect-python-20200719.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -8,7 +8,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/proj/${PN}.git"
 else
 	SRC_URI="https://dev.gentoo.org/~chutzpah/dist/misc/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="Eselect module for management of multiple Python versions"
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 8134a3ebcfe..5585ce3fa4e 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -24,10 +24,10 @@ DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
 DIST bash-5.3-rc1.tar.gz 10742642 BLAKE2B 846414fe545da1ee62b541a8861d68e1dc57114276d40c6af2a9ab1f91cedb220d060f1bd81a811d6dacd841cd1b66e0ed7d8462b3c7066ad204f3786d6af0ec SHA512 16a74fcb31a8ea20cf9505a8cee584a02baed1d2c47b75556e4ae6752712db8f9e0b4b202d2cbe77990fec1ff141ff35e410d4495887ed90f5457c032079c5e5
 DIST bash-5.3-rc1.tar.gz.sig 95 BLAKE2B cc7916f92eddd881ac4d791918b7bb579396df4badbd671a7d0664fd814cee37327dce31d288a8fb03bc66a23536873b5fcd72f2e08e294b9ff9f2ef889741e3 SHA512 a275ff17f9318b5626450eeeb9f49157c9b20df974e004adb26f6585c84deea8d68fc0e1670f990096675ecadd652b58895f74c4e40c8e142a3c2ed414145248
-DIST bash-5.3_rc1_p20250409-42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c.tar.gz 15866668 BLAKE2B 472b67d397dd0f4ba070d4899bb1ecde08a90a7d2f5fc16b8f79c7113d2ca66cbc353e128ace17128069ebc7f8560605dda1441019174a942abb0dd345629746 SHA512 43614445ac11d25258ba6c47f020a1b87d8fa33b139e4d2237683ea0465bf24b03cf84e7e2771de4b038bbecab44c923bb307e4a60b9590b42936ea4e7c86e73
-DIST bash-5.3_rc1_p20250419-482872ed8b51408066c3275a18350436f4d0ee41.tar.gz 16004323 BLAKE2B 936b2bf45e90be658105a2755b9a0be046cd5ae50b6d34624ff20199fa93c1de4a8f9ab669c2c9cf86e2e4d6379f124d91141354d41d437536931cd157491626 SHA512 f04eb6c45124a66fc894c4a1f217351a0247ddd870cfcbbcd01bcff77369d022c6ca82f693c6f2fcd035ce5a67ab3fdbc902b30a4c76e84fdaddd25eeb7c407f
-DIST bash-5.3_rc1_p20250422-7731dc5c4d405ab147fc562e3af2a375ca593554.tar.gz 15996966 BLAKE2B 6a9c720b2747ccff7d8d198354163b6e0645b8a8e436a65e5d1f86ad509b8f197d95ba7cd4097ec4558911d73f98817da65f90a879215b8ad243388e1fdd75df SHA512 21847abf8019776f310c1de8f7469823c233039fa95ca1f872071580f917c728ac767f6daa778dfcfa0fd7583edf07b7928075d5086f3711d68a45ea3133857f
 DIST bash-5.3_rc1_p20250430-15df5993542463ba9798e4ea5e488dfddf83c276.tar.gz 15996459 BLAKE2B 013768ddce578a50845f1709a276b80474999e83172d32d4ba1978a795c17fbd2c77d3812a631ade937afa9a0850ee40f45dcd8b02251fce8c3d0619b82de33d SHA512 e86edefd13e9863c059411587377393b5dc290bf42d1bb5f3684e4a881a0ea10f554b22752f3632b1fc29ff8be08ec1ace8f729639b55ec97eb77968886856fd
+DIST bash-5.3_rc1_p20250504-535a8150b65ee6888f54f602274dbbdcd77c788e.tar.gz 15998986 BLAKE2B 61591119702903fdaf52ce143299c136b77c435315f368d4ea1b0ba9b2cf8dd390859d5ae250fe381b285d96be6bf66464ecdb34f86ca0d2dd8dfbcfe8308130 SHA512 3ff4ad11a716318b429806cf859fd5d2f7e63948f0f53386a09ef915851c27da47f7f7a61d3b35fe586d08825e3db0c78e44401de66408ae282483d85470cc26
+DIST bash-5.3_rc1_p20250519-870ad4c92b771aafe5b444792a8fa904b2d4a418.tar.gz 16005716 BLAKE2B eb7403266febcabe1e24d524cae7305c36b6a7fc4f886ab8be374075a632d234f0e0541a652dbfe8a0be042d59389edfb1680c182cfec0dc1586508915b44abb SHA512 bfc3faef232ecd348dfb4f55a0597245cf7fa5bbe18ec18a667e31f7bca220b31c80a0e3010c48d442a878cd227de49d35a8510b26be32cc35986bbdb68d2b5f
+DIST bash-5.3_rc1_p20250530-dbe4256d5ea02fec1817fe7e275b0e534dc33a40.tar.gz 16065207 BLAKE2B a261d79ba7834e2c8c2f8dab1638b1285bfa3c3ac3266c9f3cf886c6ce0e3b2a47f8c3ed5bcb3a166a01fee503250e21c1bf2ea7b09602bda937f98f44c49467 SHA512 83d0fc9253bb6db27e6b584a341a75246a61bfa3a3a750ef4127bf82e057e3e945061799872a90f6fca01e030ef0948ed6510237b777c0d4daf36a7b54ad458f
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
index 6836c71ee4d..bb0392ca2a3 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-2.05b-destdir.patch
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch # bug #220040
@@ -105,6 +105,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
index 6ea72c07198..6a9d1dc0e02 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-3.0-protos.patch
@@ -110,6 +110,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
index 66fae17e010..de9635116e9 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch # bug #220040
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-2.05b-parallel-build.patch # bug #41002
@@ -105,6 +105,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
index 790bcdb42b2..6e2c01156a9 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.59.patch # bug #220040
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-3.2-loadables.patch
@@ -107,6 +107,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
index 83095fd1026..0e4b7dc3665 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.0-configure.patch # bug #304901
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.x-deferred-heredocs.patch
@@ -101,6 +101,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
index 056fcbfee8c..ef525196a30 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +53,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.1-fbsd-eaccess.patch #bug #303411
 
@@ -96,6 +96,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
index 9189dd54211..0ec99efcdaf 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -39,6 +39,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -53,8 +55,6 @@ DEPEND="${RDEPEND}
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.2-execute-job-control.patch # bug #383237
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.2-parallel-build.patch
@@ -108,6 +108,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
index d1bd7188d32..dce3f7fbff7 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -43,6 +43,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -63,8 +65,6 @@ PATCHES=(
 	"${WORKDIR}"/${P}-r2-patches/${PN}-4.4-popd-offset-overflow.patch # bug #600174
 )
 
-S="${WORKDIR}/${MY_P}"
-
 pkg_setup() {
 	# bug #7332
 	if is-flag -malign-double ; then
@@ -117,6 +117,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--docdir='$(datarootdir)'/doc/${PF}
 		--htmldir='$(docdir)/html'
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
index a00a3d5f57b..0c4d3c66f06 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -52,6 +52,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
@@ -68,8 +70,6 @@ RDEPEND="
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 #BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 pkg_setup() {
 	# bug #7332
 	if is-flag -malign-double ; then
@@ -128,6 +128,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
index 2fa356b7fac..bde53d1bb06 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
@@ -52,6 +52,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
@@ -68,8 +70,6 @@ RDEPEND="
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	# Patches from Chet sent to bashbug ml
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-5.0-history-append.patch
@@ -132,6 +132,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu89)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
index 0a1dbe4b63a..aeb350668ec 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
@@ -177,6 +177,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
deleted file mode 100644
index b3ac276e72d..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
+++ /dev/null
@@ -1,408 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
-case ${PV} in
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.2_p1"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-S=${WORKDIR}/${MY_P}
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-	"${FILESDIR}/${PN}-5.2_p15-random-ub.patch"
-	"${FILESDIR}/${PN}-5.2_p15-configure-clang16.patch"
-	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
-	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-1.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch"
-	"${FILESDIR}/${PN}-5.2_p32-erroneous-delimiter-pushback-condition.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# bash 5.3 drops unprototyped functions, earlier versions are
-	# incompatible with C23.
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
index 2e063be865c..cf762c50b56 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
@@ -180,6 +180,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
index 4bb6c49f60b..80d3c5dc070 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
@@ -178,6 +178,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
index d495d9e3b91..03ff453715b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
@@ -26,6 +26,7 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
index a71d009bc5d..3c991f38eba 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430-r1.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,7 +320,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
index e9dedb0573e..de539bc422a 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250504-r1.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="7731dc5c4d405ab147fc562e3af2a375ca593554"
+	BASH_COMMIT="535a8150b65ee6888f54f602274dbbdcd77c788e"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,8 +320,8 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250519.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250519.ebuild
index b8c4d806b78..3e090ec7abf 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250519.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c"
+	BASH_COMMIT="870ad4c92b771aafe5b444792a8fa904b2d4a418"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,8 +320,8 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250530.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250530.ebuild
index d6c2f34c71f..83edb4e9360 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250530.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="482872ed8b51408066c3275a18350436f4d0ee41"
+	BASH_COMMIT="dbe4256d5ea02fec1817fe7e275b0e534dc33a40"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,8 +320,8 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
index 48dc6faddf9..de539bc422a 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,8 +46,8 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="d3e86e66ce857a8dc02e3116fd98b6e5b34d6364"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
+	BASH_COMMIT="535a8150b65ee6888f54f602274dbbdcd77c788e"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
 	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -315,7 +320,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
index 6e800095264..e997c37cff1 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
@@ -1,4 +1,4 @@
-From 57fbf1c67f2d89365601f39e72781fba001fe2f3 Mon Sep 17 00:00:00 2001
+From 01463f6ae5a58b7309769596714e76b0d265b622 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 08:13:38 +0100
 Subject: [PATCH 3/3] Backport fix for erroneous delimiter pushback condition
@@ -23,7 +23,7 @@ $'\315'
 ''
 ''
 
-With the upcoming 5.3-rc2, which will incoprorate this patch, all three
+With the upcoming 5.3-rc2, which will incorporate this patch, all three
 records are read correctly.
 
 <FOO>
@@ -47,7 +47,7 @@ Signed-off-by: Kerin Millar <kfm@plushkava.net>
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 9fd9a74c..8000def3 100644
+index 48351c3c..70a3508b 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -1102,14 +1102,14 @@ read_mbchar (fd, string, ind, ch, delim, unbuffered)
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
index ff6fdf25414..ea27d3b3d19 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
@@ -1,4 +1,4 @@
-From fb31e1965baa732f9e4cdbe3a7d6691d7beb4e03 Mon Sep 17 00:00:00 2001
+From c87aca06c259b6283a499584d95c87f163accba0 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 07:59:25 +0100
 Subject: [PATCH 2/3] Backport fix for invalid continuation bytes above 0x7F
@@ -26,11 +26,11 @@ Link: https://mywiki.wooledge.org/BashPitfalls#IFS.3D_read_-r_-d_.27.27_filename
 Link: https://lists.gnu.org/r/bug-bash/2024-08/msg00100.html
 Signed-off-by: Kerin Millar <kfm@plushkava.net>
 ---
- builtins/read.def | 40 +++++++++++++++++++++++-----------------
- 1 file changed, 23 insertions(+), 17 deletions(-)
+ builtins/read.def | 41 +++++++++++++++++++++++------------------
+ 1 file changed, 23 insertions(+), 18 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 53b4bd81..9fd9a74c 100644
+index 53b4bd81..48351c3c 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -142,7 +142,7 @@ sh_timer *read_timeout;
@@ -80,16 +80,17 @@ index 53b4bd81..9fd9a74c 100644
  	      mbchar[--i] = '\0';		/* unget the delimiter */
  	    }
  	  break;		/* invalid multibyte character */
-@@ -1220,6 +1219,8 @@ edit_line (p, itext)
+@@ -1219,7 +1218,8 @@ edit_line (p, itext)
+ 
    len = strlen (ret);
    ret = (char *)xrealloc (ret, len + 2);
-   ret[len++] = delim;
+-  ret[len++] = delim;
 +  if (delim > 0)
 +    ret[len++] = delim;
    ret[len] = '\0';
    return ret;
  }
-@@ -1240,7 +1241,7 @@ static rl_command_func_t *old_delim_func;
+@@ -1240,7 +1240,7 @@ static rl_command_func_t *old_delim_func;
  static int old_newline_ctype;
  static rl_command_func_t *old_newline_func;
  
@@ -98,7 +99,7 @@ index 53b4bd81..9fd9a74c 100644
  
  static void
  set_eol_delim (c)
-@@ -1252,19 +1253,21 @@ set_eol_delim (c)
+@@ -1252,19 +1252,21 @@ set_eol_delim (c)
      initialize_readline ();
    cmap = rl_get_keymap ();
  
@@ -128,7 +129,7 @@ index 53b4bd81..9fd9a74c 100644
  
    delim_char = c;
  }
-@@ -1280,7 +1283,10 @@ reset_eol_delim (cp)
+@@ -1280,7 +1282,10 @@ reset_eol_delim (cp)
    cmap[RETURN].type = old_newline_ctype;
    cmap[RETURN].function = old_newline_func;
  
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
deleted file mode 100644
index 72693cb33aa..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
+++ /dev/null
@@ -1,73 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-color.bash
-
-if [[ ${NO_COLOR} ]]; then
-	# Respect the user's wish not to use color. See https://no-color.org/.
-	gentoo_color=0
-elif [[ ${COLORTERM@a} == *x* && ${COLORTERM} == @(24bit|truecolor) ]]; then
-	# The COLORTERM environment variable can reasonably be trusted here.
-	# See https://github.com/termstandard/colors for further information.
-	gentoo_color=1
-elif unset -v COLORTERM; ! gentoo_color=$(tput colors 2>/dev/null); then
-	# Either ncurses is not installed or no terminfo database could be
-	# found. Fall back to a whitelist which covers the majority of terminal
-	# emulators and virtual console implementations known to support color
-	# and which remain (somewhat) popular. This will rarely happen, so the
-	# list need not be exhaustive.
-	case ${TERM} in
-		*color*    |\
-		*direct*   |\
-		*ghostty   |\
-		[Ekx]term* |\
-		alacritty  |\
-		aterm      |\
-		contour    |\
-		dtterm     |\
-		foot*      |\
-		jfbterm    |\
-		linux      |\
-		mlterm     |\
-		rxvt*      |\
-		screen*    |\
-		tmux*      |\
-		wsvt25*    ) gentoo_color=1
-	esac
-elif (( gentoo_color == 16777216 )); then
-	# Truecolor support is available. Advertise it.
-	export COLORTERM=truecolor
-fi
-
-# For direxpand to be missing indicates that bash is lacking readline support.
-if (( gentoo_color <= 0 )) || [[ ! $(shopt -p direxpand 2>/dev/null) ]]; then
-	# Define a prompt without color.
-	PS1='\u@\h \w \$ '
-elif (( EUID == 0 )); then
-	# If root, omit the username and print the hostname in red.
-	PS1='\[\e[01;31m\]\h\[\e[01;34m\] \w \$\[\e[00m\] '
-else
-	# Otherwise, print the username and hostname in green.
-	PS1='\[\e[01;32m\]\u@\h\[\e[01;34m\] \w \$\[\e[00m\] '
-fi
-
-if (( gentoo_color > 0 )); then
-	# Colorize the output of diff(1), grep(1) and a few coreutils utilities.
-	# However, do so only where no alias/function by the given name exists.
-	for _ in diff dir grep ls vdir; do
-		if [[ $(type -t "$_") == file ]]; then
-			alias "$_=$_ --color=auto"
-		fi
-	done
-
-	# Enable colors for ls(1) and some other utilities that respect the
-	# LS_COLORS variable. Prefer ~/.dir_colors, per bug #64489.
-	if hash dircolors 2>/dev/null; then
-		if [[ -f ~/.dir_colors ]]; then
-			eval "$(COLORTERM=1 dircolors -b -- ~/.dir_colors)"
-		elif [[ -f /etc/DIR_COLORS ]]; then
-			eval "$(COLORTERM=1 dircolors -b /etc/DIR_COLORS)"
-		else
-			eval "$(COLORTERM=1 dircolors -b)"
-		fi
-	fi
-fi
-
-unset -v gentoo_color
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
similarity index 64%
rename from sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
index a141f4b96bf..14624175505 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/autoconf-archive-2024.10.16-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,6 +6,9 @@ EAPI=8
 DESCRIPTION="GNU Autoconf Macro Archive"
 HOMEPAGE="https://www.gnu.org/software/autoconf-archive/"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+# Temporary patchset for 2024.10.16 because a snapshot is too awkward to make
+# Can be dropped on next release
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-patches.tar.xz"
 
 LICENSE="GPL-3"
 SLOT="0"
@@ -16,3 +19,8 @@ RDEPEND="
 	!=gnome-base/gnome-common-3.14.0-r0
 	!>=gnome-base/gnome-common-3.14.0-r1[-autoconf-archive(+)]
 "
+
+PATCHES=(
+	"${WORKDIR}"/${P}-patches
+	"${FILESDIR}"/${P}-lua.patch
+)
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch
new file mode 100644
index 00000000000..dc65abc4707
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-archive/files/autoconf-archive-2024.10.16-lua.patch
@@ -0,0 +1,209 @@
+https://github.com/autoconf-archive/autoconf-archive/pull/318
+
+From 51056b0e139322d0377b0ecd30efd80ec1290dfe Mon Sep 17 00:00:00 2001
+From: Peter Simons <simons@cryp.to>
+Date: Sat, 9 Nov 2024 09:22:08 +0100
+Subject: [PATCH] Revert "Add LuaJIT support to AX_PROG_LUA macro"
+
+---
+ m4/ax_lua.m4 | 109 ++++++++++++++-------------------------------------
+ 1 file changed, 29 insertions(+), 80 deletions(-)
+
+diff --git a/m4/ax_lua.m4 b/m4/ax_lua.m4
+index 5f63cace..a2f2a2ce 100644
+--- a/m4/ax_lua.m4
++++ b/m4/ax_lua.m4
+@@ -49,14 +49,6 @@
+ #   interpreter. If LUA is blank, the user's path is searched for an
+ #   suitable interpreter.
+ #
+-#   Optionally a LUAJIT option may be set ahead of time to look for and
+-#   validate a LuaJIT install instead of PUC Lua. Usage might look like:
+-#
+-#     AC_ARG_WITH(luajit, [AS_HELP_STRING([--with-luajit],
+-#         [Prefer LuaJIT over PUC Lua, even if the latter is newer. Default: no])
+-#     ])
+-#     AM_CONDITIONAL([LUAJIT], [test "x$with_luajit" != 'xno'])
+-#
+ #   If MINIMUM-VERSION is supplied, then only Lua interpreters with a
+ #   version number greater or equal to MINIMUM-VERSION will be accepted. If
+ #   TOO-BIG-VERSION is also supplied, then only Lua interpreters with a
+@@ -160,7 +152,6 @@
+ #
+ # LICENSE
+ #
+-#   Copyright (c) 2023 Caleb Maclennan <caleb@alerque.com>
+ #   Copyright (c) 2015 Reuben Thomas <rrt@sc3d.org>
+ #   Copyright (c) 2014 Tim Perkins <tprk77@gmail.com>
+ #
+@@ -190,7 +181,7 @@
+ #   modified version of the Autoconf Macro, you may extend this special
+ #   exception to the GPL to apply to your modified version as well.
+ 
+-#serial 47
++#serial 48
+ 
+ dnl =========================================================================
+ dnl AX_PROG_LUA([MINIMUM-VERSION], [TOO-BIG-VERSION],
+@@ -206,14 +197,13 @@ AC_DEFUN([AX_PROG_LUA],
+   AC_ARG_VAR([LUA], [The Lua interpreter, e.g. /usr/bin/lua5.1])
+ 
+   dnl Find a Lua interpreter.
+-  AM_COND_IF([LUAJIT],
+-        [_ax_lua_interpreter_list='luajit luajit-2.1.0-beta3 luajit-2.0.5 luajit-2.0.4 luajit-2.0.3'],
+-        [_ax_lua_interpreter_list='lua lua5.4 lua54 lua5.3 lua53 lua5.2 lua52 lua5.1 lua51 lua5.0 lua50'])
++  m4_define_default([_AX_LUA_INTERPRETER_LIST],
++    [lua lua5.4 lua54 lua5.3 lua53 lua5.2 lua52 lua5.1 lua51 lua50])
+ 
+   m4_if([$1], [],
+   [ dnl No version check is needed. Find any Lua interpreter.
+     AS_IF([test "x$LUA" = 'x'],
+-      [AC_PATH_PROGS([LUA], [$_ax_lua_interpreter_list], [:])])
++      [AC_PATH_PROGS([LUA], [_AX_LUA_INTERPRETER_LIST], [:])])
+     ax_display_LUA='lua'
+ 
+     AS_IF([test "x$LUA" != 'x:'],
+@@ -252,7 +242,7 @@ AC_DEFUN([AX_PROG_LUA],
+         [_ax_check_text="for a Lua interpreter with version >= $1, < $2"])
+       AC_CACHE_CHECK([$_ax_check_text],
+         [ax_cv_pathless_LUA],
+-        [ for ax_cv_pathless_LUA in $_ax_lua_interpreter_list none; do
++        [ for ax_cv_pathless_LUA in _AX_LUA_INTERPRETER_LIST none; do
+             test "x$ax_cv_pathless_LUA" = 'xnone' && break
+             _AX_LUA_CHK_IS_INTRP([$ax_cv_pathless_LUA], [], [continue])
+             _AX_LUA_CHK_VER([$ax_cv_pathless_LUA], [$1], [$2], [break])
+@@ -285,18 +275,6 @@ AC_DEFUN([AX_PROG_LUA],
+     AC_SUBST([LUA_VERSION], [$ax_cv_lua_version])
+     AC_SUBST([LUA_SHORT_VERSION], [`echo "$LUA_VERSION" | $SED 's|\.||'`])
+ 
+-    AM_COND_IF([LUAJIT], [
+-      AC_CACHE_CHECK([for $ax_display_LUA jit version], [ax_cv_luajit_version],
+-        [ ax_cv_luajit_version=[`$LUA -e '
+-          local _, _, ver = string.find(jit and jit.version, "(%d+%..+)")
+-          print(ver or "")'`]
+-        ])
+-      AS_IF([test "x$ax_cv_luajit_version" = 'x'],
+-        [AC_MSG_ERROR([invalid Lua jit version number])])
+-      AC_SUBST([LUAJIT_VERSION], [$ax_cv_luajit_version])
+-      AC_SUBST([LUAJIT_SHORT_VERSION], [$(echo "$LUAJIT_VERSION" | $SED 's|\.|§|;s|\..*||;s|§|.|')])
+-    ])
+-
+     dnl The following check is not supported:
+     dnl At times (like when building shared libraries) you may want to know
+     dnl which OS platform Lua thinks this is.
+@@ -486,50 +464,33 @@ AC_DEFUN([AX_LUA_HEADERS],
+       AC_MSG_ERROR([cannot check Lua headers without knowing LUA_VERSION])
+     ])
+ 
+-  AM_COND_IF([LUAJIT],[
+-    dnl Check for LUAJIT_VERSION.
+-    AC_MSG_CHECKING([if LUAJIT_VERSION is defined])
+-    AS_IF([test "x$LUAJIT_VERSION" != 'x'],
+-      [AC_MSG_RESULT([yes])],
+-      [ AC_MSG_RESULT([no])
+-        AC_MSG_ERROR([cannot check Lua jit headers without knowing LUAJIT_VERSION])
+-      ])
+-  ])
+-
+   dnl Make LUA_INCLUDE a precious variable.
+   AC_ARG_VAR([LUA_INCLUDE], [The Lua includes, e.g. -I/usr/include/lua5.1])
+ 
+-  dnl  Some default directories to search.
+-  AM_COND_IF([LUAJIT],
+-    [_ax_lua_include_list="
+-      /usr/include/luajit-$LUAJIT_VERSION
+-      /usr/include/luajit-$LUAJIT_SHORT_VERSION
+-      /usr/local/include/luajit-$LUAJIT_VERSION
+-      /usr/local/include/luajit-$LUAJIT_SHORT_VERSION"],
+-    [_ax_lua_include_list="
+-      /usr/include/lua$LUA_VERSION
+-      /usr/include/lua-$LUA_VERSION
+-      /usr/include/lua/$LUA_VERSION
+-      /usr/include/lua$LUA_SHORT_VERSION
+-      /usr/local/include/lua$LUA_VERSION
+-      /usr/local/include/lua-$LUA_VERSION
+-      /usr/local/include/lua/$LUA_VERSION
+-      /usr/local/include/lua$LUA_SHORT_VERSION"])
++  dnl Some default directories to search.
++  LUA_SHORT_VERSION=`echo "$LUA_VERSION" | $SED 's|\.||'`
++  m4_define_default([_AX_LUA_INCLUDE_LIST],
++    [ /usr/include/lua$LUA_VERSION \
++      /usr/include/lua-$LUA_VERSION \
++      /usr/include/lua/$LUA_VERSION \
++      /usr/include/lua$LUA_SHORT_VERSION \
++      /usr/local/include/lua$LUA_VERSION \
++      /usr/local/include/lua-$LUA_VERSION \
++      /usr/local/include/lua/$LUA_VERSION \
++      /usr/local/include/lua$LUA_SHORT_VERSION \
++    ])
+ 
+   dnl Try to find the headers.
+   _ax_lua_saved_cppflags=$CPPFLAGS
+   CPPFLAGS="$CPPFLAGS $LUA_INCLUDE"
+   AC_CHECK_HEADERS([lua.h lualib.h lauxlib.h luaconf.h])
+-  AM_COND_IF([LUAJIT], [AC_CHECK_HEADERS([luajit.h])])
+   CPPFLAGS=$_ax_lua_saved_cppflags
+ 
+   dnl Try some other directories if LUA_INCLUDE was not set.
+   AS_IF([test "x$LUA_INCLUDE" = 'x' &&
+-         test "x$ac_cv_header_lua_h" != 'xyes' ||
+-         test "x$with_luajit" != 'xno' &&
+-         test "x$ac_cv_header_luajit_h" != 'xyes'],
++         test "x$ac_cv_header_lua_h" != 'xyes'],
+     [ dnl Try some common include paths.
+-      for _ax_include_path in $_ax_lua_include_list; do
++      for _ax_include_path in _AX_LUA_INCLUDE_LIST; do
+         test ! -d "$_ax_include_path" && continue
+ 
+         AC_MSG_CHECKING([for Lua headers in])
+@@ -539,12 +500,10 @@ AC_DEFUN([AX_LUA_HEADERS],
+         AS_UNSET([ac_cv_header_lualib_h])
+         AS_UNSET([ac_cv_header_lauxlib_h])
+         AS_UNSET([ac_cv_header_luaconf_h])
+-        AS_UNSET([ac_cv_header_luajit_h])
+ 
+         _ax_lua_saved_cppflags=$CPPFLAGS
+         CPPFLAGS="$CPPFLAGS -I$_ax_include_path"
+         AC_CHECK_HEADERS([lua.h lualib.h lauxlib.h luaconf.h])
+-        AM_COND_IF([LUAJIT], [AC_CHECK_HEADERS([luajit.h])])
+         CPPFLAGS=$_ax_lua_saved_cppflags
+ 
+         AS_IF([test "x$ac_cv_header_lua_h" = 'xyes'],
+@@ -662,26 +621,16 @@ AC_DEFUN([AX_LUA_LIBS],
+     dnl Try to find the Lua libs.
+     _ax_lua_saved_libs=$LIBS
+     LIBS="$LIBS $LUA_LIB"
+-    AM_COND_IF([LUAJIT],
+-      [AC_SEARCH_LIBS([lua_load],
+-        [ luajit$LUA_VERSION \
+-          luajit$LUA_SHORT_VERSION \
+-          luajit-$LUA_VERSION \
+-          luajit-$LUA_SHORT_VERSION \
+-          luajit],
+-        [_ax_found_lua_libs='yes'],
+-        [_ax_found_lua_libs='no'],
+-        [$_ax_lua_extra_libs])],
+-      [AC_SEARCH_LIBS([lua_load],
+-        [ lua$LUA_VERSION \
+-          lua$LUA_SHORT_VERSION \
+-          lua-$LUA_VERSION \
+-          lua-$LUA_SHORT_VERSION \
+-          lua \
+-        ],
+-        [_ax_found_lua_libs='yes'],
+-        [_ax_found_lua_libs='no'],
+-        [$_ax_lua_extra_libs])])
++    AC_SEARCH_LIBS([lua_load],
++      [ lua$LUA_VERSION \
++        lua$LUA_SHORT_VERSION \
++        lua-$LUA_VERSION \
++        lua-$LUA_SHORT_VERSION \
++        lua \
++      ],
++      [_ax_found_lua_libs='yes'],
++      [_ax_found_lua_libs='no'],
++      [$_ax_lua_extra_libs])
+     LIBS=$_ax_lua_saved_libs
+ 
+     AS_IF([test "x$ac_cv_search_lua_load" != 'xno' &&
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/Manifest
index 391333652eb..62ba955b058 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/Manifest
@@ -1,2 +1 @@
-DIST autotools-wrappers-at-20221207.tar.gz 3646 BLAKE2B 82bec40e03ae5ec133252fd3c05c3fed537bb415e800918df9c9d783d48a9d76cbe60c53dd7daf6d94653d79fc52be8c089183dda996e8a72dd03ffa83098613 SHA512 12ea99721e6fc60a3ed7351d6c228aaf6e4eef0bd0444eda8cd742f74fa91150ef07bb52f6bcad4a350269e8032f5d4e204d2f2108b0d9c441ddd7f9755862b7
 DIST autotools-wrappers-at-20231224.tar.gz 3645 BLAKE2B fbf414240fe3a4b5d2c24ea649cc347df46bf7f0297bc0d27f98265f57753a596929277403496d76d6249f878bffa8be3e77b62ce9138df6920dd9a5216b300a SHA512 a3cc51e1eb1d055a8161b86bc3497a9bea3cb972d8d22b2f9fc712ca5ecb7809e84083a5754705911f2d037cbff83747476e96b412bfe11183273764de0d5331
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/autoconf-wrapper-20221207-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/autoconf-wrapper-20221207-r1.ebuild
deleted file mode 100644
index 12a8da8e222..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/autoconf-wrapper/autoconf-wrapper-20221207-r1.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MY_P="autotools-wrappers-at-${PV}"
-
-DESCRIPTION="Wrapper for autoconf to manage multiple autoconf versions"
-HOMEPAGE="https://gitweb.gentoo.org/proj/autotools-wrappers.git"
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="
-		https://anongit.gentoo.org/git/proj/autotools-wrappers.git
-		https://github.com/gentoo/autotools-wrappers
-	"
-	inherit git-r3
-else
-	SRC_URI="https://gitweb.gentoo.org/proj/autotools-wrappers.git/snapshot/${MY_P}.tar.gz"
-	S="${WORKDIR}/${MY_P}"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-2"
-SLOT="0"
-
-src_prepare() {
-	default
-
-	# usr/bin/aclocal: bad substitution -> /bin/sh != POSIX shell
-	if use prefix ; then
-		sed -i -e '1c\#!'"${EPREFIX}"'/bin/sh' ac-wrapper.sh || die
-	fi
-}
-
-src_install() {
-	exeinto /usr/$(get_libdir)/misc
-	doexe ac-wrapper.sh
-
-	dodir /usr/bin
-	local x=
-	for x in auto{conf,header,m4te,reconf,scan,update} ifnames ; do
-		dosym -r /usr/$(get_libdir)/misc/ac-wrapper.sh /usr/bin/${x}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/autoconf/autoconf-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/autoconf/autoconf-9999.ebuild
index 2ee45bd6b68..0e1f6dc5b47 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/autoconf/autoconf-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/autoconf/autoconf-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -64,7 +64,11 @@ src_prepare() {
 		local ver=$(./build-aux/git-version-gen .tarball-version)
 		echo "${ver}" > .tarball-version || die
 
-		autoreconf -f -i || die
+		export WANT_AUTOCONF=2.5
+		export WANT_AUTOMAKE=1.17
+		# Don't try wrapping the autotools - this thing runs as it tends
+		# to be a bit esoteric, and the script does `set -e` itself.
+		./bootstrap || die
 	fi
 
 	# usr/bin/libtool is provided by binutils-apple, need gnu libtool
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/Manifest
index 9fdf26eaa10..2efef9f78fb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/Manifest
@@ -1,2 +1,2 @@
-DIST autotools-wrappers-at-20221207.tar.gz 3646 BLAKE2B 82bec40e03ae5ec133252fd3c05c3fed537bb415e800918df9c9d783d48a9d76cbe60c53dd7daf6d94653d79fc52be8c089183dda996e8a72dd03ffa83098613 SHA512 12ea99721e6fc60a3ed7351d6c228aaf6e4eef0bd0444eda8cd742f74fa91150ef07bb52f6bcad4a350269e8032f5d4e204d2f2108b0d9c441ddd7f9755862b7
 DIST autotools-wrappers-at-20240607.tar.gz 3648 BLAKE2B 2b63c6b71b0a1eff801d011ed0829b42944dd5fa409464644036b4b312f2fd27862fa169c8d915db7daf1fb9862d52bbf9e606b274e82dfda3395e568120e6a4 SHA512 3754c34520109e4f2d2cbf45fe24cfc788c61210864a1199c7cc208e91c400d45533fb02934c61a5662f1402ba8464a0aa4ef16de17460646c8c176ab09df0af
+DIST autotools-wrappers-at-20250528.tar.gz 3642 BLAKE2B 74747a89ec1177fc8020f5318c7f9e5fd15ca66e0ee5018722fdd12341ed4393962d558aaaaec270f727280d225125fd933cea49a47792b7bc75f88da70ced9e SHA512 6d17649977278e2f094e8d9f941916d498292c001080cddb78367c61e4da5c221501382b1eb4f2b6e8c5b2101ce9cb2bbc4063f87e23eb1f8c99361764157b54
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20221207.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20250528.ebuild
similarity index 76%
rename from sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20221207.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20250528.ebuild
index c2b1cb6ed48..731042260a5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20221207.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20250528.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-# Remember to modify LAST_KNOWN_AUTOAKE_VER 'upstream' on new automake (major) releases!
+# Remember to modify LAST_KNOWN_AUTOMAKE_VER 'upstream' on new automake (major) releases!
 
 MY_P="autotools-wrappers-at-${PV}"
 
@@ -20,7 +20,7 @@ else
 	SRC_URI="https://gitweb.gentoo.org/proj/autotools-wrappers.git/snapshot/${MY_P}.tar.gz"
 	S="${WORKDIR}"/${MY_P}
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/automake/Manifest
index 28d1f25e03b..9b545d8211f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/Manifest
@@ -1,6 +1,5 @@
 DIST automake-1.11.6.tar.xz 1092908 BLAKE2B 17254d81d6920c32aa877b6c892025de8e4060b8bcbe50fff841ada513dd462ddde8fc6838b4976098a812f8fda047e7186cb62cea8175df615dde75a9959144 SHA512 6e4cdf69f07734954f770fd4a7211a8c9dc69fe25a7746bd3c1e01d3139c94cab2900399e87371548833e99687e0d2b59c5e746ab2fdfbc7d47f2c1d439137ba
-DIST automake-1.16.5-tests-c99.patch.xz 7176 BLAKE2B 1fa1d3a499bacc5da9ee9d8ea6cb63d9ab91646a708a53d9bb08eef65fe02a6ab34ff95737042348ea7572bd70c6c7467e260d9441239a00c3571d25d73085f0 SHA512 0065b809219257cbce3c6f6f88459b91a5a29272e0027698e06246181357ffe8d5d40057086438f891d821836441a5a96f2568d52dcd3b5acb80e4d4968cbaf9
-DIST automake-1.16.5.tar.xz 1601740 BLAKE2B 87408abc57e1d4317a2b518fb3606d0f6d156522e7333016dd84747cd8922f27ef7fcc93220b11f794ce52bf8fd9a788d0166a4d1964d7c283905f269977ac7c SHA512 3084ae543aa3fb5a05104ffb2e66cfa9a53080f2343c44809707fd648516869511500dba50dae67ff10f92a1bf3b5a92b2a0fa01cda30adb69b9da03994d9d88
-DIST automake-1.16.5.tar.xz.sig 833 BLAKE2B a79fcdce97e13ac3bf39d73e183da92703681ff80011974d95a41be20169f95414551985f7a46602fba3558e33f24d6dcb76222d99f9de4fef0d3dc59b88807e SHA512 032a7c39abb4cabbefa4eb9c15263baec0902e48c0c81364307361a41fd55be282b9640707c789f5ae572e8e60240e34d1b575a671b5710f5d2a5716fafc2d51
 DIST automake-1.17.tar.xz 1652632 BLAKE2B 53c24c138faf3d2be4e30ababcccd4d157c03e815fc4b7f3e3063b6648cf254dfa63afe6e3285b21309dbf260335c3e67991db3825e7532b158b25ccaead83f5 SHA512 46aba1c9d64a6368b326020803a2999831c1deaf31eaa1c1dfdcfa5138a7f755643294e82a08b6daab3983b31eee725bdb7b9edc4e9a558374c7d1f1b8e854a7
 DIST automake-1.17.tar.xz.sig 833 BLAKE2B 4564c7189360c61bde7e16a7c3a52b86084fb16b7f4625969fc588a6aa0da687c7b27acf7247822ec0e09e59336acf0ef69784032f255190a070081f6d9da5cc SHA512 180dde452ec097a9267c334044a9ec16bb65cc6ccbc000b7eca0af81ed7ece6f4ce6f6c2be8a2cabca9d48fd46085c81f0ee5d020967104bc25f37f52927829a
+DIST automake-1.18.tar.xz 1652364 BLAKE2B 45456d6d0fdcd1222c79980ede1df16dfbf18fa4d4698289dbef7c9e24ae8877881678974c5defcce0a9f46b72882b4603e457e8142722174ccf0e495f941550 SHA512 3488d9188a9e11a3e7f911f429ef49d2d92c5ea42262e3e288e1d4de39217facd5a7b7c7ccac06e6fd78a661985af1fe5638353575ebadffb36fc22553e5f782
+DIST automake-1.18.tar.xz.sig 488 BLAKE2B 5a0e9784f536262ab1015e444a67f827e123da7122730e3c4d8c474de544473b731f876a5e743df15b97571990be7509d9007ea8a1ddf00af9cf1747b528016e SHA512 0c01e85ce08a88809d0205de1250836b2a81bb1c16abb395937f737a1bd37fe8d5612c19dbed7d1afd02ed8a8a321356601e4ae8d32b0859dc50fc3617c33f0c
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.11.6-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.11.6-r4.ebuild
index 4050acfb3eb..589911530be 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.11.6-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.11.6-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -7,7 +7,7 @@ DESCRIPTION="Used to generate Makefile.in from Makefile.am"
 HOMEPAGE="https://www.gnu.org/software/automake/"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2+ FSFAP"
 # Use Gentoo versioning for slotting.
 SLOT="${PV:0:4}"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.16.5-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.16.5-r2.ebuild
deleted file mode 100644
index ec7c639cbc2..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.16.5-r2.ebuild
+++ /dev/null
@@ -1,157 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-# Bumping notes:
-# * Remember to modify LAST_KNOWN_AUTOMAKE_VER 'upstream' in dev-build/automake-wrapper
-# on new automake (major) releases, as well as the dependency in RDEPEND below too.
-# * Update _WANT_AUTOMAKE and _automake_atom case statement in autotools.eclass.
-
-PYTHON_COMPAT=( python3_{10..13} )
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jimmeyering.asc
-inherit python-any-r1 verify-sig
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/r/${PN}.git"
-	inherit git-r3
-else
-	if [[ ${PV/_beta} == ${PV} ]]; then
-		MY_P="${P}"
-		SRC_URI="
-			mirror://gnu/${PN}/${P}.tar.xz
-			https://alpha.gnu.org/pub/gnu/${PN}/${MY_P}.tar.xz
-			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-1.16.5-tests-c99.patch.xz
-			verify-sig? (
-				mirror://gnu/${PN}/${P}.tar.xz.sig
-				https://alpha.gnu.org/pub/gnu/${PN}/${MY_P}.tar.xz.sig
-			)
-		"
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	else
-		MY_PV="$(ver_cut 1).$(($(ver_cut 2)-1))b"
-		MY_P="${PN}-${MY_PV}"
-
-		# Alpha/beta releases are not distributed on the usual mirrors.
-		SRC_URI="https://alpha.gnu.org/pub/gnu/${PN}/${MY_P}.tar.xz"
-	fi
-
-	S="${WORKDIR}/${MY_P}"
-fi
-
-DESCRIPTION="Used to generate Makefile.in from Makefile.am"
-HOMEPAGE="https://www.gnu.org/software/automake/"
-
-LICENSE="GPL-2"
-# Use Gentoo versioning for slotting.
-SLOT="${PV:0:4}"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=dev-lang/perl-5.6
-	>=dev-build/automake-wrapper-11
-	>=dev-build/autoconf-2.69:*
-	sys-devel/gnuconfig
-"
-BDEPEND="
-	app-alternatives/gzip
-	sys-apps/help2man
-	dev-build/autoconf-wrapper
-	dev-build/autoconf
-	test? (
-		${PYTHON_DEPS}
-		dev-util/dejagnu
-		sys-devel/bison
-		sys-devel/flex
-	)
-	verify-sig? ( sec-keys/openpgp-keys-jimmeyering )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.16.5-py3-compile.patch
-	"${FILESDIR}"/${PN}-1.16.5-fix-instmany-python.sh-test.patch
-	"${FILESDIR}"/${PN}-1.16.5-fix-py-compile-basedir.sh-test.patch
-	"${FILESDIR}"/${PN}-1.16.5-apostrophe-in-tests.patch
-	"${FILESDIR}"/${PN}-1.16.5-parallel-build.patch
-	"${FILESDIR}"/${PN}-1.16.5-py312.patch
-	"${WORKDIR}"/${PN}-1.16.5-tests-c99.patch
-)
-
-pkg_setup() {
-	# Avoid python-any-r1_pkg_setup
-	:
-}
-
-src_unpack() {
-	use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
-	default
-}
-
-src_prepare() {
-	default
-
-	export WANT_AUTOCONF=2.5
-	# Don't try wrapping the autotools - this thing runs as it tends
-	# to be a bit esoteric, and the script does `set -e` itself.
-	./bootstrap || die
-	sed -i -e "/APIVERSION=/s:=.*:=${SLOT}:" configure || die
-
-	# bug #628912
-	if ! has_version -b sys-apps/texinfo ; then
-		touch doc/{stamp-vti,version.texi,automake.info} || die
-	fi
-}
-
-src_configure() {
-	use test && python_setup
-	# Also used in install.
-	MY_INFODIR="${EPREFIX}/usr/share/automake-${PV}/info"
-	econf --infodir="${MY_INFODIR}"
-}
-
-src_test() {
-	# Fails with byacc/flex
-	emake YACC="bison -y" LEX="flex" check
-}
-
-src_install() {
-	default
-
-	rm "${ED}"/usr/share/aclocal/README || die
-	rmdir "${ED}"/usr/share/aclocal || die
-	rm \
-		"${ED}"/usr/bin/{aclocal,automake} \
-		"${ED}"/usr/share/man/man1/{aclocal,automake}.1 || die
-
-	# remove all config.guess and config.sub files replacing them
-	# w/a symlink to a specific gnuconfig version
-	local x
-	for x in guess sub ; do
-		dosym ../gnuconfig/config.${x} \
-			/usr/share/${PN}-${SLOT}/config.${x}
-	done
-
-	# Avoid QA message about pre-compressed file in docs
-	local tarfile="${ED}/usr/share/doc/${PF}/amhello-1.0.tar.gz"
-	if [[ -f "${tarfile}" ]] ; then
-		gunzip "${tarfile}" || die
-	fi
-
-	pushd "${D}/${MY_INFODIR}" >/dev/null || die
-	for f in *.info*; do
-		# Install convenience aliases for versioned Automake pages.
-		ln -s "$f" "${f/./-${PV}.}" || die
-	done
-	popd >/dev/null || die
-
-	local major="$(ver_cut 1)"
-	local minor="$(ver_cut 2)"
-	local idx="$((99999-(major*1000+minor)))"
-	newenvd - "06automake${idx}" <<-EOF
-	INFOPATH="${MY_INFODIR}"
-	EOF
-
-	docompress "${MY_INFODIR}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild
index add36e6de72..8ab14fafd69 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 # on new automake (major) releases, as well as the dependency in RDEPEND below too.
 # * Update _WANT_AUTOMAKE and _automake_atom case statement in autotools.eclass.
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 
 inherit python-any-r1 verify-sig
 
@@ -35,14 +35,14 @@ else
 				mirror://gnu/${PN}/${P}.tar.xz.sig
 			)
 		"
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
 DESCRIPTION="Used to generate Makefile.in from Makefile.am"
 HOMEPAGE="https://www.gnu.org/software/automake/"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2+ FSFAP"
 # Use Gentoo versioning for slotting.
 SLOT="${MANGLED_SLOT}"
 IUSE="test"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.18.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.18.ebuild
index ac6f9937d68..a1260278425 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.18.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 # on new automake (major) releases, as well as the dependency in RDEPEND below too.
 # * Update _WANT_AUTOMAKE and _automake_atom case statement in autotools.eclass.
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit python-any-r1 verify-sig
 
@@ -19,7 +19,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/r/${PN}.git"
 	inherit git-r3
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jimmeyering.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/karlberry.asc
 	if [[ $(ver_cut 3) -ge 90 ]] ; then
 		MANGLED_SLOT=$(ver_cut 1).$(($(ver_cut 2) + 1))
 		SRC_URI="
@@ -35,14 +35,14 @@ else
 				mirror://gnu/${PN}/${P}.tar.xz.sig
 			)
 		"
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
 DESCRIPTION="Used to generate Makefile.in from Makefile.am"
 HOMEPAGE="https://www.gnu.org/software/automake/"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2+ FSFAP"
 # Use Gentoo versioning for slotting.
 SLOT="${MANGLED_SLOT}"
 IUSE="test"
@@ -50,7 +50,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=dev-lang/perl-5.6
-	>=dev-build/automake-wrapper-20240607
+	>=dev-build/automake-wrapper-20250528
 	>=dev-build/autoconf-2.69:*
 	sys-devel/gnuconfig
 "
@@ -65,7 +65,7 @@ BDEPEND="
 		sys-devel/bison
 		sys-devel/flex
 	)
-	verify-sig? ( sec-keys/openpgp-keys-jimmeyering )
+	verify-sig? ( sec-keys/openpgp-keys-karlberry )
 "
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-9999.ebuild
index 12f75497467..a1260278425 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -8,7 +8,7 @@ EAPI=8
 # on new automake (major) releases, as well as the dependency in RDEPEND below too.
 # * Update _WANT_AUTOMAKE and _automake_atom case statement in autotools.eclass.
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit python-any-r1 verify-sig
 
@@ -19,7 +19,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/r/${PN}.git"
 	inherit git-r3
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jimmeyering.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/karlberry.asc
 	if [[ $(ver_cut 3) -ge 90 ]] ; then
 		MANGLED_SLOT=$(ver_cut 1).$(($(ver_cut 2) + 1))
 		SRC_URI="
@@ -42,7 +42,7 @@ fi
 DESCRIPTION="Used to generate Makefile.in from Makefile.am"
 HOMEPAGE="https://www.gnu.org/software/automake/"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2+ FSFAP"
 # Use Gentoo versioning for slotting.
 SLOT="${MANGLED_SLOT}"
 IUSE="test"
@@ -50,7 +50,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=dev-lang/perl-5.6
-	>=dev-build/automake-wrapper-20240607
+	>=dev-build/automake-wrapper-20250528
 	>=dev-build/autoconf-2.69:*
 	sys-devel/gnuconfig
 "
@@ -65,7 +65,7 @@ BDEPEND="
 		sys-devel/bison
 		sys-devel/flex
 	)
-	verify-sig? ( sec-keys/openpgp-keys-jimmeyering )
+	verify-sig? ( sec-keys/openpgp-keys-karlberry )
 "
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-apostrophe-in-tests.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-apostrophe-in-tests.patch
deleted file mode 100644
index 2c1c99d5736..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-apostrophe-in-tests.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-https://git.savannah.gnu.org/cgit/automake.git/commit/?h=ed1368e8803e8934a8bbab52a38753484dba2a37
-
-From ed1368e8803e8934a8bbab52a38753484dba2a37 Mon Sep 17 00:00:00 2001
-From: Karl Berry <karl@freefriends.org>
-Date: Mon, 12 Dec 2022 14:50:33 -0800
-Subject: test: avoid apostrophe in test document.
-
-From automake patch https://bugs.gnu.org/59989
-(though a different solution), suggestion by Frederic Berat.
-
-* t/txinfo-include.sh: avoid apostrophes in test document,
-since Texinfo 7.0 turns them into UTF-8 by default.
----
- t/txinfo-include.sh | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/t/txinfo-include.sh b/t/txinfo-include.sh
-index 8a15f01..10fff07 100644
---- a/t/txinfo-include.sh
-+++ b/t/txinfo-include.sh
-@@ -28,6 +28,9 @@ main_TEXINFOS = one.texi two.texi three.texi
- sub_more_TEXINFOS = sub/desc.texi sub/hist.texi
- END
- 
-+# We avoid apostrophes in the test document since Texinfo
-+# turns them into UTF-8, which is not easy to grep.
-+#
- cat > main.texi << 'END'
- \input texinfo
- @setfilename main.info
-@@ -61,8 +64,8 @@ END
- 
- cat > three.texi << 'END'
- @node three
--@chapter Chapter two
--GNU's Not Unix.
-+@chapter Chapter three
-+Quux quux quux.
- END
- 
- mkdir sub
-@@ -106,7 +109,7 @@ check_info_contents ()
-   srcdir=${1-.}
-   $FGREP "Foo bar, baz."                        $srcdir/main.info
-   $FGREP "Blah Blah Blah."                      $srcdir/main.info
--  $FGREP "GNU's Not Unix."                      $srcdir/main.info
-+  $FGREP "Quux quux quux."                      $srcdir/main.info
-   $FGREP 'It does something, really.'           $srcdir/sub/more.info
-   $FGREP 'It was written somehow.'              $srcdir/sub/more.info
- }
--- 
-cgit v1.1
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-instmany-python.sh-test.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-instmany-python.sh-test.patch
deleted file mode 100644
index 5cddb4cfb83..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-instmany-python.sh-test.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 50daac4f15d207b6b69011b9cdde62b56c1c8b10 Mon Sep 17 00:00:00 2001
-From: Thomas Deutschmann <whissi@gentoo.org>
-Date: Fri, 20 Nov 2020 02:17:31 +0100
-Subject: [PATCH 2/2] tests: fix instmany-python.sh: increase limit
-
-Still failing with 4500 on Gentoo. Passing with 7000...
----
- t/instmany-python.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/t/instmany-python.sh b/t/instmany-python.sh
-index dce3594b5..1c482520d 100644
---- a/t/instmany-python.sh
-+++ b/t/instmany-python.sh
-@@ -21,7 +21,7 @@
- required='python'
- . test-init.sh
- 
--limit=4500
-+limit=7000
- subdir=long_subdir_name_with_many_characters
- nfiles=81
- list=$(seq_ 1 $nfiles)
--- 
-2.29.2
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-py-compile-basedir.sh-test.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-py-compile-basedir.sh-test.patch
deleted file mode 100644
index 85273d6aaf0..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-fix-py-compile-basedir.sh-test.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-https://git.savannah.gnu.org/cgit/automake.git/commit/?h=ae8fb00111ba0c4922609cd9beb552fb41b66cc6
-
-From e3db5b8038a902501a354b6921dcebcb4180f50a Mon Sep 17 00:00:00 2001
-From: Thomas Deutschmann <whissi@gentoo.org>
-Date: Fri, 20 Nov 2020 02:13:56 +0100
-Subject: [PATCH 1/2] tests: fix py-compile-basedir.sh: add missing test call
-
-Fixes: b279a0d46 ("tests: in python tests, do not require .pyo files (for python3)")
----
- t/py-compile-basedir.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/t/py-compile-basedir.sh b/t/py-compile-basedir.sh
-index 13a22ff1d..1a16ee2d7 100644
---- a/t/py-compile-basedir.sh
-+++ b/t/py-compile-basedir.sh
-@@ -43,7 +43,7 @@ for d in foo foo/bar "$(pwd)/foo" . .. ../foo ''; do
-   py_installed "$d2/sub/$f.pyc"
-   files=$(find "$d2" | grep '\.py[co]$')
-   # with new-enough Python3, there are six files.
--  test $(echo "$files" | wc -l) -eq 4 || $(echo "$files" | wc -l) -eq 6
-+  test $(echo "$files" | wc -l) -eq 4 || test $(echo "$files" | wc -l) -eq 6
-   case $d2 in
-     .|..) rm -f $files;;
-        *) rm -rf "$d2";;
--- 
-2.29.2
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-parallel-build.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-parallel-build.patch
deleted file mode 100644
index 985e86aeb32..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-parallel-build.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-https://git.savannah.gnu.org/cgit/automake.git/commit/?h=5d02285845acfc20a4900a471c0e7c5e2ff390a0
-
-From 5d02285845acfc20a4900a471c0e7c5e2ff390a0 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Tue, 18 Jan 2022 04:47:09 -0500
-Subject: [PATCH] build: fix race in parallel builds
-
-As reported by Hongxu Jia:
-> The automake-$(APIVERSION) is a hardlink of automake, if it is
-> created later than update_mans executing, there is a failure
-> [snip]
-> |: && mkdir -p doc && ./pre-inst-env /usr/bin/env perl ../automake-1.16.1/doc/help2man --output=doc/aclocal-1.16.1 aclocal-1.16
-> |help2man: can't get `--help' info from aclocal-1.16
-> |Try `--no-discard-stderr' if option outputs to stderr
-> Makefile:3693: recipe for target 'doc/aclocal-1.16.1' failed
-> [snip]
->
-> The automake_script is required by update_mans and update_mans
-> invokes automake-$(APIVERSION) rather than automake to generate
-> doc, so we should assign `automake-$(APIVERSION)' to automake_script.
->
-> The same reason to tweak aclocal_script.
-
-However, rather than update the _script variables to point to the
-hardlinked copies of the programs, we can have the help2man steps
-run the existing scripts directly.  This makes the relationship a
-bit more explicit and avoids implicit dependencies on names.
-
-* doc/local.mk: Pass $(aclocal_script) and $(automake_script) to $(update_mans).
-* THANKS: Add Hongxu Jia.
----
- THANKS       | 1 +
- doc/local.mk | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/doc/local.mk b/doc/local.mk
-index a29363d2d71b..06c78823a574 100644
---- a/doc/local.mk
-+++ b/doc/local.mk
-@@ -46,9 +46,9 @@ update_mans = \
- 	  && echo ".so man1/$$f-$(APIVERSION).1" > $@
- 
- %D%/aclocal-$(APIVERSION).1: $(aclocal_script) lib/Automake/Config.pm
--	$(update_mans) aclocal-$(APIVERSION)
-+	$(update_mans) $(aclocal_script)
- %D%/automake-$(APIVERSION).1: $(automake_script) lib/Automake/Config.pm
--	$(update_mans) automake-$(APIVERSION)
-+	$(update_mans) $(automake_script)
- 
- ## This target is not invoked as a dependency of anything. It exists
- ## merely to make checking the links in automake.texi (that is,
--- 
-2.43.0
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py3-compile.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py3-compile.patch
deleted file mode 100644
index 003b391b04a..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py3-compile.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-https://git.savannah.gnu.org/cgit/automake.git/commit/?h=bde43d0481ff540418271ac37012a574a4fcf097
-
-From aa449bd4c836abf0320033c5077259fc760b622d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
-Date: Sun, 3 Nov 2019 11:51:19 +0100
-Subject: [PATCH] py-compile: Support -OO for py3.5+, and -O&-OO for pypy3
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Michał Górny <mgorny@gentoo.org>
----
- lib/py-compile | 29 +++++++++++++++++++++++++----
- 1 file changed, 25 insertions(+), 4 deletions(-)
-
-diff --git a/lib/py-compile b/lib/py-compile
-index e56d98d6e..5b9ae5d5d 100755
---- a/lib/py-compile
-+++ b/lib/py-compile
-@@ -126,12 +126,10 @@ if test "$python_major" -le 2; then
-   import_lib=imp
-   import_test="hasattr(imp, 'get_tag')"
-   import_call=imp.cache_from_source
--  import_arg2=', False' # needed in one call and not the other
- else
-   import_lib=importlib
-   import_test="hasattr(sys.implementation, 'cache_tag')"
-   import_call=importlib.util.cache_from_source
--  import_arg2=
- fi
- 
- $PYTHON -c "
-@@ -159,7 +157,7 @@ $PYTHON -O -c "
- import sys, os, py_compile, $import_lib
- 
- # pypy does not use .pyo optimization
--if hasattr(sys, 'pypy_translation_info'):
-+if hasattr(sys, 'pypy_translation_info') and sys.hexversion < 0x03050000:
-     sys.exit(0)
- 
- files = '''$files'''
-@@ -173,7 +171,30 @@ for file in files.split():
-     sys.stdout.write(file)
-     sys.stdout.flush()
-     if $import_test:
--        py_compile.compile(filepath, $import_call(filepath$import_arg2), path)
-+        py_compile.compile(filepath, $import_call(filepath), path)
-+    else:
-+        py_compile.compile(filepath, filepath + 'o', path)
-+sys.stdout.write('\n')" 2>/dev/null || :
-+
-+$PYTHON -OO -c "
-+import sys, os, py_compile, $import_lib
-+
-+# python<3.5 does not have split files for -O and -OO
-+if sys.hexversion < 0x03050000:
-+    sys.exit(0)
-+
-+files = '''$files'''
-+sys.stdout.write('Byte-compiling python modules (optimized versions) ...\n')
-+for file in files.split():
-+    $pathtrans
-+    $filetrans
-+    if not os.path.exists(filepath) or not (len(filepath) >= 3
-+                                            and filepath[-3:] == '.py'):
-+	    continue
-+    sys.stdout.write(file)
-+    sys.stdout.flush()
-+    if $import_test:
-+        py_compile.compile(filepath, $import_call(filepath), path)
-     else:
-         py_compile.compile(filepath, filepath + 'o', path)
- sys.stdout.write('\n')" 2>/dev/null || exit $?
--- 
-2.25.2
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py312.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py312.patch
deleted file mode 100644
index 124403f1db2..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.16.5-py312.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-https://git.savannah.gnu.org/cgit/automake.git/commit/?id=f1112a88d2361eb2ba5cedf49995ac75879059d9
-
-From f1112a88d2361eb2ba5cedf49995ac75879059d9 Mon Sep 17 00:00:00 2001
-From: Bogdan <bogdro_rep@gmx.us>
-Date: Sun, 28 Jan 2024 18:12:50 -0800
-Subject: [PATCH] test: another check for PEP-3147 induced by Python 3.12.1.
-
-Fix for more of https://bugs.gnu.org/68119.
-
-* t/ax/am-test-lib.sh (python_has_pep3147) <am_pep3147_tag>:
-check sys.implementation.cache_tag as well as the (old)
-imp.get_tag. For Python 3.12.1.
----
- t/ax/am-test-lib.sh | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/t/ax/am-test-lib.sh b/t/ax/am-test-lib.sh
-index fbbb79005..d61fd6662 100644
---- a/t/ax/am-test-lib.sh
-+++ b/t/ax/am-test-lib.sh
-@@ -635,6 +635,10 @@ python_has_pep3147 ()
-     am_pep3147_tag=$($PYTHON -c 'import imp; print(imp.get_tag())') \
-       || am_pep3147_tag=none
-   fi
-+  if test "$am_pep3147_tag" = "none"; then
-+    am_pep3147_tag=$($PYTHON -c 'import sys; print(sys.implementation.cache_tag)') \
-+      || am_pep3147_tag=none
-+  fi
-   test $am_pep3147_tag != none
- }
- am_pep3147_tag=
--- 
-2.44.0
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index 047c7e2c904..1e2abe2598d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -6,16 +6,10 @@ DIST cmake-3.31.0-docs.tar.xz 562756 BLAKE2B ef1d145658fd197ea515f05fbbad54b213b
 DIST cmake-3.31.5-SHA-256.txt 1646 BLAKE2B 45b9e829febf185ba9f532c208e6b49bcf56e6ffbdf2fb46fb8e6bc6cc58bb890a4a27cb00eb7acfc12b595aa20dcd1343142ab9e1fd42baee12af941cb786de SHA512 1b5a6f405cdb1cfaf52a5666b67d76261121ee66e6c9b73338da72af5f6eb6a27f87b642f657ab9d64bc491b9d8526cae4699e8f053e44550b2e01c3a0f3aa1a
 DIST cmake-3.31.5-SHA-256.txt.asc 833 BLAKE2B 0206a62c7816b4115e56e1f1519b6357610037f18949a3a5ce894bfd364de39918073fa267516ec4071eaf35fd641363cdaeeb0704de5918d2f6aace9e7bdfbe SHA512 016ec25b29b28845c1a2680e0b25f35b7ce89e466493caa99acaad4f8e32f9173a72afcecdddd90e89ea00ac10df3fa0dc37b3edc1de1923198e393f9f54e769
 DIST cmake-3.31.5.tar.gz 11706495 BLAKE2B 16375229d7344b10db40c76fe2fc8a3f90626683b3846a1d0ead22ae6312cc71c58ff4d4314216c0ea34f4c7c4bb8610c5923b875063d08bb247cc1c4ee1ceab SHA512 1981efafa8916371caf58b1fcbf9c9d73d365ec119279860ee2fa11f4ff72d87bb3a4570eb20a45fae95260bb8f565daf2f579a890b2dad588207b3fcc158e43
-DIST cmake-3.31.6-SHA-256.txt 1646 BLAKE2B f5d3bb67759b4b227bd38eb7de8405052fd55cef528d3a4d4754d77815cdb018831fadcb51e590186faa5e7911bd6d9ceba29d971a7d125435df06132276a00d SHA512 8e3d939ccab2260380fce92c31ba8244c7b4d19c7245d5bc9607e9352f2e7fa1e0e4ecc8555f8418f9659f53c142111dd34aba0739d947f387e5a88345dd6b46
-DIST cmake-3.31.6-SHA-256.txt.asc 833 BLAKE2B a99307a7e8011a1df30a2f364ae68b2f5d286d0d98f8a9b5d27283aa109963d6989218a8b3787666d7aa3a7e37e4d6468077c16b6550727efd1295f8c0504caa SHA512 c7a728110790a85ba89dace68c9bd4c22c81ae4482a758297fdb49e7eb11ccf0056d0d4fcf100be71eed7cc2ae3f633722df801dba2d61dd0fafb476d5b09128
-DIST cmake-3.31.6.tar.gz 11710589 BLAKE2B ea1bee1a98568407dfc164f82bf0e3ab082124bbbb12cfa18489bdbe9964418ee30fb62b4915bc06645bcd2cf1e17bfb9c210812da070acbba848db186d06044 SHA512 839d06b6ebd0bf78cbe8f7ae3a7c00026e70d759a81ac51aa103f35ad985ac69be9e667aae7b5fe48c5e0c41baec791259279679dbdf2ddd8b63a48382a8a2a0
 DIST cmake-3.31.7-SHA-256.txt 1646 BLAKE2B a3b52506b586ee81cb4192ddbfa52c8f2c4456d99ce3e0f1c2e88c22a756d58905219498e41b726bce6258b5bbe44fb2c58bb0c5972303a6ca8c2dc37de59676 SHA512 eb967dbc6a4c18d1b0b97910b89a5e9392e29bd1a8c169c92899215ee15f5a8a4852c06b3643c5ce420a57ef93c9153380d75f68f23092475032850390d1ab4e
 DIST cmake-3.31.7-SHA-256.txt.asc 833 BLAKE2B 9ddb47b9aa26875b294d4e3db27b4c9518c3a01f3a11d1a50afae08ef7871f52367c0d275415cd801613b036ae88f92611d03bb5d576e8bcd324c3ec46d943e1 SHA512 9b7234c8fe122cf458a42c5d5ba71bd7694c2cb610cc989d2ea2a710a5615a0f49f0747b3ab4321d0bb69987321e8256b335a3e5d29de4bc783d683b7dedae93
 DIST cmake-3.31.7.tar.gz 11711975 BLAKE2B 8bf3ea288695f6e1a9f301f8ad471e1007061cb9ed69b8a432d5de7e1779580ffbbd4050a85b1a3df30a85ee971ed0421ce14d9a77b026f7147d73ca8fee7ec9 SHA512 896f29e8e7c897e6e346141496d3f338aeaced8300fb2fd1fedcd0236742bfe4842de1c94253adf54f4847b17c5d9699c92d199cbb4a74c99ee14972c939b09e
-DIST cmake-4.0.0-SHA-256.txt 2015 BLAKE2B 8f3737f51768c61a16543e8d4a4bc6c359f2f2c128b1d7a5b80cae6c09e64d8ed28147619336172b217d0ea264ce424b2ef519b36bc6e30771a7144bee6d67b1 SHA512 50abb18d59e2685ea462d1e4cbafb005172030c1dc7f77a959e178caba744347d67b575318d3a09c1f44966f5efcfdb2fa0dd2dbbddb1fc8487f54c0e4207d69
-DIST cmake-4.0.0-SHA-256.txt.asc 833 BLAKE2B 2e9fe03e6db837dffe703740c76b312fced691ac2b2a5df6c8c199489902ce36ab8bef6ba599734470e5c4ded7ab4ad75eb374578b2204ed72d5711ad8af843d SHA512 93da422a75ce068d26b96e0a50746511f7ee3da6f8fd8d232bf9fd6a95853290ae98858ab8a00719091b79a9a6064bf7c0f840d45fa773baaa48b489ea4f54fc
-DIST cmake-4.0.0.tar.gz 11824527 BLAKE2B 21ab208f663498a4851e312bdee884fae9a711234ffd7da73c56894a51d2cd7a479f18fc0d3f276c9eee964e97965d0d57ccfe9a95a10f1bb7ad319c8fe0b7af SHA512 6892f68a48f428b7d7321e646b75d72f751a20b44e74696d445c90dc0dc8be7894f546d70e3749ff44a1bbea0371e9f4d509a9c116c17c231db65affe60945df
 DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d4198155145a039635e6a0ea40af463f3a2d45b6c6ce7d3a9b1fee24f0c1cfd1c3aa95c27669ca3c6281d54e701fc0ece202 SHA512 74c20067d3b82493024b2f2711b55b93998ce3b5f35ab5a154f33a8268a35a29d01127c55ce6b85b80ff252d15284ed1065e1338422124f6722a4190a984637c
-DIST cmake-4.0.1-SHA-256.txt 2015 BLAKE2B 3b6f2c889d4e67b459c1cd4a86470f1429f0153ff596bef7deb178050ad79686b4fc3ad0663a243219ebc2d626b3382ec747ee5a0d65c9a030444b8c60e50801 SHA512 f5b23ec12ac172c6d567722ac8d37c1325ad9da6d22944e1ed2cebb77dd645ac948f10f8f2060061990788d82209a1266848f334dd77c6014ce7c11d308aae95
-DIST cmake-4.0.1-SHA-256.txt.asc 833 BLAKE2B 67c5984baf0d3ed4bc263ee39963e9a540bf6328786101d62adebe3cba550e14d291edb0dee40cdabadb6763c02c1959208956b43532f760db878d6796a32f7d SHA512 5a80e483a4f280969ad8f7bf31f3cc3b1b1cb13b4853a1bf1616414e8f2c2cac381658126bfe23aa229eb40af5a423f5e2d0e076b5f02e7e667b4b83d007b7b3
-DIST cmake-4.0.1.tar.gz 11826844 BLAKE2B beedd233ce7a40a694394ec0b23a14e2ad566a98e6c04b0ffa8d66844cf66b4545974635647ffde247021a00378f48d09f0f8fa0d0e100fc6a55b258bb01fe83 SHA512 25f3e93b1fe09b4aacf6f6361942f829c4833075a05ad26a9bdbd1278f5f6a78389e619e478152e2ecc4108a4bccc3ed901f96db0571dc05f1feba4e04f8f516
+DIST cmake-4.0.2-SHA-256.txt 2015 BLAKE2B 19e4be043bd45e0e3ed88a758ef1791f4e8b0164a42e3df72f8451c2321e9e72a305e4bfe146cf1e91a41e987d6e4d137781f12d3331f12d47d7ee9b06ecc8ce SHA512 9b91f2fa6c5bb0323358457b2393d2f3723f175253c6d0154da4defa9d206eabef90c9159f5ad6f465568859b2289ad3bcb3154aac8f9640587894eff231075b
+DIST cmake-4.0.2-SHA-256.txt.asc 833 BLAKE2B 4a7221627af5c9ee0cc6492a126feb48ad47cf654990fb45e0bb124a9bf23243d04081572836904b089f34d13b95f2b8c57c3c1bad32f53afb75881c274cbf6a SHA512 e6f8c372f6be8fca8a2f2b91c143905be173c4d10f2d4102400b07eecb27728591db6687dc89d0781e7c072280b13c4a84c151e0dffc8dd1bcb4792b710f8159
+DIST cmake-4.0.2.tar.gz 11829733 BLAKE2B 3ea56ae2916f60f564a1d630ddff97ccd41ec11753aabde894f9a0369477ae57ed9b9e45f7a6684cca534706554b613bfa95b8105a2a19917d5ca1c76c7ea1c9 SHA512 049138ec2a7d690663d431bcb4d8abd22f18ec2c9e0e58092df6bbfe801a30fef9a3b7cbd9fe88c476c0a95c71147a5b31b0494f04be879a86cbaaa4697f613c
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.28.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.28.5.ebuild
index 180561f64d9..914a5ddf13e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.28.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.28.5.ebuild
@@ -97,6 +97,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.6-curl-8.13.0.patch
 )
 
 cmake_src_bootstrap() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild
deleted file mode 100644
index f94a7b1a1a7..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild
+++ /dev/null
@@ -1,314 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
-	toolchain-funcs xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == *9999* ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	gui? ( dev-qt/qtbase:6[gui,widgets] )
-	ncurses? ( sys-libs/ncurses:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	# Cuda
-	"${FILESDIR}"/${PN}-3.30.3-cudahostld.patch
-
-	# Upstream fixes (can usually be removed with a version bump)
-	"${FILESDIR}"/${PN}-3.31.6-curl-8.13.0.patch
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-pkg_pretend() {
-	if [[ -z ${EPREFIX} ]] ; then
-		local file
-		local errant_files=()
-
-		# See bug #599684 and  bug #753581 (at least)
-		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
-			if [[ -e ${file} ]]; then
-				errant_files+=( "${file}" )
-			fi
-		done
-
-		# If errant files exist
-		if [[ ${#errant_files[@]} -gt 0 ]]; then
-			eerror "Errant files found!"
-			eerror "The presence of these files is known to confuse CMake's"
-			eerror "library path logic. Please (re)move these files:"
-
-			for file in "${errant_files[@]}"; do
-				eerror " mv ${file} ${file}.bak"
-			done
-
-			die "Stray files found in /etc/, see above message"
-		fi
-	fi
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-		# Disable system integration, bug #933744
-		sed -i -e 's/__APPLE__/__DISABLED__/' \
-			Source/cmFindProgramCommand.cxx \
-			Source/CPack/cmCPackGeneratorFactory.cxx || die
-		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
-			Source/cmMachO.cxx || die
-		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
-			Source/CMakeLists.txt || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
-	## handle them as part of bootstrapping, sadly.
-
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-		-DBUILD_QtDialog=$(usex gui)
-	)
-
-	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
-
-	cmake_src_configure
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actually bootstrap it every time so why test it?
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	local -x QT_QPA_PLATFORM=offscreen
-
-	cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
index e384162dd9a..a59fcb4bde8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7-r1.ebuild
@@ -47,7 +47,7 @@ else
 			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
 		)"
 
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
 	fi
@@ -98,6 +98,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.30.3-cudahostld.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.7-hdf5.patch
 )
 
 cmake_src_bootstrap() {
@@ -124,7 +125,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild
deleted file mode 100644
index 41639c300a5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.0.ebuild
+++ /dev/null
@@ -1,321 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-CMAKE_DOCS_VERSION=4.0.0_rc1
-#CMAKE_DOCS_VERSION=${PV}
-#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
-	toolchain-funcs xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == *9999* ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
-	inherit verify-sig
-
-	SRC_URI+=" verify-sig? (
-		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
-		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
-		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
-		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
-	)"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	gui? ( dev-qt/qtbase:6[gui,widgets] )
-	ncurses? ( sys-libs/ncurses:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	# Cuda
-	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
-
-	# Upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-pkg_pretend() {
-	if [[ -z ${EPREFIX} ]] ; then
-		local file
-		local errant_files=()
-
-		# See bug #599684 and  bug #753581 (at least)
-		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
-			if [[ -e ${file} ]]; then
-				errant_files+=( "${file}" )
-			fi
-		done
-
-		# If errant files exist
-		if [[ ${#errant_files[@]} -gt 0 ]]; then
-			eerror "Errant files found!"
-			eerror "The presence of these files is known to confuse CMake's"
-			eerror "library path logic. Please (re)move these files:"
-
-			for file in "${errant_files[@]}"; do
-				eerror " mv ${file} ${file}.bak"
-			done
-
-			die "Stray files found in /etc/, see above message"
-		fi
-	fi
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-		# Disable system integration, bug #933744
-		sed -i -e 's/__APPLE__/__DISABLED__/' \
-			Source/cmFindProgramCommand.cxx \
-			Source/CPack/cmCPackGeneratorFactory.cxx || die
-		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
-			Source/cmMachO.cxx || die
-		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
-			Source/CMakeLists.txt || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
-	## handle them as part of bootstrapping, sadly.
-
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	# 4.0.0_rc1 is missing this, fails to configure
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
-	touch .clang-tidy Utilities/.clang-tidy || die
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-		-DBUILD_QtDialog=$(usex gui)
-	)
-
-	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
-
-	cmake_src_configure
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actually bootstrap it every time so why test it?
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	local -x QT_QPA_PLATFORM=offscreen
-
-	cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
index 41639c300a5..e1c7d026c0a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.2-r1.ebuild
@@ -102,6 +102,7 @@ PATCHES=(
 	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.7-hdf5.patch
 )
 
 cmake_src_bootstrap() {
@@ -128,7 +129,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
index 41639c300a5..d5c57e85205 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
@@ -128,7 +128,7 @@ pkg_pretend() {
 		local file
 		local errant_files=()
 
-		# See bug #599684 and  bug #753581 (at least)
+		# See bug #599684 and bug #753581 (at least)
 		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
 			if [[ -e ${file} ]]; then
 				errant_files+=( "${file}" )
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch
new file mode 100644
index 00000000000..c68c5eeec98
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.7-hdf5.patch
@@ -0,0 +1,34 @@
+https://bugs.gentoo.org/954378#c14
+https://gitlab.kitware.com/cmake/cmake/-/issues/23261
+https://gitlab.kitware.com/cmake/cmake/-/commit/a869b79c5921412c91fb71a761748ae5f7d3fb23
+
+From a869b79c5921412c91fb71a761748ae5f7d3fb23 Mon Sep 17 00:00:00 2001
+From: Atri Bhattacharya <badshah400@gmail.org>
+Date: Mon, 10 Mar 2025 20:55:36 +0530
+Subject: [PATCH] FindHDF5: Prefer h5hl* compilers for HDF5_FIND_HL
+
+Prefer `h5hlcc`, `h5hlc++`, and `h5hlfc` compilers when HDF5's HL libraries
+are requested. These include the `-lhdf_hl` in the command line, whereas
+the non-hl compilers (like `h5cc`) do not. Using the latter, therefore,
+leads to cmake complaining about not finding the `HDF5_HL` libraries even
+though they are present in the same location as the `hdf5` library itself.
+
+Fixes: #23261
+--- a/Modules/FindHDF5.cmake
++++ b/Modules/FindHDF5.cmake
+@@ -218,6 +218,13 @@ else()
+   set(HDF5_Fortran_COMPILER_NAMES h5fc h5pfc)
+ endif()
+ 
++# Prefer h5hl<LANG> compilers if HDF5_FIND_HL is enabled
++if(HDF5_FIND_HL)
++  list(PREPEND HDF5_C_COMPILER_NAMES h5hlcc)
++  list(PREPEND HDF5_CXX_COMPILER_NAMES h5hlc++)
++  list(PREPEND HDF5_Fortran_COMPILER_NAMES h5hlfc)
++endif()
++
+ # Test first if the current compilers automatically wrap HDF5
+ function(_HDF5_test_regular_compiler_C success version is_parallel)
+   if(NOT ${success} OR
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
index 5367861a292..9bfc3ac247f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
@@ -1,8 +1,9 @@
-# Copyright 2020-2024 Gentoo Authors
+# Copyright 2020-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
-PYTHON_COMPAT=( python3_{10..13} )
+
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit edo python-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index bbf1c22a062..a8ae54d21fe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -12,16 +12,13 @@ DIST meson-1.6.1.tar.gz 2276144 BLAKE2B 7ccdb3bf3f701fc787fabf91413db8301a8658b8
 DIST meson-1.6.1.tar.gz.asc 833 BLAKE2B 6666eca8e5506b8692fc29ba66dc3ee9d725a7d720a7b43db720098f7e00671e71993586606c187d8314e3919474f5733d64a8d052be6552cbcf013a872905ab SHA512 543cf396de0a58998c3587aa05580fa9a56734db40b74fc5fbb22cd56124531804a5360d6b9acb9baa71753ac04c343364da4d78a0d366d8e8bc760030ebf8d3
 DIST meson-1.7.0.tar.gz 2293975 BLAKE2B 64465b33c2358fddc3594807ee5d251dc6bcc1030ed3559d2d5dc33b7092a512b8a3d3b75cc7152812dbc62631d3b9fba596cd105654ae3ff38f01be8ada5232 SHA512 a5d1f00b193ca37ae64f85c9dfc29a2661c167d82d9953b9acd1393b222b05fa5fc03ffdf00fd1ae7a2014da3a7366c35f70bf02e3204e929b74f7b00c17c840
 DIST meson-1.7.0.tar.gz.asc 833 BLAKE2B 34783968262e5ce54cca7f4878b09e7611670ede620b8588ac915bb55fed7f4051e151d789b10e9bd650241149dc9930c14b356c3ce436682d496eeabc805672 SHA512 85ec14f080d0d1492922c971909dc734ab1cd4914a567afbfeff5dc00d19a9a72e6e0668280fc045f270c49389ea03059b9eeb831788b2154fb39116b38f6e5e
-DIST meson-1.7.1.tar.gz 2295198 BLAKE2B a1eda88cc349f74ab00e367daf5f27452875f483d95d7dcad2255b5df040efd39019dd6b1b61a58709662193c3dce28c6f378e80f7c15a4b9be694ed4173f59d SHA512 bad913c59f540b701a0d234a868bd88615ccfcdc09931f8dea7b4da48bcc3a3c3c7e9cdeeff5abfcd48c6b2b25e5c60590811125b7156da36b714e00b35813c6
-DIST meson-1.7.1.tar.gz.asc 833 BLAKE2B 1e854c5f026471d1fa1f9f9ca26a8be06518564694b92ba8a751f2c05fa430359c5f6c9b636c0df9a2db338f61a9750e4080d60171a0e3bef49163c416166ef6 SHA512 266de0d34828688491ad3167bb3b88f489b579af1bbbb20a28e3ccfc342fa04659970d4db5e10a0470a5c52d37f4b04f718d7af4c3c3e9e1e67c69c10f3c4662
 DIST meson-1.7.2.tar.gz 5009274 BLAKE2B f5a19d7c0dfa35efda5bdef972fa6362a64fee2c74be0c09dee6d52c30a8b0169dbe7fab3199add306c778f6a57196251b44ec27ff6b5e038e12c11b27513a54 SHA512 c3c71ae0e0c31d8d72e200bb5fd5e6584ce41aabe1e85575d50371f82ed02c6e346da3b0b4a2786199b9410daaa1622807a88bfc8ac991cf134bad4a53b3c863
 DIST meson-1.7.2.tar.gz.asc 996 BLAKE2B 9a34bb86f15eb92d4eb972835e8e18e175c869a6ba9d88310ca6058654200b227c7a4a945eee220784f584737a3b74ffcd06e2b60a3e502e49af5da69eb1e5bf SHA512 a1e0461a28dfc8ba74ffd919511584148094c2bc809c3d380749856cbdaa33473c1a0c1ec92928020f50e116803fc03deb37b3ee2aca7e56287b155a5ccc36ac
-DIST meson-1.8.0.tar.gz 2334911 BLAKE2B a27a6e105bb19ff0fa77f62b7563b66cdeffef8e4d6ec538e1cc5c49fae16097afeae9669ed80b1d0688059c1135ff392c722e39c94f5686fb926ffcd6abf893 SHA512 345ca35b0c9219f42a46eb2dbda793b46277b2220912124a5054973390138ef1310004e1a90fde37c177d3e7103b209ebf539def2ae597f3d472c35c043bc46b
-DIST meson-1.8.0.tar.gz.asc 833 BLAKE2B ad1ef6f9fb8b02231b64dac2660cfdf6f2bed801c4696d905b681836132c6da257698cc636c3e449d2b137f4c16b19eb22ad87271298647d33ffa26871e358ff SHA512 cdfb8a6b121f56b02b50b52db0db33fbaec90e6432e047ab168cc529bf79e55a05ad1377c3def8bad130a316c6666d203752bb5173d6e8c84f55d53afb8d5f27
+DIST meson-1.8.1.tar.gz 2332007 BLAKE2B 8fa77bd0e1494d94de585f8f740cb01dfc302fef1f1d8f25a4a2110470e53e33e61ce1f6c3605b1babdda6531d238e1e87227071334a8f42085dcc35f1940d9b SHA512 f5e7a6098f73e46b30a5e9b09f4da21c2e9cd8133a2ee6f2894fe1603356dbe29361ff95063ac364828676c56da1675c5d58238abda4329e935bcf216a9a80df
+DIST meson-1.8.1.tar.gz.asc 833 BLAKE2B a31c10eb386597049eed127987dfa32f044fbd2ec0261fa0547c066a47a57e27893821f80eb6a7ad82fd72278ff77abdaf4a88fd057b9b960edd8626530a17be SHA512 5d6a0681ccd1132f86904b88fdef4838a9de403d29b6dddb8d8626ce3f1e9d1d911b79f821aa81cd1421fd4c095ca488494a1b77e59f94ba616504eef251dbc7
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
 DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150943b6cd95a0599b0392299e2a9338921b52bbe3613fc03fa931c28fb2121801bdb74880f2bd4fecb051b7f1fcb4b SHA512 9d9a3862602251ca780acdf18cee4ab9cd14404481e216b557eafc88b23561ecf481836898b78cbc4ee3539869b5578c649a5c71f32b3074d8125b867ea4751d
-DIST meson-reference-1.7.1.3 344764 BLAKE2B f4b6a5eb80f143310e9aae3fe512b5146b39df4e74e589c571d3f58ddfcb3298d1accff417c055e46a4ad61fc0557723eb4d89607a4793d1bcc134f1e83ab3eb SHA512 f36e4adcf7eab70738c71c48c87328bc436168dc605c0931b746d4b48915269dc9245215a4aa968046e4cb0f5167f595da1cf2acd96d87ed47aea9b34b63a652
 DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
-DIST meson-reference-1.8.0.3 345633 BLAKE2B 1f67780a3cf61ab0c992d68f9a7936d24061a204eef6bf9827f0f8a04985c16a04ef2039d622a5d71783e4c07bbf5ac6ed123247aeb770c9d05a0988bd8073d8 SHA512 009cc42d4d279c9c3a912885d1fe3baf7d097fe8868c725cc853c81270e64b49203363324f39e2a2797eadaa82322f15d1076566c87b9b3a2c6c05c1fdbbfc63
+DIST meson-reference-1.8.1.3 345633 BLAKE2B 026423161eeddff3e663016c4b3fff885e96dc1a652562fe312cb80cfcc845015cab0d0f51c39f187cc484752f8f2bf7954dc8daf6762a74f895338cac4c35c4 SHA512 d3041eee86e63c178a04d5ec1ec383e7bbd209f358103806d488b28383471c1ecb5a13aa3716f699c1973a1d32dace34b0fdb0375e19abc0050deeb66fc5d376
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/files/unbreak-setuptools-test_installed.patch b/sdk_container/src/third_party/portage-stable/dev-build/meson/files/unbreak-setuptools-test_installed.patch
new file mode 100644
index 00000000000..522b8ae81be
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/files/unbreak-setuptools-test_installed.patch
@@ -0,0 +1,34 @@
+From 23e4e2f20ca698f4070f7da79f5e06249d34b622 Mon Sep 17 00:00:00 2001
+From: Eli Schwartz <eschwartz93@gmail.com>
+Date: Sat, 24 May 2025 22:38:44 -0400
+Subject: [PATCH] Unbreak "Fix setuptools 49 test. (fixes #7452)"
+
+This unbreaks commit 59910c437a81b94c72e3cbdfc2c3612fae576d6e.
+
+It kind of maybe appears to fix something but does break it all quite
+terribly too. Totally random subdirectories of site-packages/ should
+certainly not be added to PYTHONPATH regardless of anything else as that
+may include mesonbuild/, leading to `import ast` finding mesonbuild.ast
+instead...
+
+The underlying issue here is that egg .pth is not loaded from PYTHONPATH
+at all, which means depending on versions of e.g. setuptools this test
+may end up solely testing system-installed meson, or fail entirely. So
+we can fix this by manually adding eggs specifically.
+---
+ run_meson_command_tests.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/run_meson_command_tests.py b/run_meson_command_tests.py
+index f9faca9af6fe..7265d3e031e2 100755
+--- a/run_meson_command_tests.py
++++ b/run_meson_command_tests.py
+@@ -143,7 +143,7 @@ def test_meson_installed(self):
+         os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']
+         self._run(python_command + ['setup.py', 'install', '--prefix', str(prefix)])
+         # Fix importlib-metadata by appending all dirs in pylibdir
+-        PYTHONPATHS = [pylibdir] + [x for x in pylibdir.iterdir()]
++        PYTHONPATHS = [pylibdir] + [x for x in pylibdir.iterdir() if x.name.endswith('.egg')]
+         PYTHONPATHS = [os.path.join(str(x), '') for x in PYTHONPATHS]
+         os.environ['PYTHONPATH'] = os.pathsep.join(PYTHONPATHS)
+         # Check that all the files were installed correctly
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild
deleted file mode 100644
index 009a98dca97..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild
+++ /dev/null
@@ -1,225 +0,0 @@
-# Copyright 2016-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-DISTUTILS_USE_PEP517=setuptools
-
-inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
-
-if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
-	inherit ninja-utils git-r3
-
-	BDEPEND="
-		${NINJA_DEPEND}
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	"
-
-else
-	inherit verify-sig
-
-	MY_PV=${PV/_/}
-	MY_P=${P/_/}
-	S=${WORKDIR}/${MY_P}
-
-	SRC_URI="
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
-		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
-	"
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-DESCRIPTION="Open source build system"
-HOMEPAGE="https://mesonbuild.com/"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-IUSE="test test-full"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="test-full? ( test )"
-
-DEPEND="
-	test? (
-		dev-libs/glib:2
-		dev-libs/gobject-introspection
-		app-alternatives/ninja
-		dev-vcs/git
-		sys-libs/zlib[static-libs(+)]
-		virtual/pkgconfig
-		dev-build/cmake
-	)
-	test-full? (
-		|| ( dev-lang/rust dev-lang/rust-bin )
-		dev-lang/nasm
-		>=dev-lang/pypy-3
-		dev-lang/vala
-		dev-python/cython
-		virtual/fortran
-		virtual/jdk
-
-		app-text/doxygen
-		dev-cpp/gtest
-		dev-libs/protobuf
-		dev-util/bindgen
-		dev-util/gtk-doc
-		dev-util/itstool
-		llvm-core/llvm
-		media-libs/libsdl2
-		media-libs/libwmf
-		net-libs/libpcap
-		sci-libs/hdf5[fortran]
-		sci-libs/netcdf
-		sys-cluster/openmpi[fortran]
-		sys-devel/bison
-		sys-devel/flex
-
-		dev-qt/linguist-tools:5
-		dev-qt/qtwidgets:5
-		dev-qt/qtbase:6[gui,widgets]
-		dev-qt/qttools:6
-		dev-util/gdbus-codegen
-		x11-libs/gtk+:3
-
-		dev-libs/wayland
-		dev-util/wayland-scanner
-	)
-"
-RDEPEND="
-	!<dev-build/muon-0.2.0-r2[man(-)]
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
-)
-
-src_unpack() {
-	if [[ ${PV} = *9999* ]]; then
-		git-r3_src_unpack
-	else
-		default
-		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
-	fi
-}
-
-python_prepare_all() {
-	local disable_unittests=(
-		# ASAN and sandbox both want control over LD_PRELOAD
-		# https://bugs.gentoo.org/673016
-		-e 's/test_generate_gir_with_address_sanitizer/_&/'
-
-		# ASAN is unsupported on some targets
-		# https://bugs.gentoo.org/692822
-		-e 's/test_pch_with_address_sanitizer/_&/'
-
-		# clippy-driver fails, but only when run via portage.
-		#
-		#   error[E0463]: can't find crate for `std`
-		#   error: requires `sized` lang_item
-		-e 's/test_rust_clippy/_&/'
-	)
-
-	sed -i "${disable_unittests[@]}" unittests/*.py || die
-
-	# Broken due to python2 script created by python_wrapper_setup
-	rm -r "test cases/frameworks/1 boost" || die
-	# nvcc breaks on essentially any LDFLAGS
-	# https://bugs.gentoo.org/936757
-	# https://github.com/mesonbuild/meson/issues/11234
-	rm -r "test cases/cuda"/* || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_check_deps() {
-	if [[ ${PV} = *9999* ]]; then
-		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-	fi
-}
-
-python_configure_all() {
-	if [[ ${PV} = *9999* ]]; then
-		# We use the unsafe_yaml loader because strictyaml is not packaged. In
-		# theory they produce the same results, but pyyaml is faster and
-		# without safety checks.
-		edo ./meson.py setup \
-			--prefix "${EPREFIX}/usr" \
-			-Dhtml=false \
-			-Dunsafe_yaml=true \
-			docs/ docs/builddir
-	fi
-}
-
-python_compile_all() {
-	if [[ ${PV} = *9999* ]]; then
-		eninja -C docs/builddir
-	fi
-}
-
-src_test() {
-	tc-export PKG_CONFIG
-	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
-		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
-	else
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	(
-		# meson has its own tests for LTO support. We don't need to verify that
-		# all tests work when they happen to use it. And in particular, this
-		# breaks rust.
-		filter-lto
-
-		# remove unwanted python_wrapper_setup contents
-		# We actually do want to non-error if python2 is installed and tested.
-		remove="${T}/${EPYTHON}/bin:"
-		PATH=${PATH/${remove}/}
-
-		# test_meson_installed
-		unset PYTHONDONTWRITEBYTECODE
-
-		# https://bugs.gentoo.org/687792
-		unset PKG_CONFIG
-
-		# test_cross_file_system_paths
-		unset XDG_DATA_HOME
-
-		# 'test cases/unit/73 summary' expects 80 columns
-		export COLUMNS=80
-
-		# If JAVA_HOME is not set, meson looks for javac in PATH.
-		# If javac is in /usr/bin, meson assumes /usr/include is a valid
-		# JDK include path. Setting JAVA_HOME works around this broken
-		# autodetection. If no JDK is installed, we should end up with an empty
-		# value in JAVA_HOME, and the tests should get skipped.
-		export JAVA_HOME=$(java-config -O 2>/dev/null)
-
-		${EPYTHON} -u run_tests.py
-	) || die "Testing failed with ${EPYTHON}"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all
-
-	insinto /usr/share/vim/vimfiles
-	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
-
-	dozshcomp data/shell-completions/zsh/_meson
-	dobashcomp data/shell-completions/bash/meson
-
-	if [[ ${PV} = *9999* ]]; then
-		DESTDIR="${ED}" eninja -C docs/builddir install
-	else
-		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
index e812183223e..a5477d321e7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@@ -36,7 +36,7 @@ else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.gpg
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
@@ -102,6 +102,7 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+	"${FILESDIR}"/unbreak-setuptools-test_installed.patch
 )
 
 src_unpack() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.1.ebuild
index 3a33c45497e..a3373d35b8a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.1.ebuild
@@ -102,6 +102,7 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+	"${FILESDIR}"/unbreak-setuptools-test_installed.patch
 )
 
 src_unpack() {
@@ -118,6 +119,7 @@ python_prepare_all() {
 		# ASAN and sandbox both want control over LD_PRELOAD
 		# https://bugs.gentoo.org/673016
 		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
 
 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
index b8fff02af69..cad9562fb97 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.1.ebuild
@@ -1,9 +1,9 @@
-# Copyright 2012-2024 Gentoo Authors
+# Copyright 2012-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 edo python-any-r1 toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
index fd2cbd72e0a..8185b7a0c88 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 2012-2024 Gentoo Authors
+# Copyright 2012-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 edo python-any-r1 toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/Manifest b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/Manifest
index 27d44dcf6c4..62d3e0cef14 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/Manifest
@@ -1,2 +1,3 @@
 DIST glog-0.5.0.tar.gz 183346 BLAKE2B 9109a9a4bd3c74ba5d4c1d9ed44ffe0e16d5d3b9b12bf9dd5d31c6e728292ea50f39b4e1b96d55fbb35653a448af4dc8a978e266a2b0f34261c5108099e90845 SHA512 445e4338f3d81cd0b065f2da9c6ce343c243263ca144cea424ef97531a4e9e09c06ffd6942ac01c5213a8003c75cfbbede3c4028d12f0134f23ff29314769c1a
 DIST glog-0.6.0.tar.gz 193267 BLAKE2B b42112cdfd54280ce7a9592c3af6b6e10dcb854fe9dbe0db7445c60801d1c12a240c4b3709b45e41aedeb8876d2e08fc3368296e088be6a66126858888cc274e SHA512 fd2c42583d0dd72c790a8cf888f328a64447c5fb9d99b2e2a3833d70c102cb0eb9ae874632c2732424cc86216c8a076a3e24b23a793eaddb5da8a1dc52ba9226
+DIST glog-0.7.1.tar.gz 182681 BLAKE2B d8bf2d4285e3be17a151d1f6f63dedbac9d5dd6667983d37e4b591be49751b6982abff7802dcd2c42651360d354c6c8ab1cc03c216ed1a3f7ba5cfb6a1a60dbf SHA512 2dabac87d44e4fe58beceb31b22be732b47df84c22f1af8c0e7d0f262de939889de1f16025c1256539f2833ef3393bc92034e983aa2886752bb8705801a68630
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/files/glog-0.6.0-cmake-4.patch b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/files/glog-0.6.0-cmake-4.patch
new file mode 100644
index 00000000000..0f17e373e2e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/files/glog-0.6.0-cmake-4.patch
@@ -0,0 +1,18 @@
+https://bugs.gentoo.org/954083
+https://github.com/google/glog/commit/3411d58669fe07e70335b252299432a00d1e7c6c
+
+From 3411d58669fe07e70335b252299432a00d1e7c6c Mon Sep 17 00:00:00 2001
+From: Sergiu Deitsch <sergiu.deitsch@gmail.com>
+Date: Thu, 5 Oct 2023 00:48:10 +0200
+Subject: [PATCH] cmake: eliminate deprecation warning
+
+--- a/cmake/GetCacheVariables.cmake
++++ b/cmake/GetCacheVariables.cmake
+@@ -1,5 +1,5 @@
+ cmake_policy (PUSH)
+-cmake_policy (VERSION 3.3)
++cmake_policy (VERSION 3.16...3.27)
+ 
+ include (CMakeParseArguments)
+ 
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0-r1.ebuild
new file mode 100644
index 00000000000..fca47051d4d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0-r1.ebuild
@@ -0,0 +1,64 @@
+# Copyright 2011-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib
+
+DESCRIPTION="Google Logging library"
+HOMEPAGE="https://github.com/google/glog"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/google/glog"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/google/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+LICENSE="BSD"
+SLOT="0/1"
+IUSE="gflags +libunwind llvm-libunwind test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	gflags? ( dev-cpp/gflags:=[${MULTILIB_USEDEP}] )
+	libunwind? (
+		llvm-libunwind? ( llvm-runtimes/libunwind:=[${MULTILIB_USEDEP}] )
+		!llvm-libunwind? ( sys-libs/libunwind:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-cpp/gtest-1.8.0[${MULTILIB_USEDEP}] )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.6.0-cmake-4.patch
+)
+
+src_configure() {
+	local mycmakeargs=(
+		-DBUILD_TESTING=$(usex test ON OFF)
+		-DWITH_GFLAGS=$(usex gflags ON OFF)
+		-DWITH_GTEST=$(usex test ON OFF)
+		-DWITH_UNWIND=$(usex libunwind ON OFF)
+	)
+
+	cmake-multilib_src_configure
+}
+
+src_test() {
+	# Tests have a history of being brittle: bug #863599
+	CMAKE_SKIP_TESTS=(
+		logging
+		stacktrace
+		symbolize
+		log_severity_conversion
+		includes_vlog_is_on
+		includes_raw_logging
+	)
+
+	cmake-multilib_src_test -j1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.7.1.ebuild
new file mode 100644
index 00000000000..478208ff707
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.7.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 2011-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib
+
+DESCRIPTION="Google Logging library"
+HOMEPAGE="https://github.com/google/glog"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/google/glog"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/google/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+LICENSE="BSD"
+SLOT="0/2"
+IUSE="gflags +libunwind llvm-libunwind test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	gflags? ( dev-cpp/gflags:=[${MULTILIB_USEDEP}] )
+	libunwind? (
+		llvm-libunwind? ( llvm-runtimes/libunwind:=[${MULTILIB_USEDEP}] )
+		!llvm-libunwind? ( sys-libs/libunwind:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-cpp/gtest-1.8.0[${MULTILIB_USEDEP}] )
+"
+
+src_configure() {
+	local mycmakeargs=(
+		-DBUILD_TESTING=$(usex test ON OFF)
+		-DWITH_GFLAGS=$(usex gflags ON OFF)
+		-DWITH_GTEST=$(usex test ON OFF)
+		-DWITH_UNWIND=$(usex libunwind ON OFF)
+	)
+
+	cmake-multilib_src_configure
+}
+
+src_test() {
+	# Tests have a history of being brittle: bug #863599
+	CMAKE_SKIP_TESTS=(
+		logging
+		stacktrace
+		symbolize
+		log_severity_conversion
+		includes_vlog_is_on
+		includes_raw_logging
+	)
+
+	cmake-multilib_src_test -j1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index 12e9aee5405..edfef27a1d7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,6 +1,10 @@
 DIST sqlite-doc-3460100.zip 10851427 BLAKE2B 7462e83ca84e3e9aac7236f575fd2bdddac7744ae700a63fe8fdc9d2df3157c59fd374d99a0526bd4d9f742005ee7a90f3d78057861d3c3fcba9f897630e48db SHA512 1ad7dfc938d182f69ea9367b4f5ead1d48b991626521249e8b58c9fb4c2553e348ce402de9cc81b0ad699d4c45c467de56a98ee39f9c3555c6fafff15fba41ce
 DIST sqlite-doc-3470200.zip 10957830 BLAKE2B cbc40dd440d1c5af4ad4333090a7306bd54ec43250a478b6900b8f74bd721035018ea7647f3a208d42cc0639827325be26a9412d17af7d390f4e584d4c6acf44 SHA512 48349d512b7cd9bc6f6a5da3a2b2285de159d4653667311adb0f5e6a970060db940a590c2d01b529afc1614065b22434d5b3ac4d8d0122d003d74926745ba56e
 DIST sqlite-doc-3490100.zip 11333315 BLAKE2B 28fe302820898861e404f5c6dd1c05c3ff3ff10a8b713604f0ccec6b21ca7b82d61ba720903d7e9d8e9ec5de701900c5972037c23627ddd1a2734e95a92c5d6a SHA512 0eb6af0483bca7f6efd6baf00210adcca1d23ea5b474728aa96614a93a868ec6f9257d9b5f29c452fed5323c64fc180ee3845695ddbbcd7836dac69aecdfc833
+DIST sqlite-doc-3490200.zip 11340124 BLAKE2B 56c1456f5720ee98553350790232d043caf197ed6b47bee57405561180513db7ed60c517dd9e86c80aced2a630dd7ca4314a0546de39419fafaccd3d8bd14c52 SHA512 0ea707eb52d019f20157a5b5334340169981547b0714ed58912df932fb76dd0d2cabb6ed3afaefcda24e5477ccbc3cdc1fc81a761d792c06dbad3cc3928a3368
+DIST sqlite-doc-3500000.zip 11367399 BLAKE2B 3356bfc188a8827dbee655df559e0c12391e74d7d1a8afff47f19fd4e6136f30b8eaf43ad1a51da39b9e8e4259e24dc5c4f976d96ea5be008219b4caa48cd105 SHA512 bc385c3d47f738547eac353d78121076bc188cb972b78b5ef8176da91e7c325e99111ebdd80f93538254562281113a527bbfbcd687923874291f19481980cb22
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
+DIST sqlite-src-3490200.zip 14377708 BLAKE2B b455388c3c9d0424b7f36b5ab41b7506f524d35c015205eaf164a62494061a308ed419cb75cde6f5c1011a724274980675e4958a9a24d025c7a94ba8f9a13551 SHA512 d07600391df9fd635b1d43cff208021450a18cedad67221e239b0ed86ef287f2f31c040ac413c8a69123615f01658b68f26b6e70a71da39be3ead372a13c8bdc
+DIST sqlite-src-3500000.zip 14387288 BLAKE2B 9df808ca2e754d8196c19bba3eca370b7675edb89c1fe3bce4d50f848132a5a67079ef6bfceef44fafc7f96f2ded495416093dcda821ea64e06b04b81f3678f1 SHA512 d1b14906011c22bdb1a77e2668aceb42ea912047d8c6358e68fd4097cdaf1dc932ad47f3e621b5242c0c30366a1ecea26c170cd21ff4153d4f0c91d4b9c9eb14
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild
new file mode 100644
index 00000000000..edfe015e6fd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.2.ebuild
@@ -0,0 +1,446 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+	# https://sqlite.org/forum/forumpost/f93323a743
+	"${FILESDIR}"/${PN}-3.49.0-icu-tests.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.0.ebuild
new file mode 100644
index 00000000000..b1a38b74238
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.0.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-16.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-16.2-r2.ebuild
index e3015bdaa8c..606e48ef822 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-16.2-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-16.2-r2.ebuild
@@ -79,7 +79,7 @@ LICENSE="GPL-3+ LGPL-2.1+"
 SLOT="0"
 IUSE="babeltrace cet debuginfod guile lzma multitarget nls +python rocm +server sim source-highlight test vanilla xml xxhash zstd"
 if [[ -n ${REGULAR_RELEASE} ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 fi
 REQUIRED_USE="
 	guile? ( ${GUILE_REQUIRED_USE} )
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
index c236d38e10a..a1cd9e7d10d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
@@ -2,3 +2,5 @@ DIST strace-6.13.tar.xz 2642452 BLAKE2B cdac801dc5b0fe9c165d9d99a41e51aacf13e8bd
 DIST strace-6.13.tar.xz.asc 801 BLAKE2B 508286a008213e2bd3e0cba6c339a61abae1460f0f71b885c7bef480431bdf5e190a2cb3e44d236019ed54d3bf3a257ebb94e2161971abe0648f685e7849e3bd SHA512 a59e4aeff491ad62603b0591653e7da5e8a4ef0fedcf2faad3f485993b37b738c0809cefa5753ab7d1b85f3b6c87b423b6416dea36def65e220548ee0b4afb46
 DIST strace-6.14.tar.xz 2650972 BLAKE2B 940bb7d54c29e8f22dcf67e617e8a664a7147bb96538b3a8a680698fa33f528d6082fb9c9d7eda9540e7730fa0f7d88aafbead4cccd8844ca687e2e4a1c8a7d2 SHA512 2a18dbfddb054dc7845fa6645d194297c6fe7d67607f812198e712b8b1f75d6e99e9e19587e9ad799e9566d7a558e2d64fe216a61456d5c3f23dfa2e42e3b412
 DIST strace-6.14.tar.xz.asc 801 BLAKE2B d25bc4e4164861c258da9037579603f5cfbfc45ee75c172fa90783d3ef9bfb743690b50bb6a6350f24937aa4cb4d87ea63e05f48d081c07ac45f0796486bb733 SHA512 8c107df8bedd2a9574e390e4bb576062681a5137bb48efbdb9ed2f9229871ffc847936b5e2341e335702601feba3a0935b9cc22a316607b5e32858b5cbcb0fd8
+DIST strace-6.15.tar.xz 2662388 BLAKE2B 73bac2016b3a92e88c1bfcdf4b0ce7a273c07554e61c1ba59d5b7c27f219ea0fc0f976413a26cf34e512739d0275e702dab280dd73d6124a4eabe67c6d8d0109 SHA512 5bb21b55d52aab6883821d4aea9449138d5efafac99f72b3831de710ed1ece11bb4a21b16fab97d772397213f43d06072e1d467ae03c38198ead0e65ddcd6ab5
+DIST strace-6.15.tar.xz.asc 801 BLAKE2B 08eb7aac938ab8f0fbb1f37b3072a3243b4a97e9206d2f6e23202d1494a0917e061a814a1a55cec5264dd828dbc2480a9ed63cc8b55fe68945d00a52c85e5bbf SHA512 c2c0098d9b415950c6f0591e2b8c59b96bb929df9270f5e256078d27e93b791f3bca2bf52f36d8ddf3b7354e711a94b4588b78a94da3327a35777c859808d993
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
index c7ff39d3ba9..9f4936a52d4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
@@ -16,7 +16,7 @@ else
 		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
 		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.15.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.15.ebuild
new file mode 100644
index 00000000000..196f558d280
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.15.ebuild
@@ -0,0 +1,120 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
+
+DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
+HOMEPAGE="https://strace.io/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/strace/strace.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
+LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
+SLOT="0"
+IUSE="aio perl selinux static test unwind elfutils"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="?? ( unwind elfutils )"
+
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
+LIB_DEPEND="
+	unwind? ( sys-libs/libunwind[static-libs(+)] )
+	elfutils? ( dev-libs/elfutils[static-libs(+)] )
+	selinux? ( sys-libs/libselinux[static-libs(+)] )
+"
+# strace only uses the header from libaio to decode structs
+DEPEND="
+	static? ( ${LIB_DEPEND} )
+	aio? ( >=dev-libs/libaio-0.3.106 )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	perl? ( dev-lang/perl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-6.5-static.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ! -e configure ]] ; then
+		# git generation
+		sed /autoreconf/d -i bootstrap || die
+		edo ./bootstrap
+		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
+	fi
+
+	eautoreconf
+
+	# Stub out the -k test since it's known to be flaky. bug #545812
+	sed -i '1iexit 77' tests*/strace-k.test || die
+}
+
+src_configure() {
+	# Set up the default build settings, and then use the names strace expects.
+	tc-export_build_env BUILD_{CC,CPP}
+	local v bv
+	for v in CC CPP {C,CPP,LD}FLAGS ; do
+		bv="BUILD_${v}"
+		export "${v}_FOR_BUILD=${!bv}"
+	done
+
+	filter-lfs-flags # configure handles this sanely
+
+	export ac_cv_header_libaio_h=$(usex aio)
+	use elibc_musl && export ac_cv_header_stdc=no
+
+	local myeconfargs=(
+		--disable-gcc-Werror
+
+		# Don't require mpers support on non-multilib systems. #649560
+		--enable-mpers=check
+
+		# We don't want to pin to exact linux-headers versions (bug #950309)
+		--enable-bundled=yes
+
+		$(use_enable static)
+		$(use_with unwind libunwind)
+		$(use_with elfutils libdw)
+		$(use_with selinux libselinux)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if has usersandbox ${FEATURES} ; then
+		# bug #643044
+		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
+		return 0
+	fi
+
+	default
+}
+
+src_install() {
+	default
+
+	if use perl ; then
+		exeinto /usr/bin
+		doexe src/strace-graph
+	fi
+
+	dodoc CREDITS
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.6.ebuild
index bcac703061a..bfe8fa04997 100644
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.6.ebuild
@@ -12,7 +12,7 @@ SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/dev-go/${PN}/${P}-deps.ta
 
 LICENSE="BSD-2 MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
 
 src_compile() {
 	emake build
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index 23d57986ce3..96be497e402 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,2 +1,2 @@
-DIST go1.23.8.src.tar.gz 28182772 BLAKE2B 568b9fcc7ed12cb19e10b458fc1890a5977c97660657e9eb7c171aa16382f6790a78cb87df99ed72ec18d5ff1654ee4d15a4d603332ad0812ee97f6500866198 SHA512 8e352a01484c168894026080ee4501180e327d734fb3d892ab17daac193964fcd5fd90033c9cf86d6ffe8b7e4da64bda83ba4501a6c05919bcefbe9e2467c771
-DIST go1.24.2.src.tar.gz 30787666 BLAKE2B bb5f998a87e6527def304347b854c4addb0860a03da82e711f60e2af460bd43c36273b25126c643a679ae22fca226e6a4fc5ba55967d21965ffdc8f564781e35 SHA512 6366a32f6678e7908b138f62dafeed96f7144b3b93505e75fba374b33727da8b1d087c1f979f493382b319758ebfcbeb30e9d7dadcb2923b628c8abe7db41c6f
+DIST go1.23.9.src.tar.gz 28182928 BLAKE2B fe1038bb32982c4b2032e4a2a9aa533e7ff648337107581b905e484ae9cbbb8bb4e6d8b5b6041f06dd9b25b47c271e9240d6b329813d7777736fc9a33538a381 SHA512 0f80680caabbf50a4f55555d0515530c55e297f38bf193a9da531e640f069719e3c7a5670b72f7629fada8162f978305ae1e4e6398369b8021cfe6dc9157254a
+DIST go1.24.3.src.tar.gz 30789282 BLAKE2B b9ddb484900129f2b916c224ce30b59fdd14ed396f92b8935baa775e9574c5970494d8e612b60c675f699a73683781dfa9802a4c3906f5cc112b9de8ea83154f SHA512 05d19372fb923eeea19395b4de569d2ecfec7fadf2d8236d47cd667982de51c569e9816372cb79e32166553f9bcbe68f7bc2a6ded5655809b1caf5bd941011e7
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
index e51a36bbc3d..3c89d598512 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
@@ -35,9 +35,6 @@ LICENSE="BSD"
 SLOT="0/${PV}"
 IUSE="cpu_flags_x86_sse2"
 
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
 BDEPEND="|| (
 		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
 		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
@@ -76,6 +73,7 @@ go_cross_compile() {
 
 PATCHES=(
 	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
+	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
 	"${FILESDIR}"/go-never-download-newer-toolchains.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild
deleted file mode 100644
index be97c056577..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r2.ebuild
+++ /dev/null
@@ -1,133 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-vgetrandom.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
index 423eda182b2..f3fe286ef7a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
@@ -31,9 +31,6 @@ LICENSE="BSD"
 SLOT="0/${PV}"
 IUSE="cpu_flags_x86_sse2"
 
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
 BDEPEND="|| (
 		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
 		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
@@ -72,6 +69,7 @@ go_cross_compile() {
 
 PATCHES=(
 	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
+	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
 	"${FILESDIR}"/go-never-download-newer-toolchains.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 08ea74a5f17..edb2a99ff2c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -8,17 +8,24 @@ DIST Python-3.12.10.tar.xz 20520960 BLAKE2B f05805da36958e3ebb68c69353e8119b20ee
 DIST Python-3.12.10.tar.xz.asc 963 BLAKE2B 45e1ec67311d1ac5679cb5a05b92e61f3e5e6e9d3ffa5462c09c2aa066fda7ea915df13f6e5ad33aa924f6ce1f18e2d78a31af15412a10c093fc8a5b536c5133 SHA512 7edfa6fd816cf2a052abdb775d464e2f389105ed3e782cacf90805613aaca54bf71308504a5336ee1204e872e7db28df32413fb10b057056b0d5cb3c7a20a9f1
 DIST Python-3.13.3.tar.xz 22654240 BLAKE2B 24ac47c13cbfa4dc9ce6ae4d18d7b5310f83ac1f4f18722138ef07e01cb8ac37edf6f4301983cb468f533b9b475b5a9d761d3044e61c7ccaa99dceadb954fe34 SHA512 f7559b6dceae69f48742af0a6497fbec42cd1e5304f64b6eb9d89222a1171ccf12fa186cc0decabb4e98d05223184967a4a7537754c01083dacdc9073cb1a578
 DIST Python-3.13.3.tar.xz.asc 963 BLAKE2B 4a98965305b80e985512f54d9ce8ab88a74fe0d3ee48e300fbc2b4e251c0f499f4eb935e0aeb6d5ad8262338643325126f094fff926da1e2b9a2b3a2247701dc SHA512 54f8da5f4a4dcadc9830cb07aecf695a26a2de48ab98e1f42b09fdde1c70989476d07ce7ea81337216f1e5fcbf6b688e0608c88a2545ced416b01640108e94db
-DIST Python-3.14.0a7.tar.xz 23015952 BLAKE2B f12039695a3a7fdd6352adfca803bad066af3b320159faa1d85bdd914732e8170bc2494427151fad140d699db13645066fa41d8e74dc697226957e793a6305ef SHA512 f7e50c201cb1bbc4779d898e65408147637de7b9d9d85a2e6ad4f8dda758ec150dfb95ee1f12c686a3f46c29a986a75b45323bcbab87b81b319d91236989f6b0
-DIST Python-3.14.0a7.tar.xz.sigstore 4795 BLAKE2B ba10cb295cc4ca7eb41783fad9a85994c0ccf53983b19a73afbf32739248d9dd2282e998c15223d45259b780d6b7de25f418563a9c2e6fc2ef4f0d12290de539 SHA512 daee7d607851092e1c8e7b05b5419e464b8d2c4d65a746a206838709d612412680362c9adb3c67751641893e945e2f6b06b4e6e235e7b18ec4a208af9633525a
+DIST Python-3.14.0b2.tar.xz 23579860 BLAKE2B bf5ebac54531a7c837e7650754264b4be28e28613d488d1c7546db77e2ef3b501ff646d7fb505c6ac0fa1381c3230d1c1899bc82144f369339c89687b5dc7f5c SHA512 cdd37f8a982e6194d5afa80a2eb94c899080809749d59a50a2ce3eed37f720a1fd9a7977f0dd3992650d173a7070b15610077d97cb499bd16a7500c56ef1f8dd
+DIST Python-3.14.0b2.tar.xz.sigstore 5131 BLAKE2B 04cab57a4da63f5abf28db94e5fd952206124ce37ef5a5d981839a0790881c9c4ea6d186f233eaaf6e82350bdfdbb0048d761b816d81eaba71c707bd9714a9d9 SHA512 a356037824fbde5950f197cf04f0d71ddaf4b68006b2ab9951f9b4c2df508e84bd0bec7d72051e75d22c17eee767e46e5d2c167e853fb941b0831cb26d518fdc
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.22.tar.xz 19652572 BLAKE2B 59f2d2cecde8179064115b52205c2195b26cd0f37aec3e88b0fe2a1a7893a7df8ae38a024814d42064d5e4916e4054a76dddeec0a0dcf29af576d52dbcf65f4c SHA512 c5a76c579455626bf40bb41ee99cab6e444aa5d5085dab7cf622c70ded750e31710c2c30f032917f0d4069350c01a889ed9831d77fcc2d52fcec54055dd07496
 DIST Python-3.9.22.tar.xz.asc 833 BLAKE2B 2bc75d7e39ebee63b8cfd9ee1af2941bc0bd659becf89d291ea33f5baea2b606a34841c7ac5c597eac51b19602cf24ccec123964a1022d43fd251553fb3f90f7 SHA512 9a04fcf7d7fc0521873d29efad3a80a9ff63df4fc4fe4108059246db6517b22d967f4d4e0eebb32c79417f66ee3b60fe00428be155fc1cbea163aa36c1a3ddee
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.17.tar.xz 28784 BLAKE2B 7f1c1f9f49876b99d80a3f40b66061ab96796821e1a5396f5edfa08e3878b8b9970688d3c861d9c5d08701a8850584eb87a223e3ba84c5536ae689f59145ad43 SHA512 3e89b334d81702f0e6fa00e9b70daf6ff4df439c280c6cff33aa8874dde29f63d809697757df39daea07bf746207e931f211558811c9e731df9ca846a8559483
+DIST python-gentoo-patches-3.10.17_p1.tar.xz 34900 BLAKE2B 8931746997a71f45a08eb3b75d3b65a23ec2d6e3d5e1e617f2183efd7d91c3874ff5dfb3f39cb54c3e238ebfd5fe6b3b9d470ac41ccd71d6d9db485d52d205a0 SHA512 c4c9753cca98c4626744b3c5092b984ee06a4c8505a1ea58567ce155d93fd3985428544f2a53c00db848106a4b67875452c879b67e33b1d63d336ad31ec4e4ea
+DIST python-gentoo-patches-3.11.11.tar.xz 10604 BLAKE2B 6be4c66b0458f7a7085aef976cff3dcb4d114ac0b64fb27327a5693e8d41a77f7eeed718b9c5a1b1961278235ee4cd43497aa3dc27e6e6bed65804b95f667a15 SHA512 ab8113a94949cead34d976179f80c3e0a6686bf2476079a74f97b4d08c24a237500dc7ee09dc3b0ec98d2fbcb138397c73d7e2252e617a957a13999e59115158
 DIST python-gentoo-patches-3.11.12.tar.xz 15616 BLAKE2B 5d4a47058fc35c4ae966e3dff823f91129852bf81cd586d5b3a34a6daf672732918daf00199394f2f982411ec30a291f45bba55b3ffa3d96a179ecd600ea4647 SHA512 77973ef88403f94d55162e0138cd29b4d8959a8fcf4cec730daf7ddd8fb4a3acfcd0dd1fdaacbdd2b218bd15f6c6715ce339df4eba48227d17520243d96eeb39
+DIST python-gentoo-patches-3.11.12_p1.tar.xz 22192 BLAKE2B 2d7f39d1d55428e5dc617a796a3147046c0549bd8fc26a1d3b2701ca2ab17a4cc990b8fed925a7b8d7c410b12f4c22e14f9e64d7ea4b2c387c919570abad259f SHA512 363b049824b520b92541569d315e4e67192f3bd915f44f600acc51858ae3960b0060222cab2612f9aef53c7b2a0e323d197e107c9bcbdc4625572303d6393a5c
 DIST python-gentoo-patches-3.12.10.tar.xz 10744 BLAKE2B 2abf4874018156d6735cf8604c410dc4726ac9365bc7500abe6b82472aad100aac7268957256692f4275b02965773e58178519ed8038e121f1ffa3c53770d238 SHA512 62066405aa00f46f9645e9c747d53bb93bf510fc791d14d49e00edfd79981778e6c8e07bfa7bac88d76407a0ffd8f7321dea89f81d90b01dbf13f4d381b6a1a3
+DIST python-gentoo-patches-3.12.10_p1.tar.xz 17356 BLAKE2B 9a87b3a6f04977067cb0ce126e45c9d584145bc9cf1d43e46e7ae5e295a14d69b07b6e20c18bff74d02f0e6c3617e8c1ff015097be32cb7dc76ae45ab71d1a41 SHA512 d98f27176d3ea2532c2f8c0a2eadf23f1f0b305e08bbbfd12acfae7308070d70a8d3c3eb60fe157f4ff51cb6302bea5882d75f6a8028310c95309aed3bdaddb5
 DIST python-gentoo-patches-3.13.3.tar.xz 8336 BLAKE2B 66393886fbd034eb14732e4f81f5798e77650ea3fe1c4f8176bd93808b711c8977a53c3f52be6c9b97a368299258b851d9bdb6d4c8e0c75695c6aea784d48b44 SHA512 c1ed31d6aaef81addf786c2ccc1013309b122b791c42fe10e467a677d0db8f149e8b1cc21928c146298918c7ceb851b4b19d1e59f491cb161004e1c9386db289
-DIST python-gentoo-patches-3.14.0a7.tar.xz 5680 BLAKE2B 72fdb5debdcae47143724a100736272994298f4b9c7c4954a1a506b247b93fc06f5dc25140c0fd1f5fdc9110d41b93d33451e11fa07219d394728f987324d7b5 SHA512 e4091ff450bf1ba328961c6e9fbfea233ba8027ded4682355129a67767827080ec2cf23995f7fde9517bc65fbc135820bf89578bdccd539e4559c7944345d15a
+DIST python-gentoo-patches-3.13.3_p1.tar.xz 15164 BLAKE2B 56420b8d051fbf3eb47f2bce08c79f167b9fbaa89f8ee932e3db27ea08a191f042e1f0114c1377c8210060332141b36eb1d582507185c983297a1d61573aa435 SHA512 1e138be3ef5c03e4d0b520aa736cdec44daf2956a931f4080e53b0652ebefa48095cad837e7bae4cc90bd42fbb7aba6f25c61e3c880ca1a581a745744b011fa3
+DIST python-gentoo-patches-3.14.0b1.tar.xz 5680 BLAKE2B 514b3edc3025e5bf675d371b5ada17dea426856edf1fb6095c2ee400eae95bd4265ef81fe593ae9338e801e7d0a25b1d5ba2d05ca563fd9dd020114b13575746 SHA512 74289e42cf532b54bb1b66a283ec19156f8a36ba38764209c133842314c9efb2ce2ebcba5aa9213bcf7fc0c8a5ca9b6e7adbd5dbfa4397233136d7cd55f53ee7
+DIST python-gentoo-patches-3.14.0b2.tar.xz 6168 BLAKE2B ecf2fd981efc289fbc16d615c6e69ad7a797bd6906e6f974ece47eace582d7c4b3ea0217b0df9575e522416df2749125ff3658d8aca6a53bf977d5f155dd6b90 SHA512 552ff5306ca43c89e65b1df42cb71753c7e900efc4be7e35150c187184a5e94241fea78bb9084831508fd4a7e71323be59c1565901560ec53fc076c3697baf34
 DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.22.tar.xz 35388 BLAKE2B b6acfa681bdb589f74094ea04bd053bfc122ef9f36b3413c33c352cfae4e101027b0348770b47b9fee769eaba8109406acb6418c1cb8c431fbc7cf1c69124dcb SHA512 335c32d696f9660c957dec0c9a54e2f04e34003d2dbb438e6c9e74ce0a6352b5849e8626397939e3ffa7dc3172ac88cfa2168dd0d120be306e8c898dc7b6b3dc
+DIST python-gentoo-patches-3.9.22_p1.tar.xz 41444 BLAKE2B 5c86c93203c50f5786017bb878e930fd2910184ec7de8ef22cf5f80853f952c143dd0d64f25d752e921d6f86db665aa6646d838e4c490d16186e095c67b58cba SHA512 471382690ff86dab6a247c2c0dad138d541d9091b0f30b3d58386a170022b5812aecc13c9751fdec3de715d810ee56d310be8c0005631845be7515247ca2443d
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
index 22ce986e067..ba2d5afe2fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/metadata.xml
@@ -26,6 +26,11 @@
 			by running Python's test suite and collecting statistics
 			based on its performance. This will take longer to build.
 		</flag>
+		<flag name="tail-call-interp">
+			Enable the tail call interpreter. May lead to better
+			performance but is still new and dependent on latest
+			toolchain versions (Clang 19, GCC 15).
+		</flag>
 		<flag name="valgrind">
 			Disable pymalloc when running under
 			<pkg>dev-debug/valgrind</pkg> is detected (may incur minor
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
index 21a3da35103..dd5e1696bcf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17-r1.ebuild
@@ -213,7 +213,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17_p1.ebuild
new file mode 100644
index 00000000000..86b8117a04d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17_p1.ebuild
@@ -0,0 +1,564 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-debug/valgrind )
+	test? ( app-arch/xz-utils )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
new file mode 100644
index 00000000000..e0ac0eb6a0f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
@@ -0,0 +1,553 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 multiprocessing pax-utils
+inherit prefix toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.10.17"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-debug/valgrind )
+	test? ( app-arch/xz-utils )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
index f0a1c419e83..378131678f9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
@@ -208,7 +208,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12_p1.ebuild
new file mode 100644
index 00000000000..5a0e3c8f589
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12_p1.ebuild
@@ -0,0 +1,617 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
new file mode 100644
index 00000000000..9edb7b83fe0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
@@ -0,0 +1,606 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.11.11"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
index 1bba7b9fc57..c1c5804b332 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
@@ -211,7 +211,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -398,9 +397,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10_p1.ebuild
new file mode 100644
index 00000000000..8f00cf2a81d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10_p1.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
new file mode 100644
index 00000000000..e8e9a8c6c86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
@@ -0,0 +1,600 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.12.10"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
index a02ac6833e5..41372672b7f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
@@ -244,7 +244,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -421,9 +420,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
index 72516043f5f..2a02ff9b8ea 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
@@ -246,7 +246,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -423,9 +422,7 @@ src_configure() {
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1-r100.ebuild
new file mode 100644
index 00000000000..41372672b7f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1-r100.ebuild
@@ -0,0 +1,636 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1.ebuild
new file mode 100644
index 00000000000..7546fdf4b52
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3_p1.ebuild
@@ -0,0 +1,631 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999-r100.ebuild
new file mode 100644
index 00000000000..6ac6b34b91d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999-r100.ebuild
@@ -0,0 +1,624 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-3.13.3"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER%t}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
new file mode 100644
index 00000000000..c245d8ce261
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
@@ -0,0 +1,619 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.13.3"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2-r100.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2-r100.ebuild
index eff6e9f28d1..ce2d5a0c348 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2-r100.ebuild
@@ -12,7 +12,7 @@ inherit autotools check-reqs flag-o-matic linux-info llvm-r1
 inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
 inherit verify-sig
 
-MY_PV=${PV/_alpha/a}
+MY_PV=${PV/_beta/b}
 MY_P="Python-${MY_PV%_p*}"
 PYVER="$(ver_cut 1-2)t"
 PATCHSET="python-gentoo-patches-${MY_PV}"
@@ -33,9 +33,10 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
 "
 REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
@@ -48,6 +49,7 @@ RESTRICT="!test? ( test )"
 RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
+	app-arch/zstd:=
 	>=dev-libs/expat-2.1:=
 	dev-libs/libffi:=
 	dev-libs/mpdecimal:=
@@ -93,7 +95,6 @@ BDEPEND="
 			llvm-core/llvm:${LLVM_SLOT}
 		')
 	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
 "
 RDEPEND+="
 	!build? ( app-misc/mime-types )
@@ -245,7 +246,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -419,12 +419,11 @@ src_configure() {
 		$(use_enable jit experimental-jit)
 		$(use_enable pgo optimizations)
 		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2.ebuild
index 53ffce4948b..16596b39675 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta2.ebuild
@@ -12,7 +12,7 @@ inherit autotools check-reqs flag-o-matic linux-info llvm-r1
 inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
 inherit verify-sig
 
-MY_PV=${PV/_alpha/a}
+MY_PV=${PV/_beta/b}
 MY_P="Python-${MY_PV%_p*}"
 PYVER=$(ver_cut 1-2)
 PATCHSET="python-gentoo-patches-${MY_PV}"
@@ -33,9 +33,10 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
 "
 REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
@@ -48,6 +49,7 @@ RESTRICT="!test? ( test )"
 RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
+	app-arch/zstd:=
 	>=dev-libs/expat-2.1:=
 	dev-libs/libffi:=
 	dev-libs/mpdecimal:=
@@ -93,7 +95,6 @@ BDEPEND="
 			llvm-core/llvm:${LLVM_SLOT}
 		')
 	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
 "
 RDEPEND+="
 	!build? ( app-misc/mime-types )
@@ -247,7 +248,6 @@ src_configure() {
 		local -x ac_cv_header_bluetooth_bluetooth_h=no
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
@@ -421,12 +421,11 @@ src_configure() {
 		$(use_enable jit experimental-jit)
 		$(use_enable pgo optimizations)
 		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
 		$(use_with valgrind)
 	)
 
-	# https://bugs.gentoo.org/700012
 	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
 		myeconfargs+=(
 			--with-lto
 		)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999-r100.ebuild
new file mode 100644
index 00000000000..a5e88fd3151
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999-r100.ebuild
@@ -0,0 +1,625 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-3.14.0b1"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER%t}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
new file mode 100644
index 00000000000..65194aeb14c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
@@ -0,0 +1,620 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.14.0b1"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
new file mode 100644
index 00000000000..e6af67d55aa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
@@ -0,0 +1,590 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 linux-info llvm-r1
+inherit multiprocessing pax-utils toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.14.0b1"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
index c6e038ea7cd..868acf645bd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
@@ -138,7 +138,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
index e8160fe107b..90d06175348 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
@@ -147,7 +147,6 @@ src_configure() {
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
 
-	append-flags -fwrapv
 	filter-flags -malign-double
 
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22_p1.ebuild
new file mode 100644
index 00000000000..5a397749c5c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22_p1.ebuild
@@ -0,0 +1,558 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
new file mode 100644
index 00000000000..5ff1e9b5d4f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
@@ -0,0 +1,547 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic git-r3 multiprocessing pax-utils
+inherit prefix toolchain-funcs
+
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-3.9.22"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+"
+EGIT_REPO_URI="https://github.com/python/cpython.git"
+EGIT_BRANCH=${PYVER}
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	git-r3_src_unpack
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index 5c83bf3aee4..7be42f0ed38 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -1,40 +1,3 @@
-DIST rust-1.71.1-aarch64-unknown-linux-gnu.tar.xz 209839296 BLAKE2B da65e966a6bd8c6a8a13e5ab747da2a8d9b55f90fc20c1bd041ccc1a2f4e2d11d50d2ed9cc7f3a470e7f886ec8b891ef98ea1295491414d5afeae7f83fa3a555 SHA512 a2ea1383a6ea965e4b0c3a7c648bb357fb531a6984418756abcff3c526ccd9221a28aeedd11b65180fd166575e07a00151460dbc15e3b132a0bcac643911d242
-DIST rust-1.71.1-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 52d1fbdba32db7ac2578615fd10a3db1da84441274bb190624e517aec67279c7330f7c6b7fa0835d8e1cd8f578d34952813228a6a221e41c4193e9a079cc6fb6 SHA512 63cbbdd9a73f0223444565b60f59765a734633ef8e93843639969b96fb67550b85fe58079d486a927174f95619f0d6fdfe3f3b84d871f776bc48986be7965238
-DIST rust-1.71.1-aarch64-unknown-linux-musl.tar.xz 193170880 BLAKE2B 26384119108f4503d35f79fc5401c46e1eee326eca4dc6cc282949d2f195928fda5d3bf56c0509b04fdaa3e7c3c47f4ba44b2b82a60b02f7bc520360b0433efe SHA512 3e79692cd4dba512516eb48970dc9711448c33e1d7a5ebe7c5fadaed7f053ae9c1a8e6efcd1713f87dd84107a37b0fb21b1246e0d5c3e0dab677e5c7ed210825
-DIST rust-1.71.1-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 223d21586b07645d5860a3a023f42a191fc2490ad9e5736c3b2335565227780aa1f87174060cd6f87c4c873b965bb32b1556fb60fe70a7dc0f753409adabb024 SHA512 197197752e5ce110a1a96ecab8d1ae3aa82769a199c51b42a14b1f0749045a280f00aea0dd0653211bb941b80fbf43960d1e11766cf2dc35be3a34445e336423
-DIST rust-1.71.1-arm-unknown-linux-gnueabi.tar.xz 173870064 BLAKE2B 3c2e440e22199e081f6121513cf2a86b22ba0da08569d0b95edd1a69d890e191bda150429f4329c9932d45c44d49e8dfe1902513bb379b039dabfeb8bca36a44 SHA512 c59b1ba5d8bc29a2d1bb57f19e584af28ac92d8bbf889b80d443684e09a6249453bea429226078c9ffcc4d04a7a03f3605d82e3d8b412ca83720cabf5595a8e5
-DIST rust-1.71.1-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B 38a5fe9e5e67298909d6a36e625b990128649975d47e544847a2d6067ff88fa63cc0c3e1c8e2c8697f0a0f39584b4e60cb8f29390cc6abad721c681a4cf183e2 SHA512 a7230aa7f507e5e4d71d2701fd5c1abe29e3c53109d67a5133fc32ea32018c6ea6dfe512a0e58acfa8d2c39dbaeee2cafe420aef4979e95ce9d62b7520b9b01c
-DIST rust-1.71.1-arm-unknown-linux-gnueabihf.tar.xz 174277632 BLAKE2B c317f946f4fa7b4e5c4e39bf4035108ff1a6085420f932eaa532cb89f15babf4b80a5c231f9980300d4ea18b6dd369bcda33bdceeb7065b03fdde41a01165e76 SHA512 ff4b6ac0e6691820f525a84505a3556a729cb189700209c084e9fe981bd076ad7ec30fb748666b7f51ee901ac039d596670bf782c60018590980ff1e61cd396b
-DIST rust-1.71.1-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 2fa6e24ac4cd9ec4772655c5e8b135a0118c38ebb41462940669df0c65c0091e60306a5a09cb020dcdaf06aca7b2c8cdff904dd2a5f4ca87acfbc5775adf2b6c SHA512 c9cf9c1f8e19fe0576dd805f21ed8afd1d3536fa8ba00fcd39d6e6638198fca51114a8d99cd62164d8a0aee6bdf37831e678f08241fb8ba63ccdd6e8c7225717
-DIST rust-1.71.1-armv7-unknown-linux-gnueabihf.tar.xz 178239136 BLAKE2B ae0ca46260aa4bb60760812f50e606ecc18fc14b3dfa56135cb6a83249c0cd5e0544d29ef5eb34d3ce45e53552f736c8db2928b3d65d847a9b3d61be7e863ee2 SHA512 56c63d4e9dd99ba3604bec5c0f0d8c2a51a93c0d11beed721d99cca05b20310f4439c049ee5b3ddb6e723381e315ac991d9a7327cea86e852b6cfca4cc7f9a0d
-DIST rust-1.71.1-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B d5cea850a1930a316574c977542e7026eed67dc244d8857c720d9de168f39b5437912634cd5ebefb63e8d58200e7b11d69b8c6ea0e257642a0df7c1ae8026c80 SHA512 2d06f90f916e4f184d536b695d123628a28f452ad4fb3da53dd3fcf5e013df594e8ee6eb1819268bc5b20ceb1c05d6d3b68a4021e60c73c7da934fc05014d2c1
-DIST rust-1.71.1-i686-unknown-linux-gnu.tar.xz 202188608 BLAKE2B 153f94771d68ab8bc25d1e38afea206cdd182a1ca0b7ea8616b932617c2368acaffda959ce3220506d7b2601b5120ce65ab83fbef167429b1b8a76108f3137b6 SHA512 e835354cee992f751d994943718d8908bc687a540b91b4b296962ceb0047d447e5b12a7cfc6661de8a4ee9c90722f8274c3e6a37f6842e8012f883cff32ac2aa
-DIST rust-1.71.1-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d2e47ce2eaf7d8c16a12630778cffb25fdbbe23d978ff46d02fb6363f6ce45a6295cb948f7b20c9a966d14f832a38e3c53018188b54fcfaac7b2df85508990a9 SHA512 2e5d191ba550965de6962c595c5dd063f96603522eff467433f3cffb31539e3406c1a62e3fd37a66c4eeaff2c1200a33439c6ca5133dc00930c89c7713ecb0ee
-DIST rust-1.71.1-loongarch64-unknown-linux-gnu.tar.xz 158000652 BLAKE2B 6ca5a251202330755f53eff6151abb724cbfbdf190e19d15df009e33cb17795b74a491e8a6c040ea69fcb603d19b7baf6f1f47afb5a984bcbb6239640748e003 SHA512 be33401e6f02669102e51524ecb2a4bcb75a539084ed0e04f80bd389be8432a7f3952304b21397fc1d6894d86a263da40831625a04b72536dd2af79b0d2e1845
-DIST rust-1.71.1-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 5b744b2bd11ff69ac0c66af93a80c0c9f4d6aec465109033a8ffc63d2a1a8bb0e9cde1d3e9aa65e27287105673230acd07511e58112b7c5beb0c452323cea72a SHA512 a5d71f2555bfda22c0366a35032ab902071e3c75e781d1b1c5d090b6b6dac78046b31b789f71f9ed4adf80523903add324c1eb8e8f8a7b744d6a7d8cc6d3be68
-DIST rust-1.71.1-mips-unknown-linux-gnu.tar.xz 152451900 BLAKE2B 86804480dec985aecedec561707ce7dd2dff5e85b25da940051c2d89ae905b630ed7bb0df9e9bf6373917c5f6f513049b8be4b0b673d7c0dd77d8095700e6103 SHA512 0d3069e17c23e6651bc6dc2f7dd4de6b5b54e24ade5aa81a8ddbaa5f4f13c26084c3a04d246181d49fbb15cedede2a5d8f3e4a21080654a257c1b4285dcdef27
-DIST rust-1.71.1-mips-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 217ca15420e4ccce2ea287913eaee07b90a1ec534a805b899032a8ba18f7b6a75feba873b8fa773efef32cbb0b265da08ff026e6d387c824e63000b04e7419b5 SHA512 2e0355d8364a9e6b711012fc8e1f227c76290804d967def666ae30e899f52197da06dc1498191f6b9de6868730eb8883ca0849351981efd82a5b9d12da9681d0
-DIST rust-1.71.1-mips64-unknown-linux-gnuabi64.tar.xz 150685836 BLAKE2B 90496f5f9b3af09d9da3b45913a57ac2b1035838cf4940d3a6d4c2fb6bd1c5dacc86b144e8be851a35bcce19100ed2cc800d840c3182b01ea1954353060d56d4 SHA512 af97988af615c7cfe08db0424169cb133f97914fcc75a76356ae3b0eeac2c8eed436208694d218a75879db163963d87523d23d6ce5ccc91688679950536c13df
-DIST rust-1.71.1-mips64-unknown-linux-gnuabi64.tar.xz.asc 801 BLAKE2B 04665afa887c047d2e888ee4275faab1efda5f7dbeb4222c056af53c756a00ccfa5cd0f5a792df4bff325cb870f50ce6cb09e713afeeec201050eaa14dd6b0da SHA512 560d1e474e177cdc28cf94b10f72785ccc0db748a185b5bee8ab0c9598d3ef7152f79bffa7f11594be06ae07c3d56bc8176bfbd40284a6888d20e77bd036b9e6
-DIST rust-1.71.1-mips64el-unknown-linux-gnuabi64.tar.xz 153800316 BLAKE2B 63787c2fd44406d45de5f153259237df8116aa5419d241c92c5e9509db1fdea6fbfa0b119bca83cbc23a2abdfd50365de7c7e3f37bb0f7d402382657c97ad226 SHA512 a6c8399f2f4e56340d1712c71f03ac87ecb8f3694f0c4f1ce64a1f810de850f5ece7361cd93e8881d83cea2094a82a51f0d54cb795c4d02a5a1d94ed49b8f0cf
-DIST rust-1.71.1-mips64el-unknown-linux-gnuabi64.tar.xz.asc 801 BLAKE2B b69e13a4dd21447d7a39c24f96e9416c7b68bdb4af08c1ee7e312d78d2b064d1d67e397c0f04f9f8c68498ff3934350729021c9a4ee521967bdb63f53ab08c17 SHA512 9bcf27125cdf776719c87adb2947b1b9965dd3dcb231293a225e2424906e759f97ce2972d2f7ecaf69d708266303b8dc776c3e119c070e1c21ef59fb90405050
-DIST rust-1.71.1-mipsel-unknown-linux-gnu.tar.xz 155924032 BLAKE2B a4862cfd02053dc8303de9158929da634980c15d8fe32b7b51b316e6aa83de1f0d075ea4acd250d5bb210cb269bff373613bd45eba003f38439e22831b433dc2 SHA512 96708e1481c4790d5c2938ce7664cf83c2b9295023af017345ab0c9afa37bd43c2db93b9e8097d8d1aa6c913bab0db9324f057ecb25aa65bc16295cc625f2bdd
-DIST rust-1.71.1-mipsel-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 90063d27ffb9071f6c10cc54d17073ea79436dab947b7f8f0a8f2d7c0671edc66f7e45d5954af77f30f8c3a005d2951af56f129d311cf328c9987bd5a5ea9802 SHA512 a2bc87f7c1baaf6f245b1d008162a1e5f52b6f949a3e06f69a7ae22315fc7770403ace7289830cfa60f6e66fabbb23352fabb5f0c24be05d58f4f891a8d6e956
-DIST rust-1.71.1-powerpc-unknown-linux-gnu.tar.xz 172809692 BLAKE2B dd6e3c96d168dc2ad4b3bca38a42a2b3c5c0ec5555f042ffb9a7e1d6430bce3659953c2c6c5454843ab41e648e479c5cef2645f2ce0bafe72892ff1ed014787d SHA512 bc2a8b9fc8494cdbab89364c15212f7f8e9af416639f9dd05cc57f0ffe18288be7ec489d18061387c43a2f8f4ab1273bcd7de58126546b59a42ae80e9a2c45d8
-DIST rust-1.71.1-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 620a63d1732cc0cccdc3bf6b141e2467c0ba50668d72be44cf04becfa9e0c30e5a5a4a7f5ae39fd1321130703bc6522c78e9bfdb23e7b3354fd760eb4d118991 SHA512 f6467c3ab3694fb89db06c67e6fb8afde75b4ab86752d9c918c89ca6bcc8914bf45da71076142eeea2dd10910edea42ab0d8144ff7b769b22edcf9bdb447e381
-DIST rust-1.71.1-powerpc64-unknown-linux-gnu.tar.xz 172399116 BLAKE2B ebc82664a4e9f651e9111e862a9cc341615526c6e7af2b181a653eb7d6a0c52156bf1cd35671c6e5aea41fa2653f042a9c865212bef6e8844a88fb9bb7a8891a SHA512 94395abdeb1615f594e4fc86d8bad85a01bbab05893bc8af7890ec509a2006d51c1a8723d3cc8082a214ee851fe4ba06707e01c3f009ed340d791d35e034341a
-DIST rust-1.71.1-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6d3565b8d9ec5b6d719dbe06120469e2a6f1ac42708bd7ef9705e796f0a4c528929a3984a7090a4da6521b09a53b48db119dc388d66f782f01a1ebfa61c8df21 SHA512 847fa662ddf9234a4a6b73e9d515b06fd0af0f098a826463ddb7df406dfdb25ca7b37110e90ff07f0a58cdf2c42755ccac70f057243b44f3b733ddc449cbde2a
-DIST rust-1.71.1-powerpc64le-unknown-linux-gnu.tar.xz 183620460 BLAKE2B f8c562813364a2ddcad26287f227ea93af4d91fb083998835e469a676c9be1c0262e88d0cb7e06cdd1293ba8807334744d4e4000c58d9f34c07fc851b0e31e5b SHA512 f8f627d847e405c9960a01f59eb1e14aa647e42004cbeaabe734c110827921f019cc01bea13f2ea0b5b3c2e4391f60b6ccbe4298182593564169cce0db6c9ae6
-DIST rust-1.71.1-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 2c09621ed09918bcebc6561f7f12e387be7919568929d0215a6bc5333610c158acca2998ff8c918956d8289da2f3e2ed4850c0ce45a9f1d85a304063eb8d5671 SHA512 5f5361a954d4b0510d48cf5b2f2bd0722f9d99a7b28aab8f3dfea9303489d9b60f6e20ee4fc61b74619d3c0fd298ab9bb903b3509f55c448886e428ba9e28d71
-DIST rust-1.71.1-riscv64gc-unknown-linux-gnu.tar.xz 164813572 BLAKE2B f86f7443da64afd416ea3119933a05a7638ee41576e9d761f491376b781e9362992223186109a6b930ee8a012dac5c37547448dcb903bd5bc480b66f8fef3123 SHA512 525a345dcb09141e4f4f5ef911c8f8dd63180fab956752ce0e9f5e2821c89603a2896e7042e019f61ae8807052e96b52bec492f49508dad2a351ce1a9c6de79b
-DIST rust-1.71.1-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6d37bd643caa5780e80a51876228bd12175132af89f1fd35dbd55f8c5544afd21c3e844027083d9cd5ba48bd41c3dc8c1427b400c2141dc3e1d128a6f5672ba2 SHA512 ee22b054810c12dbd48e9ac4006d74f2545c5fa090b80f831673e0850e16122569376380d1edea6c6195bf76441c0751ab52c6a143a643e656af0880c12578c5
-DIST rust-1.71.1-s390x-unknown-linux-gnu.tar.xz 195515792 BLAKE2B e8618c69ccc350c7e63461080a3768bf4d7b26f57e75a98a6e62625cb0deed8cf93dc00e485051d01b9996c6b48d3d1a84f88d5194b618d06e926c5543524071 SHA512 7915806421c07b70acf31bab86086981dcabee08e826668c8225db68c4f895fd16ba3e16b710416d2b96de3c30a9dcd137107a04ced21972d3fe52500e56178e
-DIST rust-1.71.1-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 4266dea5182a07d4ea1f28e6a362a2233df684836af9b5d2b78e87aea2626575d3af6716868b1cc10d2f38d77910d845c3997da7bf93fe865d8486d63dbc9e1b SHA512 a70d2d4592021294734ca9e069ce1f22e2531323524e4bc6477efae074026e0685e31c1d06328e2b17eb87a27dd7ec6793804c87280a002733b87a676c374729
-DIST rust-1.71.1-sparc64-unknown-linux-gnu.sam.tar.xz 57363076 BLAKE2B f1332698c8d36a853f11a2a5b7b9ecf6461bf7b505c08c1fbb6da3e851251f1b081969beeedb20eda3214d08054a8fdd544fa084a69d259b6b71b4dc1f4e1721 SHA512 1614523649f8d27569440ea03e9f4ad40eaa6ae826bf89f6616dc1106c99897c197e56017d16843a1b5bead40fa1f16d8603b91f28e41e6bc38ccf7544618ce9
-DIST rust-1.71.1-x86_64-unknown-linux-gnu.tar.xz 161080376 BLAKE2B 40bf80551c032dd62e19bae5a235575c5d8894ea75f77dd34510499b4f4e779e27da0faa98aaeacb57f73e9632ee90ff0f60f167108529ade67198841215d109 SHA512 15c5ff75b02357beefe717a36e7755d2841778ce4e39020d2b920239e4c8d0adfc17ee65de7bf42493d287bdfca194189f3276adc0374ac3d1a6af63270ef954
-DIST rust-1.71.1-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ce029d9af59f26535a3fa121f20672f7eaad5019934457ac7ddc059dafcb2c3a37e5683923d4bba3f3a735805f11092189cf84d0a6352a5f9f475bd3eb00cdf5 SHA512 0376b16b9c845738c3c291ab2a73a3ecb20cbb8bdd0820568a0683c84b211e639413b3046d756e607a0f1b23695c9dcb351711fcc474e6faa8fe3098b1fefefd
-DIST rust-1.71.1-x86_64-unknown-linux-musl.tar.xz 232096648 BLAKE2B 7f4deafa57baa300f037ce3d9dbd101d5d28cf29368c4b2fc8e51799e59382155076aa0a3c0b6fa0c076693fd43dfaf80ad7685cd44233d7c31037c091a90224 SHA512 55b507a30d62a36aece4a2c2cab985e09d9552ae331c1cab51d949777261600e61d4f05ca1e81fe8b37591fb91939b1cdb55e6930d70e5126eea1a78caa74eb4
-DIST rust-1.71.1-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B d4a9f89274bf4b0004248764c07c7f82f8708f81a826d7509611b75e51d280707a75ff2c9d6b372e79259f7086b3e962afe51c3f0b98dd3fdd4feb683783c9fb SHA512 8be13b63b48740bec80772a826f06a012de58b1294f87374d7b4c844c90f3093ffe86bd3f1d989987696aa095302cc4644e3137fa2c9e1363c9ae8c3e1a05268
 DIST rust-1.74.1-aarch64-unknown-linux-gnu.tar.xz 216291888 BLAKE2B 522c2f2b27f9ff81968d7aa536d2f909bca4e4ca6bb341c08227c87e7f25d9808ea6da74ae1bcf3a7bce4165f1d374fef21d352bff37b7241d19d50a624a08e2 SHA512 57486ce7f4ab8fa6f8091817790396df5b9cd31b4c9901b9969fe5407908458fb384423097ee27485c03dbd30d0cb15c3e8f0e5c15ef4ad17662d91685e8caad
 DIST rust-1.74.1-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B a60c4878f4441029f1f23e6a9a29046fa2d62c1aa8bf33c5ae4c0e986d67ea64688a3fd22bfdc01e99635cc567d87a94fc9ccdb8e512cc4dc8f0378d22eabbfc SHA512 3b2c3d1ccbe5d18c4b8bad62337ddec6306bc0ab654fd75962403f79b86f669ede6f8754327f8375cd4a12f74f3f4df4e183a85f8459de015e6543e17ca80767
 DIST rust-1.74.1-aarch64-unknown-linux-musl.tar.xz 196804076 BLAKE2B c866cef7698da867e8389bc6d460f67486e52822bec516256a8170380d8a2693732c18cc18729b980278fbe3c6fd2d21f1470fea449e66458d5481ac00728824 SHA512 54b9574f624dbb1b8399747e855eccca38dee76c2b59d71fbe41bfb05c1a784bc38d383e7aff0ffb0b8c2c5878bd0f8806e03d1a3c2a6bc4a1a9483d711641ce
@@ -553,35 +516,41 @@ DIST rust-1.86.0-x86_64-unknown-linux-gnu.tar.xz 192462932 BLAKE2B 75bb01181aad6
 DIST rust-1.86.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B b7365bb0f74a12de2e80b4579323b3ae3b3e65460a216cad7c8f61d4fb4bb86bb55cc25721a6cbd8be5b2b5a92aec7601950d2f1b04f94644a890c91966bc20f SHA512 d57cd3221f0d1dbfe69dbe4c5417b0e2d292a09fa892ed46ea90df95b6502c5d0e54eb4916f1289041758dbcc30cd6910f2bd4edc99f2711abb6a9e246361c6b
 DIST rust-1.86.0-x86_64-unknown-linux-musl.tar.xz 283110076 BLAKE2B 9881d9dc7ac8e1f6cdf632131b31eae7404d17f76d38873509e4b8e549e00c37dfef3bdb0663a20b6fb13dc8198a6d25f74931d6f7e4d017400420a6032ab374 SHA512 abb2d6ccc009840b32e48755b2af2a7f2b04eafe285e5c2f35593bf3219e12cfb8ce9e15429cf2315bc5a0ee5103d3b64c7eea121cb77cb8ff2e699bd685bf88
 DIST rust-1.86.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 9dbec80a7661d103e0b0a2187bd524eb5a4f255e6a15ac4bf59f82eb0b5710ef09dec0f35dd0e3015d374c701c2945ddc510a05c5bad2287ce855c30c0460935 SHA512 9664e026d85ed42227680c385bfc42a2cdfdb3a37858ced5cfcf2f7baec4840e01fc0e3e581fba1297a55245864f3d1483f430fc58295b98b84814df07f73c0c
-DIST rust-1.87.0_beta20250420-aarch64-unknown-linux-gnu.tar.xz 167053492 BLAKE2B f2138a03c2e842daa3ad49bb25b2ea63b7cb40165e472cdb20aca778b9fbc6d21f6102e10a0de411e873ddac7726a52dd0221afc6869650aa9a4cdca2e7fa9c1 SHA512 1db6b9ccb1071e95af7900c891e2f72ce52b434d7157c5b89370288d4fc12f4b2f51edbac761e09be79777d2bd156a334a71535e9bd15fe8a67596a9853ff0c3
-DIST rust-1.87.0_beta20250420-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 55efcb2f4a63e712934e25edb15adacbe5941b0fa795827526fb720b5fc4083de7cc093c763cd86324b107aef74a953d06f510033f398fd018152e24ae3574a9 SHA512 b5d609a91d2bd2254337c776c33f6b6322211a7aa03da9afd26683afbcd5f02fcd62938b0288e572c55d8f413bc32b4d3df6c6cd544c4a6d3a38630cb058c91f
-DIST rust-1.87.0_beta20250420-aarch64-unknown-linux-musl.tar.xz 244278800 BLAKE2B 59b807b8c8e83c825a34734d6d317fb56a0fd670a629a20866ad2baa3afadc2e22353f81415b2ae073b705e063633f3961fcaf10ab34eb8eb6b2c05d2df204e4 SHA512 b6cb75ef359d48081dc4c40dc7e6f9794a121d750cec5b18f040aa0f80efa521d32eea0435cf74e467b59467af1bcbd971a3724d53a04963be7c0b21c5bcfdf8
-DIST rust-1.87.0_beta20250420-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B ac1cecf73f8018a8aa9bcf42f452818b810e13b7ea00be9b2a10ec60605980458b223600389dee74e679134951277ef5cd3b0d402425ffdcf1285530c490e028 SHA512 fedabb1ed5f3a38c36b20cd4dbbc44e11044522ad86e328d804ff975725195a33b321b447c5b918afa7bcff1485b1d4078a37181db4e3584905a7dca8ec13be2
-DIST rust-1.87.0_beta20250420-arm-unknown-linux-gnueabi.tar.xz 229437800 BLAKE2B c7f6f72c9f538832edb58443115b202e6947f6e4cb8bd2fbbb81ad36ef93ea899067d1a94970eccdb5e6577f9d6d5d60a829a125dac3b48dfb7892d029aa9b46 SHA512 601c2c9a0f4acd988bcd4ee1ba2515baa092c4558d8a2109a965873b26d91f5645605a9371cdadd8fa27eabc34c2d50a781f8921fc9f9eed91933f800f36ca69
-DIST rust-1.87.0_beta20250420-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B af63985f0b853ef1b8f0ae5b4448afe277c304cbb783cb73eee51a9c1b4429a245e164e5d63a62c9a50b72e0a52328e58ec2505eda2f5bc87cf36e4218d741e9 SHA512 deb475f6dff36af8ccaa4c27794dfc48073ea2e32177631e7ddde3f8f6cbceec6963f16c27b1fba9c191c4e48a6040b1929c4dd792303d6ee6cdda53bb5c893d
-DIST rust-1.87.0_beta20250420-arm-unknown-linux-gnueabihf.tar.xz 229830976 BLAKE2B 5cb3bc360d230b8b5fc3c5390b3d5097fefb76dfb73c47312ec229612fac1f1e34160b0a91d3374b7915dbece571f5edc05651bdfac344aebe6b99350b1d6042 SHA512 c1b6a2538967a05b336227d06e5cc7e73ad75e73abd39b1c690ffd6ddd9ec5f52adc2d209ace65672691da97ca12b200a7ecca3a0590f366af5aad0d190882e1
-DIST rust-1.87.0_beta20250420-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 9a9f0c2cb9991f0131662b41e8dcfc6a8bc66b32baa844b58e25aae09699f902496927454377643987cec0031da23a9b7b358d07b28e327720f75b6426741926 SHA512 8145c0adfbef8179396ff9d65089f179a523e6b500908a9a272c858d86cbc6235909b1f5e91ef5188377d00ed6a22c8668baa3c16827620a1698c7abce42fd99
-DIST rust-1.87.0_beta20250420-armv7-unknown-linux-gnueabihf.tar.xz 235549272 BLAKE2B 8df4bb650ee3f4d58227480e341db7cc9f0e7b065cb887c2931da46eab951edb304e6dcb3320496ac9da4a90e386973126fe4e197152c37554dd17c2b1cb624f SHA512 8699544f8faf3002afb973179b3555bf12afd03667d295ec48d95cc3737e4bfd65d21bada4b7d2ad2582c6060a785603ec86ef636063b2b382da1bfedbfea331
-DIST rust-1.87.0_beta20250420-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 45cb81d2f9133c4c6929a0d866393858237d4d99eece49bf8878dc351ac31224e61cb9f19b96e2639cc29502cecc4475dd1eb4f1d96fbe6a45ad03e00a215ceb SHA512 c294dca3cff31b08e40394d8d25b4af5c7c98cfaaa7b2b1ee07b6c2af4b961181b56121b7638b42f6bcf36978b5a56e8311ec2c6f658b72daee39e4fbd360407
-DIST rust-1.87.0_beta20250420-i686-unknown-linux-gnu.tar.xz 263549596 BLAKE2B b2e31c243b1514f17bc43c7715838e710dda3a8fa567c49a470b7bce082873b802b655cc790fdbf5325ab3df6c7fe5ccaa1ab9295ed0071dee532bce52f0b06b SHA512 d02a842878dac99812aff56c6d906d60c51c37a6e03185c6a956f2712ffb0a46b9b198fdd7b05d50e7f9c56505d819253be28fa035f02c042065796853f571ed
-DIST rust-1.87.0_beta20250420-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3f6b3b1aea710e68713f67fcb13ad0ff81879f3e2c95bc288bf73dff01d051ca0e9f4e586b802fbf91dc9f75b69988c0df764a0d6128c02e9dbbc992f70fb340 SHA512 b35be052c1dba1b8d9f673a99fc5b2c5b123f33feffc4c5b24de2d5528c4624dc0d0ef75b9904cd9e86db12db7148693d1c5c065a07377072fc515fa4395ffd2
-DIST rust-1.87.0_beta20250420-loongarch64-unknown-linux-gnu.tar.xz 261203096 BLAKE2B efc35a94cba075d843bd800fb52cb26bd01bcb02567a708926a5f8163e50cfab20802f50a8f11b449448b7924df462aafd6756a25eca3dee9882efed7a987366 SHA512 da71cf2b582f95119fddfb2dadf668b3c9ce9d731cffa68510ca72a7d2f5304c91530f020c3edfdcd03f4aca73905e8e32e8d5c304d0eb81dea432e212e715e5
-DIST rust-1.87.0_beta20250420-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fee28e7ed6d77dd9a4a1a67fcdb886213c8cb047187508a0f4557dabc9a4fb9ff1278ffaf9b5ec652ac3eea1801275c4019221077a787a1045bce38c8b8bb08a SHA512 6f9de5973a73eff1f44121e859aa97d74ca3df451ac1cdc20e5cf6f242368aa355157eb24c91084dcd7c2e594810b8c7ce4b6258fac5e68404e1789ef76a3bd9
-DIST rust-1.87.0_beta20250420-powerpc-unknown-linux-gnu.tar.xz 255800912 BLAKE2B 56e2e716d97e96096563569f1f8823ad31b8f104f424bc75d23c2b694181df9dd81b2d6b550f18149fb367041e7c7f30463e4c0abe294b45f3b1853e6f1423eb SHA512 cd489c80bb6c901ba134af7f2d45afdd7ee1b82b3e1e4eb45049ec1316f9c067c463561459ddd7eab014ec8fdf4e00fc681baa63a36c1d953c2105df54acffe3
-DIST rust-1.87.0_beta20250420-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c134bf010ec2db06a8643668ffb6474fa530be7c31a076b2700f47477cddd2d8591ab2288b19f11b228dc933cb78c0576b4e512b89f3346ce4f01a0d68afd65f SHA512 514039fa3faead4cdadaafbd7cc0583f7bb084a1accc295928b0f44657d94b0e47931d8badc69f80c13351ef6dd872a7d43856d7ba2ca63495a0f340c19f5c3c
-DIST rust-1.87.0_beta20250420-powerpc64-unknown-linux-gnu.tar.xz 255799988 BLAKE2B 585274636abb052f26ffeee7918a2ab5ee38029e7e895fbb278f24b659b8e28f34f6613375f90c1eb7dcc8236f657d5bef760c55291d048e4d102845883eee21 SHA512 b5d464d78b9b7ce0ef960c71d0a1e9d683ae599b46acaf096639baa69e0f67153e3ccf70e08ee4d2e9d23f8778cf654c6e9c3383d39a862a01ce03ecf2033338
-DIST rust-1.87.0_beta20250420-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 5fe0d07c0fedc718143aa8bc43383a95397a96ac46affa15f5114cb782996430bd347bd2a488d2cbab162fd2570834761296ec5e837da145093a83444d5c9fb9 SHA512 9a3c2b157adff51a286815de379bb8e42990c6dc4ee345950ea866ef6ef7cd4da17f39868aafec8ad9682eed187ca5665f5d332af8dbdb9beb29ce21bf14ba0c
-DIST rust-1.87.0_beta20250420-powerpc64le-unknown-linux-gnu.tar.xz 271492844 BLAKE2B b090331958ac17b08b24b28ef772307bef4788ba16b40fa6cc62b0e1c6e4f5fecf4151048ab7f0ab10ff41a8c1c714df65e62c162dc9fdd8d56b3cc7390d93d5 SHA512 688fd8f82fb690f95a86e9457caca313527dee737c4bc6f928cce449ed456c5a569f1448afe6b8cee770e16a7603f5a212c62566df44115277cfc12b6969692d
-DIST rust-1.87.0_beta20250420-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6b83e970941e484c36c6147bb629383bf6a79a535c99f9c0c73b9881e38f2fcd4193bd27ffee4262fe2f5e0d74c867d35f7b60ff6543b61edc67b05b7674a5ac SHA512 c849e801743a2a7f36d7a436309ed0bc5adf52cc3717a631a2dd56eeafd1942e97d624500f67d83d53187a821a56db88bdaad8928bd732bcea0a5d5e11803a41
-DIST rust-1.87.0_beta20250420-riscv64gc-unknown-linux-gnu.tar.xz 250483088 BLAKE2B 175a7c391337c844879736d7b71e5a9ebb777fb6134cb8ad4e42a3de56815487b5cefca681089a93e354f1a1d8f8d5b3bfb5016bb7b80003db4d8e2f70be71fd SHA512 4ebafd8d1ebe0238e040c36c422b5b828b309c2f8322145ba07820a068e3c53a2ed7798c4ac67e2610baec1126c8d8e271c3b3004971490a253a5c59090c8fd7
-DIST rust-1.87.0_beta20250420-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 72e0e1cb9f3e5fcd76e62c3efd42530f2cf04d54f05cbabeaaf3e1e16ce3f84a2d5f0ba0658da8cfdfd574bf85e4471a0b963a2ba57c1d790b314f0b89df9f56 SHA512 0e9ea30c181d46a8835c6c323bfb23f3eb1a7a267361b8aad056d4c820dd69b184ba210a9d0e1341d65178929eac473c69d11b4e0ec4f65de52f82f9bb93900b
-DIST rust-1.87.0_beta20250420-s390x-unknown-linux-gnu.tar.xz 240064780 BLAKE2B 193ca1b6d4a65eab53be8b6c16acb7b0acade0cb3c41dc244e06c38d34a0c9b1a6ad7bf852cb2ce1e432ca8f509e890dbe63cfc48c4cca11f8dd72a52664c39f SHA512 060c876c11cd5783e7517ebeefe9d601b2f1e3220b69851200cb00d8fc06434c492740374798133248b3b5fd3b08e5d9ce9d458191896be9296a6245b7d30fe8
-DIST rust-1.87.0_beta20250420-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B f41d5b89fbdc2f2d7fd7bfa56df5a481784bfa86563c2429a19cc86c397146151b9de31ce71f6a54986fd307533dc8f9df0ca23edbf659fa0efb1bd74613cfd2 SHA512 96968b74f64a7402be3d27e09867d62eb0554169553abac241c6ad4393c3854128494776bc9132bdcaee499e89e6a4875b8a25731af176d88297fa74f6c1dbea
-DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-gnu.tar.xz 198552720 BLAKE2B 89ed8af9a09c7dd63833d91482f87b727b9597978318c7e66cec36afd1adaa13ed8ed6c87a2a5e118d8d1d0fc022e6cf8e3c6c79c92edf95162df9baf83aca04 SHA512 33b1df17bda04cf0b4dcd04337185dbd1b99bb440a0cfa2b6aaaf72257acb739e07f417ee56b691e32b8739016149a8bd5492cca8a84c0daeb92cfd9c5d4560a
-DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 45a0d818111946afc5e6544deea84d649175a0059f6a4574b7d7d2095ff008285ad09945f7e79b02331b13627da51cdea535cf80e4454248572a1fe5524489f2 SHA512 47d46d2c48cbe2a0b72278bf4e60483b889d83371ee35eb568809cd50d1e5058eee62f416e1ba3871016e0a2957be57a3716882eae41eb6c384510f4e523e3af
-DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-musl.tar.xz 293222552 BLAKE2B 167b847bb5f23de2ab1b918976c7abe8cfa9d98b51ffad52aa208d986c9e409f37f72114280dd61a255496502d92d22e0d26c233c4034214d5e9f1565ecd32f1 SHA512 535e5320e11e70b86213146803994b7bf15475c24aa2822cf9f193586b01e8d77de509d9ba08cd6892f43b2caf1c22c657c4a1949582bc10283a47fc014de2d6
-DIST rust-1.87.0_beta20250420-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B e25674a14e3efdfd95fe2269c9848bd9c78a9f7819d35a6fa54abc50478250eaf1207249719d92b9d8fa104943a3129ff3045cd4e7039febf94ad483098796fd SHA512 f493ca8b9604350e93deec6b698086662b82b8b774d66b7090815755657111255710b04105bff9f72d9d83de0268cb34df4db9c184f1066a364d5c44dda3331f
-DIST rust-src-1.71.1.tar.xz 2460244 BLAKE2B e3a5b5bfb808310f96e760aab55310c7a790fa551d248c9c5dbb407e0a80653563d8df73a9e0973aa63d3286aad6c755b78098dd8db2dc1a2ed3cadb926b40e1 SHA512 659cc46e1ece2ddbcf5ab748bae48843bd36353cc633b59e4ac062d843af66919e8d5c39ccb72ebdbf94a0e26a8056ade6bd1c8fe9a936469bd405122a8ae35d
+DIST rust-1.87.0-aarch64-unknown-linux-gnu.tar.xz 167259360 BLAKE2B 026bea6ea66e17ea9e6e94b0e907bdb4ede1d488e4bd52a6cdfff2d382f0051678c37a331572dec023dcf9a3d6297f0e8052aa3fbd845986e0ebf90b8f097b72 SHA512 75af0569428a504a3d1160202e7be71077d54278e2920ea063e8018e1d91562adcc35458b43dc2f61e2fa24851a11abcf861874416a6b1e2a4a865b1142f819e
+DIST rust-1.87.0-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 8973b988aa3715a96be2e9ce9297f5907af6766f247e696f8f31bb0cb2df50ca6aa0467140af4d19dc22d480594d7b31b1595cce60958b39a6ae976d7280a14c SHA512 a02ea05357ee068ff5a09a304dfb71184ee9e2219b310e69c31e3183a63d64b5bc3bb1b8dc29a47c86bfe4b9bd93cc7a5be932a6390760beddb3ab2a6f7a5c48
+DIST rust-1.87.0-aarch64-unknown-linux-musl.tar.xz 244130124 BLAKE2B 6829190afd8bfe569c6042220c42be230e20922bb740a079b8f364c1253ac5c12ec82bceb012edf0b562c3e060d359c0938034d1f6c0b36cb4f3c99c9af19340 SHA512 b4e0a547fe511f0e7b1c35830c1f1c62572ef3a2f9a7899f9dc864912b02f1db3a044c66b1d5b6a086e04640e433fb2bc56761954481236e35903b1b254fb593
+DIST rust-1.87.0-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 86ea6c97b53c5dca92a674cd34892abb813c94a2913404aea972f4e7e17713a69c11079a5f1551a993dbfb8601a570e7b02b518b8e6fcf5e8022464c3558f8cc SHA512 8bf165651359cd6610ab0b0fc36e6cb2d554e41e5b4edb6de322cfcce2b480d76677498620084e96f6ebefded0bcbc3cb52a59b85174c8c49a7c947a415dc441
+DIST rust-1.87.0-arm-unknown-linux-gnueabi.tar.xz 229278052 BLAKE2B 910aab46ed70817ea29eaeb839049b430dbe7cc8c2f41a23cd0ebedc05c721075b6806b124114e5b27059834c8f2eaa19469e12065e924198c48f8733b1cb8a1 SHA512 e3e88baec54d19a7a153e199351a91d32d3d1a8dedcfff5398b50b7bd96411aeb90729c71a7754fa17356e8392f5da99a87dd1261071d4cf049b936878f47fd5
+DIST rust-1.87.0-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B d3632820eb4eb99c129a189e6a5fa49e2dc3c341d59903d237cfe32db58056a8ece06855f818c93754b216ffd384e9f1ac0e9d6e52b85f7252b94e659e1dcb14 SHA512 e77adc67132fed80cf4531f5663e1f457560ea28cfa8444924c5bd8cb0cf130432120ae394e94469ac01123fe85d971b7aa2010c10246f5cdb94e9acd095ad4f
+DIST rust-1.87.0-arm-unknown-linux-gnueabihf.tar.xz 229685724 BLAKE2B 75a2655e7e62b4c0f5256bb5f9aed9ddb5371321369278153e2ba450476f4c32e02ff06dfaa79318f5bc56a0b61d4c14c557336f35d1804af63c8a308f24d594 SHA512 d0fffe360d94146c5aa43eebb298b1e685b1251e877c4d1a0766e9cdfb5fba71a6a822ddb6e8bfb035076b2e0c4b7340fe191e1f1569b2b7b297fddad4f1e397
+DIST rust-1.87.0-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B e12a4127861634f0b2e858f5d8a300b880a5f79161ce23d5d912fd9ef73912798a70df6586199fdf6c666fa693f81776b75409fc0b16abfa9a16092b1da3f0c3 SHA512 a4041a7b51160c6d8895fc75a7ec4c571cf4bb70d9e00d22fdf7bcb3824cfa621103d03a802c620804b1da870e86cc9503500219dc69dff5ad813a99b4f9d0bc
+DIST rust-1.87.0-armv7-unknown-linux-gnueabihf.tar.xz 235422088 BLAKE2B cd8a105a79990462fc3936b2218d3e58eb02e558f9abbc2bdaf35bf077430c6639ec7b75dedc11e887ab47ac8ed4595693fe89bc9eea75c8eab8d189218a2ce4 SHA512 0afa7e3c442808b762e03f18a3311c4c422fdeaccbdb37434633d9d01c0be623e2e54248416f6c34b220bcb08edf9ff93623252a8c6a93f37279156c347b984b
+DIST rust-1.87.0-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 16c0cfc7e6c2410f0c07e13da9a15f3104099b0bb40d23b4c4f0a52bc5e6265b4c657fbf6e25899d31061785195763ba91280a9dfd88749e944e1aab4f745bf0 SHA512 fa70d2000313a78715f208a62ccf6cf0f378e35e4d0f7cae8b87f1c5d6cb6cbb52f9bce386aa68213e7d170ee88887818af6c8e0acf5fb5ecf4ea820ef509244
+DIST rust-1.87.0-i686-unknown-linux-gnu.tar.xz 262819840 BLAKE2B a5a20f5ba6fb1e35cf2343bf3a337b4511f686f03e78f9ea85376d86038bea054394e41efffdad71526121420b342cab4c26a6d8b2d218316c32b840bcf906e6 SHA512 d0ff536fea9b92d3c2414e98b4d645bbf306a3f764a8fa0579ae96557f28a44c3e3bc82a714ea219d6e53713ab4af138272e3db454ecea34480971e1a4ff364c
+DIST rust-1.87.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c02fc161e300a291271135c0e7c1a2d13a9d4827469293d54fdce76eea4486d9f2633d55f650b5b0fa70c1dfd6004a69f91f0688138b4ceaaebce08bad19deed SHA512 2b865cd2cc2dc7f8755c72adb7f0dad07cfa4fb74d9f4540db8eccc504ce0308e577f5c81c7d8a67d3a502f43e32fda1c30a1aa41fc1fe9f04c8127bb41f56a2
+DIST rust-1.87.0-loongarch64-unknown-linux-gnu.tar.xz 261506320 BLAKE2B 1c7002e835023ac22c63f85a2e3d3fa9d484fab1f1fdd38a6a56ec534c092f4eefe9bed4daec3db854a99217794f074a342130a7c4bed7695216a789931a4f83 SHA512 df3bb2090cdb0ec2e3a4d3e570fcf678e6d1c337ab253d4afdb68f58bd20c8c25ba73b779427d8a02170cc8d1960ca7140663d24cff0a03fb331483f4532d299
+DIST rust-1.87.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 2950882f1605d178869cdd69aa8102c3b737eee4d043cfc6c701582bdbe2ceb11fd689f0e6b5f86a6ea9bd352f60f97fc67b040a364d140fe2728399228543f6 SHA512 ac87fb385f10d4da9b924e642abcc9171447c54b2a37769667c37755c3436a5aca970b25988377afe2eadbf011b01b731c72c15ff63a286c38e5f2c8fe47c39f
+DIST rust-1.87.0-mips-unknown-linux-gnu.tar.xz 78296428 BLAKE2B abde51cc451ccbf783be3e1516e2d5da0bbe7e8b9ca09e499d1445db48ad4ee60f2d469e7e7556ae35ba6ef1d11323f58e2081f7c52bc8679cf9a7c227cc8d1b SHA512 7c731ca5462386f78cfdc85ca48b11b107b184473dd0cd0d38897150ff90a4dfd26b36acdce92b7390e9ab023f052e790fe0ba828fb750c762d7e4b19460610f
+DIST rust-1.87.0-mips64-unknown-linux-gnuabi64.tar.xz 77986664 BLAKE2B 1c9d5b04503bb6c6f34994537cae3e67cc82d5e8fb4774e3e19f8c88de969b4fab6481444c9db6aa093a9daf186d4b3588e4136440d7617e6c4b3da42f66b6e0 SHA512 26e19f6b2ab597dbe625a6030a88473a5cf962290c06577fab489f2470793e5dd4ff00cdd4b44b336d41e8b0f279f140e1c35ede4b251b37da9d9d873de639c4
+DIST rust-1.87.0-mips64el-unknown-linux-gnuabi64.tar.xz 79581512 BLAKE2B 718cdb2a20b2bf267f0e1bc1c48a6f4f74373f18dc0084b62f15ee971603d3cea8d64fa969d7a9015d6b2f3e258b60c5449a5040e3a5d0b452e733e0a48815f9 SHA512 dd77eb93a4d6adb3470bf1c0c71ee7526fec0930d02ebe4f9d8866ce8ed7eed7a8e3848a95824a6f702f1fb4900ec6e7efd05ec5e557d5c66974568d324d9250
+DIST rust-1.87.0-mipsel-unknown-linux-gnu.tar.xz 79988916 BLAKE2B f4a76840e29a3ca35b3e32628055e053f71430fa44a3bb8ba130db7eb3714e7966272ecbc74afaf2dc6bf3faee0b81b0761952487867c8cd60380fc1f02a49e3 SHA512 64bc1ab2b9f74281751c6cb37ab9d1fc5c545917aae74c10ea0b2e3cd3bc20f8c57060470a04d55e88171445a1f0496ac5644227c369b0207565101c604c05c5
+DIST rust-1.87.0-powerpc-unknown-linux-gnu.tar.xz 255453516 BLAKE2B 8346c8f7656d5b6d27c60cc54bec370e4810c03f66bea40fc23b27aaf0bbad85d48c20e1de6674ea90590e34dd45cb7e2279880cefdc9586d955e19d577f941c SHA512 322d02fb5e751af33288d1699a74dcc1edddfa7eb3b99096fee42fc7e9507295713bdd9673b2937a69134e612dff46035bdac81f25e9d4053be8ec0b55c9944f
+DIST rust-1.87.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 1b6ab115e1d2fe478f72d9431dc256aa410a53d5a3bec6ca64bbdee551c248daf4c99e63c1ed9c19bc1692cf9ee5ca444bb344ac231d2a9a4d5947bb086c97b4 SHA512 14de9b00c1e50eabac1364bc0bafe8689ec4466fc8a52724a312947d95cb776b3f448a5787402d435d11aa1f15338680589130c0390ba8973863e49b7535391e
+DIST rust-1.87.0-powerpc64-unknown-linux-gnu.tar.xz 255684892 BLAKE2B 276e916e8fd098a5843ff7d73db229aefa0f7a55b535db5b58926c0f35527d412ae64af184b1218484ee0f316c79ab48e55ff8abcd84fb3216d2166a752afc46 SHA512 7877936ddfda27bb44a02929bd3715ec1e1f59c0a6a4907b28939d0cb4fdfae80b58c90a8024ab21508c2afa252ef99e79c633baf7ca507a5064b2e0335db4df
+DIST rust-1.87.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e762097c3bfda52e66b57c1935f0a83990197eb8d5e270db5e1fa47b84303e32e47ea9ce17d9b2f778da1c920f6417c8eddd4dfdfa904b30b177ce5e40a320a8 SHA512 dd4b5064f6bf1685a019018d515478b7088daffb3f5cbeaed93e9e1232c4771762604db9b87b0816cb3b38f36bef7ac8579aa2ca1bc7f36716576b221ec341dd
+DIST rust-1.87.0-powerpc64-unknown-linux-musl.tar.xz 80980736 BLAKE2B bacf5aed3af21f8b825e54e7f58fd4c442c47d2898da26d120ffcda3238b4cb9d52ce3256ec37df1def2f0313d822424d6b9ba8e47cc48c072861c631a6b33bc SHA512 904dd60d80edcb1b9a9b34c4184b27cfc21f7480ebd2910447ad6e8e9d11872e4c84432e658ad5f6d8c439c687ccb2ec87611df9d499d73b21602cab13a97632
+DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz 271039948 BLAKE2B 1bf3516b146fa88b4460e15bfb51960ebce8ea46ea2d79ea391cd30c5685d7d5e0d7178450538577aab462180f777789bb5061d1f5a4460fb609784d0e35c636 SHA512 60fa1a2656c6b9273bf27ad87b04b676e2cb71219e2f26b5ad4ae045809378d5072b9e1dcc19829dc0eb46be9819f20f3a53731d83a2ef6b024d458ebfdcd656
+DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fe05b3cd1746932222690932292bf36af9cd9ee36efa30598c52d66a4e7452220901f6da0acd9b498aabfc3de457f36e5d69e07799e51dd417ae98ef171c9482 SHA512 052512118f795c63bd9a4ba50a68212ef57f21bc031b70fcf88b5903f6a95b3251d43d2a7895d3a697637d94e76623b5ffc1b6c190c9e1e426d3955d71e7d549
+DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz 250242712 BLAKE2B d9d75de2381bdbf40ca77cb8dc1c8ecb23b5e209f2c919b56c08605aa557c4d827b92404bf0012093fcf551cd01520c41c6c8f9f2f56798104c6db8592b4d918 SHA512 e5520a5d6fbc0a50a54ccd9c850652475bac2e95e19ec2141e57c038d9a26ccf7cc2a046fb2fe4272b721005a4deabfc2c35c6c7d0a6cc2426e8e45e3e97834b
+DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e7c01e8a1027c408231812482418af16b1147ec577b6b67cea00172eba0716c58954b2a4378ee0213d839e35546efd7eab9f3d3b69ea57e8b560101229bad3d8 SHA512 4279b423334a9ec356d42d1973bf9d3388d5de8aa745b18c34d634d4d9d60c70cf165d851f571ab99a567e49bdd635eb0094c5c932571b0a5325408319403341
+DIST rust-1.87.0-riscv64gc-unknown-linux-musl.tar.xz 86942496 BLAKE2B 3c19dc3eb317518108cc269bc57c53296876d7f4d58a9dd0859dd2d42f377f204c7ee3337672875ee93f3f3a2459f9cdb882460d848dc4d12ca55bb0239e7a96 SHA512 872bb2a158159274b0eb70e21350ce56bf2edf5177ef3d9b8d63b7344930b6d93834d87ff24652f2487a1a997225e562567c53c906939836bff2cd374394e00b
+DIST rust-1.87.0-s390x-unknown-linux-gnu.tar.xz 240071608 BLAKE2B c9e7f72a30556a9ef84003fcd767c3ef403d5e5e7415301b0ba18c4459b7fc6c3fab73afe517c2e6e1a8bb18c3d3e4a913e89eee2ea2038f76738f9ab9145467 SHA512 827908d5fd01b413d15ac7fe831a4557056ea94545ed38fad993999995997cf98bd14a237b4805fa991dc90f807ccc64c1511569ce2898b76d270248f052d5fe
+DIST rust-1.87.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6a6b8098e21881983ad51d048e9ab0a5a73b4387215ced4cbe082ad55def165bbafa9e65fd9040e20f42631912d058194b5348db50bfb07b13780a94da76a7d0 SHA512 2433840adf4589c210642e2966ae51104d4e2caa9e86822a63f0e83612c0f6e675e9c7e176cb517091074c1cd4326d060ef78a6afced23d9dace01340ec57793
+DIST rust-1.87.0-sparc64-unknown-linux-gnu.tar.xz 76313076 BLAKE2B e52593f7d67f8dc479ad7b2cb0c4943952ab2680120be387cf22c4fed297ed25d2289d543c18fa2443c46814af89f977d64c0ea0cdc6c3ed442f3ea12a8e43e9 SHA512 2c91473fc0e84b1250ef1bb4314bc8373bf25eabe8ca765240954b4c8d552ca0b81d89193e425f29af3a704f05aa696def78acef3731046a87bca9f516092557
+DIST rust-1.87.0-x86_64-unknown-linux-gnu.tar.xz 198639092 BLAKE2B 908c974cc044e18aeee57e588947837040bd2e2ef553a8f820b56d5b484ed57964c58c71c4e49f10fd83af6abb3c6d5ec508406d91ade8403d9b763097efc312 SHA512 eded4a503d2435b7ca32d03e8c9258fc7cca73bc00181ccbfbabb6d5038b3fed34406c708b6db6608a3d9cb988fb833875a374541be89286628b8f5ca2f3ea8d
+DIST rust-1.87.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B edac3e21d9414e774c507a352664f6d73beb78ca3b4f19c95097e073b461d10aeef8d0b2bcf0457b8944c40327f04907c05edcc92070cc10958a9deb1d843bc7 SHA512 1946680287698a07a922c18b74d27c1de374eed86624aeb76167aafcd0acc8ad4bca57fea5a8f8420deadcaf819be6ea0c47b8ca97033cd94578037fbbc86168
+DIST rust-1.87.0-x86_64-unknown-linux-musl.tar.xz 292508024 BLAKE2B 2fdf8a2be388bbfeb52211c372b95f42563ef762883d4634f857545a3bdcf9fa6c41c9099df1a26b936f3a3e9e8679d891d3ed80e593e405663f02421fadad6c SHA512 9629d62407eb517e09b21cca83ae1528b60b589df29ee12d99e7f334c234cdd9e24c497c175b4e83b8a993f6117e17a8004b350a28868d7e5247c26dd165d253
+DIST rust-1.87.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 9ee89dcd5bca680c4b6c13b85166d4d7d6bf1c685931a6466e8701868840136376ae8980931e5cf91f82da1cec7f9bfc0ec74576d5e57eb14991d7d398524cd7 SHA512 5985a66b9c898f71864c5f18104a92930bfd20acd827efd0d7222c28da25fc96ca72f72c880be0b75ed25ea381f9d7e07e2e1243c4b465eb4903073bb74691bf
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
 DIST rust-src-1.76.0.tar.xz 2590884 BLAKE2B d1a6215dab34d7b10c3177d2b248f997d3a846388f3442567572880aa5c5bc51b56398f5d4dc32727cee7c9dbef494430d6534a76b66c4ae5ac4fed07266644d SHA512 39d2fe58fae8c8c5a6cb3fb1ef2a1c7548c018fef6ccea531659fdfecd68a4aa77125299d2cbe5b58e500337b4d074928318fa9ebce358af500d0ef27260e3ca
@@ -597,4 +566,4 @@ DIST rust-src-1.84.1.tar.xz 3016012 BLAKE2B c9edeaf0797a22e384c54b3fe3e7c833464c
 DIST rust-src-1.85.0.tar.xz 3036988 BLAKE2B b7281b23eef60cf052e1641a29915c02c590166a73e5ae75890072ce80f95a2ab71cead3e3da7adf757ec0352d1dcc87ba4c3070282a27657b34420fe24a0c16 SHA512 613cfa603dc457cee34b154acef9573d766ce5757c9e8342b13d362f2e62b4cee47071a59df9fd5fa42ecade1a9efdada5784402aaf7254d5996558533bff8db
 DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a071bc9608ac468bca364fafaa9c277b91e40da870a083c802cc13b9b876a548d7fa8ae67ad9552321a7412b7d8cd8 SHA512 d230cbb1daae3e2f5168abef94c5b99fb118c34a980f018d5df3e43f6ead4e0a17d6ea29bcfbcd0fb745e215f7a4d0282a99a714dba77b98a16254bb27c2d2ad
 DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
-DIST rust-src-1.87.0_beta20250420.tar.xz 3118744 BLAKE2B 44c32b7b91c1b8440eaa64ec22422775fcc47581b0620bb51fcf738fa9e73ee938c40df578885db095cd4b442f50d972c2ec44c64a77a6093c7cf65bcee04a70 SHA512 cb08ad457250112c696e5ea82606ecf1f49d0196bfac81d743587458dc1c23a728afcd33c2651690a107c9fb45c15033648c2a7e0228aa00860b9b21b3b1e9a6
+DIST rust-src-1.87.0.tar.xz 3119800 BLAKE2B 6429eb419f17109537a2a5463b0c68f504b3cb0f55766e18f73cf053883b06eedc934ab4598756790cec147ff41c4eb30a807d2ce0b7e6af33310710fdc5a8c1 SHA512 9747c60268d772b7c6e7694260c0808d2b8a42028f5606499c81595d76f5bc32c9acf6b4b9aad168235f8fd77d980c56bc4afc3d40f5d0374b23d3e66e3de390
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild
deleted file mode 100644
index 0e1bf418b71..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild
+++ /dev/null
@@ -1,241 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( 16 )
-LLVM_OPTIONAL="yes"
-
-inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
-
-MY_P="rust-${PV}"
-# curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
-MY_SRC_URI="${RUST_TOOLCHAIN_BASEURL%/}/2023-08-03/rust-src-${PV}.tar.xz"
-GENTOO_BIN_BASEURI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}" # omit leading slash
-
-DESCRIPTION="Language empowering everyone to build reliable and efficient software"
-HOMEPAGE="https://www.rust-lang.org/"
-SRC_URI="$(rust_all_arch_uris ${MY_P})
-	rust-src? ( ${MY_SRC_URI} )
-"
-# No point keeping this in the eclass; this is the only revision that needs the logic
-SRC_URI+="
-mips? (
-	abi_mips_o32? (
-		big-endian?  ( $(rust_arch_uri mips-unknown-linux-gnu "${MY_P}") )
-		!big-endian? ( $(rust_arch_uri mipsel-unknown-linux-gnu "${MY_P}") )
-	)
-	abi_mips_n64? (
-		big-endian?  ( $(rust_arch_uri mips64-unknown-linux-gnuabi64 "${MY_P}") )
-		!big-endian? ( $(rust_arch_uri mips64el-unknown-linux-gnuabi64 "${MY_P}") )
-	)
-)
-"
-
-# Keep this separate to allow easy commenting out if not yet built
-SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/${MY_P}-sparc64-unknown-linux-gnu.tar.xz -> ${MY_P}-sparc64-unknown-linux-gnu.sam.tar.xz ) "
-
-LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4 UoI-NCSA"
-SLOT="${PV}"
-KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
-
-RDEPEND="
-	>=app-eselect/eselect-rust-20190311
-	dev-libs/openssl
-	sys-apps/lsb-release
-	sys-devel/gcc:*
-	!dev-lang/rust:stable
-	!dev-lang/rust-bin:stable
-"
-BDEPEND="
-	prefix? ( dev-util/patchelf )
-	verify-sig? ( sec-keys/openpgp-keys-rust )
-"
-
-REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
-
-# stripping rust may break it (at least on x86_64)
-# https://github.com/rust-lang/rust/issues/112286
-RESTRICT="strip"
-
-QA_PREBUILT="
-	opt/${P}/bin/.*
-	opt/${P}/lib/.*.so
-	opt/${P}/libexec/.*
-	opt/${P}/lib/rustlib/.*/bin/.*
-	opt/${P}/lib/rustlib/.*/lib/.*
-"
-
-# An rmeta file is custom binary format that contains the metadata for the crate.
-# rmeta files do not support linking, since they do not contain compiled object files.
-# so we can safely silence the warning for this QA check.
-QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
-
-VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
-
-src_unpack() {
-	# sadly rust-src tarball does not have corresponding .asc file
-	# so do partial verification
-	if use verify-sig; then
-		for f in ${A}; do
-			if [[ -f ${DISTDIR}/${f}.asc ]]; then
-				verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
-			fi
-		done
-	fi
-
-	default_src_unpack
-
-	mv "${WORKDIR}/${MY_P}-$(rust_abi)" "${S}" || die
-}
-
-patchelf_for_bin() {
-	local filetype=$(file -b ${1})
-	if [[ ${filetype} == *ELF*interpreter* ]]; then
-		einfo "${1}'s interpreter changed"
-		patchelf ${1} --set-interpreter ${2} || die
-	elif [[ ${filetype} == *script* ]]; then
-		hprefixify ${1}
-	fi
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-
-	# start native abi install
-	pushd "${S}" >/dev/null || die
-	local analysis std
-	analysis="$(grep 'analysis' ./components)"
-	std="$(grep 'std' ./components)"
-	local components="rustc,cargo,${std}"
-	use doc && components="${components},rust-docs"
-	use clippy && components="${components},clippy-preview"
-	use rustfmt && components="${components},rustfmt-preview"
-	use rust-analyzer && components="${components},rust-analyzer-preview,${analysis}"
-	# Rust component 'rust-src' is extracted from separate archive
-	if use rust-src; then
-		einfo "Combining rust and rust-src installers"
-		mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
-		echo rust-src >> ./components || die
-		components="${components},rust-src"
-	fi
-	./install.sh \
-		--components="${components}" \
-		--disable-verify \
-		--prefix="${ED}/opt/${P}" \
-		--mandir="${ED}/opt/${P}/man" \
-		--disable-ldconfig \
-		|| die
-
-	if use prefix; then
-		local interpreter=$(patchelf --print-interpreter "${EPREFIX}/bin/bash")
-		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${P}/bin"
-		find "${ED}/opt/${P}/bin" -type f -print0 | \
-			while IFS=  read -r -d '' filename; do
-				patchelf_for_bin ${filename} ${interpreter} \; || die
-			done
-		eend ${PIPESTATUS[0]}
-	fi
-
-	local symlinks=(
-		cargo
-		rustc
-		rustdoc
-		rust-gdb
-		rust-gdbgui
-		rust-lldb
-	)
-
-	use clippy && symlinks+=( clippy-driver cargo-clippy )
-	use rustfmt && symlinks+=( rustfmt cargo-fmt )
-	use rust-analyzer && symlinks+=( rust-analyzer )
-
-	einfo "installing eselect-rust symlinks and paths"
-	local i
-	for i in "${symlinks[@]}"; do
-		# we need realpath on /usr/bin/* symlink return version-appended binary path.
-		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
-		local ver_i="${i}-bin-${PV}"
-		ln -v "${ED}/opt/${P}/bin/${i}" "${ED}/opt/${P}/bin/${ver_i}" || die
-		dosym "../../opt/${P}/bin/${ver_i}" "/usr/bin/${ver_i}"
-	done
-
-	# symlinks to switch components to active rust in eselect
-	dosym "../../../opt/${P}/lib" "/usr/lib/rust/lib-bin-${PV}"
-	dosym "../../../opt/${P}/man" "/usr/lib/rust/man-bin-${PV}"
-	dosym "../../opt/${P}/lib/rustlib" "/usr/lib/rustlib-bin-${PV}"
-	dosym "../../../opt/${P}/share/doc/rust" "/usr/share/doc/${P}"
-
-	# make all capital underscored variable
-	local CARGO_TRIPLET="$(rust_abi)"
-	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
-	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
-	cat <<-_EOF_ > "${T}/50${P}"
-		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${PV}"
-	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
-	_EOF_
-	doenvd "${T}/50${P}"
-
-	# note: eselect-rust adds EROOT to all paths below
-	cat <<-_EOF_ > "${T}/provider-${P}"
-	/usr/bin/cargo
-	/usr/bin/rustdoc
-	/usr/bin/rust-gdb
-	/usr/bin/rust-gdbgui
-	/usr/bin/rust-lldb
-	/usr/lib/rustlib
-	/usr/lib/rust/lib
-	/usr/lib/rust/man
-	/usr/share/doc/rust
-	_EOF_
-
-	if use clippy; then
-		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
-	fi
-	if use rustfmt; then
-		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
-	fi
-	if use rust-analyzer; then
-		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
-	fi
-
-	insinto /etc/env.d/rust
-	doins "${T}/provider-${P}"
-	popd >/dev/null || die
-	#end native abi install
-
-	else
-		local rust_target
-		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
-		dodir "/opt/${P}/lib/rustlib"
-		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
-			"${ED}/opt/${P}/lib/rustlib" || die
-	fi
-
-	# BUG: installs x86_64 binary on other arches
-	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
-}
-
-pkg_postinst() {
-	eselect rust update
-
-	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
-		elog "Rust installs helper scripts for calling GDB and LLDB,"
-		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
-	fi
-
-	if has_version app-editors/emacs; then
-		elog "install app-emacs/rust-mode to get emacs support for rust."
-	fi
-
-	if has_version app-editors/gvim || has_version app-editors/vim; then
-		elog "install app-vim/rust-vim to get vim support for rust."
-	fi
-}
-
-pkg_postrm() {
-	eselect rust cleanup
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250420.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250420.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
index e00494d54b3..279ac9c31f1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0_beta20250420.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
@@ -20,37 +20,37 @@ elif [[ ${PV} == *beta* ]]; then
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
 	"
 else
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/rust-
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "${PV}")
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/rust-}/2025-05-15/rust-src-${PV}.tar.xz )
 	"
 	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
-
 DESCRIPTION="Systems programming language from Mozilla"
 HOMEPAGE="https://www.rust-lang.org/"
 
-if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+if [[ ${PV} != *9999* && ${PV} != *beta* ]]; then
+	GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PV}" # omit trailing slash
+	MY_P=rust-${PV}
 	# Keep this separate to allow easy commenting out if not yet built
-	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/${MY_P}-sparc64-unknown-linux-gnu.tar.xz ) "
 	SRC_URI+=" mips? (
 		abi_mips_o32? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mipsel-unknown-linux-gnu.tar.xz )
 		)
 		abi_mips_n64? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64el-unknown-linux-gnuabi64.tar.xz )
 		)
 	)"
 	SRC_URI+=" riscv? (
-		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-riscv64gc-unknown-linux-musl.tar.xz )
 	)"
-	SRC_URI+=" ppc64? ( elibc_musl? (
-		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	SRC_URI+=" ppc64? ( big-endian? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-powerpc64-unknown-linux-musl.tar.xz )
 	) )"
 fi
 
@@ -165,13 +165,15 @@ patchelf_for_bin() {
 
 rust_native_abi_install() {
 	pushd "${S}" >/dev/null || die
-	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
 	local std="$(grep 'std' ./components || die "std not found in components")"
 	local components=( "rustc" "cargo" "${std}" )
 	use doc && components+=( "rust-docs" )
 	use clippy && components+=( "clippy-preview" )
 	use rustfmt && components+=( "rustfmt-preview" )
-	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	if use rust-analyzer; then
+		local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+		components+=( "rust-analyzer-preview" "${analysis}" )
+	fi
 	# Rust component 'rust-src' is extracted from separate archive
 	if use rust-src; then
 		einfo "Combining rust and rust-src installers"
@@ -200,8 +202,9 @@ rust_native_abi_install() {
 
 	if use prefix; then
 		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
-		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
-		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+		local binpth="${ED}/opt/rust-bin-${SLOT}/bin"
+		ebegin "Changing interpreter to ${interpreter} for Gentoo Prefix at ${binpth}"
+		find "${binpth}" -type f -print0 | \
 			while IFS=  read -r -d '' filename; do
 				patchelf_for_bin ${filename} ${interpreter} \; || die
 			done
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
index 1a87c2a9eff..ab332c7a70c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@@ -10,5 +10,5 @@ DIST rustc-1.85.1-src.tar.xz 274028992 BLAKE2B 1dddbbc0d14fe9551fd2eb59a47521ac7
 DIST rustc-1.85.1-src.tar.xz.asc 801 BLAKE2B 07409ef6c044b72394a28dfd5b5decb237ca540714010a4f81e4213a3bf7ffb2e14029789f930cea0dab115a6e986859f6cdefd3798be780c2ff21c3e5fa6593 SHA512 7f19653fd05c89390a4073f5184ca162863b7116cc4d8867a5aa4304568880707ebb9f9dda166d7d04f30b2df6ed223eedd98df1744f809773054edfcd2385ff
 DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef2ddf2ad52acb5d9ee78496a7b5dbc10da5a51c72cf2a6f66d543a531d3138a49767c98501ae4e885e03988d2ccfbb59 SHA512 9ce195e24a03765f7163de16271e3d19d731d4b80fcc2bfd919106c9d42543eade018f712f6947ea3c6e57c6cb2e6841596aa668d608b8da15101a7da14f3097
 DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
-DIST rustc-1.87.0_beta20250420-src.tar.xz 283544556 BLAKE2B 70a59c7d695e881a4e21d500f19b7d83e3a86bc8d5dfaaaa28a4cd4631b12937a2743119e3181e84af7b348386c672f4e62675da8cfb399095fcdda527b072e0 SHA512 37e62954c21b0d5c232dca1d0fe476b165eb63b7315c1fcaa18068707f4fd00e2def09968ee1d243f62cb3eae3fbb4381493b8505179342705998dce08e23afe
-DIST rustc-1.87.0_beta20250420-src.tar.xz.asc 801 BLAKE2B c0ed0686d3bc612e8b0edb96817928107905220328af81d2f9200552c3edb58d98ae8844f01b7dd20e59e6c0a173f6da11b2cd58d0c3b5d5f0bd8290528ea86c SHA512 e2e694feec13d8fb8d9b50442c0c2e3de5cef0a249730c945124880220e44d481b2109098c5a8479f765384a4298e293e63743c924e0866ed2e5aece3a35c98f
+DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec75797d91ccd6f1df4afd7187878adbb8d99c9e8a3b11c6027703b2e8d06785299d93d8649f3eda7f356dd2a6734d99d05b SHA512 2ef08c9be45434401f916d54b3739f52d255f8a3a4ce05a717499250c2333eeaf601f1d18085b878c027c609f44da74d0151f5bfc2c9ae1e01166919a91a1d2b
+DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250420.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0_beta20250420.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.87.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index d6eca425508..2d3563cd853 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -1,5 +1,3 @@
-DIST rustc-1.71.1-src.tar.xz 151983068 BLAKE2B 3dfdbc246feb84a79ae94c2de978c5585ee06cf6b683d2245869b62e28f7c79f89cc589f5431537713bf088236a0b824acefc1b68e418e9eb72e1eea98054e3f SHA512 fd0e5a16bdbeb539184513583089e55f681cb772810df357b6b1464853f7022ac02edab3dd155b2262ed0047e2a25dea3808dd078dcdfce9d399384465009db4
-DIST rustc-1.71.1-src.tar.xz.asc 801 BLAKE2B a88c073a70552d73e2d7695eceabdaa478f34501b7271fabf7f4a09f3efa545181f34353e45776b05918e6aeba88adb02f9731454f7085a7abf1602fc6589983 SHA512 9dd0406cf22f1daa7fcfd015fc1c6f8d36586aa99bf14c1491ee464c1f892ab759feb83e8b55b64713170fb777fdbe038fb5fd01a59c911b6599223baaba0677
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
 DIST rustc-1.74.1-src.tar.xz.asc 801 BLAKE2B ddf73175b164233babf31ca3a381b03e20c0f36d017c1d5f85d6ab11f0986d861ab23b11c061e6b2444ced70c3d6a494cc3de4ec86f0deb221a805491bd75420 SHA512 9a96ff9ba9a4e2af4e267b2ec126fc0675c78d0eb767703daa2f28491c3d85c2ab00fbd8584390bf658812ec6c4ab6c57e43b386db59fd505bd3134a8873a09e
 DIST rustc-1.75.0-src.tar.xz 159624388 BLAKE2B 8937b80585eddaa3e1f1ef948899d14a170308518c6fef9fe569560cdd870053776956743f796055f2119399b9ca6c0df12fedd789ae46324d071e5126c4e495 SHA512 7b0f25d91b1b5c317980fc88e059200bd43b56a70b445fbc72fb9b96e09775bfd3a98e9bd9d662af80f0ce3aef527c777ee82777e96ca876f47a972d63da8606
@@ -30,5 +28,5 @@ DIST rustc-1.85.1-src.tar.xz 274028992 BLAKE2B 1dddbbc0d14fe9551fd2eb59a47521ac7
 DIST rustc-1.85.1-src.tar.xz.asc 801 BLAKE2B 07409ef6c044b72394a28dfd5b5decb237ca540714010a4f81e4213a3bf7ffb2e14029789f930cea0dab115a6e986859f6cdefd3798be780c2ff21c3e5fa6593 SHA512 7f19653fd05c89390a4073f5184ca162863b7116cc4d8867a5aa4304568880707ebb9f9dda166d7d04f30b2df6ed223eedd98df1744f809773054edfcd2385ff
 DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef2ddf2ad52acb5d9ee78496a7b5dbc10da5a51c72cf2a6f66d543a531d3138a49767c98501ae4e885e03988d2ccfbb59 SHA512 9ce195e24a03765f7163de16271e3d19d731d4b80fcc2bfd919106c9d42543eade018f712f6947ea3c6e57c6cb2e6841596aa668d608b8da15101a7da14f3097
 DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
-DIST rustc-1.87.0_beta20250420-src.tar.xz 283544556 BLAKE2B 70a59c7d695e881a4e21d500f19b7d83e3a86bc8d5dfaaaa28a4cd4631b12937a2743119e3181e84af7b348386c672f4e62675da8cfb399095fcdda527b072e0 SHA512 37e62954c21b0d5c232dca1d0fe476b165eb63b7315c1fcaa18068707f4fd00e2def09968ee1d243f62cb3eae3fbb4381493b8505179342705998dce08e23afe
-DIST rustc-1.87.0_beta20250420-src.tar.xz.asc 801 BLAKE2B c0ed0686d3bc612e8b0edb96817928107905220328af81d2f9200552c3edb58d98ae8844f01b7dd20e59e6c0a173f6da11b2cd58d0c3b5d5f0bd8290528ea86c SHA512 e2e694feec13d8fb8d9b50442c0c2e3de5cef0a249730c945124880220e44d481b2109098c5a8479f765384a4298e293e63743c924e0866ed2e5aece3a35c98f
+DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec75797d91ccd6f1df4afd7187878adbb8d99c9e8a3b11c6027703b2e8d06785299d93d8649f3eda7f356dd2a6734d99d05b SHA512 2ef08c9be45434401f916d54b3739f52d255f8a3a4ce05a717499250c2333eeaf601f1d18085b878c027c609f44da74d0151f5bfc2c9ae1e01166919a91a1d2b
+DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.71.1-fix-bootstrap-version-comparison.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.71.1-fix-bootstrap-version-comparison.patch
deleted file mode 100644
index 8857c4b7658..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.71.1-fix-bootstrap-version-comparison.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-https://github.com/rust-lang/rust/pull/114440
-From: Ariadne Conill <ariadne@dereferenced.org>
-Date: Thu, 3 Aug 2023 15:05:40 -0700
-Subject: [PATCH] bootstrap: config: fix version comparison bug
-
-Rust requires a previous version of Rust to build, such as the current version, or the
-previous version.  However, the version comparison logic did not take patch releases
-into consideration when doing the version comparison for the current branch, e.g.
-Rust 1.71.1 could not be built by Rust 1.71.0 because it is neither an exact version
-match, or the previous version.
-
-Adjust the version comparison logic to tolerate mismatches in the patch version.
-
-Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
---- a/src/bootstrap/config.rs
-+++ b/src/bootstrap/config.rs
-@@ -2004,7 +2004,8 @@ impl Config {
-                 .unwrap();
-         if !(source_version == rustc_version
-             || (source_version.major == rustc_version.major
--                && source_version.minor == rustc_version.minor + 1))
-+                && (source_version.minor == rustc_version.minor
-+                    || source_version.minor == rustc_version.minor + 1)))
-         {
-             let prev_version = format!("{}.{}.x", source_version.major, source_version.minor - 1);
-             eprintln!(
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.86.0-znver.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.86.0-znver.patch
new file mode 100644
index 00000000000..5b93a76e653
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.86.0-znver.patch
@@ -0,0 +1,186 @@
+https://github.com/rust-lang/rust/issues/138054
+https://bugs.gentoo.org/953109#c7
+diff --git a/library/portable-simd/crates/core_simd/src/lib.rs b/library/portable-simd/crates/core_simd/src/lib.rs
+index 7f57847c9c234..717b882b64ba1 100644
+--- a/library/portable-simd/crates/core_simd/src/lib.rs
++++ b/library/portable-simd/crates/core_simd/src/lib.rs
+@@ -35,7 +35,11 @@
+     feature(stdarch_x86_avx512)
+ )]
+ #![warn(missing_docs, clippy::missing_inline_in_public_items)] // basically all items, really
+-#![deny(unsafe_op_in_unsafe_fn, clippy::undocumented_unsafe_blocks)]
++#![deny(
++    unsafe_op_in_unsafe_fn,
++    unreachable_pub,
++    clippy::undocumented_unsafe_blocks
++)]
+ #![doc(test(attr(deny(warnings))))]
+ #![allow(internal_features)]
+ #![unstable(feature = "portable_simd", issue = "86656")]
+diff --git a/library/portable-simd/crates/core_simd/src/masks/bitmask.rs b/library/portable-simd/crates/core_simd/src/masks/bitmask.rs
+index db4312d5bf88a..8221d8f17e90e 100644
+--- a/library/portable-simd/crates/core_simd/src/masks/bitmask.rs
++++ b/library/portable-simd/crates/core_simd/src/masks/bitmask.rs
+@@ -5,7 +5,7 @@ use core::marker::PhantomData;
+ 
+ /// A mask where each lane is represented by a single bit.
+ #[repr(transparent)]
+-pub struct Mask<T, const N: usize>(
++pub(crate) struct Mask<T, const N: usize>(
+     <LaneCount<N> as SupportedLaneCount>::BitMask,
+     PhantomData<T>,
+ )
+@@ -78,7 +78,7 @@ where
+ {
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub fn splat(value: bool) -> Self {
++    pub(crate) fn splat(value: bool) -> Self {
+         let mut mask = <LaneCount<N> as SupportedLaneCount>::BitMask::default();
+         if value {
+             mask.as_mut().fill(u8::MAX)
+@@ -93,12 +93,12 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub unsafe fn test_unchecked(&self, lane: usize) -> bool {
++    pub(crate) unsafe fn test_unchecked(&self, lane: usize) -> bool {
+         (self.0.as_ref()[lane / 8] >> (lane % 8)) & 0x1 > 0
+     }
+ 
+     #[inline]
+-    pub unsafe fn set_unchecked(&mut self, lane: usize, value: bool) {
++    pub(crate) unsafe fn set_unchecked(&mut self, lane: usize, value: bool) {
+         unsafe {
+             self.0.as_mut()[lane / 8] ^= ((value ^ self.test_unchecked(lane)) as u8) << (lane % 8)
+         }
+@@ -106,7 +106,7 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new vector and does not mutate the original value"]
+-    pub fn to_int(self) -> Simd<T, N> {
++    pub(crate) fn to_int(self) -> Simd<T, N> {
+         unsafe {
+             core::intrinsics::simd::simd_select_bitmask(
+                 self.0,
+@@ -118,19 +118,19 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub unsafe fn from_int_unchecked(value: Simd<T, N>) -> Self {
++    pub(crate) unsafe fn from_int_unchecked(value: Simd<T, N>) -> Self {
+         unsafe { Self(core::intrinsics::simd::simd_bitmask(value), PhantomData) }
+     }
+ 
+     #[inline]
+-    pub fn to_bitmask_integer(self) -> u64 {
++    pub(crate) fn to_bitmask_integer(self) -> u64 {
+         let mut bitmask = [0u8; 8];
+         bitmask[..self.0.as_ref().len()].copy_from_slice(self.0.as_ref());
+         u64::from_ne_bytes(bitmask)
+     }
+ 
+     #[inline]
+-    pub fn from_bitmask_integer(bitmask: u64) -> Self {
++    pub(crate) fn from_bitmask_integer(bitmask: u64) -> Self {
+         let mut bytes = <LaneCount<N> as SupportedLaneCount>::BitMask::default();
+         let len = bytes.as_mut().len();
+         bytes
+@@ -141,7 +141,7 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub fn convert<U>(self) -> Mask<U, N>
++    pub(crate) fn convert<U>(self) -> Mask<U, N>
+     where
+         U: MaskElement,
+     {
+@@ -151,13 +151,13 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub fn any(self) -> bool {
++    pub(crate) fn any(self) -> bool {
+         self != Self::splat(false)
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub fn all(self) -> bool {
++    pub(crate) fn all(self) -> bool {
+         self == Self::splat(true)
+     }
+ }
+diff --git a/library/portable-simd/crates/core_simd/src/masks/full_masks.rs b/library/portable-simd/crates/core_simd/src/masks/full_masks.rs
+index ae55cf1f8fa87..a693ea90b9cb8 100644
+--- a/library/portable-simd/crates/core_simd/src/masks/full_masks.rs
++++ b/library/portable-simd/crates/core_simd/src/masks/full_masks.rs
+@@ -3,7 +3,7 @@
+ use crate::simd::{LaneCount, MaskElement, Simd, SupportedLaneCount};
+ 
+ #[repr(transparent)]
+-pub struct Mask<T, const N: usize>(Simd<T, N>)
++pub(crate) struct Mask<T, const N: usize>(Simd<T, N>)
+ where
+     T: MaskElement,
+     LaneCount<N>: SupportedLaneCount;
+@@ -103,36 +103,36 @@ where
+ {
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub fn splat(value: bool) -> Self {
++    pub(crate) fn splat(value: bool) -> Self {
+         Self(Simd::splat(if value { T::TRUE } else { T::FALSE }))
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub unsafe fn test_unchecked(&self, lane: usize) -> bool {
++    pub(crate) unsafe fn test_unchecked(&self, lane: usize) -> bool {
+         T::eq(self.0[lane], T::TRUE)
+     }
+ 
+     #[inline]
+-    pub unsafe fn set_unchecked(&mut self, lane: usize, value: bool) {
++    pub(crate) unsafe fn set_unchecked(&mut self, lane: usize, value: bool) {
+         self.0[lane] = if value { T::TRUE } else { T::FALSE }
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new vector and does not mutate the original value"]
+-    pub fn to_int(self) -> Simd<T, N> {
++    pub(crate) fn to_int(self) -> Simd<T, N> {
+         self.0
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub unsafe fn from_int_unchecked(value: Simd<T, N>) -> Self {
++    pub(crate) unsafe fn from_int_unchecked(value: Simd<T, N>) -> Self {
+         Self(value)
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new mask and does not mutate the original value"]
+-    pub fn convert<U>(self) -> Mask<U, N>
++    pub(crate) fn convert<U>(self) -> Mask<U, N>
+     where
+         U: MaskElement,
+     {
+@@ -221,14 +221,14 @@ where
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub fn any(self) -> bool {
++    pub(crate) fn any(self) -> bool {
+         // Safety: use `self` as an integer vector
+         unsafe { core::intrinsics::simd::simd_reduce_any(self.to_int()) }
+     }
+ 
+     #[inline]
+     #[must_use = "method returns a new bool and does not mutate the original value"]
+-    pub fn all(self) -> bool {
++    pub(crate) fn all(self) -> bool {
+         // Safety: use `self` as an integer vector
+         unsafe { core::intrinsics::simd::simd_reduce_all(self.to_int()) }
+     }
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.87.0-znver.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.87.0-znver.patch
new file mode 100644
index 00000000000..11424a41566
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.87.0-znver.patch
@@ -0,0 +1,9 @@
+https://bugs.gentoo.org/956018#c3
+--- a/library/portable-simd/crates/core_simd/src/masks/bitmask.rs
++++ b/library/portable-simd/crates/core_simd/src/masks/bitmask.rs
+@@ -1,4 +1,5 @@
+ #![allow(unused_imports)]
++#![allow(unused_attributes)]
+ use super::MaskElement;
+ use crate::simd::{LaneCount, Simd, SupportedLaneCount};
+ use core::marker::PhantomData;
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.71.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.71.1-r101.ebuild
deleted file mode 100644
index ec66165dfcf..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.71.1-r101.ebuild
+++ /dev/null
@@ -1,718 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( 16 )
-PYTHON_COMPAT=( python3_{10..12} )
-
-RUST_MAX_VER=${PV}
-RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
-
-inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing multilib multilib-build \
-	optfeature python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
-
-if [[ ${PV} = *beta* ]]; then
-	betaver=${PV//*beta}
-	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
-	MY_P="rustc-beta"
-	SRC="${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz"
-else
-	MY_P="rustc-${PV}"
-	SRC="${MY_P}-src.tar.xz"
-	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
-fi
-
-DESCRIPTION="Language empowering everyone to build reliable and efficient software"
-HOMEPAGE="https://www.rust-lang.org/"
-
-SRC_URI="
-	https://static.rust-lang.org/dist/${SRC}
-	verify-sig? ( https://static.rust-lang.org/dist/${SRC}.asc )
-"
-S="${WORKDIR}/${MY_P}-src"
-
-# keep in sync with llvm ebuild of the same version as bundled one.
-ALL_LLVM_TARGETS=( AArch64 AMDGPU ARM AVR BPF Hexagon Lanai LoongArch Mips MSP430
-	NVPTX PowerPC RISCV Sparc SystemZ VE WebAssembly X86 XCore )
-ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
-LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
-
-# https://github.com/rust-lang/llvm-project/blob/rustc-1.71.0/llvm/CMakeLists.txt
-_ALL_RUST_EXPERIMENTAL_TARGETS=()
-declare -A ALL_RUST_EXPERIMENTAL_TARGETS
-for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
-	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
-done
-
-LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4 UoI-NCSA"
-SLOT="${PV}"
-
-IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto miri nightly parallel-compiler rustfmt rust-analyzer rust-src system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
-
-LLVM_DEPEND=()
-# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
-for _x in "${ALL_LLVM_TARGETS[@]}"; do
-	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
-	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
-		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
-	fi
-done
-LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
-LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
-
-BDEPEND="${PYTHON_DEPS}
-	app-eselect/eselect-rust
-	|| (
-		>=sys-devel/gcc-4.7[cxx]
-		>=llvm-core/clang-3.5
-	)
-	!system-llvm? (
-		>=dev-build/cmake-3.13.4
-		app-alternatives/ninja
-	)
-	test? ( dev-debug/gdb )
-	verify-sig? ( sec-keys/openpgp-keys-rust )
-"
-
-DEPEND="
-	>=app-arch/xz-utils-5.2
-	net-misc/curl:=[http2,ssl]
-	sys-libs/zlib:=
-	dev-libs/openssl:0=
-	system-llvm? (
-		${LLVM_DEPEND[*]}
-		llvm-libunwind? ( llvm-runtimes/libunwind:= )
-	)
-	!system-llvm? (
-		!llvm-libunwind? (
-			elibc_musl? ( sys-libs/libunwind:= )
-		)
-	)
-"
-
-RDEPEND="${DEPEND}
-	app-eselect/eselect-rust
-	dev-lang/rust-common
-	sys-apps/lsb-release
-	!dev-lang/rust:stable
-	!dev-lang/rust-bin:stable
-"
-
-REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
-	miri? ( nightly )
-	parallel-compiler? ( nightly )
-	rust-analyzer? ( rust-src )
-	test? ( ${ALL_LLVM_TARGETS[*]} )
-	wasm? ( llvm_targets_WebAssembly )
-	x86? ( cpu_flags_x86_sse2 )
-"
-
-# we don't use cmake.eclass, but can get a warning
-CMAKE_WARN_UNUSED_CLI=no
-
-QA_FLAGS_IGNORED="
-	usr/lib/${PN}/${PV}/bin/.*
-	usr/lib/${PN}/${PV}/libexec/.*
-	usr/lib/${PN}/${PV}/lib/lib.*.so
-	usr/lib/${PN}/${PV}/lib/rustlib/.*/bin/.*
-	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/lib.*.so
-"
-
-QA_SONAME="
-	usr/lib/${PN}/${PV}/lib/lib.*.so.*
-	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/lib.*.so
-"
-
-QA_PRESTRIPPED="
-	usr/lib/${PN}/${PV}/lib/rustlib/.*/bin/rust-llvm-dwp
-	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/self-contained/crtn.o
-"
-
-# An rmeta file is custom binary format that contains the metadata for the crate.
-# rmeta files do not support linking, since they do not contain compiled object files.
-# so we can safely silence the warning for this QA check.
-QA_EXECSTACK="usr/lib/${PN}/${PV}/lib/rustlib/*/lib*.rlib:lib.rmeta"
-
-# causes double bootstrap
-RESTRICT="test"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
-
-PATCHES=(
-	"${FILESDIR}"/1.71.1-fix-bootstrap-version-comparison.patch
-	"${FILESDIR}"/1.70.0-ignore-broken-and-non-applicable-tests.patch
-	"${FILESDIR}"/1.62.1-musl-dynamic-linking.patch
-	"${FILESDIR}"/1.67.0-doc-wasm.patch
-)
-
-toml_usex() {
-	usex "${1}" true false
-}
-
-pre_build_checks() {
-	local M=9216
-	# multiply requirements by 1.3 if we are doing x86-multilib
-	if use amd64; then
-		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
-	fi
-	M=$(( $(usex clippy 128 0) + ${M} ))
-	M=$(( $(usex miri 128 0) + ${M} ))
-	M=$(( $(usex rustfmt 256 0) + ${M} ))
-	# add 2G if we compile llvm and 256M per llvm_target
-	if ! use system-llvm; then
-		M=$(( 2048 + ${M} ))
-		local ltarget
-		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
-			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
-		done
-	fi
-	M=$(( $(usex wasm 256 0) + ${M} ))
-	M=$(( $(usex debug 2 1) * ${M} ))
-	eshopts_push -s extglob
-	if is-flagq '-g?(gdb)?([1-9])'; then
-		M=$(( 15 * ${M} / 10 ))
-	fi
-	eshopts_pop
-	M=$(( $(usex doc 256 0) + ${M} ))
-	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
-}
-
-llvm_check_deps() {
-	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
-}
-
-# Is LLVM being linked against libc++?
-is_libcxx_linked() {
-	local code='#include <ciso646>
-#if defined(_LIBCPP_VERSION)
-	HAVE_LIBCXX
-#endif
-'
-	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
-	[[ ${out} == *HAVE_LIBCXX* ]]
-}
-
-pkg_pretend() {
-	pre_build_checks
-}
-
-pkg_setup() {
-	pre_build_checks
-	python-any-r1_pkg_setup
-
-	export LIBGIT2_NO_PKG_CONFIG=1 #749381
-
-	rust_pkg_setup
-
-	if use system-llvm; then
-		llvm-r1_pkg_setup
-
-		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
-		export LLVM_LINK_SHARED=1
-		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
-	fi
-}
-
-src_configure() {
-	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
-
-	local rust_target="" rust_targets="" arch_cflags
-
-	# Collect rust target names to compile standard libs for all ABIs.
-	for v in $(multilib_get_enabled_abi_pairs); do
-		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
-	done
-	if use wasm; then
-		rust_targets+=",\"wasm32-unknown-unknown\""
-		if use system-llvm; then
-			# un-hardcode rust-lld linker for this target
-			# https://bugs.gentoo.org/715348
-			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/wasm_base.rs || die
-		fi
-	fi
-	rust_targets="${rust_targets#,}"
-
-	# cargo and rustdoc are mandatory and should always be included
-	local tools='"cargo","rustdoc", "rust-demangler"'
-	use clippy && tools+=',"clippy"'
-	use miri && tools+=',"miri"'
-	use rustfmt && tools+=',"rustfmt"'
-	use rust-analyzer && tools+=',"rust-analyzer"'
-	use rust-src && tools+=',"src"'
-
-	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
-	# in case of prefix it will be already prefixed, as --print sysroot returns full path
-	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
-
-	rust_target="$(rust_abi)"
-
-	RUST_EXPERIMENTAL_TARGETS=()
-	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
-		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
-			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
-		fi
-	done
-	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
-
-	local cm_btype="$(usex debug DEBUG RELEASE)"
-	cat <<- _EOF_ > "${S}"/config.toml
-		changelog-seen = 2
-		[llvm]
-		download-ci-llvm = false
-		optimize = $(toml_usex !debug)
-		release-debuginfo = $(toml_usex debug)
-		assertions = $(toml_usex debug)
-		ninja = true
-		targets = "${LLVM_TARGETS// /;}"
-		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
-		link-shared = $(toml_usex system-llvm)
-		$(if is_libcxx_linked; then
-			# https://bugs.gentoo.org/732632
-			echo "use-libcxx = true"
-			echo "static-libstdcpp = false"
-		fi)
-		$(case "${rust_target}" in
-			i586-*-linux-*)
-				# https://github.com/rust-lang/rust/issues/93059
-				echo 'cflags = "-fcf-protection=none"'
-				echo 'cxxflags = "-fcf-protection=none"'
-				echo 'ldflags = "-fcf-protection=none"'
-				;;
-			*)
-				;;
-		esac)
-		enable-warnings = false
-		[llvm.build-config]
-		CMAKE_VERBOSE_MAKEFILE = "ON"
-		CMAKE_C_FLAGS_${cm_btype} = "${CFLAGS}"
-		CMAKE_CXX_FLAGS_${cm_btype} = "${CXXFLAGS}"
-		CMAKE_EXE_LINKER_FLAGS_${cm_btype} = "${LDFLAGS}"
-		CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = "${LDFLAGS}"
-		CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = "${LDFLAGS}"
-		CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = "${ARFLAGS}"
-		[build]
-		build-stage = 2
-		test-stage = 2
-		build = "${rust_target}"
-		host = ["${rust_target}"]
-		target = [${rust_targets}]
-		cargo = "${rust_stage0_root}/bin/cargo"
-		rustc = "${rust_stage0_root}/bin/rustc"
-		rustfmt = "${rust_stage0_root}/bin/rustfmt"
-		docs = $(toml_usex doc)
-		compiler-docs = false
-		submodules = false
-		python = "${EPYTHON}"
-		locked-deps = true
-		vendor = true
-		extended = true
-		tools = [${tools}]
-		verbose = 2
-		sanitizers = false
-		profiler = true
-		cargo-native-static = false
-		[install]
-		prefix = "${EPREFIX}/usr/lib/${PN}/${PV}"
-		sysconfdir = "etc"
-		docdir = "share/doc/rust"
-		bindir = "bin"
-		libdir = "lib"
-		mandir = "share/man"
-		[rust]
-		# https://github.com/rust-lang/rust/issues/54872
-		codegen-units-std = 1
-		optimize = true
-		debug = $(toml_usex debug)
-		debug-assertions = $(toml_usex debug)
-		debug-assertions-std = $(toml_usex debug)
-		debuginfo-level = $(usex debug 2 0)
-		debuginfo-level-rustc = $(usex debug 2 0)
-		debuginfo-level-std = $(usex debug 2 0)
-		debuginfo-level-tools = $(usex debug 2 0)
-		debuginfo-level-tests = 0
-		backtrace = true
-		incremental = false
-		default-linker = "${CHOST}-cc"
-		parallel-compiler = $(toml_usex parallel-compiler)
-		channel = "$(usex nightly nightly stable)"
-		description = "gentoo"
-		rpath = true
-		verbose-tests = true
-		optimize-tests = $(toml_usex !debug)
-		codegen-tests = true
-		dist-src = false
-		remap-debuginfo = true
-		lld = $(usex system-llvm false $(toml_usex wasm))
-		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
-		# https://github.com/rust-lang/rust/issues/74976
-		# https://github.com/rust-lang/rust/issues/76526
-		deny-warnings = $(usex wasm $(usex doc false true) true)
-		backtrace-on-ice = true
-		jemalloc = false
-		lto = "$(usex lto fat off)"
-		[dist]
-		src-tarball = false
-		compression-formats = ["xz"]
-		compression-profile = "balanced"
-	_EOF_
-
-	for v in $(multilib_get_enabled_abi_pairs); do
-		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
-		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
-
-		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
-
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.${rust_target}]
-			ar = "$(tc-getAR)"
-			cc = "$(tc-getCC)"
-			cxx = "$(tc-getCXX)"
-			linker = "$(tc-getCC)"
-			ranlib = "$(tc-getRANLIB)"
-			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
-		_EOF_
-		if use system-llvm; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
-			_EOF_
-		fi
-		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
-		# but we patch it and set to false here as well
-		if use elibc_musl; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				crt-static = false
-			_EOF_
-		fi
-	done
-	if use wasm; then
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.wasm32-unknown-unknown]
-			linker = "$(usex system-llvm lld rust-lld)"
-			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
-			profiler = false
-		_EOF_
-	fi
-
-	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
-	# experimental cross support
-	# discussion: https://bugs.gentoo.org/679878
-	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
-	# it would be much better if we could split out stdlib
-	# complilation to separate ebuild and abuse CATEGORY to
-	# just install to /usr/lib/rustlib/<target>
-
-	# extra targets defined as a bash array
-	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
-	# best place would be /etc/portage/env/dev-lang/rust
-	# Example:
-	# RUST_CROSS_TARGETS=(
-	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
-	# )
-	# no extra hand holding is done, no target transformations, all
-	# values are passed as-is with just basic checks, so it's up to user to supply correct values
-	# valid rust targets can be obtained with
-	# 	rustc --print target-list
-	# matching cross toolchain has to be installed
-	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
-	# only gcc toolchains installed with crossdev are checked for now.
-
-	# BUG: we can't pass host flags to cross compiler, so just filter for now
-	# BUG: this should be more fine-grained.
-	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
-
-	local cross_target_spec
-	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
-		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
-		local cross_llvm_target="${cross_target_spec%%:*}"
-		# extracts toolchain triples, <rust-target>:<CTARGET>
-		local cross_triples="${cross_target_spec#*:}"
-		# extracts first element after before : separator
-		local cross_rust_target="${cross_triples%%:*}"
-		# extracts last element after : separator
-		local cross_toolchain="${cross_triples##*:}"
-		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
-		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
-
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.${cross_rust_target}]
-			ar = "${cross_toolchain}-ar"
-			cc = "${cross_toolchain}-gcc"
-			cxx = "${cross_toolchain}-g++"
-			linker = "${cross_toolchain}-gcc"
-			ranlib = "${cross_toolchain}-ranlib"
-		_EOF_
-		if use system-llvm; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
-			_EOF_
-		fi
-		if [[ "${cross_toolchain}" == *-musl* ]]; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
-			_EOF_
-		fi
-
-		# append cross target to "normal" target list
-		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
-		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
-
-		rust_targets="${rust_targets},\"${cross_rust_target}\""
-		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
-
-		ewarn
-		ewarn "Enabled ${cross_rust_target} rust target"
-		ewarn "Using ${cross_toolchain} cross toolchain"
-		ewarn
-		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
-			ewarn "'sys-devel/binutils[multitarget]' is not installed"
-			ewarn "'strip' will be unable to strip cross libraries"
-			ewarn "cross targets will be installed with full debug information"
-			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
-			ewarn
-			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
-			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
-			ewarn
-		fi
-	done
-	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
-
-	einfo "Rust configured with the following flags:"
-	echo
-	echo RUSTFLAGS="\"${RUSTFLAGS}\""
-	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
-	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
-	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
-	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
-	env | grep "CFLAGS_.*"
-	echo
-	einfo "config.toml contents:"
-	cat "${S}"/config.toml || die
-	echo
-}
-
-src_compile() {
-	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
-}
-
-src_test() {
-	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
-
-	# those are basic and codegen tests.
-	local tests=(
-		codegen
-		codegen-units
-		compile-fail
-		incremental
-		mir-opt
-		pretty
-		run-make
-	)
-
-	# fails if llvm is not built with ALL targets.
-	# and known to fail with system llvm sometimes.
-	use system-llvm || tests+=( assembly )
-
-	# fragile/expensive/less important tests
-	# or tests that require extra builds
-	# TODO: instead of skipping, just make some nonfatal.
-	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
-		tests+=(
-			rustdoc
-			rustdoc-js
-			rustdoc-js-std
-			rustdoc-ui
-			run-make-fulldeps
-			ui
-			ui-fulldeps
-		)
-	fi
-
-	local i failed=()
-	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
-	for i in "${tests[@]}"; do
-		local t="src/test/${i}"
-		einfo "rust_src_test: running ${t}"
-		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
-				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
-		then
-				failed+=( "${t}" )
-				eerror "rust_src_test: ${t} failed"
-		fi
-	done
-
-	if [[ ${#failed[@]} -ne 0 ]]; then
-		eerror "rust_src_test: failure summary: ${failed[@]}"
-		die "aborting due to test failures"
-	fi
-}
-
-src_install() {
-	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
-
-	# bug #689562, #689160
-	rm -v "${ED}/usr/lib/${PN}/${PV}/etc/bash_completion.d/cargo" || die
-	rmdir -v "${ED}/usr/lib/${PN}/${PV}"/etc{/bash_completion.d,} || die
-
-	local symlinks=(
-		cargo
-		rustc
-		rustdoc
-		rust-gdb
-		rust-gdbgui
-		rust-lldb
-		rust-demangler
-	)
-
-	use clippy && symlinks+=( clippy-driver cargo-clippy )
-	use miri && symlinks+=( miri cargo-miri )
-	use rustfmt && symlinks+=( rustfmt cargo-fmt )
-	use rust-analyzer && symlinks+=( rust-analyzer )
-
-	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
-	local i
-	for i in "${symlinks[@]}"; do
-		# we need realpath on /usr/bin/* symlink return version-appended binary path.
-		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
-		# need to fix eselect-rust to remove this hack.
-		local ver_i="${i}-${PV}"
-		if [[ -f "${ED}/usr/lib/${PN}/${PV}/bin/${i}" ]]; then
-			einfo "Installing ${i} symlink"
-			ln -v "${ED}/usr/lib/${PN}/${PV}/bin/${i}" "${ED}/usr/lib/${PN}/${PV}/bin/${ver_i}" || die
-		else
-			ewarn "${i} symlink requested, but source file not found"
-			ewarn "please report this"
-		fi
-		dosym "../lib/${PN}/${PV}/bin/${ver_i}" "/usr/bin/${ver_i}"
-	done
-
-	# symlinks to switch components to active rust in eselect
-	dosym "${PV}/lib" "/usr/lib/${PN}/lib-${PV}"
-	dosym "${PV}/libexec" "/usr/lib/${PN}/libexec-${PV}"
-	dosym "${PV}/share/man" "/usr/lib/${PN}/man-${PV}"
-	dosym "rust/${PV}/lib/rustlib" "/usr/lib/rustlib-${PV}"
-	dosym "../../lib/${PN}/${PV}/share/doc/rust" "/usr/share/doc/${P}"
-
-	newenvd - "50${P}" <<-_EOF_
-		MANPATH="${EPREFIX}/usr/lib/rust/man-${PV}"
-	_EOF_
-
-	rm -rf "${ED}/usr/lib/${PN}/${PV}"/*.old || die
-	rm -rf "${ED}/usr/lib/${PN}/${PV}/bin"/*.old || die
-	rm -rf "${ED}/usr/lib/${PN}/${PV}/doc"/*.old || die
-
-	# note: eselect-rust adds EROOT to all paths below
-	cat <<-_EOF_ > "${T}/provider-${P}"
-		/usr/bin/cargo
-		/usr/bin/rustdoc
-		/usr/bin/rust-demangler
-		/usr/bin/rust-gdb
-		/usr/bin/rust-gdbgui
-		/usr/bin/rust-lldb
-		/usr/lib/rustlib
-		/usr/lib/rust/lib
-		/usr/lib/rust/libexec
-		/usr/lib/rust/man
-		/usr/share/doc/rust
-	_EOF_
-
-	if use clippy; then
-		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
-	fi
-	if use miri; then
-		echo /usr/bin/miri >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
-	fi
-	if use rustfmt; then
-		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
-	fi
-	if use rust-analyzer; then
-		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
-	fi
-
-	insinto /etc/env.d/rust
-	doins "${T}/provider-${P}"
-
-	if use dist; then
-		insinto "/usr/lib/${PN}/${PV}/dist"
-		doins -r "${S}/build/dist/."
-	fi
-}
-
-pkg_preinst() {
-	# 943308 and friends; basically --keep-going can forget to unmerge old rust
-	# but the soft blocker allows us to install conflicting files.
-	# This results in duplicated .{rlib,so} files which confuses rustc and results in
-	# the need for manual intervention.
-	if has_version -b "dev-lang/rust:stable/$(ver_cut 1-2)"; then
-		# we need to find all .{rlib,so} files in the old rust lib directory
-		# and store them in an array for later use
-		readarray -d '' old_rust_libs < <(
-			find "${EROOT}/usr/lib/rust/${PV}/lib/rustlib" \
-			-type f \( -name '*.rlib' -o -name '*.so' \) -print0)
-		export old_rust_libs
-		if [[ ${#old_rust_libs[@]} -gt 0 ]]; then
-			einfo "Found old .rlib and .so files in the old rust lib directory"
-		else
-			die "Found no old .rlib and .so files but old rust version is installed. Bailing!"
-		fi
-	fi
-}
-
-pkg_postinst() {
-
-	local old_rust="dev-lang/rust:stable/$(ver_cut 1-2)"
-	if has_version -b ${old_rust}; then
-		# Be _extra_ careful here as we're removing files from the live filesystem
-		local f
-		local only_one_file=()
-		einfo "Tidying up libraries files from non-slotted \`${old_rust}\`."
-		for f in "${old_rust_libs[@]}"; do
-			[[ -f ${f} ]] || die "old_rust_libs array contains non-existent file"
-			local base_name="${f%-*}"
-			local ext="${f##*.}"
-			local matching_files=("${base_name}"-*.${ext})
-			case ${#matching_files[@]} in
-				2)
-					einfo "Removing old .${ext}: ${f}"
-					rm "${f}" || die
-					;;
-				1)
-					# Turns out fingerprints are not as unique as we'd thought, _sometimes_ they collide,
-					# so we may have already installed over the old file.
-					# We'll warn about this just in case, but it's probably fine.
-					only_one_file+=( "${matching_files[0]}" )
-					;;
-				*)
-					die "Expected one or two files matching ${base_name}-\*.rlib, but found ${#matching_files[@]}"
-					;;
-			esac
-		done
-		if [[ ${#only_one_file} -gt 0 ]]; then
-			einfo "While tidying up non-slotted rust libraries for \`${old_rust}\`,"
-			einfo "the following file(s) did not have a duplicate where one was expected:"
-			for f in "${only_one_file[@]}"; do
-				einfo "	* ${f}"
-			done
-			einfo ""
-			einfo "This is unlikely to cause problems; the fingerprint for the library ended up being the same."
-			einfo "However, if you encounter any issues please report them to the Gentoo Rust Team."
-		fi
-	fi
-
-	eselect rust update
-
-	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
-		elog "Rust installs helper scripts for calling GDB and LLDB,"
-		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
-	fi
-
-	optfeature "Emacs support" "app-emacs/rust-mode"
-	optfeature "Vim support" "app-vim/rust-vim"
-}
-
-pkg_postrm() {
-	eselect rust cleanup
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
index 3604d73a750..7c23f41ec51 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
@@ -175,6 +175,7 @@ PATCHES=(
 	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
 	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
 	"${FILESDIR}"/1.67.0-doc-wasm.patch
+	"${FILESDIR}"/1.86.0-znver.patch
 )
 
 clear_vendor_checksums() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250420.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250420.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0.ebuild
index acfa779e1a7..516441d2b6d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0_beta20250420.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 LLVM_COMPAT=( 20 )
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@@ -88,8 +88,10 @@ done
 LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
 LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
 
+# dev-libs/oniguruma is used for documentation
 BDEPEND="${PYTHON_DEPS}
 	app-eselect/eselect-rust
+	dev-libs/oniguruma
 	|| (
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
@@ -174,6 +176,7 @@ PATCHES=(
 	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
 	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
 	"${FILESDIR}"/1.67.0-doc-wasm.patch
+	"${FILESDIR}"/1.87.0-znver.patch
 )
 
 clear_vendor_checksums() {
@@ -327,6 +330,12 @@ src_configure() {
 		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
 	fi
 
+	# Avoid bundled copies of libraries
+	export RUSTONIG_SYSTEM_LIBONIG=1
+	# Need to check if these can be optional
+	#export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
+	#export LIBSSH2_SYS_USE_PKG_CONFIG=1
+
 	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
 
 	local rust_target="" rust_targets="" arch_cflags
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
index bdaabbaded5..d9eff0ee970 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@@ -88,8 +88,10 @@ done
 LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
 LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
 
+# dev-libs/oniguruma is used for documentation
 BDEPEND="${PYTHON_DEPS}
 	app-eselect/eselect-rust
+	dev-libs/oniguruma
 	|| (
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
@@ -327,6 +329,12 @@ src_configure() {
 		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
 	fi
 
+	# Avoid bundled copies of libraries
+	export RUSTONIG_SYSTEM_LIBONIG=1
+	# Need to check if these can be optional
+	#export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
+	#export LIBSSH2_SYS_USE_PKG_CONFIG=1
+
 	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
 
 	local rust_target="" rust_targets="" arch_cflags
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
index 59ff88d02e2..83a553240a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/tcl/tcl-8.6.16.ebuild
@@ -18,7 +18,7 @@ S="${SPARENT}"/unix
 
 LICENSE="tcltk Spencer-99"
 SLOT="0/8.6"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug +threads"
 
 RDEPEND=">=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
index 34648241675..f489f09a68a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/yasm/yasm-1.3.0-r2.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit flag-o-matic toolchain-funcs
+inherit dot-a flag-o-matic toolchain-funcs
 
 if [[ ${PV} == 9999* ]] ; then
 	EGIT_REPO_URI="https://github.com/yasm/yasm.git"
@@ -51,6 +51,8 @@ src_prepare() {
 }
 
 src_configure() {
+	lto-guarantee-fat
+
 	# bug #943747
 	append-flags -std=gnu17
 
@@ -70,3 +72,8 @@ src_test() {
 	# https://bugs.gentoo.org/718870
 	emake -j1 check
 }
+
+src_install() {
+	default
+	strip-lto-bytecode
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7-r1.ebuild
index 59d3603071b..60060425c85 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cowsql/cowsql-1.15.7-r1.ebuild
@@ -16,7 +16,7 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="dev-db/sqlite:3
-	dev-libs/libuv:=
+	=dev-libs/libuv-1.50*:=
 	>=dev-libs/raft-0.18.1:="
 DEPEND="${RDEPEND}
 	test? ( dev-libs/raft[lz4,test] )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
index 7faec8fb4b0..f2ed1b0bde5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/dbus-glib/dbus-glib-0.112.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -46,6 +46,9 @@ multilib_src_configure() {
 	# bug #943768
 	append-cflags -std=gnu17
 
+	# bug #923801
+	append-lfs-flags
+
 	local myconf=(
 		--localstatedir="${EPREFIX}"/var
 		--enable-bash-completion
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
index cdd63bff7f4..1ad8bec40d5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.193.ebuild
@@ -65,6 +65,7 @@ BDEPEND+="
 PATCHES=(
 	"${FILESDIR}"/${PN}-0.189-musl-aarch64-regs.patch
 	"${FILESDIR}"/${PN}-0.191-musl-macros.patch
+	"${FILESDIR}"/${P}-perf.patch
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch
new file mode 100644
index 00000000000..d256d258650
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.193-perf.patch
@@ -0,0 +1,53 @@
+https://sourceware.org/git/?p=elfutils.git;a=commit;h=d05241ce690018548857199bd34d7734c7164679
+https://bugs.gentoo.org/955065
+
+From d05241ce690018548857199bd34d7734c7164679 Mon Sep 17 00:00:00 2001
+From: Serhei Makarov <serhei@serhei.io>
+Date: Mon, 5 May 2025 12:08:55 -0400
+Subject: [PATCH] PR32930 backends/: guard asm/perf_regs.h include
+
+asm/perf_regs.h is an arch-specific linux include, not present on
+architectures like hppa and m68k that lack perf_events support.
+
+Only one place we need to fix; others already guard the include by
+architecture, or use architecture-independent headers (e.g.
+linux/perf_events.h).
+
+* backends/libebl_PERF_FLAGS.h: Only include asm/perf_regs.h on
+  architectures where we use it.
+
+Signed-off-by: Serhei Makarov <serhei@serhei.io>
+---
+ backends/libebl_PERF_FLAGS.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/backends/libebl_PERF_FLAGS.h b/backends/libebl_PERF_FLAGS.h
+index 2ed45f0f..51c20ea6 100644
+--- a/backends/libebl_PERF_FLAGS.h
++++ b/backends/libebl_PERF_FLAGS.h
+@@ -32,8 +32,12 @@
+ #define _LIBEBL_PERF_FLAGS_H 1
+ 
+ #if defined(__linux__)
++/* XXX Need to exclude __linux__ arches without perf_regs.h. */
++#if defined(__x86_64__) || defined(__i386__)
++/* || defined(other_architecture)... */
+ # include <asm/perf_regs.h>
+ #endif
++#endif
+ 
+ #if defined(_ASM_X86_PERF_REGS_H)
+ /* See the code in x86_initreg_sample.c for list of required regs and
+@@ -49,8 +53,8 @@
+    see the code in tools/perf/util/intel-pt.c intel_pt_add_gp_regs()
+    and note how regs are added in the same order as the perf_regs.h enum.  */
+ #else
+-/* Since asm/perf_regs.h gives the register layout for a different arch,
+-   we can't unwind x86_64 frames.  */
++/* Since asm/perf_regs.h is absent, or gives the register layout for a
++   different arch, we can't unwind i386 and x86_64 frames. */
+ #define PERF_FRAME_REGISTERS_I386 0
+ #define PERF_FRAME_REGISTERS_X86_64 0
+ #endif
+-- 
+2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
index d3bd2aab46c..f351849b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
@@ -3,5 +3,6 @@ DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
 DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
+DIST glib-2.84.2.tar.xz 5617588 BLAKE2B 31592cbeca58f03c138a02b0cd953b6bd2cdcbfa39283241affd1bff439d6376f0420b4b715856963c64903f3646cf89890f709f514a85d93fb3bbe26b99d516 SHA512 430928d7d7a442fc3927ca943f2569035fe8768768a0ebc6720ae1ef152b56fc5f8d4215d21b4828cc2f39a8632c907ed2c52a0c8566da1c533a2e049a1a121f
 DIST gobject-introspection-1.80.1.tar.xz 1040228 BLAKE2B 7a8c1da9bc8aef293deedde1eed97536fa2f42f79a9761ac8ededb0676e46b636545a69e20e63d812844aeb626fa4fb7ce3c7922e51554fdc79560f16443acd9 SHA512 f45c2c1b105086488d974c6134db9910746df8edb187772f2ecd249656a1047c8ac88ba51f5bf7393c3d99c3ace143ecd09be256c2f4d0ceee110c9ad51a839a
 DIST gobject-introspection-1.82.0.tar.xz 1052872 BLAKE2B 8336ae26d48a71a203655d9d268076f603055ceabb55dbfa676f2c67b4096b83afc106d485dc45d02b3a8be806f9ef50d54806a82e61f2a252ae59543c61e934 SHA512 e139fadb4174c72b648914f3774d89fc0e5eaee45bba0c13edf05de883664dad8276dbc34006217bb09871ed4bad23adab51ff232a17b9eb131329b2926cafb7
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
index e7fad17bc48..3b5d51599f5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.6.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -173,6 +173,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -245,6 +250,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
index 246b5d60c86..d9251be8853 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.80.5-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -210,6 +210,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -237,6 +242,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -388,6 +405,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
index a134d8d3560..db2270f0b02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.82.5.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -198,6 +198,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -225,6 +230,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -376,6 +393,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
index 0ec8e828545..ed8c98dbf27 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -202,6 +202,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -229,6 +234,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -380,6 +397,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
index fb9437f28ee..ea49a52a6f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 PYTHON_REQ_USE="xml(+)"
 PYTHON_COMPAT=( python3_{11..13} )
 
-inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
 
 DESCRIPTION="The GLib library of C routines"
 HOMEPAGE="https://www.gtk.org/"
@@ -203,6 +203,11 @@ src_prepare() {
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
 }
 
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
 multilib_src_configure() {
 	# TODO: figure a way to pass appropriate values for all cross properties
 	# that glib uses (search for get_cross_property)
@@ -230,6 +235,18 @@ multilib_src_configure() {
 			return 0
 		fi
 
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
 		return 1
 	}
 
@@ -381,6 +398,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	# These are installed by dev-util/glib-utils
 	# TODO: With patching we might be able to get rid of the python-any deps
 	# and removals, and test depend on glib-utils instead; revisit now with
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.2.ebuild
new file mode 100644
index 00000000000..0d8b582cdb8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.2.ebuild
@@ -0,0 +1,483 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_REQ_USE="xml(+)"
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit dot-a eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+
+DESCRIPTION="The GLib library of C routines"
+HOMEPAGE="https://www.gtk.org/"
+
+INTROSPECTION_PN="gobject-introspection"
+INTROSPECTION_PV="1.82.0"
+INTROSPECTION_P="${INTROSPECTION_PN}-${INTROSPECTION_PV}"
+SRC_URI="
+	${SRC_URI}
+	introspection? ( mirror://gnome/sources/gobject-introspection/${INTROSPECTION_PV%.*}/gobject-introspection-${INTROSPECTION_PV}.tar.${GNOME_TARBALL_SUFFIX} )
+"
+INTROSPECTION_SOURCE_DIR="${WORKDIR}/${INTROSPECTION_P}"
+INTROSPECTION_BUILD_DIR="${WORKDIR}/${INTROSPECTION_P}-build"
+
+LICENSE="LGPL-2.1+"
+SLOT="2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="dbus debug +elf doc +introspection +mime selinux static-libs sysprof systemtap test utils xattr"
+RESTRICT="!test? ( test )"
+
+# * elfutils (via libelf) does not build on Windows. gresources are not embedded
+# within ELF binaries on that platform anyway and inspecting ELF binaries from
+# other platforms is not that useful so exclude the dependency in this case.
+# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
+# these are used by GIO, which glib[static-libs] consumers don't really seem
+# to need at all, thus not imposing the deps for now and once some consumers
+# are actually found to static link libgio-2.0.a, we can revisit and either add
+# them or just put the (build) deps in that rare consumer instead of recursive
+# RDEPEND here (due to lack of recursive DEPEND).
+RDEPEND="
+	!<dev-libs/gobject-introspection-1.80.1
+	!<dev-util/gdbus-codegen-${PV}
+	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/libpcre2-10.32:0=[${MULTILIB_USEDEP},unicode(+),static-libs?]
+	>=dev-libs/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
+	introspection? (
+		>=dev-libs/gobject-introspection-common-${INTROSPECTION_PV}
+	)
+	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
+	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
+	xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
+	elf? ( virtual/libelf:0= )
+	sysprof? ( >=dev-util/sysprof-capture-3.40.1:4[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+# libxml2 used for optional tests that get automatically skipped
+BDEPEND="
+	app-text/docbook-xsl-stylesheets
+	>=dev-build/meson-1.4.0
+	dev-libs/libxslt
+	>=sys-devel/gettext-0.19.8
+	doc? ( >=dev-util/gi-docgen-2023.1 )
+	dev-python/docutils
+	systemtap? ( >=dev-debug/systemtap-1.3 )
+	${PYTHON_DEPS}
+	test? ( >=sys-apps/dbus-1.2.14 )
+	virtual/pkgconfig
+
+	introspection? (
+		$(python_gen_any_dep '
+			dev-python/setuptools[${PYTHON_USEDEP}]
+		')
+		virtual/pkgconfig
+		sys-devel/bison
+		app-alternatives/lex
+		${PYTHON_DEPS}
+	)
+"
+# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
+
+PDEPEND="
+	dbus? ( gnome-base/dconf )
+	mime? ( x11-misc/shared-mime-info )
+"
+# shared-mime-info needed for gio/xdgmime, bug #409481
+# dconf is needed to be able to save settings, bug #498436
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/gio-querymodules$(get_exeext)
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.64.1-mark-gdbus-server-auth-test-flaky.patch
+)
+
+python_check_deps() {
+	if use introspection ; then
+		python_has_version "dev-python/setuptools[${PYTHON_USEDEP}]"
+	fi
+}
+
+pkg_setup() {
+	if use kernel_linux ; then
+		CONFIG_CHECK="~INOTIFY_USER"
+		if use test ; then
+			CONFIG_CHECK="~IPV6"
+			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
+		fi
+		linux-info_pkg_setup
+	fi
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use test; then
+		# TODO: Review the test exclusions, especially now with meson
+		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
+		if ! has_version dev-util/desktop-file-utils ; then
+			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
+			ewarn "think on installing it to get these tests run."
+			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
+			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
+		fi
+
+		# gdesktopappinfo requires existing terminal (gnome-terminal or any
+		# other), falling back to xterm if one doesn't exist
+		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
+		#	ewarn "Some tests will be skipped due to missing terminal program"
+		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
+		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready
+		# for backport (or in a bump) and file new issue if still fails
+		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
+		# desktop-app-info/launch* might fail similarly
+		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
+		#fi
+
+		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
+		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
+		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
+
+		ewarn "Tests for search-utils have been skipped"
+		sed -i -e "/search-utils/d" glib/tests/meson.build || die
+
+		# Running gdb inside a test within sandbox is brittle
+		sed -i -e '/self.__gdb = shutil.which("gdb")/s:"gdb":"gdb-idonotexist":' glib/tests/assert-msg-test.py || die
+
+		# Play nice with network-sandbox, but this approach would defeat the purpose of the test
+		#sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
+	else
+		# Don't build tests, also prevents extra deps, bug #512022
+		sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
+	fi
+
+	# Don't build fuzzing binaries - not used
+	sed -i -e '/subdir.*fuzzing/d' meson.build || die
+
+	# gdbus-codegen is a separate package
+	sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
+	sed -i -e '/install : true/d' gio/gdbus-2.0/codegen/meson.build || die
+
+	# Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
+	sed -i -e '/install_dir/d' gio/tests/meson.build || die
+
+	cat > "${T}/glib-test-ld-wrapper" <<-EOF
+		#!/usr/bin/env sh
+		exec \${LD:-ld} "\$@"
+	EOF
+	chmod a+x "${T}/glib-test-ld-wrapper" || die
+	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
+
+	# make default sane for us
+	if use prefix ; then
+		sed -i -e "s:/usr/local:${EPREFIX}/usr:" gio/xdgmime/xdgmime.c || die
+		# bug #308609, without path, bug #314057
+		export PERL=perl
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# fix standards conflicts
+		sed -i \
+			-e 's/\<\(_XOPEN_SOURCE_EXTENDED\)\>/_POSIX_PTHREAD_SEMANTICS/' \
+			-e '/\<_XOPEN_SOURCE\>/s/\<2\>/600/' \
+			meson.build || die
+		sed -i -e '/#define\s\+_POSIX_SOURCE/d' \
+			glib/giounix.c || die
+	fi
+
+	# disable native macOS integrations
+	sed -i -e '/glib_conf.set(.HAVE_\(CARBON\|COCOA\).,/s/true/false/' \
+		meson.build || die
+	sed -i \
+		-e '/AvailabilityMacros.h/d' \
+		gio/giomodule.c || die
+
+	# Link the glib source to the introspection subproject directory so it can be built there first
+	if use introspection ; then
+		ln -s "${S}" "${INTROSPECTION_SOURCE_DIR}/subprojects/glib"
+	fi
+
+	default
+	gnome2_environment_reset
+	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
+}
+
+src_configure() {
+	lto-guarantee-fat
+	meson-multilib_src_configure
+}
+
+multilib_src_configure() {
+	# TODO: figure a way to pass appropriate values for all cross properties
+	# that glib uses (search for get_cross_property)
+	#if tc-is-cross-compiler ; then
+		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
+		# TODO-meson: This should be in meson cross file as 'growing_stack'
+		# property; and more, look at get_cross_property
+		#case ${CHOST} in
+		#hppa*|metag*) export glib_cv_stack_grows=yes ;;
+		#*)            export glib_cv_stack_grows=no ;;
+		#esac
+	#fi
+
+	_need_bootstrap_gi() {
+		if ! multilib_native_use introspection ; then
+			return 1
+		fi
+
+		if ! has_version ">=dev-libs/${INTROSPECTION_P}" ; then
+			return 0
+		fi
+
+		# Is the installed gobject-introspection usable?
+		if ! g-ir-scanner --version &> /dev/null ; then
+			return 0
+		fi
+
+		# Do we somehow have a dev-libs/gobject-introspection installed
+		# with an unsatisfied dependency? (bug #951487)
+		if ! $(tc-getPKG_CONFIG) --cflags gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		# Make sure has_version didn't lie to us while at it as well,
+		# given bug #951487.
+		if ! $(tc-getPKG_CONFIG) --atleast-version=${INTROSPECTION_PV} gobject-introspection-1.0 &> /dev/null ; then
+			return 0
+		fi
+
+		return 1
+	}
+
+	# Build internal copy of gobject-introspection to avoid circular dependency (built for native abi only)
+	if _need_bootstrap_gi ; then
+		einfo "Bootstrapping gobject-introspection..."
+		INTROSPECTION_BIN_DIR="${T}/bootstrap-gi-prefix/usr/bin"
+		INTROSPECTION_LIB_DIR="${T}/bootstrap-gi-prefix/usr/$(get_libdir)"
+
+		local emesonargs=(
+			--prefix="${T}/bootstrap-gi-prefix/usr"
+			-Dpython="${EPYTHON}"
+			-Dbuild_introspection_data=true
+			# Build an internal copy of glib for the internal copy of gobject-introspection
+			--force-fallback-for=glib
+			# Make the paths in pkgconfig files relative as we used to not
+			# do a proper install here and it seems less risky to keep it
+			# this way.
+			-Dpkgconfig.relocatable=true
+
+			# We want as minimal a build as possible here to speed things up
+			# and reduce the risk of failures.
+			-Dglib:selinux=disabled
+			-Dglib:xattr=false
+			-Dglib:libmount=disabled
+			-Dglib:man-pages=disabled
+			-Dglib:dtrace=disabled
+			-Dglib:systemtap=disabled
+			-Dglib:sysprof=disabled
+			-Dglib:documentation=false
+			-Dglib:tests=false
+			-Dglib:installed_tests=false
+			-Dglib:nls=disabled
+			-Dglib:oss_fuzz=disabled
+			-Dglib:libelf=disabled
+			-Dglib:multiarch=false
+		)
+
+		ORIG_SOURCE_DIR=${EMESON_SOURCE}
+		EMESON_SOURCE=${INTROSPECTION_SOURCE_DIR}
+
+		# g-ir-scanner has some relocatable logic but it searches
+		# for 'lib', not 'lib64', so it can't find itself and eventually
+		# falls back to the system installation. See bug #946221.
+		sed -i -e "/^pylibdir =/s:'lib:'$(get_libdir):" "${EMESON_SOURCE}"/tools/g-ir-tool-template.in || die
+
+		ORIG_BUILD_DIR=${BUILD_DIR}
+		BUILD_DIR=${INTROSPECTION_BUILD_DIR}
+
+		pushd ${INTROSPECTION_SOURCE_DIR} || die
+
+		meson_src_configure
+		meson_src_compile
+		# We already provide a prefix in ${T} above. Blank DESTDIR
+		# as it may be set in the environment by Portage (though not
+		# guaranteed in src_configure).
+		meson_src_install --destdir ""
+
+		popd || die
+
+		EMESON_SOURCE=${ORIG_SOURCE_DIR}
+		BUILD_DIR=${ORIG_BUILD_DIR}
+
+		# Add gobject-introspection binaries and pkgconfig files to path
+		export PATH="${INTROSPECTION_BIN_DIR}:${PATH}"
+
+		# Override primary pkgconfig search paths to prioritize our internal copy
+		export PKG_CONFIG_LIBDIR="${INTROSPECTION_LIB_DIR}/pkgconfig:${INTROSPECTION_BUILD_DIR}/meson-private"
+
+		# Set the normal primary pkgconfig search paths as secondary
+		# (We also need to prepend our just-built one for later use of
+		# g-ir-scanner to use the new one and to help workaround bugs like
+		# bug #946221.)
+		export PKG_CONFIG_PATH="${PKG_CONFIG_LIBDIR}:$(pkg-config --variable pc_path pkg-config)"
+
+		# Add the paths to the built glib libraries to the library path so that gobject-introspection can load them
+		for gliblib in glib gobject gthread gmodule gio girepository; do
+			export LD_LIBRARY_PATH="${BUILD_DIR}/${gliblib}:${LD_LIBRARY_PATH}"
+		done
+
+		# Add the path to introspection libraries so that glib can call gir utilities
+		export LD_LIBRARY_PATH="${INTROSPECTION_LIB_DIR}:${LD_LIBRARY_PATH}"
+
+		# Add the paths to the gobject-introspection python modules to python path so they can be imported
+		export PYTHONPATH="${INTROSPECTION_LIB_DIR}/gobject-introspection:${PYTHONPATH}"
+	fi
+
+	# TODO: Can this be cleaned up now we have -Dglib_debug? (bug #946485)
+	use debug && EMESON_BUILD_TYPE=debug
+
+	local emesonargs=(
+		-Ddefault_library=$(usex static-libs both shared)
+		-Druntime_dir="${EPREFIX}"/run
+		$(meson_feature debug glib_debug)
+		$(meson_feature selinux)
+		$(meson_use xattr)
+		-Dlibmount=enabled # only used if host_system == 'linux'
+		-Dman-pages=enabled
+		$(meson_feature systemtap dtrace)
+		$(meson_feature systemtap)
+		$(meson_feature sysprof)
+		$(meson_use doc documentation)
+		$(meson_use test tests)
+		-Dinstalled_tests=false
+		-Dnls=enabled
+		-Doss_fuzz=disabled
+		$(meson_native_use_feature elf libelf)
+		-Dmultiarch=false
+		$(meson_native_use_feature introspection)
+	)
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		local native_file="${T}"/meson.${CHOST}.ini.local
+		cat >> ${native_file} <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+		emesonargs+=( --native-file "${native_file}" )
+	fi
+
+	meson_src_configure
+}
+
+multilib_src_test() {
+	export XDG_CONFIG_DIRS=/etc/xdg
+	export XDG_DATA_DIRS=/usr/local/share:/usr/share
+	# TODO: Use ${ABI} here to be unique for multilib?
+	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
+	export LC_TIME=C # bug #411967
+	export TZ=UTC
+	unset GSETTINGS_BACKEND # bug #596380
+	python_setup
+
+	# https://bugs.gentoo.org/839807
+	local -x SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict /usr/b
+
+	# Related test is a bit nitpicking
+	mkdir -p "$G_DBUS_COOKIE_SHA1_KEYRING_DIR" || die
+	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR" || die
+
+	meson_src_test --timeout-multiplier 20 --no-suite flaky
+}
+
+multilib_src_install() {
+	meson_src_install
+	keepdir /usr/$(get_libdir)/gio/modules
+}
+
+multilib_src_install_all() {
+	strip-lto-bytecode
+
+	# These are installed by dev-util/glib-utils
+	# TODO: With patching we might be able to get rid of the python-any deps
+	# and removals, and test depend on glib-utils instead; revisit now with
+	# meson
+	rm "${ED}/usr/bin/glib-genmarshal" || die
+	rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
+	rm "${ED}/usr/bin/glib-mkenums" || die
+	rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
+	rm "${ED}/usr/bin/gtester-report" || die
+	rm "${ED}/usr/share/man/man1/gtester-report.1" || die
+	# gdbus-codegen manpage installed by dev-util/gdbus-codegen
+	rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
+}
+
+pkg_preinst() {
+	xdg_pkg_preinst
+
+	# Make gschemas.compiled belong to glib alone
+	local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
+
+	if [[ -e ${EROOT}${cache} ]]; then
+		cp "${EROOT}"${cache} "${ED}"/${cache} || die
+	else
+		touch "${ED}"${cache} || die
+	fi
+
+	multilib_pkg_preinst() {
+		# Make giomodule.cache belong to glib alone
+		local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
+
+		if [[ -e ${EROOT}${cache} ]]; then
+			cp "${EROOT}"${cache} "${ED}"${cache} || die
+		else
+			touch "${ED}"${cache} || die
+		fi
+	}
+
+	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
+	# file due to inability to create it and GIO might not look at any of the modules there
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_preinst
+	fi
+}
+
+pkg_postinst() {
+	xdg_pkg_postinst
+	# glib installs no schemas itself, but we force update for fresh install in case
+	# something has dropped in a schemas file without direct glib dep; and for upgrades
+	# in case the compiled schema format could have changed
+	gnome2_schemas_update
+
+	multilib_pkg_postinst() {
+		gnome2_giomodule_cache_update \
+			|| die "Update GIO modules cache failed (for ${ABI})"
+	}
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_postinst
+	else
+		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
+		ewarn "You might want to run gio-querymodules manually on the target for"
+		ewarn "your final image for performance reasons and re-run it when packages"
+		ewarn "installing GIO modules get upgraded or added to the image."
+	fi
+
+	if ver_replacing "-lt" "2.63.6"; then
+		ewarn "glib no longer installs the gio-launch-desktop binary. You may need"
+		ewarn "to restart your session for \"Open With\" dialogs to work."
+	fi
+}
+
+pkg_postrm() {
+	xdg_pkg_postrm
+	gnome2_schemas_update
+
+	if [[ -z ${REPLACED_BY_VERSION} ]]; then
+		multilib_pkg_postrm() {
+			rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache || die
+		}
+		multilib_foreach_abi multilib_pkg_postrm
+		rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
index f5614b08d6b..c0da723e9fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
@@ -12,7 +12,7 @@ S="${WORKDIR}"/inih-r${PV}
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 
 DOCS=( README.md )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
index 24fa3b4d26f..bc87888b557 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
@@ -1 +1,2 @@
+DIST jansson-2.14.1.tar.bz2 482990 BLAKE2B b3efb1cbe018bb88664167249edca65c5194922c69fa82a0514d5bbcd24324464ddcc30ae57f8ab0f9c43f28d2364adc973f87146ceff0889ea2b6eafb91b1ea SHA512 668d8ffbd13b83e8a55449c588f267220c2a9e4690281c2386e3dada4c8b890c80effd6a946b3500bb1cf800eb8cf1bb3da3c6476ceea4f462d2ccc9cd4911d8
 DIST jansson-2.14.tar.bz2 434481 BLAKE2B b7b7e98360fd73f7925b88e3729a7a18307b4f05fed4b37659d24ddc03208469471d508dcd245534f73af3b5e93f595e49e3cb2c99733955b03d471bd5a32f15 SHA512 1a659c0f41b0672757c13ebd16bd10ad7d6484366aefda078aa816266ce4f5638bc121f1ce8c4234b0b9f201ea73c227b9084125857452cbcba058a111e4a6fd
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch
index 0da70dc5afc..5b73aea5c94 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch
@@ -1,3 +1,5 @@
+https://github.com/akheron/jansson/pull/666
+
 From https://github.com/akheron/jansson/pull/666/commits/1e2ac681e5f39fc7a7e8b8deb2162a93976d4622 Mon Sep 17 00:00:00 2001
 From: Violet Purcell <vimproved@inventati.org>
 Date: Wed, 11 Oct 2023 20:51:57 -0400
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14.1-default-symver-test.patch b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14.1-default-symver-test.patch
new file mode 100644
index 00000000000..6f5bbcc0788
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/files/jansson-2.14.1-default-symver-test.patch
@@ -0,0 +1,62 @@
+https://github.com/akheron/jansson/issues/715
+
+Modified https://github.com/akheron/jansson/pull/666 with lessons taken from https://github.com/akheron/jansson/pull/704.
+
+From https://github.com/akheron/jansson/pull/666/commits/1e2ac681e5f39fc7a7e8b8deb2162a93976d4622 Mon Sep 17 00:00:00 2001
+From: Violet Purcell <vimproved@inventati.org>
+Date: Wed, 11 Oct 2023 20:51:57 -0400
+Subject: [PATCH] Port check for --default-symver to autoconf
+
+This commit ports the configure check for -Wl,--default-symver that is
+present in CMake to autoconf. This fixes building Jansson via autoconf
+with non-bfd linkers on glibc systems.
+
+Signed-off-by: Violet Purcell <vimproved@inventati.org>
+--- a/configure.ac
++++ b/configure.ac
+@@ -25,6 +25,9 @@ AC_TYPE_UINT16_T
+ AC_TYPE_UINT8_T
+ AC_TYPE_LONG_LONG_INT
+ 
++jansson_soversion="4"
++AC_SUBST([jansson_soversion])
++
+ AC_C_INLINE
+ case $ac_cv_c_inline in
+     yes) json_inline=inline;;
+@@ -138,8 +141,12 @@ AS_IF([test "x$with_Bsymbolic" = "xyes"], [JSON_BSYMBOLIC_LDFLAGS=-Wl[,]-Bsymbol
+ AC_SUBST(JSON_BSYMBOLIC_LDFLAGS)
+ 
+ # Enable symbol versioning on GNU libc
++m4_pattern_forbid([^AX_CHECK_LINK_FLAG$])
+ JSON_SYMVER_LDFLAGS=
+-AC_CHECK_DECL([__GLIBC__], [JSON_SYMVER_LDFLAGS=-Wl,--default-symver])
++AC_CHECK_DECL([__GLIBC__],
++  [AX_CHECK_LINK_FLAG([-Wl,--default-symver],
++    [JSON_SYMVER_LDFLAGS=-Wl,--default-symver],
++    [JSON_SYMVER_LDFLAGS=-Wl,--version-script,$ac_abs_confdir/jansson.sym])])
+ AC_SUBST([JSON_SYMVER_LDFLAGS])
+ 
+ AC_ARG_ENABLE([ossfuzzers],
+@@ -168,6 +175,7 @@ AC_SUBST([AM_CFLAGS])
+ 
+ AC_CONFIG_FILES([
+         jansson.pc
++	jansson.sym
+         Makefile
+         doc/Makefile
+         src/Makefile
+--- /dev/null
++++ b/jansson.sym.in
+@@ -0,0 +1,8 @@
++JANSSON_@jansson_soversion@ {
++	global:
++		json_*;
++		jansson_*;
++	local:
++		*;
++};
++
+-- 
+2.42.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14.1.ebuild
new file mode 100644
index 00000000000..bba913be160
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14.1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="C library for encoding, decoding and manipulating JSON data"
+HOMEPAGE="https://www.digip.org/jansson/"
+SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.bz2"
+
+LICENSE="MIT"
+SLOT="0/4"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+IUSE="doc static-libs"
+
+BDEPEND="
+	dev-build/autoconf-archive
+	doc? ( dev-python/sphinx )
+"
+
+PATCHES=(
+	"${FILESDIR}"/jansson-2.14.1-default-symver-test.patch
+)
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf $(use_enable static-libs static)
+}
+
+src_compile() {
+	default
+
+	if use doc ; then
+		emake html
+		HTML_DOCS=( doc/_build/html/. )
+	fi
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113.ebuild
deleted file mode 100644
index 2470933b123..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit multilib-minimal toolchain-funcs flag-o-matic usr-ldscript
-
-DESCRIPTION="Asynchronous input/output library that uses the kernels native interface"
-HOMEPAGE="https://pagure.io/libaio"
-if [[ ${PV} == 9999 ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://pagure.io/libaio.git"
-else
-	SRC_URI="https://releases.pagure.org/${PN}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-fi
-LICENSE="LGPL-2"
-SLOT="0"
-IUSE="static-libs test"
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.3.112-cppflags.patch
-	"${FILESDIR}"/${PN}-0.3.113-respect-LDFLAGS.patch
-	"${FILESDIR}"/${PN}-0.3.113-32-bit-tests.patch
-)
-
-src_prepare() {
-	default
-
-	local sed_args=(
-		-e "/^prefix=/s:/usr:${EPREFIX}/usr:"
-		-e '/^libdir=/s:lib$:$(ABI_LIBDIR):'
-		-e 's:-Werror ::'
-	)
-	if ! use static-libs; then
-		sed_args+=( -e '/\tinstall .*\/libaio.a/d' )
-		# Tests require the static library to be built.
-		use test || sed_args+=( -e '/^all_targets +=/s/ libaio.a//' )
-	fi
-	sed -i "${sed_args[@]}" src/Makefile harness/Makefile Makefile || die
-
-	multilib_copy_sources
-}
-
-multilib_src_configure() {
-	# Upstream aren't interested in fixing: bug #855698
-	filter-lto
-
-	if use arm ; then
-		# When building for thumb, we can't allow frame pointers.
-		# http://crbug.com/464517
-		if $(tc-getCPP) ${CFLAGS} ${CPPFLAGS} - <<<$'#ifndef __thumb__\n#error\n#endif' >&/dev/null ; then
-			append-flags -fomit-frame-pointer
-		fi
-	fi
-}
-
-_emake() {
-	CC="$(tc-getCC)" \
-	AR="$(tc-getAR)" \
-	RANLIB="$(tc-getRANLIB)" \
-	ABI_LIBDIR="$(get_libdir)" \
-	CFLAGS_WERROR= \
-	emake "$@"
-}
-
-multilib_src_compile() {
-	_emake
-}
-
-multilib_src_test() {
-	mkdir -p testdir || die
-
-	# 'make check' breaks with sandbox, 'make partcheck' works
-	_emake partcheck prefix="${S}/src" libdir="${S}/src"
-}
-
-multilib_src_install() {
-	_emake install DESTDIR="${D}"
-}
-
-multilib_src_install_all() {
-	doman man/*
-	dodoc ChangeLog TODO
-
-	# move to / for multipath-tools, bug #325355
-	gen_usr_ldscript -a aio
-
-	# This lib is a bare minimal shim on top of kernel syscalls.
-	export QA_DT_NEEDED=$(find "${ED}" -type f -name 'libaio.so.*' -printf '/%P\n')
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
index 37651c71198..bb710483294 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.11.8.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/guillemjover.asc
-inherit flag-o-matic multilib multilib-minimal verify-sig
+inherit dot-a flag-o-matic libtool multilib multilib-minimal verify-sig
 
 DESCRIPTION="Library to provide useful functions commonly found on BSD systems"
 HOMEPAGE="https://libbsd.freedesktop.org/wiki/ https://gitlab.freedesktop.org/libbsd/libbsd"
@@ -23,7 +23,14 @@ DEPEND="
 "
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-guillemjover )"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 multilib_src_configure() {
+	lto-guarantee-fat
+
 	# Broken (still) with lld-17 (bug #922342, bug #915068)
 	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
 
@@ -38,6 +45,8 @@ multilib_src_configure() {
 
 multilib_src_install() {
 	emake DESTDIR="${D}" install
+	# always strip due to libbsd-ctor.a
+	strip-lto-bytecode #"${ED}"
 
 	find "${ED}" -type f -name "*.la" -delete || die
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
index 182fa14cff1..9f2517d30bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libbsd/libbsd-0.12.1.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/guillemjover.asc
-inherit flag-o-matic multilib multilib-minimal verify-sig
+inherit dot-a flag-o-matic libtool multilib multilib-minimal verify-sig
 
 DESCRIPTION="Library to provide useful functions commonly found on BSD systems"
 HOMEPAGE="https://libbsd.freedesktop.org/wiki/ https://gitlab.freedesktop.org/libbsd/libbsd"
@@ -24,7 +24,14 @@ DEPEND="
 "
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-guillemjover )"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 multilib_src_configure() {
+	lto-guarantee-fat
+
 	# bug #911726
 	filter-flags -fno-semantic-interposition
 
@@ -36,6 +43,8 @@ multilib_src_configure() {
 
 multilib_src_install() {
 	emake DESTDIR="${D}" install
+	# always strip due to libbsd-ctor.a
+	strip-lto-bytecode #"${ED}"
 
 	find "${ED}" -type f -name "*.la" -delete || die
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r3.ebuild
new file mode 100644
index 00000000000..367acc250b2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/libdnet-1.18.0-r3.ebuild
@@ -0,0 +1,116 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..12} )
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+
+inherit autotools distutils-r1
+
+DESCRIPTION="Simplified, portable interface to several low-level networking routines"
+HOMEPAGE="https://github.com/ofalk/libdnet"
+SRC_URI="https://github.com/ofalk/${PN}/archive/${P}.tar.gz"
+S="${WORKDIR}/${PN}-${P}"
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="python test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="
+	dev-libs/libbsd
+	python? (
+		${PYTHON_DEPS}
+		dev-python/netifaces[${PYTHON_USEDEP}]
+	)
+"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	python? (
+		${DISTUTILS_DEPS}
+		dev-python/cython[${PYTHON_USEDEP}]
+	)
+	test? ( dev-libs/check )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.18.0-fix-incompatible-function-pointer.patch"
+)
+
+DOCS=( README.md THANKS )
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e 's/libcheck.a/libcheck.so/g' \
+		configure.ac || die
+	sed -i \
+		-e "s/lib\/libcheck/$(get_libdir)\/libcheck/g" \
+		configure.ac || die
+	sed -i \
+		-e 's|-L$libdir ||g' \
+		dnet-config.in || die
+	sed -i \
+		-e '/^SUBDIRS/s|python||g' \
+		Makefile.am || die
+
+	# Stale e.g. pkg-config macros w/ bashisms
+	rm aclocal.m4 {config,m4}/libtool.m4 || die
+
+	AT_M4DIR="config" eautoreconf
+
+	if use python; then
+		cd python || die
+		distutils-r1_src_prepare
+	fi
+}
+
+src_configure() {
+	econf \
+		$(use_with python) \
+		$(use_enable test check)
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		cd python || die
+		distutils-r1_src_compile
+	fi
+}
+
+src_test() {
+	# https://bugs.gentoo.org/778797#c4
+	# check_ip needs privileges and check_fw can't work on Linux
+	emake check XFAIL_TESTS="check_fw check_ip"
+
+	# Needs network access, tries to access 8.8.8.8 to get IP/interfaces.
+	# We could maybe run a daemon or just patch it to avoid that.
+	#if use python; then
+	#	cd python || die
+	#	distutils-r1_src_test
+	#fi
+}
+
+python_test() {
+	eunittest
+}
+
+src_install() {
+	default
+
+	if use python; then
+		cd python || die
+		unset DOCS
+		distutils-r1_src_install
+	fi
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libevent/libevent-2.1.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libevent/libevent-2.1.12-r1.ebuild
index a1dd4f712b0..326968be46d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libevent/libevent-2.1.12-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libevent/libevent-2.1.12-r1.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit libtool multilib-minimal verify-sig
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
index 703f69f6861..b1d6b56ba60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
@@ -1,4 +1,2 @@
-DIST libffi-3.4.4.tar.gz 1362394 BLAKE2B 189fe1ffe9507f204581b0ab09995dc7e7b761bb4eac7e338e9f5ff81431aebcef6c182c1839c9f9acb2706697a260c67e6d1351cf7e2aed7c4eb5d694f6f8fd SHA512 88680aeb0fa0dc0319e5cd2ba45b4b5a340bc9b4bcf20b1e0613b39cd898f177a3863aa94034d8e23a7f6f44d858a53dcd36d1bb8dee13b751ef814224061889
 DIST libffi-3.4.6.tar.gz 1391684 BLAKE2B af8402a09bdbd59b4e9400d2d71bd5ce98f6f1d981d35d1ab40d77a831b13b32c5bd34ca54ff75999e39f0d8a9c066381fae7a8d6c5216d955e064f929f08b88 SHA512 033d2600e879b83c6bce0eb80f69c5f32aa775bf2e962c9d39fbd21226fa19d1e79173d8eaa0d0157014d54509ea73315ad86842356fc3a303c0831c94c6ab39
-DIST libffi-3.4.7.tar.gz 1393979 BLAKE2B 0dd17b4fd358beb9842889168437443137445a5dba1f0a7e8669ae420d8efb927815c08602c1b1b141acfdfdbaa12b417863402a5c8df5f36519fd3e772d3f37 SHA512 d19f59a5b5d61bd7d9e8a7a74b8bf2e697201a19c247c410c789e93ca8678a4eb9f13c9bee19f129be80ade8514f6b1acb38d66f44d86edd32644ed7bbe31dd6
 DIST libffi-3.4.8.tar.gz 1397992 BLAKE2B 10b3d970dc598fb8689bca49751cda499ddc5216baf89d38625385b0d42d57f10d15cce3c4c044c9c73a4fce384c26f2a8e1b99269e9db1174c2631201c6bfd4 SHA512 05344c6c1a1a5b44704f6cf99277098d1ea3ac1dc11c2a691c501786a214f76184ec0637135588630db609ce79e49df3dbd00282dd61e7f21137afba70e24ffe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch
deleted file mode 100644
index 065f35e7c4c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-closure-function-ptrs.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-https://github.com/libffi/libffi/commit/e58e22b22386ed0e0a95e97eb8eed016e3f01b02
-
-From e58e22b22386ed0e0a95e97eb8eed016e3f01b02 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Thu, 2 Feb 2023 07:02:53 -0500
-Subject: [PATCH] From Dave Anglin:
-
-A couple of years ago the 32-bit hppa targets were converted from using a trampoline executed on the stack to the function descriptor technique used by ia64. This is more efficient and avoids having to have an executable stack. However, function pointers on 32-bit need the PLABEL bit set in the pointer. It distinguishes between pointers that point directly to the executable code and pointer that point to a function descriptor. We need the later for libffi. But as a result, it is not possible to convert using casts data pointers to function pointers.
-
-The solution at the time was to set the PLABEL bit in hppa closure pointers using FFI_CLOSURE_PTR. However, I realized recently that this was a bad choice. Packages like python-cffi allocate their own closure pointers, so this isn't going to work well there.
-
-A better solution is to leave closure pointers unchanged and only set the PLABEL bit in pointers used to point to executable code.
-
-The attached patch drops the FFI_CLOSURE_PTR and FFI_RESTORE_PTR defines. This allows some cleanup in the hppa closure routines. The FFI_FN define is now used to set the PLABEL bit on hppa. ffi_closure_alloc is modified to set the PLABEL bit in the value set in *code.
-
-I also added a FFI_CL define to convert a function pointer to a closure pointer. It is only used in one test case.
---- a/include/ffi.h.in
-+++ b/include/ffi.h.in
-@@ -361,14 +361,6 @@ typedef struct {
- FFI_API void *ffi_closure_alloc (size_t size, void **code);
- FFI_API void ffi_closure_free (void *);
- 
--#if defined(PA_LINUX) || defined(PA_HPUX)
--#define FFI_CLOSURE_PTR(X) ((void *)((unsigned int)(X) | 2))
--#define FFI_RESTORE_PTR(X) ((void *)((unsigned int)(X) & ~3))
--#else
--#define FFI_CLOSURE_PTR(X) (X)
--#define FFI_RESTORE_PTR(X) (X)
--#endif
--
- FFI_API ffi_status
- ffi_prep_closure (ffi_closure*,
- 		  ffi_cif *,
-@@ -515,8 +507,14 @@ FFI_API
- ffi_status ffi_get_struct_offsets (ffi_abi abi, ffi_type *struct_type,
- 				   size_t *offsets);
- 
--/* Useful for eliminating compiler warnings.  */
-+/* Convert between closure and function pointers.  */
-+#if defined(PA_LINUX) || defined(PA_HPUX)
-+#define FFI_FN(f) ((void (*)(void))((unsigned int)(f) | 2))
-+#define FFI_CL(f) ((void *)((unsigned int)(f) & ~3))
-+#else
- #define FFI_FN(f) ((void (*)(void))f)
-+#define FFI_CL(f) ((void *)(f))
-+#endif
- 
- /* ---- Definitions shared with assembly code ---------------------------- */
- 
---- a/src/closures.c
-+++ b/src/closures.c
-@@ -993,23 +993,23 @@ ffi_closure_alloc (size_t size, void **code)
-   if (!code)
-     return NULL;
- 
--  ptr = FFI_CLOSURE_PTR (dlmalloc (size));
-+  ptr = dlmalloc (size);
- 
-   if (ptr)
-     {
-       msegmentptr seg = segment_holding (gm, ptr);
- 
--      *code = add_segment_exec_offset (ptr, seg);
-+      *code = FFI_FN (add_segment_exec_offset (ptr, seg));
-       if (!ffi_tramp_is_supported ())
-         return ptr;
- 
-       ftramp = ffi_tramp_alloc (0);
-       if (ftramp == NULL)
-       {
--        dlfree (FFI_RESTORE_PTR (ptr));
-+        dlfree (ptr);
-         return NULL;
-       }
--      *code = ffi_tramp_get_addr (ftramp);
-+      *code = FFI_FN (ffi_tramp_get_addr (ftramp));
-       ((ffi_closure *) ptr)->ftramp = ftramp;
-     }
- 
-@@ -1050,7 +1050,7 @@ ffi_closure_free (void *ptr)
-   if (ffi_tramp_is_supported ())
-     ffi_tramp_free (((ffi_closure *) ptr)->ftramp);
- 
--  dlfree (FFI_RESTORE_PTR (ptr));
-+  dlfree (ptr);
- }
- 
- int
-@@ -1070,16 +1070,20 @@ ffi_tramp_is_present (void *ptr)
- void *
- ffi_closure_alloc (size_t size, void **code)
- {
-+  void *c;
-+
-   if (!code)
-     return NULL;
- 
--  return *code = FFI_CLOSURE_PTR (malloc (size));
-+  c = malloc (size);
-+  *code = FFI_FN (c);
-+  return c;
- }
- 
- void
- ffi_closure_free (void *ptr)
- {
--  free (FFI_RESTORE_PTR (ptr));
-+  free (ptr);
- }
- 
- void *
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -445,7 +445,6 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-   int i, avn;
-   unsigned int slot = FIRST_ARG_SLOT;
-   register UINT32 r28 asm("r28");
--  ffi_closure *c = (ffi_closure *)FFI_RESTORE_PTR (closure);
- 
-   cif = closure->cif;
- 
-@@ -548,7 +547,7 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-     }
- 
-   /* Invoke the closure.  */
--  (c->fun) (cif, rvalue, avalue, c->user_data);
-+  (closure->fun) (cif, rvalue, avalue, closure->user_data);
- 
-   debug(3, "after calling function, ret[0] = %08x, ret[1] = %08x\n", u.ret[0],
- 	u.ret[1]);
-@@ -649,8 +648,6 @@ ffi_prep_closure_loc (ffi_closure* closure,
- 		      void *user_data,
- 		      void *codeloc)
- {
--  ffi_closure *c = (ffi_closure *)FFI_RESTORE_PTR (closure);
--
-   /* The layout of a function descriptor.  A function pointer with the PLABEL
-      bit set points to a function descriptor.  */
-   struct pa32_fd
-@@ -676,14 +673,14 @@ ffi_prep_closure_loc (ffi_closure* closure,
-   fd = (struct pa32_fd *)((UINT32)ffi_closure_pa32 & ~3);
- 
-   /* Setup trampoline.  */
--  tramp = (struct ffi_pa32_trampoline_struct *)c->tramp;
-+  tramp = (struct ffi_pa32_trampoline_struct *)closure->tramp;
-   tramp->code_pointer = fd->code_pointer;
-   tramp->fake_gp = (UINT32)codeloc & ~3;
-   tramp->real_gp = fd->gp;
- 
--  c->cif  = cif;
--  c->user_data = user_data;
--  c->fun  = fun;
-+  closure->cif  = cif;
-+  closure->user_data = user_data;
-+  closure->fun  = fun;
- 
-   return FFI_OK;
- }
---- a/testsuite/libffi.closures/closure_loc_fn0.c
-+++ b/testsuite/libffi.closures/closure_loc_fn0.c
-@@ -85,7 +85,7 @@ int main (void)
- 
- #ifndef FFI_EXEC_STATIC_TRAMP
-   /* With static trampolines, the codeloc does not point to closure */
--  CHECK(memcmp(pcl, codeloc, sizeof(*pcl)) == 0);
-+  CHECK(memcmp(pcl, FFI_CL(codeloc), sizeof(*pcl)) == 0);
- #endif
- 
-   res = (*((closure_loc_test_type0)codeloc))
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch
deleted file mode 100644
index 822a7eb893e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-jump-table.patch
+++ /dev/null
@@ -1,289 +0,0 @@
-https://github.com/libffi/libffi/commit/222abd0c65babe2174b21753217145f5031a8b91
-
-From 222abd0c65babe2174b21753217145f5031a8b91 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Thu, 2 Feb 2023 07:04:55 -0500
-Subject: [PATCH] From Dave Anglin:
-
-This patch is derived from the work done in implementing libffi for 64-bit hppa64-hpux target. Currently, the 32-bit hppa targets do a linear search for the return type of an ffi_call. This is slow and inefficient. A jump table can used to jump directly to the code used to process the return value. In most common cases, the return value can be processed in the jump table itself.
-
-The patch also fixes return handling for FFI_TYPE_UINT8, FFI_TYPE_SINT8, FFI_TYPE_UINT16 and FFI_TYPE_SINT16.
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -56,27 +56,12 @@ static inline int ffi_struct_type(ffi_type *t)
-   size_t sz = t->size;
- 
-   /* Small structure results are passed in registers,
--     larger ones are passed by pointer.  Note that
--     small structures of size 2, 4 and 8 differ from
--     the corresponding integer types in that they have
--     different alignment requirements.  */
--
--  if (sz <= 1)
--    return FFI_TYPE_UINT8;
--  else if (sz == 2)
--    return FFI_TYPE_SMALL_STRUCT2;
--  else if (sz == 3)
--    return FFI_TYPE_SMALL_STRUCT3;
--  else if (sz == 4)
--    return FFI_TYPE_SMALL_STRUCT4;
--  else if (sz == 5)
--    return FFI_TYPE_SMALL_STRUCT5;
--  else if (sz == 6)
--    return FFI_TYPE_SMALL_STRUCT6;
--  else if (sz == 7)
--    return FFI_TYPE_SMALL_STRUCT7;
--  else if (sz <= 8)
--    return FFI_TYPE_SMALL_STRUCT8;
-+     larger ones are passed by pointer.  Note that small
-+     structures differ from the corresponding integer
-+     types in that they have different alignment requirements.  */
-+
-+  if (sz <= 8)
-+    return -sz;
-   else
-     return FFI_TYPE_STRUCT; /* else, we pass it by pointer.  */
- }
-@@ -556,16 +541,16 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-   switch (cif->flags)
-     {
-     case FFI_TYPE_UINT8:
--      *(stack - FIRST_ARG_SLOT) = (UINT8)(u.ret[0] >> 24);
-+      *(stack - FIRST_ARG_SLOT) = (UINT8)u.ret[0];
-       break;
-     case FFI_TYPE_SINT8:
--      *(stack - FIRST_ARG_SLOT) = (SINT8)(u.ret[0] >> 24);
-+      *(stack - FIRST_ARG_SLOT) = (SINT8)u.ret[0];
-       break;
-     case FFI_TYPE_UINT16:
--      *(stack - FIRST_ARG_SLOT) = (UINT16)(u.ret[0] >> 16);
-+      *(stack - FIRST_ARG_SLOT) = (UINT16)u.ret[0];
-       break;
-     case FFI_TYPE_SINT16:
--      *(stack - FIRST_ARG_SLOT) = (SINT16)(u.ret[0] >> 16);
-+      *(stack - FIRST_ARG_SLOT) = (SINT16)u.ret[0];
-       break;
-     case FFI_TYPE_INT:
-     case FFI_TYPE_SINT32:
-@@ -590,6 +575,7 @@ ffi_status ffi_closure_inner_pa32(ffi_closure *closure, UINT32 *stack)
-       /* Don't need a return value, done by caller.  */
-       break;
- 
-+    case FFI_TYPE_SMALL_STRUCT1:
-     case FFI_TYPE_SMALL_STRUCT2:
-     case FFI_TYPE_SMALL_STRUCT3:
-     case FFI_TYPE_SMALL_STRUCT4:
---- a/src/pa/ffitarget.h
-+++ b/src/pa/ffitarget.h
-@@ -73,11 +73,22 @@ typedef enum ffi_abi {
- #define FFI_TRAMPOLINE_SIZE 12
- #endif
- 
--#define FFI_TYPE_SMALL_STRUCT2 -1
--#define FFI_TYPE_SMALL_STRUCT3 -2
--#define FFI_TYPE_SMALL_STRUCT4 -3
--#define FFI_TYPE_SMALL_STRUCT5 -4
--#define FFI_TYPE_SMALL_STRUCT6 -5
--#define FFI_TYPE_SMALL_STRUCT7 -6
--#define FFI_TYPE_SMALL_STRUCT8 -7
-+#define FFI_TYPE_SMALL_STRUCT1 -1
-+#define FFI_TYPE_SMALL_STRUCT2 -2
-+#define FFI_TYPE_SMALL_STRUCT3 -3
-+#define FFI_TYPE_SMALL_STRUCT4 -4
-+#define FFI_TYPE_SMALL_STRUCT5 -5
-+#define FFI_TYPE_SMALL_STRUCT6 -6
-+#define FFI_TYPE_SMALL_STRUCT7 -7
-+#define FFI_TYPE_SMALL_STRUCT8 -8
-+
-+/* linux.S and hpux32.S expect FFI_TYPE_COMPLEX is the last generic type.  */
-+#define FFI_PA_TYPE_LAST FFI_TYPE_COMPLEX
-+
-+/* If new generic types are added, the jump tables in linux.S and hpux32.S
-+   likely need updating.  */
-+#if FFI_TYPE_LAST != FFI_PA_TYPE_LAST
-+# error "You likely have broken jump tables"
-+#endif
-+
- #endif
-
---- a/src/pa/linux.S
-+++ b/src/pa/linux.S
-@@ -103,51 +103,103 @@ ffi_call_pa32:
- 
- 	/* Prepare to store the result; we need to recover flags and rvalue.  */
- 	ldw -48(%r3), %r21                      /* r21 <- flags */
--	ldw -52(%r3), %r20                      /* r20 <- rvalue */
- 
--	/* Store the result according to the return type.  */
-+	/* Adjust flags range from [-8, 15] to  [0, 23].  */
-+	addi 8, %r21, %r21
- 
--.Lcheckint:
--	comib,<>,n FFI_TYPE_INT, %r21, .Lcheckint8
--	b	.Ldone
--	stw	%ret0, 0(%r20)
-+	blr %r21, %r0
-+	ldw -52(%r3), %r20                      /* r20 <- rvalue */
- 
--.Lcheckint8:
--	comib,<>,n FFI_TYPE_UINT8, %r21, .Lcheckint16
-+	/* Giant jump table */
-+	/* 8-byte small struct */
-+	b,n	.Lsmst8
-+	nop
-+	/* 7-byte small struct */
-+	b,n	.Lsmst7
-+	nop
-+	/* 6-byte small struct */
-+	b,n	.Lsmst6
-+	nop
-+	/* 5-byte small struct */
-+	b,n	.Lsmst5
-+	nop
-+	/* 4-byte small struct */
-+	b,n	.Lsmst4
-+	nop
-+	/* 3-byte small struct */
-+	b,n	.Lsmst3
-+	nop
-+	/* 2-byte small struct */
-+	b,n	.Lsmst2
-+	nop
-+	/* 1-byte small struct */
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
--
--.Lcheckint16:
--	comib,<>,n FFI_TYPE_UINT16, %r21, .Lcheckdbl
-+	/* void */
-+	b,n	.Ldone
-+	nop
-+	/* int */
- 	b	.Ldone
--	sth	%ret0, 0(%r20)
--
--.Lcheckdbl:
--	comib,<>,n FFI_TYPE_DOUBLE, %r21, .Lcheckfloat
-+	stw	%ret0, 0(%r20)
-+	/* float */
-+	b	.Ldone
-+	fstw	%fr4L,0(%r20)
-+	/* double */
- 	b	.Ldone
- 	fstd	%fr4,0(%r20)
--
--.Lcheckfloat:
--	comib,<>,n FFI_TYPE_FLOAT, %r21, .Lcheckll
-+	/* long double */
- 	b	.Ldone
--	fstw	%fr4L,0(%r20)
-+	fstd	%fr4,0(%r20)
-+	/* unsigned int8 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint8 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int16 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint16 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int32 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* sint32 */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* unsigned int64 */
-+	b,n	.Luint64
-+	nop
-+	/* signed int64 */
-+	b,n	.Lsint64
-+	nop
-+	/* large struct */
-+	b,n	.Ldone
-+	nop
-+	/* pointer */
-+	b	.Ldone
-+	stw	%ret0, 0(%r20)
-+	/* complex */
-+	b,n	.Ldone
-+	nop
-+
-+	/* Store the result according to the return type.  */
- 
--.Lcheckll:
--	comib,<>,n FFI_TYPE_UINT64, %r21, .Lchecksmst2
-+.Luint64:
-+.Lsint64:
- 	stw	%ret0, 0(%r20)
- 	b	.Ldone
- 	stw	%ret1, 4(%r20)
- 
--.Lchecksmst2:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT2, %r21, .Lchecksmst3
-+.Lsmst2:
- 	/* 2-byte structs are returned in ret0 as ????xxyy.  */
- 	extru	%ret0, 23, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst3:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT3, %r21, .Lchecksmst4
-+.Lsmst3:
- 	/* 3-byte structs are returned in ret0 as ??xxyyzz.  */
- 	extru	%ret0, 15, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
-@@ -156,8 +208,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst4:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT4, %r21, .Lchecksmst5
-+.Lsmst4:
- 	/* 4-byte structs are returned in ret0 as wwxxyyzz.  */
- 	extru	%ret0, 7, 8, %r22
- 	stbs,ma	%r22, 1(%r20)
-@@ -168,8 +219,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret0, 0(%r20)
- 
--.Lchecksmst5:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT5, %r21, .Lchecksmst6
-+.Lsmst5:
- 	/* 5 byte values are returned right justified:
- 	      ret0     ret1
- 	   5: ??????aa bbccddee */
-@@ -183,8 +233,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst6:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT6, %r21, .Lchecksmst7
-+.Lsmst6:
- 	/* 6 byte values are returned right justified:
- 	      ret0     ret1
- 	   6: ????aabb ccddeeff */
-@@ -200,8 +249,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst7:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT7, %r21, .Lchecksmst8
-+.Lsmst7:
- 	/* 7 byte values are returned right justified:
- 	      ret0     ret1
- 	   7: ??aabbcc ddeeffgg */
-@@ -219,8 +267,7 @@ ffi_call_pa32:
- 	b	.Ldone
- 	stb	%ret1, 0(%r20)
- 
--.Lchecksmst8:
--	comib,<>,n FFI_TYPE_SMALL_STRUCT8, %r21, .Ldone
-+.Lsmst8:
- 	/* 8 byte values are returned right justified:
- 	      ret0     ret1
- 	   8: aabbccdd eeffgghh */
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch
deleted file mode 100644
index aaf4af36843..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-hppa-large-struct.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-https://github.com/libffi/libffi/commit/c50c16d0bcb58952840184aa83e62c6d912bf779
-
-From c50c16d0bcb58952840184aa83e62c6d912bf779 Mon Sep 17 00:00:00 2001
-From: Anthony Green <green@moxielogic.com>
-Date: Sun, 20 Nov 2022 12:20:40 -0500
-Subject: [PATCH] Fix large struct passing on PA-RISC
-
---- a/src/pa/ffi.c
-+++ b/src/pa/ffi.c
-@@ -376,10 +376,26 @@ extern void ffi_call_pa32(void (*)(UINT32 *, extended_cif *, unsigned),
- void ffi_call(ffi_cif *cif, void (*fn)(void), void *rvalue, void **avalue)
- {
-   extended_cif ecif;
-+  size_t i, nargs = cif->nargs;
-+  ffi_type **arg_types = cif->arg_types;
- 
-   ecif.cif = cif;
-   ecif.avalue = avalue;
- 
-+  /* If we have any large structure arguments, make a copy so we are passing
-+     by value.  */
-+  for (i = 0; i < nargs; i++)
-+    {
-+      ffi_type *at = arg_types[i];
-+      int size = at->size;
-+      if (at->type == FFI_TYPE_STRUCT && size > 8)
-+	{
-+	  char *argcopy = alloca (size);
-+	  memcpy (argcopy, avalue[i], size);
-+	  avalue[i] = argcopy;
-+	}
-+    }
-+
-   /* If the return value is a struct and we don't have a return
-      value address then we need to make one.  */
- 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch
deleted file mode 100644
index 8e87814b23b..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-lld-17.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-https://bugs.gentoo.org/915086
-https://github.com/libffi/libffi/pull/800
-
-From 65f6869fd74630a9252ef89971b725b921f17061 Mon Sep 17 00:00:00 2001
-From: Alfred Wingate <parona@protonmail.com>
-Date: Tue, 10 Oct 2023 06:32:02 +0300
-Subject: [PATCH] Put optional symbols behind ifdefs
-
-Signed-off-by: Alfred Wingate <parona@protonmail.com>
---- a/libffi.map.in
-+++ b/libffi.map.in
-@@ -33,7 +33,10 @@ LIBFFI_BASE_8.0 {
- 	ffi_raw_to_ptrarray;
- 	ffi_raw_size;
- 
-+#if !FFI_NATIVE_RAW_API
- 	ffi_java_raw_call;
-+#endif
-+
- 	ffi_java_ptrarray_to_raw;
- 	ffi_java_raw_to_ptrarray;
- 	ffi_java_raw_size;
-@@ -62,8 +65,10 @@ LIBFFI_CLOSURE_8.0 {
- 	ffi_prep_closure_loc;
- 	ffi_prep_raw_closure;
- 	ffi_prep_raw_closure_loc;
-+#if !FFI_NATIVE_RAW_API
- 	ffi_prep_java_raw_closure;
- 	ffi_prep_java_raw_closure_loc;
-+#endif
- } LIBFFI_BASE_8.0;
- #endif
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch
deleted file mode 100644
index 3768df62df9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-sparc-float-typo.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-https://github.com/libffi/libffi/issues/778
-https://bugs.gentoo.org/882071
-
-Fix incorrect type for passing floats. Thanks to Petr Sumbera and Richard Henderson
-for figuring it out on the upstream bug.
---- a/src/sparc/ffi64.c
-+++ b/src/sparc/ffi64.c
-@@ -382,13 +382,19 @@ ffi_prep_args_v9(ffi_cif *cif, unsigned long *argp, void *rvalue, void **avalue)
- 	  *argp++ = *(SINT32 *)a;
- 	  break;
- 	case FFI_TYPE_UINT32:
--	case FFI_TYPE_FLOAT:
- 	  *argp++ = *(UINT32 *)a;
- 	  break;
- 	case FFI_TYPE_SINT64:
- 	case FFI_TYPE_UINT64:
- 	case FFI_TYPE_POINTER:
-+          *argp++ = *(UINT64 *)a;
-+          break;
-+       case FFI_TYPE_FLOAT:
-+          flags |= SPARC_FLAG_FP_ARGS;
-+          *argp++ = *(UINT32 *)a;
-+          break;
- 	case FFI_TYPE_DOUBLE:
-+          flags |= SPARC_FLAG_FP_ARGS;
- 	  *argp++ = *(UINT64 *)a;
- 	  break;
- 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch
deleted file mode 100644
index a7728331135..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.4-trampoline-c99.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-https://github.com/libffi/libffi/issues/760
-https://github.com/libffi/libffi/commit/ce077e5565366171aa1b4438749b0922fce887a4
-
-From ce077e5565366171aa1b4438749b0922fce887a4 Mon Sep 17 00:00:00 2001
-From: serge-sans-paille <serge.guelton@telecom-bretagne.eu>
-Date: Thu, 2 Feb 2023 14:46:29 +0000
-Subject: [PATCH] Forward declare open_temp_exec_file (#764)
-
-It's defined in closures.c and used in tramp.c.
-Also declare it as an hidden symbol, as it should be.
-
-Co-authored-by: serge-sans-paille <sguelton@mozilla.com>
---- a/include/ffi_common.h
-+++ b/include/ffi_common.h
-@@ -128,6 +128,10 @@ void *ffi_data_to_code_pointer (void *data) FFI_HIDDEN;
-    static trampoline. */
- int ffi_tramp_is_present (void *closure) FFI_HIDDEN;
- 
-+/* Return a file descriptor of a temporary zero-sized file in a
-+   writable and executable filesystem. */
-+int open_temp_exec_file(void) FFI_HIDDEN;
-+
- /* Extended cif, used in callback from assembly routine */
- typedef struct
- {
---- a/src/tramp.c
-+++ b/src/tramp.c
-@@ -39,6 +39,10 @@
- #ifdef __linux__
- #define _GNU_SOURCE 1
- #endif
-+
-+#include <ffi.h>
-+#include <ffi_common.h>
-+
- #include <stdio.h>
- #include <unistd.h>
- #include <stdlib.h>
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
deleted file mode 100644
index a8958b2fefd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/files/libffi-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 4354fe1434a37b781ff19f5a6be51ec4e982ad5a Mon Sep 17 00:00:00 2001
-Message-ID: <4354fe1434a37b781ff19f5a6be51ec4e982ad5a.1739062746.git.sam@gentoo.org>
-From: Sam James <sam@gentoo.org>
-Date: Sun, 9 Feb 2025 00:54:28 +0000
-Subject: [PATCH] Revert "Fix x86/ffi64 calls with 6 gp and some sse registers
- (#848)"
-
-This reverts commit d21881f55ed4a44d464c9091871e69b0bb47611a.
-
-Bug: https://github.com/libffi/libffi/issues/879
-Bug: https://bugs.gentoo.org/949051
-Signed-off-by: Sam James <sam@gentoo.org>
---- a/src/x86/ffi64.c
-+++ b/src/x86/ffi64.c
-@@ -654,7 +654,7 @@ ffi_call_int (ffi_cif *cif, void (*fn)(void), void *rvalue,
- 		      break;
- 		    default:
- 		      reg_args->gpr[gprcount] = 0;
--		      memcpy (&reg_args->gpr[gprcount], a, sizeof(UINT64));
-+		      memcpy (&reg_args->gpr[gprcount], a, size);
- 		    }
- 		  gprcount++;
- 		  break;
---- a/testsuite/libffi.call/struct_int_float.c
-+++ b/testsuite/libffi.call/struct_int_float.c
-@@ -5,6 +5,7 @@
-    Originator:	kellda  */
- 
- /* { dg-do run } */
-+/* { dg-skip-if "libffi bug #879" { *-*-* } { "*" } } */
- #include "ffitest.h"
- 
- typedef struct
-
-base-commit: 1716f81e9a115d340429504563bc8e7fb2eeef2b
--- 
-2.48.1
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild
deleted file mode 100644
index 197f9975b8f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.4-r4.ebuild
+++ /dev/null
@@ -1,83 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME
-# changes.
-SLOT="0/8" # SONAME=libffi.so.8
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-hppa-large-struct.patch
-	"${FILESDIR}"/${P}-hppa-closure-function-ptrs.patch
-	"${FILESDIR}"/${P}-hppa-jump-table.patch
-	"${FILESDIR}"/${P}-sparc-float-typo.patch
-	"${FILESDIR}"/${P}-lld-17.patch
-	"${FILESDIR}"/${P}-trampoline-c99.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild
deleted file mode 100644
index 1513432cf61..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r2.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/libffi/libffi"
-	inherit git-r3
-else
-	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-arm64-bti.patch
-	"${FILESDIR}"/${P}-arm64-bti-spelling.patch
-	"${FILESDIR}"/${P}-arm64-support-pac.patch
-	"${FILESDIR}"/${P}-arm64-fix-build.patch
-	"${FILESDIR}"/${P}-sparc-struct-targs.patch
-	"${FILESDIR}"/${P}-test-typo.patch
-	"${FILESDIR}"/${P}-x86-sse.patch
-	"${FILESDIR}"/${P}-arm64-cfi.patch
-	"${FILESDIR}"/${P}-asan.patch
-	"${FILESDIR}"/${P}-tests.patch
-	"${FILESDIR}"/${P}-regenerate-autotools.patch
-	"${FILESDIR}"/${P}-c23-tests.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
index e71339d70dc..7773456321b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6-r3.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 S="${WORKDIR}"/${MY_P}
@@ -55,6 +55,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -83,6 +88,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild
deleted file mode 100644
index 1877e315196..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.6.ebuild
+++ /dev/null
@@ -1,73 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
index b53a7ca31e8..bf89160b2c7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -15,9 +15,10 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/libffi/libffi"
 	inherit autotools git-r3
 else
+	inherit libtool
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 S="${WORKDIR}"/${MY_P}
@@ -39,7 +40,11 @@ PATCHES=(
 src_prepare() {
 	default
 
-	[[ ${PV} == 9999 ]] && eautoreconf
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
 
 	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
 		# ensure we use aarch64 asm, not x86 on arm64
@@ -48,6 +53,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -76,6 +86,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r2.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r2.ebuild
index 072cb92af74..6386a4b761e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8-r2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -15,6 +15,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/libffi/libffi"
 	inherit autotools git-r3
 else
+	inherit libtool
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
@@ -33,13 +34,17 @@ RESTRICT="!test? ( test )"
 BDEPEND="test? ( dev-util/dejagnu )"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
+	"${FILESDIR}"/${PN}-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch
 )
 
 src_prepare() {
 	default
 
-	[[ ${PV} == 9999 ]] && eautoreconf
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
 
 	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
 		# ensure we use aarch64 asm, not x86 on arm64
@@ -48,6 +53,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -63,6 +73,7 @@ multilib_src_configure() {
 	ECONF_SOURCE="${S}" econf \
 		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
 		--disable-multi-os-directory \
+		--with-pic \
 		$(use_enable static-libs static) \
 		$(use_enable exec-static-trampoline exec-static-tramp) \
 		$(use_enable pax-kernel pax_emutramp) \
@@ -76,6 +87,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
deleted file mode 100644
index e000b77b4e7..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
+++ /dev/null
@@ -1,83 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal preserve-libs
-
-MY_PV=${PV/_rc/-rc}
-MY_P=${PN}-${MY_PV}
-
-DESCRIPTION="Portable, high level programming interface to various calling conventions"
-HOMEPAGE="https://sourceware.org/libffi/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/libffi/libffi"
-	inherit autotools git-r3
-else
-	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
-
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="MIT"
-# This is a core package which is depended on by e.g. Python.
-# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
-# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
-SLOT="0/8" # SONAME=libffi.so.8
-IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
-
-RESTRICT="!test? ( test )"
-BDEPEND="test? ( dev-util/dejagnu )"
-
-src_prepare() {
-	default
-
-	[[ ${PV} == 9999 ]] && eautoreconf
-
-	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
-		# ensure we use aarch64 asm, not x86 on arm64
-		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
-			configure configure.host || die
-	fi
-}
-
-multilib_src_configure() {
-	# --includedir= path maintains a few properties:
-	# 1. have stable name across libffi versions: some packages like
-	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
-	#    ${includedir} at build-time. Don't require those to be
-	#    rebuilt unless SONAME changes. bug #695788
-	#
-	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
-	#
-	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
-	#
-	#    We use /usr/$(get_libdir)/... to have ABI identifier.
-	ECONF_SOURCE="${S}" econf \
-		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
-		--disable-multi-os-directory \
-		$(use_enable static-libs static) \
-		$(use_enable exec-static-trampoline exec-static-tramp) \
-		$(use_enable pax-kernel pax_emutramp) \
-		$(use_enable debug)
-}
-
-multilib_src_test() {
-	emake -Onone check
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
index e000b77b4e7..408c095e202 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal preserve-libs
+inherit dot-a multilib-minimal preserve-libs
 
 MY_PV=${PV/_rc/-rc}
 MY_P=${PN}-${MY_PV}
@@ -15,6 +15,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/libffi/libffi"
 	inherit autotools git-r3
 else
+	inherit libtool
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
@@ -35,7 +36,11 @@ BDEPEND="test? ( dev-util/dejagnu )"
 src_prepare() {
 	default
 
-	[[ ${PV} == 9999 ]] && eautoreconf
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
 
 	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
 		# ensure we use aarch64 asm, not x86 on arm64
@@ -44,6 +49,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# --includedir= path maintains a few properties:
 	# 1. have stable name across libffi versions: some packages like
@@ -72,6 +82,7 @@ multilib_src_test() {
 multilib_src_install_all() {
 	einstalldocs
 	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
index 8f6a1788ff2..2e4f0d3014f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
@@ -4,3 +4,5 @@ DIST libgcrypt-1.10.3.tar.bz2 3783827 BLAKE2B 1a228e02820e886016eb55dee75936c442
 DIST libgcrypt-1.10.3.tar.bz2.sig 238 BLAKE2B 216baebca91b2e940f60d70a4260b6b6b8221ef88cfb42b020bc7b3743a465ef2cf105316648ed1e689cbbf7d79da421aa9f08b5af21c5b862734cf01f377214 SHA512 73795781a458c334ec6daade1b86ae8b788dd5da0b7198b46b8e54a103c5ec4c65a5dd7e6a9d173d136889f24e7f5721992f59117334f39bd1c8a94e3b55a048
 DIST libgcrypt-1.11.0.tar.bz2 4180345 BLAKE2B fe3f42480c0b9a0c50c24f4c54197404b4e1056d8baa9c0c07c671c9c05b90777580b4cbcde931b50ecb4dd93f5ddad89cea99aa36a35f86f796a003e3816f7d SHA512 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
 DIST libgcrypt-1.11.0.tar.bz2.sig 119 BLAKE2B e64d59dae5556e2826f6d297988a3300c36d05aeecfe19544c5092b5f7b777b9b3f37c5ddcfcba5a916ae237cf981efdd9e3bdec482f7c36b12ac5c70f9d4c52 SHA512 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
+DIST libgcrypt-1.11.1.tar.bz2 4233557 BLAKE2B 6416c6a782665e8a8d1c7993d94e620c586cfb65f273bde3d609bd7ca729a92d7ac3e156dabea42c34dbe50af7ce9b16333f63115f968aebb2b4a6dd37d4b99c SHA512 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678
+DIST libgcrypt-1.11.1.tar.bz2.sig 119 BLAKE2B b8d5bca5b903b34f48694a49e6da2c1ce449b0b28a71b9a0a6ce156e413cd19510ae7bc051bbc194bb17eec07501ee58538b45baf89918803077645f22c2244c SHA512 a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/files/libgcrypt-1.11.1-riscv.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/files/libgcrypt-1.11.1-riscv.patch
new file mode 100644
index 00000000000..9cab5f78b13
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/files/libgcrypt-1.11.1-riscv.patch
@@ -0,0 +1,53 @@
+https://bugs.gentoo.org/955813
+diff '--color=auto' --text --new-file --unified libgcrypt-1.11.1/cipher/simd-common-riscv.h libgcrypt/cipher/simd-common-riscv.h
+--- a/cipher/simd-common-riscv.h	1970-01-01 08:00:00.000000000 +0800
++++ b/cipher/simd-common-riscv.h	2025-05-13 08:06:01.221102266 +0800
+@@ -0,0 +1,48 @@
++/* simd-common-riscv.h  -  Common macros for RISC-V vector code
++ *
++ * Copyright (C) 2025 Jussi Kivilinna <jussi.kivilinna@iki.fi>
++ *
++ * This file is part of Libgcrypt.
++ *
++ * Libgcrypt is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU Lesser General Public License as
++ * published by the Free Software Foundation; either version 2.1 of
++ * the License, or (at your option) any later version.
++ *
++ * Libgcrypt is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this program; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef GCRY_SIMD_COMMON_RISCV_H
++#define GCRY_SIMD_COMMON_RISCV_H
++
++#include <config.h>
++
++#define memory_barrier_with_vec(a) __asm__("" : "+vr"(a) :: "memory")
++
++#define clear_vec_regs() __asm__ volatile("vsetvli zero, %0, e8, m1, ta, ma;\n" \
++					  "vmv.v.i v0, 0;\n" \
++					  "vmv.v.i v1, 0;\n" \
++					  "vmv2r.v v2, v0;\n" \
++					  "vmv4r.v v4, v0;\n" \
++					  "vmv8r.v v8, v0;\n" \
++					  "vmv8r.v v16, v0;\n" \
++					  "vmv8r.v v24, v0;\n" \
++					  : \
++					  : "r" (~0) \
++					  : "memory", "vl", "vtype", \
++					    "v0", "v1", "v2", "v3", \
++					    "v4", "v5", "v6", "v7", \
++					    "v8", "v9", "v10", "v11", \
++					    "v12", "v13", "v14", "v15", \
++					    "v16", "v17", "v18", "v19", \
++					    "v20", "v21", "v22", "v23", \
++					    "v24", "v25", "v26", "v27", \
++					    "v28", "v29", "v30", "v31")
++
++#endif /* GCRY_SIMD_COMMON_RISCV_H */
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
new file mode 100644
index 00000000000..5b9e38f6da0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
@@ -0,0 +1,186 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.49[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+	"${FILESDIR}"/${PN}-1.11.1-riscv.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Sensitive to optimisation; parts of the codebase are built with
+	# -O0 already. Don't risk it with UB.
+	strip-flags
+
+	# Temporary workaround for a build failure (known gcc issue):
+	#
+	#  * https://bugs.gentoo.org/956605
+	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
+	#
+	use riscv && filter-lto
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/Manifest
index 390a94f25ca..2c992f5d7b3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/Manifest
@@ -2,3 +2,5 @@ DIST libgpg-error-1.51.tar.bz2 1085510 BLAKE2B 8727a993fb5e589beceafce9d06d843b2
 DIST libgpg-error-1.51.tar.bz2.sig 119 BLAKE2B 34bacbe1923aebc015ea1b975616836dd80278c8edc293474f83633fef59326edfe4043419729de4c8f26c49a6292f7d13a23c3ccda8aea3d1923913df616a5e SHA512 fc793d674c0f5b26efdc71a4420e9743e9dcf8ab646577be3561dc46f15343be42991cf3fe5c49d049f49e929618e7c05dbd32f9e4ceb1d58b90263058621a9e
 DIST libgpg-error-1.53.tar.bz2 1106986 BLAKE2B 9c00543c086f963cf84507ba1a33e4df67a1a401fd313789372f489fd2d7eb77d0a4eb22f002325c9a1386f8aab2893e5dca1d9d2c1c674d7190b56aa37bdc91 SHA512 e42b013eaa4af3bbd7085eff4b9fa980052f7efebe98e512728b6079be85ae156f040acbb0bb16f0b9113b512e0c7e6fb4762c0593a4a154183965901e81f552
 DIST libgpg-error-1.53.tar.bz2.sig 119 BLAKE2B 421d1a3babc1a0916c8b95ade4550c5003137cc86295ee10d595e2d879057959637e760b4f66b5b5c5edfa5367199b02685c734dafbcb2369abc85fb3998d28f SHA512 62000a0e154219834e3891285f41357cfabdd95c1888f7703c76159529eac73bd2c9b7cd290a287ff93e052bd3ca6c70597b2250ed786c329823d34a0fc3d8cf
+DIST libgpg-error-1.55.tar.bz2 1109437 BLAKE2B ae8bf5d17ebd252b32b05b9686baf2d2e027f5e827dbd7db6fea37570aeeeea2625d416aaea96fbcdfd64fd08de589ef054843b2e3619d22fc8a052a6b5c7e0a SHA512 d3f6ca9d9abefe81f5cbbc195fbe259d3362119018c535ad2621ee407cad3487011325a9f4c4a15442a9ac5a0fe7ce86dafd7b3d891a446516362ba6b7b9047b
+DIST libgpg-error-1.55.tar.bz2.sig 238 BLAKE2B 62d461984fd658a9722183e08b8805c8f48dca06a37de9f8f76e19d3946099ec252c8ef1df76e20f9ea49f5413d87ce4a00b8dd967664125d93089617a42894a SHA512 dee5152818ff9f65d2e7165c378f10a7d07ef58848c7290e98c87ce17aaed37fea82df0c3005b159da2ce8a48a1396037f43b22c5ee9857c01bc86b77181e7a1
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.53.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.53.ebuild
index fdcf7bddbe7..43580d85220 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.53.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.53.ebuild
@@ -19,7 +19,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-2 LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="common-lisp nls static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.55.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.55.ebuild
new file mode 100644
index 00000000000..fdcf7bddbe7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgpg-error/libgpg-error-1.55.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Contains error handling functions used by GnuPG software"
+HOMEPAGE="https://www.gnupg.org/related_software/libgpg-error/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="common-lisp nls static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="nls? ( >=virtual/libintl-0-r1[${MULTILIB_USEDEP}] )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/gpg-error.h
+	/usr/include/gpgrt.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/gpg-error-config
+	/usr/bin/gpgrt-config
+)
+
+src_prepare() {
+	default
+	elibtoolize
+
+	if use prefix ; then
+		# don't hardcode /usr/xpg4/bin/sh as shell on Solaris
+		sed -i -e 's:INSTALLSHELLPATH=/usr/xpg4/bin/sh:INSTALLSHELLPATH=/bin/sh:g' configure.ac configure || die
+	fi
+
+	# This check breaks multilib
+	cat <<-EOF > src/gpg-error-config-test.sh.in || die
+	#!@INSTALLSHELLPATH@
+	exit 0
+	EOF
+
+	# only necessary for as long as we run eautoreconf, configure.ac
+	# uses ./autogen.sh to generate PACKAGE_VERSION, but autogen.sh is
+	# not a pure /bin/sh script, so it fails on some hosts
+	#sed -i -e "1s:.*:#\!${BASH}:" autogen.sh || die
+	#eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(multilib_is_native_abi || echo --disable-languages)
+		$(use_enable common-lisp languages)
+		$(use_enable nls)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+		$(use_enable test tests)
+
+		# See bug #699206 and its duplicates wrt gpgme-config
+		# Upstream no longer install this by default and we should
+		# seek to disable it at some point.
+		--enable-install-gpg-error-config
+
+		--enable-threads
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
index 96ee31132b1..4f3a214de00 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
@@ -1 +1,2 @@
 DIST libnl-3.10.0.tar.gz 1116186 BLAKE2B 13383c4ef49be3bcf89122b24d1d5dc9834353aa7128f04f50993203add14aa7f97a4500164982ddcb82f481f7324a26efc2375036d5a23bfa62b15c4fe07473 SHA512 c95e79fba69308c63a08d0c576503b4398710ea9cd1d0097851500a7fbc5fbe87fb32ac281cf42bbfe57eab07b110055e6bc9b95d82244bba3df8a31fe562962
+DIST libnl-3.11.0.tar.gz 1124072 BLAKE2B 8e2792620f56e1e9e05e4fe1f9bece70938c82c2d1a9f4e0f9de1ce0b1a7a2bf60f31a42e6056407b383875c08c575b26df87b9bd6b421d5053e96983e193c54 SHA512 69ecec6e792fc7b9c443fff8742cf45782af5c5c4664687440942eaeb616ba7b4ed2b606e33c5d86e44e6b49a9c79a1fed4b7c77781a059e13cf6a844d94530e
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/0001-Fix-compilation-error-in-GCC-14.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/0001-Fix-compilation-error-in-GCC-14.patch
new file mode 100644
index 00000000000..e0efcabb171
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/0001-Fix-compilation-error-in-GCC-14.patch
@@ -0,0 +1,36 @@
+https://github.com/thom311/libnl/commit/f278e5921498fc635bd9534a3f24979bb1b2849d
+
+From f278e5921498fc635bd9534a3f24979bb1b2849d Mon Sep 17 00:00:00 2001
+From: Aleksander Mazur <19613255+OlekMazur@users.noreply.github.com>
+Date: Sat, 29 Mar 2025 01:34:46 +0100
+Subject: [PATCH] Fix compilation error in GCC 14
+
+lib/socket.c: In function '_badrandom_from_time':
+lib/socket.c:70:13: error: implicit declaration of function 'time' [-Wimplicit-function-declaration]
+   70 |         t = time(NULL);
+      |             ^~~~
+lib/socket.c:39:1: note: 'time' is defined in header '<time.h>'; this is probably fixable by adding '#include <time.h>'
+   38 | #include "nl-aux-core/nl-core.h"
+  +++ |+#include <time.h>
+   39 |
+
+https://github.com/thom311/libnl/pull/424
+---
+ lib/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/socket.c b/lib/socket.c
+index 4e64cbb3..c6200958 100644
+--- a/lib/socket.c
++++ b/lib/socket.c
+@@ -23,6 +23,7 @@
+ 
+ #include "nl-default.h"
+ 
++#include <time.h>
+ #include <fcntl.h>
+ #include <limits.h>
+ #include <sys/socket.h>
+-- 
+2.49.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-no-iproute2.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-no-iproute2.patch
new file mode 100644
index 00000000000..d14ae2ae42e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-no-iproute2.patch
@@ -0,0 +1,18 @@
+Avoid the following test failure within network-sandbox:
+    tests/cksuite-all-netns.c:335:F:Core:route_1:0: command(system("ip -d link set v1 up")) has unexpected positive return code 512
+--- a/tests/nl-test-util.c
++++ b/tests/nl-test-util.c
+@@ -780,12 +780,7 @@ bool _nltst_in_ci(void)
+ 
+ bool _nltst_has_iproute2(void)
+ {
+-	static int has = -1;
+-
+-	if (has == -1)
+-		has = (system("ip link &>/dev/null") == 0);
+-
+-	return has;
++	return false;
+ }
+ 
+ bool _nltst_skip_no_iproute2(const char *msg)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-tests-ns.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-tests-ns.patch
new file mode 100644
index 00000000000..5dffea0468f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/files/libnl-3.11.0-tests-ns.patch
@@ -0,0 +1,176 @@
+https://github.com/thom311/libnl/commit/b3822aa3b605b2dc5f01f9aee8ee224fc23e23a0
+
+From b3822aa3b605b2dc5f01f9aee8ee224fc23e23a0 Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thaller@redhat.com>
+Date: Sun, 12 Jan 2025 10:54:59 +0100
+Subject: [PATCH] test: skip tests when having no private netns
+
+In github CI we seem now unable to create the netns. This worked
+previously, now it no longer does.
+
+Handle that by skipping the tests that require a netns.
+---
+ tests/cksuite-all-netns.c | 13 +++++++++-
+ tests/nl-test-util.c      | 50 +++++++++++++++++++++++++++++++++++++--
+ tests/nl-test-util.h      |  3 +++
+ 3 files changed, 63 insertions(+), 3 deletions(-)
+
+diff --git a/tests/cksuite-all-netns.c b/tests/cksuite-all-netns.c
+index 1948c3e8..04e0f6df 100644
+--- a/tests/cksuite-all-netns.c
++++ b/tests/cksuite-all-netns.c
+@@ -73,6 +73,9 @@ START_TEST(cache_and_clone)
+ 	size_t i;
+ 	int r;
+ 
++	if (_nltst_skip_no_netns())
++		return;
++
+ 	for (i = 0; i < _NL_N_ELEMENTS(links); i++) {
+ 		if (links[i].add)
+ 			_nltst_add_link(NULL, links[i].ifname, links[i].kind,
+@@ -132,11 +135,16 @@ START_TEST(test_create_iface)
+ 	_nl_auto_rtnl_link struct rtnl_link *link2 = NULL;
+ 	_nl_auto_rtnl_link struct rtnl_link *peer = NULL;
+ 	_nltst_auto_delete_link const char *IFNAME_DUMMY = NULL;
+-	_nltst_auto_delete_link const char *IFNAME = "ifname";
++	_nltst_auto_delete_link const char *IFNAME = NULL;
+ 	int ifindex_dummy;
+ 	uint32_t u32;
+ 	int r;
+ 
++	if (_nltst_skip_no_netns())
++		return;
++
++	IFNAME = "ifname";
++
+ 	switch (TEST_IDX) {
+ 	case 0:
+ 		link = _nltst_assert(rtnl_link_bridge_alloc());
+@@ -317,6 +325,9 @@ START_TEST(route_1)
+ 	_nl_auto_nl_socket struct nl_sock *sk = NULL;
+ 	_nl_auto_nl_cache struct nl_cache *cache = NULL;
+ 
++	if (_nltst_skip_no_netns())
++		return;
++
+ 	if (_nltst_skip_no_iproute2("route_1"))
+ 		return;
+ 
+diff --git a/tests/nl-test-util.c b/tests/nl-test-util.c
+index dc8dc5ad..d1a8f3f1 100644
+--- a/tests/nl-test-util.c
++++ b/tests/nl-test-util.c
+@@ -84,6 +84,7 @@ uint32_t _nltst_rand_u32(void)
+ 
+ struct nltst_netns {
+ 	int canary;
++	bool is_unshared;
+ };
+ 
+ /*****************************************************************************/
+@@ -114,6 +115,23 @@ void nltst_netns_fixture_teardown(void)
+ 	_nl_clear_pointer(&_netns_fixture_global.nsdata, nltst_netns_leave);
+ }
+ 
++bool nltst_netns_fixture_is_unshared(void)
++{
++	_assert_nltst_netns(_netns_fixture_global.nsdata);
++	return _netns_fixture_global.nsdata->is_unshared;
++}
++
++/*****************************************************************************/
++
++bool _nltst_skip_no_netns(void)
++{
++	if (nltst_netns_fixture_is_unshared())
++		return false;
++
++	printf("skip test due to having no private netns\n");
++	return true;
++}
++
+ /*****************************************************************************/
+ 
+ static void unshare_user(void)
+@@ -125,6 +143,10 @@ static void unshare_user(void)
+ 
+ 	/* Become a root in new user NS. */
+ 	r = unshare(CLONE_NEWUSER);
++	if (r != 0 && errno == EPERM) {
++		/* No permissions? Ignore. Will be handled later. */
++		return;
++	}
+ 	_nltst_assert_errno(r == 0);
+ 
+ 	/* Since Linux 3.19 we have to disable setgroups() in order to map users.
+@@ -149,14 +171,28 @@ static void unshare_user(void)
+ 	}
+ 	r = fprintf(f, "0 %d 1", uid);
+ 	_nltst_assert_errno(r > 0);
+-	_nltst_fclose(f);
++	r = fclose(f);
++	if (r != 0 && errno == EPERM) {
++		/* Oddly, it seems close() can fail at this point. Ignore it,
++		 * but we probably will be unable to unshare (which we handle
++		 * later).
++		 */
++	} else
++		_nltst_assert_errno(r == 0);
+ 
+ 	/* Map current GID to root in NS to be created. */
+ 	f = fopen("/proc/self/gid_map", "we");
+ 	_nltst_assert_errno(f);
+ 	r = fprintf(f, "0 %d 1", gid);
+ 	_nltst_assert_errno(r > 0);
+-	_nltst_fclose(f);
++	r = fclose(f);
++	if (r != 0 && errno == EPERM) {
++		/* Oddly, it seems close() can fail at this point. Ignore it, but
++		 * we probably will be unable to unshare (which we handle
++		 * later).
++		 */
++	} else
++		_nltst_assert_errno(r == 0);
+ }
+ 
+ struct nltst_netns *nltst_netns_enter(void)
+@@ -172,6 +208,15 @@ struct nltst_netns *nltst_netns_enter(void)
+ 	unshare_user();
+ 
+ 	r = unshare(CLONE_NEWNET | CLONE_NEWNS);
++	if (r != 0 && errno == EPERM) {
++		/* The system is probably sandboxed somehow and we are unable
++		 * to create a private netns. That seems questionable, because
++		 * a point of a private netns is to sandbox an application.
++		 * Not having permissions to sandbox sounds bad.
++		 *
++		 * Anyway. We accept this and will later skip some tests. */
++		return nsdata;
++	}
+ 	_nltst_assert_errno(r == 0);
+ 
+ 	/* We need a read-only /sys so that the platform knows there's no udev. */
+@@ -179,6 +224,7 @@ struct nltst_netns *nltst_netns_enter(void)
+ 	r = mount("sys", "/sys", "sysfs", MS_RDONLY, NULL);
+ 	_nltst_assert_errno(r == 0);
+ 
++	nsdata->is_unshared = true;
+ 	return nsdata;
+ }
+ 
+diff --git a/tests/nl-test-util.h b/tests/nl-test-util.h
+index 981228b4..d840a4ab 100644
+--- a/tests/nl-test-util.h
++++ b/tests/nl-test-util.h
+@@ -429,6 +429,9 @@ char **_nltst_strtokv(const char *str);
+ 
+ void nltst_netns_fixture_setup(void);
+ void nltst_netns_fixture_teardown(void);
++bool nltst_netns_fixture_is_unshared(void);
++
++bool _nltst_skip_no_netns(void);
+ 
+ struct nltst_netns;
+ 
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.11.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.11.0.ebuild
new file mode 100644
index 00000000000..7087ab65b13
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.11.0.ebuild
@@ -0,0 +1,137 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Make sure to test USE=utils on bumps and update MULTILIB_WRAPPED_HEADERS if needed
+
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+inherit autotools distutils-r1 multilib-minimal
+
+LIBNL_P=${P/_/-}
+LIBNL_DIR=${PV/_/}
+LIBNL_DIR=${LIBNL_DIR//./_}
+
+DESCRIPTION="Libraries providing APIs to netlink protocol based Linux kernel interfaces"
+HOMEPAGE="https://www.infradead.org/~tgr/libnl/ https://github.com/thom311/libnl"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/thom311/libnl"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/thom311/${PN}/releases/download/${PN}${LIBNL_DIR}/${P/_rc/-rc}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+	S="${WORKDIR}/${LIBNL_P}"
+fi
+
+LICENSE="LGPL-2.1 utils? ( GPL-2 )"
+SLOT="3"
+IUSE="+debug python test utils"
+RESTRICT="!test? ( test )"
+
+RDEPEND="python? ( ${PYTHON_DEPS} )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${RDEPEND}
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+	python? (
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+	)
+	test? ( dev-libs/check )
+"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# We do not install CLI stuff for non-native
+	/usr/include/libnl3/netlink/cli/addr.h
+	/usr/include/libnl3/netlink/cli/class.h
+	/usr/include/libnl3/netlink/cli/cls.h
+	/usr/include/libnl3/netlink/cli/ct.h
+	/usr/include/libnl3/netlink/cli/exp.h
+	/usr/include/libnl3/netlink/cli/link.h
+	/usr/include/libnl3/netlink/cli/mdb.h
+	/usr/include/libnl3/netlink/cli/nh.h
+	/usr/include/libnl3/netlink/cli/neigh.h
+	/usr/include/libnl3/netlink/cli/qdisc.h
+	/usr/include/libnl3/netlink/cli/route.h
+	/usr/include/libnl3/netlink/cli/rule.h
+	/usr/include/libnl3/netlink/cli/tc.h
+	/usr/include/libnl3/netlink/cli/utils.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/0001-Fix-compilation-error-in-GCC-14.patch
+	"${FILESDIR}"/${P}-tests-ns.patch
+	"${FILESDIR}"/${PN}-3.11.0-no-iproute2.patch
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	if use python; then
+		pushd "${S}"/python > /dev/null || die
+		distutils-r1_src_prepare
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_configure() {
+	# bug #884277
+	export YACC=yacc.bison
+
+	ECONF_SOURCE="${S}" econf \
+		$(multilib_native_use_enable utils cli) \
+		$(use_enable debug)
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		pushd python > /dev/null || die
+		distutils-r1_src_compile
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	CK_VERBOSITY=verbose emake check VERBOSE=1
+
+	if multilib_is_native_abi && use python ; then
+		pushd python > /dev/null || die
+		# TODO: run python/tests/test-create-bridge.py
+		distutils-r1_src_test
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		# Unset DOCS= since distutils-r1.eclass interferes
+		local DOCS=()
+
+		pushd python > /dev/null || die
+
+		distutils-r1_src_install
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_install_all() {
+	DOCS=( ChangeLog )
+
+	einstalldocs
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
index b30c49db70f..5d4ac2e9b24 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 inherit autotools distutils-r1 multilib-minimal
 
 LIBNL_P=${P/_/-}
@@ -30,9 +30,7 @@ fi
 LICENSE="LGPL-2.1 utils? ( GPL-2 )"
 SLOT="3"
 IUSE="+debug python test utils"
-# Tests fail w/ sandboxes
-# https://github.com/thom311/libnl/issues/361
-RESTRICT="!test? ( test ) test"
+RESTRICT="!test? ( test )"
 
 RDEPEND="python? ( ${PYTHON_DEPS} )"
 DEPEND="${RDEPEND}"
@@ -67,6 +65,11 @@ MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/libnl3/netlink/cli/utils.h
 )
 
+PATCHES=(
+	"${FILESDIR}"/0001-Fix-compilation-error-in-GCC-14.patch
+	"${FILESDIR}"/${PN}-3.11.0-no-iproute2.patch
+)
+
 src_prepare() {
 	default
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
index ff40a5ef75a..cb4d98b0f4c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/metadata.xml
@@ -11,5 +11,6 @@
 	</use>
 	<upstream>
 		<remote-id type="github">thom311/libnl</remote-id>
+		<remote-id type="cpe">cpe:/a:libnl_project:libnl</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/Manifest
index 5ecb26482ac..36c2ea83f9a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/Manifest
@@ -1,2 +1,3 @@
 DIST libp11-0.4.12.tar.gz 516414 BLAKE2B a816749984753a1916dd58860c51b49d316946b59eb3bc839f6a21dcff14de48d7a4937f55fc7ad96a26b914591854d5cf11a1fbac2d5f2f5e04c833973c0e42 SHA512 674cfca2c9eaf162262204c94f9d59d3095dabbc348c1842e758b897e1a5bd4ba08b2d589ec3b2a2d1343a8760eab253e7008dc09ef5b499e2f16385efe5c8cc
 DIST libp11-0.4.13.tar.gz 531147 BLAKE2B ea31e56966cc22e6a6dad2d4923bd89ad110f537172af1dca912d8449df8a6a118ceca45912e7c3d38979dd3e591a9fb110091fd5474b41d6159d489b7c9ba37 SHA512 7936e5e3e37b424caff2ce95b416e67d6bf082676c5a3efb23651d414eacdbdbc1f5e11b05097b500a9d0ca5a97e628f54dd7d1e5ba2a7b5e3a36b3b7b75b5ed
+DIST libp11-0.4.14.tar.gz 572770 BLAKE2B faa1d3ace7c820d8cbc0bc0451a6c2578bc5cffd64d9f60b29cce2a58a2bcf7b26060abca257eafce9397a2504f5779767713426f397882e906928d4762f9e57 SHA512 747400fcc07d5ebd336247e4d0b2e496aa6f3ffb0077a87513dca016494c64af275aa5e6c37bfa0b39d820700e861a2eea440b0fb983f2fb2b19ef47e2653e28
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.14.ebuild
new file mode 100644
index 00000000000..ab0122da1bc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.14.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Abstraction layer to simplify PKCS#11 API"
+HOMEPAGE="https://github.com/opensc/libp11/wiki"
+SRC_URI="https://github.com/OpenSC/${PN}/releases/download/${P}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-libs/openssl-3.0.0:=[bindist(+)]
+"
+DEPEND="${RDEPEND}
+	test? ( dev-libs/softhsm )
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+	test? ( >=dev-libs/opensc-0.23.0-r2 )
+"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local args=(
+		--enable-shared
+		$(use_enable static-libs static)
+		$(use_enable doc api-doc)
+	)
+	econf "${args[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
index a21e4729456..9d3b13d8c99 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.45.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nicholaswilson.asc
-inherit libtool multilib multilib-minimal toolchain-funcs verify-sig
+inherit dot-a libtool multilib multilib-minimal toolchain-funcs verify-sig
 
 MY_P="pcre2-${PV/_rc/-RC}"
 
@@ -55,6 +55,11 @@ src_prepare() {
 	elibtoolize
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myeconfargs=(
 		--enable-pcre2-8
@@ -99,4 +104,5 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	find "${ED}" -type f -name "*.la" -delete || die
+	strip-lto-bytecode
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
index d749d0c3ae5..ebab64f35b3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
@@ -1,2 +1,3 @@
 DIST libusb-1.0.27.tar.bz2 643680 BLAKE2B bec2eb053159ffa719c794d234f8e99b895a4fae336b862a3197b88deb3d307a53ebb98d2aa993a2f390f14264f796b96ac47274c19f56db30440484ee336c8a SHA512 42abbbcf2564f86cc2f05826aeefa6beb03c9f89dc9fe05bdfa351caa3dbd07713ce193daadecf29557604dd3cbc770c8031a78e1ad0a8df3627c3f551d28ff0
 DIST libusb-1.0.28.tar.bz2 658053 BLAKE2B 9bf506455fc1b981de155600936ab229f089ea28e58491076eab632455c4e814bf0336cd9326056a255508aa3956643c503af3ff2feda80bac036cf5cad86e80 SHA512 0f4efa6b54e6195d2e5446652c2dc07358583e205d63bf438c4409511b8637d1700a71268c40499755747827d23cc730d9122267386f847bf781993c045c519f
+DIST libusb-1.0.29.tar.bz2 645381 BLAKE2B 74db11918fa704eae3a320838c84dd06427acd5e3f73263e965decd1a09f0a14ed2d1a3916bf7eada26ab1164a3955a9fa3bdff8e3294264c6f8e1137866652a SHA512 04f8bda8197c9ecf52709609b8fbfea762fd82ddb5cde153a7630b0e8ed557d42da8cbc44f2f593aa22fdd0762e16716300565d67adb0c5240d7f3723321f690
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.28.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.28.ebuild
index 1efb75eff57..2d138348be7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.28.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.28.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.bz2"
 
 LICENSE="LGPL-2.1"
 SLOT="1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="debug doc examples static-libs test udev"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="static-libs? ( !udev )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.29.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.29.ebuild
new file mode 100644
index 00000000000..1efb75eff57
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.29.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit libtool multilib-minimal
+
+DESCRIPTION="Userspace access to USB devices"
+HOMEPAGE="https://libusb.info/ https://github.com/libusb/libusb"
+SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.bz2"
+
+LICENSE="LGPL-2.1"
+SLOT="1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="debug doc examples static-libs test udev"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="static-libs? ( !udev )"
+
+RDEPEND="udev? ( >=virtual/libudev-208:=[${MULTILIB_USEDEP}] )"
+DEPEND="
+	${RDEPEND}
+	!udev? ( virtual/os-headers )
+"
+BDEPEND="doc? ( app-text/doxygen )"
+
+src_prepare() {
+	default
+
+	# bug #923738
+	sed -i -e "s:umockdev-1.0:umockdev-1.0-DISABLED:" configure || die
+
+	elibtoolize
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(use_enable static-libs static)
+		$(use_enable udev)
+		$(use_enable debug debug-log)
+		$(use_enable test tests-build)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake
+
+	if multilib_is_native_abi; then
+		use doc && emake -C doc
+	fi
+}
+
+multilib_src_test() {
+	emake check
+
+	# noinst_PROGRAMS from tests/Makefile.am
+	if [[ -e /dev/bus/usb ]]; then
+		tests/stress || die
+	else
+		# bug #824266
+		ewarn "/dev/bus/usb does not exist, skipping stress test"
+	fi
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi; then
+		use doc && dodoc -r doc/api-1.0
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name "*.la" -delete || die
+
+	dodoc AUTHORS ChangeLog NEWS PORTING README TODO
+
+	if use examples; then
+		docinto examples
+		dodoc examples/*.{c,h}
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
index 3615728f1b9..3d46c1a0483 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
@@ -1,8 +1,8 @@
-DIST libxml2-2.11.9.tar.xz 2627500 BLAKE2B 3ecab5df9017673f31e8bbf737273d72cb4475c3a6f0d0669e7f074b0e4d378460df2e175fe4991c675d8462a2e4d4607c151ed11937a0c8a3a4e81107102f67 SHA512 d5c34ed56525f4c6b61d7055fe4219d7a3337077b4fb27081682e9f8350f1542b4476ac42f2754e590b371a4d9a00921cebf20c10b299371b05b8391e7fa7c33
-DIST libxml2-2.12.10.tar.xz 2483708 BLAKE2B b0e68457650665967936799c5b8f550a74534a820ffa1ebcf580c025681ab7f0a0941aea8e3cec93dc056e9cbe53266864635d991f8ce7662cf7b66b2c49abbd SHA512 7bd04375321a99c9b7a82d6a72d9412ab45f958b923f1e2f75d9dfbb1a053eba3e0fd067a53753f9a343b4dcb2d9ab5cba894d4194a5f9fb7108f7c545224791
-DIST libxml2-2.12.9.tar.xz 2643456 BLAKE2B 769ff564e62c1c0167e5334879ac9e912491c651b6d48a9d21db569002ae86bc4e4490098710a614bc90bbefc44a9dd0af6b02958041dd3bffccf8b5ddc0f7ca SHA512 6e4544ed3ab36d6cb7481d465ceabf223444739d7f41de3e1927309b8716a5eac85520b9bbaf69913f53e052fbfaf68bf27372074daaa24dca9463ce728b4173
 DIST libxml2-2.13.6.tar.xz 2423476 BLAKE2B b21f2946dd6945de4a47c993e93bfbbc785b51a501782bf44c234ad69675a58ccdbf6a255301c4d69e92ba9a9ed6670156e55b4d8100215f2dea015c943931ff SHA512 1d4fc3c58df28834ceeeefd49ab90b263b62823d2f0870ae38d11320da93cfa2a18d979c605293c91ad985cb702e7395ddc0ec00b4785dab35ba6d8c33d5f6a7
 DIST libxml2-2.13.7.tar.xz 2424236 BLAKE2B 464097c4b579f964a42909e26b3c2702d7b40c3029628c8980a1ea7a43867dda3c4bdf38b63557f971b20b125a5fc0ac7031bad5df10b1bc25380e995f7707b4 SHA512 6e69ed38cdf2aaa5df7e26b654a7aadd2d80131619184380bafc6a22811acb6b7286c819175c3b37edb194019a93ba6085852a0281934d6bb36d0b52ce138541
+DIST libxml2-2.13.8.tar.xz 2423128 BLAKE2B 9abe12acb2b619f8649dc4472c39d4c59074a83538bf1a534163737bf9e99e6387fec53404392c325102da1e77f53606f2679c47b7136d7f7541a8fcc6bcd995 SHA512 668e556404693f17e074bc31e2caa5e50bf003ee3cd81b61a51ea25e76efd7eff7ec70ff603eed87b9d9e9b2299673e6e8871798264113e660e703b74b58458f
+DIST libxml2-2.14.2.tar.xz 2324716 BLAKE2B 2331234ed60358168298d04c83162bfe7d08e6fc77091fe1ecf8384e68902ab745f039dc807d12dda3124313724806bd7fb651de975dbc60fdaf963bac043ff8 SHA512 9b54b9cbee76a56f187c0dc18a5303854f8b6383d11da8f92d6c89dde17b2d03f5d242b91abf9e30b50918a748770db6efdc9b3d73069e513ca30b6c2164dfec
+DIST libxml2-2.14.3.tar.xz 2325052 BLAKE2B 25ad281925dee3aa032f9ce5c71bebfdfeb3469351eebdcede01c81978ddc411376f2a13b82d207614857b385ca7d589708c3437ad3effd5bc425d7e6b515cf2 SHA512 0efdd42c5fe0160a91945fdbe3193937ee799965e0ac19bd091e1a56e63a36dfc585bd9afee83af330b7d93914e5bd28cf4914246802565dd758a6edd80b1bf7
 DIST xmlts20130923.tar.gz 641522 BLAKE2B 63a47bc69278ef510cd0b3779aed729e1b309e30efa0015d28ed051cc03f9dfddb447ab57b07b3393e8f47393d15473b0e199c34cb1f5f746b15ddfaa55670be SHA512 d5c4d26b324ed21f4e0641cd7f8b76dbf9de80df8b519982e44d41c960df29fd03618e02e9693b2d11ad06d19c4a965274c95a048ec3b9653eacb919a7f8b733
 DIST xsts-2002-01-16.tar.gz 6894439 BLAKE2B 1e9ec63d2c104655e64249e07440a04d862fcbcd4d4e19745d81b34994319b510a531c9d6df1491fae1e90b5d0764f0f1a827251ca8df5d613178b0eab01ef25 SHA512 43300af6d39c1e2221b0ed7318fe14c7464eeb6eb030ed1e22eb29b4ab17f014e2a4c8887c3a46ae5d243e3072da27f00f4e285498ae6f1288177d38d1108288
 DIST xsts-2004-01-14.tar.gz 2761085 BLAKE2B 41545995fb3a65d053257c376c07d45ffd1041a433bfbdb46d4dd87a5afb60c18c8629a3d988323f9e7a1d709775b5a7e5930276a7121c0725a22705c0976e36 SHA512 32854388d7e720ad67156baf50bf2bae7bd878ca3e35fd7e44e57cad3f434f69d56bbbedd61509f8a1faf01c9eae74a078df8fe130780b182c05c05cb1c39ebe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch
deleted file mode 100644
index 190218be3a5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.5-CVE-2023-45322.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
-https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9
-https://bugs.gentoo.org/915351
-
-From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Wed, 23 Aug 2023 20:24:24 +0200
-Subject: [PATCH] tree: Fix copying of DTDs
-
-- Don't create multiple DTD nodes.
-- Fix UAF if malloc fails.
-- Skip DTD nodes if tree module is disabled.
-
-Fixes #583.
---- a/tree.c
-+++ b/tree.c
-@@ -4471,29 +4471,28 @@ xmlNodePtr
- xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
-     xmlNodePtr ret = NULL;
-     xmlNodePtr p = NULL,q;
-+    xmlDtdPtr newSubset = NULL;
- 
-     while (node != NULL) {
--#ifdef LIBXML_TREE_ENABLED
- 	if (node->type == XML_DTD_NODE ) {
--	    if (doc == NULL) {
-+#ifdef LIBXML_TREE_ENABLED
-+	    if ((doc == NULL) || (doc->intSubset != NULL)) {
- 		node = node->next;
- 		continue;
- 	    }
--	    if (doc->intSubset == NULL) {
--		q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
--		if (q == NULL) goto error;
--		q->doc = doc;
--		q->parent = parent;
--		doc->intSubset = (xmlDtdPtr) q;
--		xmlAddChild(parent, q);
--	    } else {
--		q = (xmlNodePtr) doc->intSubset;
--		xmlAddChild(parent, q);
--	    }
--	} else
-+            q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
-+            if (q == NULL) goto error;
-+            q->doc = doc;
-+            q->parent = parent;
-+            newSubset = (xmlDtdPtr) q;
-+#else
-+            node = node->next;
-+            continue;
- #endif /* LIBXML_TREE_ENABLED */
-+	} else {
- 	    q = xmlStaticCopyNode(node, doc, parent, 1);
--	if (q == NULL) goto error;
-+	    if (q == NULL) goto error;
-+        }
- 	if (ret == NULL) {
- 	    q->prev = NULL;
- 	    ret = p = q;
-@@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
- 	}
- 	node = node->next;
-     }
-+    if (newSubset != NULL)
-+        doc->intSubset = newSubset;
-     return(ret);
- error:
-     xmlFreeNodeList(ret);
--- 
-GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch
deleted file mode 100644
index 6092c63201c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.9-icu-pkgconfig.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Needed with icu-76.1 at least. Not clear why it worked before.
-
-/var/tmp/portage/dev-libs/libxml2-2.11.9/work/libxml2-2.11.9-abi_x86_32.x86/.libs/runtest:
-  symbol lookup error: /var/tmp/portage/dev-libs/libxml2-2.11.9/work/libxml2-2.11.9-abi_x86_32.x86/.libs/libxml2.so.2: undefined symbol: UCNV_FROM_U_CALLBACK_STOP
---- a/configure.ac
-+++ b/configure.ac
-@@ -1082,10 +1082,10 @@ if test "$with_icu" != "yes" ; then
- else
-     # Try pkg-config first so that static linking works.
-     # If this succeeeds, we ignore the WITH_ICU directory.
--    PKG_CHECK_MODULES([ICU], [icu-i18n], [
-+    PKG_CHECK_MODULES([ICU], [icu-uc icu-i18n], [
-         WITH_ICU=1
-         m4_ifdef([PKG_CHECK_VAR],
--            [PKG_CHECK_VAR([ICU_DEFS], [icu-i18n], [DEFS])])
-+            [PKG_CHECK_VAR([ICU_DEFS], [icu-uc icu-i18n], [DEFS])])
-         if test "x$ICU_DEFS" != "x"; then
-             ICU_CFLAGS="$ICU_CFLAGS $ICU_DEFS"
-         fi],[:])
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch
new file mode 100644
index 00000000000..a74fff7ca25
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.14.2-no-git.patch
@@ -0,0 +1,34 @@
+From 4d6eb90bfdfe347fb1c5fe3151ef9dae80d12866 Mon Sep 17 00:00:00 2001
+From: Alfred Wingate <parona@protonmail.com>
+Date: Sun, 4 May 2025 15:41:31 +0300
+Subject: [PATCH] meson: allow building without git
+
+Signed-off-by: Alfred Wingate <parona@protonmail.com>
+---
+ meson.build | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index a8af753d..b0c99eef 100644
+--- a/meson.build
++++ b/meson.build
+@@ -17,9 +17,13 @@ v_min = v_array[1].to_int()
+ v_mic = v_array[2].to_int()
+ v_nbr = v_maj * 10000 + v_min * 100 + v_mic
+ v_extra = ''
+-r = run_command('git', 'describe', check: false)
+-if (r.returncode() == 0)
+-    v_extra = '-GIT' + r.stdout().strip()
++
++git = find_program('git', required: false)
++if git.found()
++    r = run_command(git, 'describe', check: false)
++    if (r.returncode() == 0)
++        v_extra = '-GIT' + r.stdout().strip()
++    endif
+ endif
+ 
+ # install paths
+-- 
+2.49.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
index c25a2f5681a..e9263968946 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
index 32d2937863d..b53e73fe002 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.8.ebuild
@@ -7,7 +7,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit autotools flag-o-matic python-r1 multilib-minimal
+inherit autotools python-r1 multilib-minimal
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
@@ -37,7 +37,7 @@ S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
 SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+IUSE="examples icu lzma +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -101,22 +101,14 @@ src_prepare() {
 }
 
 multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
 	libxml2_configure() {
 		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
 			$(use_with icu) \
 			$(use_with lzma) \
 			$(use_enable static-libs static) \
 			$(multilib_native_use_with readline) \
 			$(multilib_native_use_with readline history) \
+			--with-legacy \
 			"$@"
 	}
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
similarity index 53%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
index 32d2937863d..dbe8cb03767 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.2.ebuild
@@ -5,9 +5,9 @@ EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit autotools flag-o-matic python-r1 multilib-minimal
+inherit python-r1 meson-multilib
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
@@ -36,8 +36,9 @@ SRC_URI+="
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+# see so_version = v_maj + v_min_compat for subslot
+SLOT="2/16"
+IUSE="icu +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -45,23 +46,18 @@ RDEPEND="
 	virtual/libiconv
 	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
 MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-2.12.9-icu-pkgconfig.patch
+	"${FILESDIR}"/libxml2-2.14.2-no-git.patch
 )
 
 src_unpack() {
@@ -93,88 +89,77 @@ src_unpack() {
 src_prepare() {
 	default
 
-	# Please do not remove, as else we get references to PORTAGE_TMPDIR
-	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-	#elibtoolize
-
-	eautoreconf
+	sed -e "/^dir_doc/ s/meson.project_name()$/\'${PF}\'/" -i meson.build || die
 }
 
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+python_configure() {
+	local emesonargs=(
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=enabled
+	)
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_configure
+	popd >/dev/null || die
 }
 
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
+multilib_src_configure() {
+	local emesonargs=(
+		-Ddefault_library=$(multilib_native_usex static-libs both shared)
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=disabled
+
+		# There has been a clean break with a soname bump.
+		# It's time to deal with the breakage.
+		# bug #935452
+		-Dlegacy=disabled
+	)
+	meson_src_configure
 
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
 
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_compile
 	popd >/dev/null || die
 }
 
 multilib_src_compile() {
-	default
+	meson_src_compile
 
 	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
+		python_foreach_impl python_compile
 	fi
 }
 
 multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
+	meson_src_test
 
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl meson_src_test
+	fi
 }
 
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_install
+	python_optimize
+	popd >/dev/null || die
 }
 
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
 	fi
 
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
+	meson_src_install
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.3.ebuild
similarity index 51%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.3.ebuild
index 08a3b2e66ac..dbe8cb03767 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.14.3.ebuild
@@ -1,13 +1,13 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal
+inherit python-r1 meson-multilib
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -22,12 +22,10 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
 	inherit git-r3
 else
-	inherit autotools gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	inherit gnome.org
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
-inherit autotools
-
 SRC_URI+="
 	test? (
 		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
@@ -38,8 +36,9 @@ SRC_URI+="
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
-SLOT="2"
-IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+# see so_version = v_maj + v_min_compat for subslot
+SLOT="2/16"
+IUSE="icu +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -47,24 +46,18 @@ RDEPEND="
 	virtual/libiconv
 	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
 MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-2.11.5-CVE-2023-45322.patch
-	"${FILESDIR}"/${PN}-2.11.9-icu-pkgconfig.patch
+	"${FILESDIR}"/libxml2-2.14.2-no-git.patch
 )
 
 src_unpack() {
@@ -96,88 +89,77 @@ src_unpack() {
 src_prepare() {
 	default
 
-	# Please do not remove, as else we get references to PORTAGE_TMPDIR
-	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-	#elibtoolize
-
-	eautoreconf
+	sed -e "/^dir_doc/ s/meson.project_name()$/\'${PF}\'/" -i meson.build || die
 }
 
-multilib_src_configure() {
-	# Filter seemingly problematic CFLAGS (bug #26320)
-	filter-flags -fprefetch-loop-arrays -funroll-loops
-
-	# Notes:
-	# The meaning of the 'debug' USE flag does not apply to the --with-debug
-	# switch (enabling the libxml2 debug module). See bug #100898.
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--enable-ipv6 \
-			$(use_with ftp) \
-			$(use_with debug run-debug) \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+python_configure() {
+	local emesonargs=(
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=enabled
+	)
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_configure
+	popd >/dev/null || die
 }
 
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
+multilib_src_configure() {
+	local emesonargs=(
+		-Ddefault_library=$(multilib_native_usex static-libs both shared)
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=disabled
+
+		# There has been a clean break with a soname bump.
+		# It's time to deal with the breakage.
+		# bug #935452
+		-Dlegacy=disabled
+	)
+	meson_src_configure
 
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
 
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_compile
 	popd >/dev/null || die
 }
 
 multilib_src_compile() {
-	default
+	meson_src_compile
 
 	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
+		python_foreach_impl python_compile
 	fi
 }
 
 multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
-
-	emake check
+	meson_src_test
 
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl meson_src_test
+	fi
 }
 
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_install
+	python_optimize
+	popd >/dev/null || die
 }
 
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
 	fi
 
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
+	meson_src_install
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
index 45b054cf891..75a9858dc38 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
@@ -1,13 +1,13 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="xml(+)"
-inherit python-r1 multilib-minimal
+inherit python-r1 meson-multilib
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -20,9 +20,9 @@ DESCRIPTION="XML C parser and toolkit"
 HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
-	inherit autotools git-r3
+	inherit git-r3
 else
-	inherit gnome.org libtool
+	inherit gnome.org
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
@@ -36,8 +36,9 @@ SRC_URI+="
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
-SLOT="2"
-IUSE="examples icu lzma +python readline static-libs test"
+# see so_version = v_maj + v_min_compat for subslot
+SLOT="2/16"
+IUSE="icu +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
@@ -45,17 +46,12 @@ RDEPEND="
 	virtual/libiconv
 	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
-if [[ ${PV} == 9999 ]] ; then
-	BDEPEND+=" dev-build/gtk-doc-am"
-fi
-
 MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
@@ -89,82 +85,77 @@ src_unpack() {
 src_prepare() {
 	default
 
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Please do not remove, as else we get references to PORTAGE_TMPDIR
-		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
-		elibtoolize
-	fi
+	sed -e "/^dir_doc/ s/meson.project_name()$/\'${PF}\'/" -i meson.build || die
 }
 
-multilib_src_configure() {
-	libxml2_configure() {
-		ECONF_SOURCE="${S}" econf \
-			$(use_with icu) \
-			$(use_with lzma) \
-			$(use_enable static-libs static) \
-			$(multilib_native_use_with readline) \
-			$(multilib_native_use_with readline history) \
-			--with-legacy \
-			"$@"
-	}
-
-	# Build python bindings separately
-	libxml2_configure --without-python
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+python_configure() {
+	local emesonargs=(
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=enabled
+	)
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_configure
+	popd >/dev/null || die
 }
 
-libxml2_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
+multilib_src_configure() {
+	local emesonargs=(
+		-Ddefault_library=$(multilib_native_usex static-libs both shared)
+		$(meson_feature icu)
+		$(meson_native_use_feature readline)
+		$(meson_native_use_feature readline history)
+		-Dpython=disabled
+
+		# There has been a clean break with a soname bump.
+		# It's time to deal with the breakage.
+		# bug #935452
+		-Dlegacy=disabled
+	)
+	meson_src_configure
 
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
 
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_compile
 	popd >/dev/null || die
 }
 
 multilib_src_compile() {
-	default
+	meson_src_compile
 
 	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxml2_py_emake all
+		python_foreach_impl python_compile
 	fi
 }
 
 multilib_src_test() {
-	ln -s "${S}"/xmlconf || die
+	meson_src_test
 
-	emake check
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake check
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl meson_src_test
+	fi
 }
 
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	multilib_is_native_abi && use python &&
-		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
-
-	# Hack until automake release is made for the optimise fix
-	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	meson_src_install
+	python_optimize
+	popd >/dev/null || die
 }
 
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
 	fi
 
-	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
-
-	find "${ED}" -name '*.la' -delete || die
+	meson_src_install
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
index d6ddc5434aa..ad41ca7453c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
@@ -1,3 +1 @@
-DIST libxslt-1.1.39.tar.xz 1578216 BLAKE2B 7c87b769d345fc99a966bea6b4e94533fa211dc3a987ce013a03eefb05dde73ef75526bdecf7d32d8c77112232096fb22d8ec4f0a781b9f59d0422a2db75df01 SHA512 c0c99dc63f8b2acb6cc3ad7ad684ffa2a427ee8d1740495cbf8a7c9b9c8679f96351b4b676c73ccc191014db4cb4ab42b9a0070f6295565f39dbc665c5c16f89
-DIST libxslt-1.1.42.tar.xz 1573668 BLAKE2B 91b2ca38807ae21b6629b8e19f4ab9d7d19bc0af17f2546e1cf278b2f2fff62b86bbbd996085fff322f3d5ae6c2b20bcfc4e9fb501c301d3fd5d56cf5b205ede SHA512 02a2189b6cd65fa1fb929fc0e6868bc046bdd8827849f0048cdf9267ed9450745158cef0f2713a833e28fb520b312ff86dc5754dd423ce768c457bfd8812bdc7
 DIST libxslt-1.1.43.tar.xz 1518364 BLAKE2B 84d1cff32c78c4eeff4db614214ee1808bcf958d55711b08e7e2191a4343fb61d38d6b3d9b43f6f12be2dc909fced0a5b5905fa2c5ec7761c83125007e1ce265 SHA512 96110b0397a8f5791f489127574e2143845feb61bea0581d7b7e3c1101fd0718483bae81a7ce417b971bd678293bfd95daddad0dadd3e256c87d41a69faed85a
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch
deleted file mode 100644
index 8d7f98e71b9..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/files/libxslt-1.1.39-libxml2-2.11-tests.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-https://bugs.gentoo.org/918973
-https://gitlab.gnome.org/GNOME/libxslt/-/issues/99
-https://gitlab.gnome.org/GNOME/libxslt/-/commit/86ec392efd75ce24b79f4baa9822a1b088f3e47f
-
-From 86ec392efd75ce24b79f4baa9822a1b088f3e47f Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Fri, 1 Dec 2023 21:05:19 +0100
-Subject: [PATCH] tests: Fix build with older libxml2
-
-Fixes #99.
---- a/tests/runtest.c
-+++ b/tests/runtest.c
-@@ -456,7 +456,8 @@ initializeLibxml2(void) {
-     xmlSetExternalEntityLoader(xmlNoNetExternalEntityLoader);
-     xmlSetGenericErrorFunc(NULL, testErrorHandler);
-     xsltSetGenericErrorFunc(NULL, testErrorHandler);
--    xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler);
-+    xmlSetStructuredErrorFunc(NULL,
-+            (xmlStructuredErrorFunc) testStructuredErrorHandler);
-     exsltRegisterAll();
-     xsltRegisterTestModule();
-     xsltMaxDepth = 200;
--- 
-GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild
deleted file mode 100644
index ab5e6b57c5f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39-r1.ebuild
+++ /dev/null
@@ -1,128 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump this in sync with dev-libs/libxml2.
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit flag-o-matic python-r1 multilib-minimal
-
-DESCRIPTION="XSLT libraries and tools"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
-	inherit autotools git-r3
-else
-	inherit libtool gnome.org
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="crypt debug examples python static-libs"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-BDEPEND=">=virtual/pkgconfig-1"
-RDEPEND="
-	<dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
-	crypt? ( >=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-"
-DEPEND="${RDEPEND}"
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xslt-config
-)
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/libxslt/xsltconfig.h
-)
-
-PATCHES=(
-	"${FILESDIR}"/${P}-libxml2-2.11-tests.patch
-)
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Prefix always needs elibtoolize if not eautoreconf'd.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Remove this after upstream merge request to add AC_SYS_LARGEFILE lands:
-	# https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/55
-	append-lfs-flags
-
-	libxslt_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--without-python \
-			$(use_with crypt crypto) \
-			$(use_with debug) \
-			$(use_enable static-libs static) \
-			"$@"
-	}
-
-	# Build Python bindings separately
-	libxslt_configure --without-python
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxslt_configure --with-python
-	fi
-}
-
-libxslt_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake check
-	fi
-}
-
-multilib_src_install() {
-	# "default" does not work here - docs are installed by multilib_src_install_all
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake \
-			DESTDIR="${D}" \
-			install
-
-		# Hack until automake release is made for the optimise fix
-		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-		python_foreach_impl python_optimize
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild
deleted file mode 100644
index 0eb16b11c78..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.42.ebuild
+++ /dev/null
@@ -1,123 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: Please bump this in sync with dev-libs/libxml2.
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit python-r1 multilib-minimal
-
-DESCRIPTION="XSLT libraries and tools"
-HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
-	inherit autotools git-r3
-else
-	inherit libtool gnome.org
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="crypt debug examples python static-libs"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-BDEPEND=">=virtual/pkgconfig-1"
-RDEPEND="
-	>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
-	crypt? ( >=dev-libs/libgcrypt-1.5.3:=[${MULTILIB_USEDEP}] )
-	python? (
-		${PYTHON_DEPS}
-		>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
-	)
-"
-DEPEND="${RDEPEND}"
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/xslt-config
-)
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/libxslt/xsltconfig.h
-)
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	else
-		# Prefix always needs elibtoolize if not eautoreconf'd.
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	libxslt_configure() {
-		ECONF_SOURCE="${S}" econf \
-			--without-python \
-			$(use_with crypt crypto) \
-			$(use_with debug) \
-			$(use_enable static-libs static) \
-			"$@"
-	}
-
-	# Build Python bindings separately
-	libxslt_configure --without-python
-
-	if multilib_is_native_abi && use python ; then
-		NATIVE_BUILD_DIR="${BUILD_DIR}"
-		python_foreach_impl run_in_build_dir libxslt_configure --with-python
-	fi
-}
-
-libxslt_py_emake() {
-	pushd "${BUILD_DIR}"/python >/dev/null || die
-
-	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
-
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake all
-	fi
-}
-
-multilib_src_test() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake check
-	fi
-}
-
-multilib_src_install() {
-	# "default" does not work here - docs are installed by multilib_src_install_all
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python; then
-		python_foreach_impl run_in_build_dir libxslt_py_emake \
-			DESTDIR="${D}" \
-			install
-
-		# Hack until automake release is made for the optimise fix
-		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
-		python_foreach_impl python_optimize
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use examples ; then
-		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
-		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43-r1.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43-r1.ebuild
index af64f318933..86ee3d4b45c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.43-r1.ebuild
@@ -25,11 +25,11 @@ REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 BDEPEND=">=virtual/pkgconfig-1"
 RDEPEND="
-	>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
+	>=dev-libs/libxml2-2.13:2=[${MULTILIB_USEDEP}]
 	crypt? ( >=dev-libs/libgcrypt-1.5.3:=[${MULTILIB_USEDEP}] )
 	python? (
 		${PYTHON_DEPS}
-		>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
+		>=dev-libs/libxml2-2.13:2=[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
 	)
 "
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
index 936f69f3533..6458543e098 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
@@ -25,11 +25,11 @@ REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 BDEPEND=">=virtual/pkgconfig-1"
 RDEPEND="
-	>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP}]
+	>=dev-libs/libxml2-2.13:2=[${MULTILIB_USEDEP}]
 	crypt? ( >=dev-libs/libgcrypt-1.5.3:=[${MULTILIB_USEDEP}] )
 	python? (
 		${PYTHON_DEPS}
-		>=dev-libs/libxml2-2.13:2[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
+		>=dev-libs/libxml2-2.13:2=[${MULTILIB_USEDEP},python,${PYTHON_USEDEP}]
 	)
 "
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
index b61a5547b17..59a1cdaa6ef 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/lzo/lzo-2.10.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit multilib-minimal usr-ldscript
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
index 925cbb7e68f..05a8896edb7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/Manifest
@@ -1,2 +1,3 @@
 DIST dectest.zip 791733 BLAKE2B ba74ee96f6687ce34cac8406fd7fd1f743d72647a5f883f1054829d992d4dc0f61c9e3b88e2529f425cc2fbda14dfc372b3fbfafe6553baabb3244172fed712f SHA512 05f9d12aec1ebfc9ca211b01705b41c5cd1bbc54d9aa6c4799b40fb3ab1835433fd1a277735d26d2530c3793c58b107b3abb1c31f64340e5e9d7856d92c821cf
 DIST mpdecimal-4.0.0.tar.gz 315325 BLAKE2B aed5b6d5c03b12017989bbac9a166366e800ce5ee8d2fad5a1b81def48877126233998df306968902c728776616b1c06ce0ef05ea066c07daf841a53541a09f9 SHA512 7610ac53ac79f7a8a33fa7a3e61515810444ec73ebca859df7a9ddc18e96b990c99323172810c9cc7f6d6e1502c0be308cd443d6c2d5d0c871648e4842e05d59
+DIST mpdecimal-4.0.1.tar.gz 316268 BLAKE2B fcdb89721b0e16ba8cba25fab953e1f0a4b24366d0dfbc11c942e37537a3716699917013ab9e73e809c48174add8da41b4991b0250cbef07966cab81ae85b3eb SHA512 431fa8ab90d6b8cdecc38b1618fd89d040185dec3c1150203e20f40f10a16160058f6b8abddd000f6ecb74f4dc42d9fef8111444f1496ab34c34f6b814ed32b7
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild
new file mode 100644
index 00000000000..7578ab1c935
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.1.ebuild
@@ -0,0 +1,63 @@
+# Copyright 2024-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Correctly-rounded arbitrary precision decimal floating point arithmetic"
+HOMEPAGE="https://www.bytereef.org/mpdecimal/"
+SRC_URI="
+	https://www.bytereef.org/software/mpdecimal/releases/${P}.tar.gz
+	test? (
+		https://speleotrove.com/decimal/dectest.zip
+	)
+"
+
+LICENSE="BSD-2"
+SLOT="$(ver_cut 1)"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="cxx test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? (
+		app-arch/unzip
+	)
+"
+
+src_unpack() {
+	unpack "${P}.tar.gz"
+	if use test; then
+		mkdir "${P}/tests/testdata" || die
+		cd "${P}/tests/testdata" || die
+		unpack dectest.zip
+	fi
+}
+
+src_prepare() {
+	default
+
+	# sigh
+	sed -i -e "s:/lib:/$(get_libdir):" lib*/.pc/*.pc.in || die
+}
+
+src_configure() {
+	local myconf=(
+		# just COPYRIGHT.txt
+		--docdir=/removeme
+		$(use_enable cxx)
+	)
+
+	# more sigh
+	# https://bugs.gentoo.org/931599
+	local -x LDXXFLAGS="${LDFLAGS}" LD="${CC}" LDXX="${CXX}"
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+	rm -r "${D}/removeme" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
index 3800b06f187..2bfa57814eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpfr/mpfr-4.2.2.ebuild
@@ -48,7 +48,7 @@ LICENSE="LGPL-3+"
 # preserve-libs.eclass usage to pkg_*inst! See e.g. the readline ebuild.
 SLOT="0/6" # libmpfr.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="static-libs"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
index 71bf1e316dd..4b1ed75bf6e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
@@ -16,7 +16,7 @@ if [[ "${PV}" == *9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
 	SLOT="0/$(ver_cut 1-2).0"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/Manifest
index 787e3473e7a..ebb5ffeba54 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/Manifest
@@ -3,3 +3,4 @@ DIST userspace-rcu-0.14.1.tar.bz2 669999 BLAKE2B 6ae6a98020f731b5dc3bef5e7cf1a0b
 DIST userspace-rcu-0.15.0.tar.bz2 683414 BLAKE2B 3502cd0acd6e8e1370a2fd369207a305b3138b0db3186a37a9511bcf2f9ba362787274b030b0138111fe1d4805acd95bbae00c4d2332f1a0761f02bdc7f89e38 SHA512 a0b543dcc6d1ace34c4f159074a439926bcec6708fde66db14022cfa6e8082d5d0430ad02dc036cc3902304357439bbacd89b3fc5f4ed9911716f2f0480af3e4
 DIST userspace-rcu-0.15.1.tar.bz2 682998 BLAKE2B c2b20099a4a9284f44031bb2d5f87ab03292896739115fdc741493d7f7c714b306a1981c1ff8164fb39ddf200634ddefdb757582b4891aa04cadd9dd8b51260a SHA512 164d369cc1375b6b71eaa26812aff8a294bfbdffde65c2668e5c559d215d74c1973681f8083bfde39e280ca6fe8e92aadc7c867f966a5769548b754c92389616
 DIST userspace-rcu-0.15.2.tar.bz2 684018 BLAKE2B 40b21b482acf26b4478b02ef1d6e7612504c0ab869c1ae8c5b1974decf5512a6240fe2f3817b29830eea0b94836b5ba6324fb0246b3355241d5a215c11de0060 SHA512 ded62f0cb4d6c78adf06235ca4dee36a213efcbfd9cc4e24525d8d29b1d746075f0fbe22d5cee1e38bca9920e0641f94507b640569a84c937e4bae99f53be7c1
+DIST userspace-rcu-0.15.3.tar.bz2 684175 BLAKE2B e636b04fe3bac7bb8f4afff0a7b2153e38d396a9c08e8ca19e705fcda81adda5256817db87305382c7adc3630ef5b1d25ff81af818a6b8c70232df11c9bee862 SHA512 9461f5f1ebfcfdb28bc9548738a030d0a29e754ae5340581d057c405c0fa5c17560a251fa15a20cf14d35f1fcc9aceac80841b37a5f348698da52a71ee4d4fe5
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.2.ebuild
index 4dce0bee8d8..031486dc581 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://lttng.org/files/urcu/${P}.tar.bz2"
 
 LICENSE="LGPL-2.1"
 SLOT="0/8" # subslot = soname version
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.3.ebuild
new file mode 100644
index 00000000000..4dce0bee8d8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/userspace-rcu/userspace-rcu-0.15.3.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Userspace RCU (read-copy-update) library"
+HOMEPAGE="https://liburcu.org/"
+SRC_URI="https://lttng.org/files/urcu/${P}.tar.bz2"
+
+LICENSE="LGPL-2.1"
+SLOT="0/8" # subslot = soname version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="static-libs test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="test? ( sys-process/time )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.13.1-tests-no-benchmark.patch
+)
+
+src_prepare() {
+	default
+
+	# Needed for tests patch
+	# ... and refresh libtool (see https://github.com/gentoo/gentoo/pull/23973)
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--enable-shared
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	default
+
+	emake -C tests/regression regtest
+
+	# We don't run the benchmark tests.
+	rm tests/benchmark/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
index d38c6e1f4b2..4930e16a7e4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest
@@ -1,2 +1 @@
-DIST xmlsec1-1.3.6.tar.gz 2453984 BLAKE2B 217817ef0f7003247b7173a6581ba6428e623ff4e464b4ea08bd93d07c0aaba8ee379cbdd6309e3c2c6f07f5022fe55a51dc1afc001525bf219eff9f06ff5aad SHA512 f38ccc7af0026973a94b1b6f95accd70a2a2c4398985a0002c66d7b43bff6d6bcfb09ae62046cbdac82a0890622aead2df710cb0ab373c3bdf6159797613cdaa
 DIST xmlsec1-1.3.7.tar.gz 2468083 BLAKE2B 6e3b14d476cc6d37e5f9324383432dfacc1a3ac0340bcf709f70b2e8f99dadee23d48e12569b50768446dfa3601868c99190bb44fdeb5c6fc2a0bb48cfd7335e SHA512 0813ad0f7821f765947a7d81d276ba479bf54430279a7b9da31988d1ec76c60b81d3d57f1088a69a2cc0d8d27fa932ce1cb051457d1c0c5a6f071a2df4395cb8
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild
deleted file mode 100644
index 78ba551e9c1..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.6.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
-HOMEPAGE="https://www.aleksey.com/xmlsec"
-SRC_URI="
-	https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz
-	https://www.aleksey.com/xmlsec/download/older-releases/${PN}1-${PV}.tar.gz
-"
-S="${WORKDIR}/${PN}1-${PV}"
-
-LICENSE="MIT"
-# Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
-SLOT="0/$(ver_cut 1-2)"
-KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~sparc x86"
-IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	|| ( gnutls nss openssl )
-"
-
-RDEPEND="
-	>=dev-libs/libxml2-2.7.4
-	>=dev-libs/libxslt-1.0.20
-	dev-libs/libltdl
-	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
-	gnutls? ( >=net-libs/gnutls-3.6.13:= )
-	nss? (
-		>=dev-libs/nspr-4.4.1
-		>=dev-libs/nss-3.9
-	)
-	openssl? ( dev-libs/openssl:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? (
-		nss? (
-			>=dev-libs/nss-3.9[utils]
-		)
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.3.0-optimisation.patch
-)
-
-src_prepare() {
-	default
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable doc docs)
-		$(use_enable static-libs static)
-		$(use_with gcrypt)
-		$(use_with gnutls)
-		$(use_with nss nspr)
-		$(use_with nss)
-		$(use_with openssl)
-
-		--disable-werror
-		--enable-mans
-		--enable-pkgconfig
-
-		--enable-concatkdf
-		--enable-pbkdf2
-		--enable-ec
-		--enable-dh
-		--enable-sha3
-
-		--enable-files
-		$(use_enable http)
-		--disable-ftp
-	)
-
-	# Bash because of bug #721128
-	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
-	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
index 518b63635de..5d1a9be8149 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.7-r1.ebuild
@@ -24,7 +24,7 @@ REQUIRED_USE="
 "
 
 RDEPEND="
-	>=dev-libs/libxml2-2.7.4
+	>=dev-libs/libxml2-2.7.4:=
 	>=dev-libs/libxslt-1.0.20
 	dev-libs/libltdl
 	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/yajl/files/yajl-2.1.0-cmake-4.patch b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/files/yajl-2.1.0-cmake-4.patch
new file mode 100644
index 00000000000..51ed162d795
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/files/yajl-2.1.0-cmake-4.patch
@@ -0,0 +1,71 @@
+https://bugs.gentoo.org/951675
+https://github.com/lloyd/yajl/issues/254
+https://github.com/lloyd/yajl/pull/256
+
+From 6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9 Mon Sep 17 00:00:00 2001
+From: Rudi Heitbaum <rudi@heitbaum.com>
+Date: Fri, 28 Mar 2025 09:31:40 +0000
+Subject: [PATCH] Allow build with CMake 4.0.0
+
+fixes deprecated cmake option and uses cmake 2.8.0 TARGET_FILE
+update cmake supported minimum versions to 2.8.0...3.10
+
+ref:
+- https://cmake.org/cmake/help/latest/policy/CMP0026.html
+
+CMake Error at .../CMakeLists.txt: (GET_TARGET_PROPERTY):
+  The LOCATION property may not be read from target "json_...".  Use the
+  target name directly with add_custom_command, or use the generator
+  expression $<TARGET_FILE>, as appropriate.
+
+Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
+---
+ CMakeLists.txt             | 2 +-
+ reformatter/CMakeLists.txt | 4 +---
+ verify/CMakeLists.txt      | 4 +---
+ 3 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 471eee13..deba3a40 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -12,7 +12,7 @@
+ # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ 
+-CMAKE_MINIMUM_REQUIRED(VERSION 2.6)
++CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0...3.10)
+ 
+ PROJECT(YetAnotherJSONParser C)
+ 
+diff --git a/reformatter/CMakeLists.txt b/reformatter/CMakeLists.txt
+index 52a9bee8..267d02e2 100644
+--- a/reformatter/CMakeLists.txt
++++ b/reformatter/CMakeLists.txt
+@@ -35,9 +35,7 @@ IF (NOT WIN32)
+ ENDIF (NOT WIN32)
+ 
+ # copy the binary into the output directory
+-GET_TARGET_PROPERTY(binPath json_reformat LOCATION)
+-
+ ADD_CUSTOM_COMMAND(TARGET json_reformat POST_BUILD
+-    COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir})
++    COMMAND ${CMAKE_COMMAND} -E copy_if_different $<TARGET_FILE:json_reformat> ${binDir})
+ 
+ INSTALL(TARGETS json_reformat RUNTIME DESTINATION bin)
+diff --git a/verify/CMakeLists.txt b/verify/CMakeLists.txt
+index 967fca16..2f390082 100644
+--- a/verify/CMakeLists.txt
++++ b/verify/CMakeLists.txt
+@@ -29,9 +29,7 @@ ADD_EXECUTABLE(json_verify ${SRCS})
+ TARGET_LINK_LIBRARIES(json_verify yajl_s)
+ 
+ # copy in the binary
+-GET_TARGET_PROPERTY(binPath json_verify LOCATION)
+-
+ ADD_CUSTOM_COMMAND(TARGET json_verify POST_BUILD
+-    COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir})
++    COMMAND ${CMAKE_COMMAND} -E copy_if_different $<TARGET_FILE:json_verify> ${binDir})
+ 
+ INSTALL(TARGETS json_verify RUNTIME DESTINATION bin)
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r6.ebuild
new file mode 100644
index 00000000000..6ed557a6512
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/yajl/yajl-2.1.0-r6.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib multibuild
+
+DESCRIPTION="Small event-driven (SAX-style) JSON parser"
+HOMEPAGE="https://lloyd.github.io/yajl/"
+SRC_URI="https://github.com/lloyd/yajl/archive/refs/tags/${PV}.tar.gz -> ${P}-r5.tar.gz"
+
+LICENSE="ISC"
+SLOT="0/2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE=""
+
+PATCHES=(
+	"${FILESDIR}"/${P}-uclibc.patch # git master 5d4bf525
+	"${FILESDIR}"/${P}-pkg-config.patch # downstream
+	"${FILESDIR}"/${P}-memory-leak.patch # Bug 908036
+	"${FILESDIR}"/${PN}-2.1.0-cmake-4.patch # Bug 951675
+)
+
+src_prepare() {
+	cmake_src_prepare
+	multilib_copy_sources
+}
+
+multilib_src_test() {
+	cd "${S}"/test/parsing || die
+	./run_tests.sh "${BUILD_DIR}"/test/parsing/yajl_test || die
+}
+
+src_install() {
+	cmake-multilib_src_install
+	find "${D}" -name libyajl_s.a -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/Manifest
index 9f68a4a14ce..82fcb627ab0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/Manifest
@@ -1,3 +1 @@
-DIST cachecontrol-0.14.1.tar.gz 28928 BLAKE2B 9f01bc35c905f0fb489e796f96ccc0063a475bacc24b980ee67f8053412a52d9167b4b96495a8a7f7c561e2485a1b6fcb4ec94b1408ea5111f8661fea59394fd SHA512 f99463ee08199058d0f84a173d6a85276cfe6caec0bec6692e5af74f4c8e684a68ab6910c6c85cbd1f4515c7044ee2fbf149cfd85e4ce9d9ac97e9850698c07f
-DIST cachecontrol-0.14.2.tar.gz 28832 BLAKE2B fc572206871a39a2d4c50d0970b9aa2c58f9c99b28ab9bf98e76fad8c3f6e89962e84d368287d7d4beab1fcf16666e42a46a11e194c26f3c487359b767d8d77f SHA512 694dc7dfc976a4087471119a8d5f4b76aa08d62f814293d183331164a4225e8d6f9cbf58551ad806ea9e4bb4adac0d98bb54d7aa09ef4a64feff93a8899c4a58
 DIST cachecontrol-0.14.3.tar.gz 28985 BLAKE2B 130b372dc5b17eadc1f16ca6ee361bbc5fc83306a333059f538972b2e9cf29b2e0f608faa904c3d2793c7289e5ad176193534a3d1997aca97c490b9784a10bc0 SHA512 12205946ac78263148da4751a55d8c19356bdf055953a014cedfb3084869bb73034860592b5785d4e3e0bd3317c7dc80061105146460a1059eeef458ed5e8dfb
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild
deleted file mode 100644
index 57b4314bf59..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="httplib2 caching for requests"
-HOMEPAGE="
-	https://pypi.org/project/CacheControl/
-	https://github.com/psf/cachecontrol/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-RDEPEND="
-	<dev-python/msgpack-2[${PYTHON_USEDEP}]
-	>=dev-python/msgpack-0.5.2[${PYTHON_USEDEP}]
-	>=dev-python/requests-2.16.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	test? (
-		dev-python/cherrypy[${PYTHON_USEDEP}]
-		>=dev-python/filelock-3.8.0[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.2.ebuild
deleted file mode 100644
index 4a29add3823..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.2.ebuild
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="httplib2 caching for requests"
-HOMEPAGE="
-	https://pypi.org/project/CacheControl/
-	https://github.com/psf/cachecontrol/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-
-RDEPEND="
-	<dev-python/msgpack-2[${PYTHON_USEDEP}]
-	>=dev-python/msgpack-0.5.2[${PYTHON_USEDEP}]
-	>=dev-python/requests-2.16.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	test? (
-		dev-python/cherrypy[${PYTHON_USEDEP}]
-		>=dev-python/filelock-3.8.0[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=()
-
-	if [[ ${EPYTHON} == pypy3* ]]; then
-		EPYTEST_DESELECT+=(
-			tests/test_adapter.py::TestSessionActions::test_do_not_leak_response
-		)
-	fi
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.3.ebuild
index 4a29add3823..59fae266b3e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.3.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 RDEPEND="
 	<dev-python/msgpack-2[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
index c90394650b5..945bec52583 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3024.7.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
index 2170e3c5193..b0724e385a4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-1.17.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # please keep this ebuild at EAPI 8 -- sys-apps/portage dep
@@ -8,7 +8,7 @@ DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 # DO NOT ADD pypy to PYTHON_COMPAT
 # pypy bundles a modified version of cffi. Use python_gen_cond_dep instead.
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit distutils-r1 toolchain-funcs pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
index ded553993b5..510867cb076 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/chardet/chardet-5.2.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
index 11a72561fdb..87228c0a45c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
@@ -1,2 +1 @@
-DIST charset_normalizer-3.4.1.tar.gz 123188 BLAKE2B 04a2a47967d3992eb6320f173689693efb0614d67986fe1417f2f096435d2cdfaf10c57b6ecd2659f19ee907902c16fcd30f050cd14460973a059fc62ea999e3 SHA512 2891c0bd3097ad38d296a8378ded36110a06113c0f79e49cdfd7f3bca4f42487d10895db34cbb020cb70e93d9094ae72555ceef5535f8984de1cac4082232f4f
 DIST charset_normalizer-3.4.2.tar.gz 126367 BLAKE2B a83f719394753e7612657caee102c2a662980ef78e2be25a7f109913eb2650ec94b6a01a885a4f7a66b6ca8d47c680c163fdaf6bd043226b340a7aec6f15ab78 SHA512 702d9c23fe68d3538e4f45d5d9451beb02853ecf1ec6b36a7068ed8ade707bd0fd2a1764137381294590d0e5ffc2e296866f402dff33f65ec0458cf1102970fe
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.1.ebuild
deleted file mode 100644
index 2f2d644d57c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.1.ebuild
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="The Real First Universal Charset Detector"
-HOMEPAGE="
-	https://pypi.org/project/charset-normalizer/
-	https://github.com/jawah/charset_normalizer/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -o addopts=
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
index baaaf1950c4..3d8d6c85f08 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.2.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
 
 distutils_enable_tests pytest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
index a859bd28226..16b20fdac36 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/colorama/colorama-0.4.6.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
index f9997b03e11..e517c91a643 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
@@ -1,11 +1,11 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
index 8575a2f56ba..66df0440b27 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
@@ -1,40 +1,68 @@
 DIST asn1-0.20.0.crate 39382 BLAKE2B 01c9180cff6be56f43d99fe0b6cafe0c41ae0c9e1d77bc0eaa10277074043e25188d23905b74414b251d1bd53c42f5454f635caf2eba347d6c36cf5b741112b0 SHA512 6ac04a1e7260476887c72e23b667dab58da9f6c9cda3251b96a839d5d4929b657d2c5f7ec4188ebf36855dba893b038f511104c03a965949c01dd4c5e9b5e076
+DIST asn1-0.21.3.crate 40295 BLAKE2B 83135948a525b0ed432bd8e76e87f7400c56887c4a7cc505210014b8f4c9e47f9d139f723bf61165dfc772b9d86c0fe6a471336e480613ec556114afcf9fee83 SHA512 5f7b484e6081569cb1bd86b690ffcb49b51c5dff20dc08fedd9f803d634265fb4c157e2912b4763152cf8baf5556807aee109787618c3ecdb4a7307863502417
 DIST asn1_derive-0.20.0.crate 6998 BLAKE2B 270aeacaf4dbd9991c9f09f9f6fd5dfe67a16660150f8ef1fae74983b8cfd4ded01a0275a3aec47350084d7c49e07cd79a69b14db9d76232eec95211587549dc SHA512 80a5a07c8c241caa5189f21b0e626f03cd375a9899059dab195e4186e89ec6334ed5cc1ac6f04e628693e3e437b61aab7d7beee9636c0f66d4e6b5366cd75101
+DIST asn1_derive-0.21.3.crate 8570 BLAKE2B 3b94274d1c1ecbf5dd1c70cbacfbf6885a68734483eb990b090f230b6d8da3b7f2400355ce944c456b8712a1ae01b1b5a42cc277609ba752acb664337751dcec SHA512 b7feb53a380fec0a2db010a0af2ba1228aa45de99246ac7d388f5164735beff12ca882356eaa2c0eb710a099ac51ec8e739080715790af8f3d1ced6b3ff6c69e
 DIST autocfg-1.4.0.crate 17712 BLAKE2B 7f7300439899be03d001dd32b7e797bc4b9a58103081b6f7353c4b5897813cedf870b3fb1fa25d320a75326b334b44d8287e8603de34fc560d0b567143915cc6 SHA512 3b5e7c30bc73e105e4bfcab584c24fc4016db41fac9c356c6649fd841051704bbe8848e09546eb50d7c1f18ea8ce1cb72fbc268a620d5c609b3472114b5be73c
 DIST base64-0.22.1.crate 81597 BLAKE2B 6f216a560bd36e6e6b74e908344b457594cc768d9763070e269b56a14b150cbfc4b7f599d4c2a0a5f783638170ee132f0796fefb14fcac7fd73c58db0791007a SHA512 91cf2e4e7fc8815f9b8a86a7fa722a20eee3dc1dd57111b29e420de87ce7836bcdb1db01d3cafb9a977710ef63e7cc41b7772762323e68e0e832156858aace20
 DIST bitflags-2.6.0.crate 45357 BLAKE2B 3a368bd2eb58c095b7b4a46680cc2d90a28e24b2e37c854bbf8647c861c4b8fb37eca827599673c5c7df763048149dd82123d1ede1f8a0e58a6bc23c8250f7e6 SHA512 f9bb3c48931ed7e7e05ec6d13305af5da6b6c18861ff307d7dc17c658f63972c87b70b0527287b3625c8592befc207cfe15550654995faf3862bb12a6d95bacf
+DIST bitflags-2.9.1.crate 47913 BLAKE2B b14ee41348336981ab86459417b9feab90879a11a6524a8b43f2b89c09c844b4441c31e315c471be00ad21fa88b5dcc7671b56567fdcd72bb0790ceeaa25813b SHA512 6baeac42e4227e58030e317125a3c23997beceb44f9262f029e59c6dc36dd1733f2e88b3c3c8ad22f806245ef404512a880b16f3c8c52fa5c4aab287bb3cfe27
 DIST cc-1.2.1.crate 92731 BLAKE2B c9cb100964834692781ecc3f47972f83adaf27e019ca212f896b19a853521cf2084da213f2c2fc5c8a1bc794cc83fe9f81faf7751e1b065a3a2a08137cda0b61 SHA512 54bc5d85d48d678d33dc795aa6cc823a59ae6d17b4ec5708a1dd515e3495eabccdd949e9467e9bb3a29e44847a2d3ccd75055dfda241d8abbb16bfad650f2819
+DIST cc-1.2.23.crate 106527 BLAKE2B 0fd9e69ad743f4df15da3d25f85e1a422ef64b81b72af491001ccfba5c0c39e448deecc92e3a553bf74574460ecd2bf8f4056a1cd05d05856a1f3f36fa25bc19 SHA512 3fced846c630c09f629854754dc247affeae3e71375953617d77947b2bdfb479369db159cec941c7b094fd9d2fee62f7d5898d6d76de920dbd70de24ee35fd0b
 DIST cfg-if-1.0.0.crate 7934 BLAKE2B e99a5589c11d79d77a4537b34ce0a45d37b981c123b79b807cea836c89fc3926d693458893baca2882448d3d44e3f64e06141f6d916b748daa10b8cc1ae16d1b SHA512 0fb16a8882fd30e86b62c5143b1cb18ab564e84e75bd1f28fd12f24ffdc4a42e0d2e012a99abb606c12efe3c11061ff5bf8e24ab053e550ae083f7d90f6576ff
 DIST cryptography-44.0.2.tar.gz 710807 BLAKE2B 3bdfe1f6d4f44a77f8d5c2299e10e672eba2a68888fd5ee8ffae8a452d6c586c39bf5527feee60b62121dd7b18e13b1c91705df87ba0b52885e8538c56fec139 SHA512 12594fcd349b02a077d52b870af99850e275f13a561bbe9c993475f4ebfd35eccb63400c93a9629caf68195b759e2dbfddc3c60dc3066d063bb447acd7b17c03
 DIST cryptography-44.0.3.tar.gz 711096 BLAKE2B 42b1fd4cd22c50d377c9942740561612dcc5958a7c9e2bf2d54fc88faac43b3ebbd4ff4085fee923c39510f591e7e93f811541389733b190af3e69504b13643b SHA512 505c3a4275dbaae827ebc7c478d3196c9a2bef71e460a391d56ee53b7ff8a054f7ac81c1a8a4a59829d04dd9a434c123df948627ab8f07ec39259ea0498a8c69
+DIST cryptography-45.0.2.tar.gz 743865 BLAKE2B e2aa5e53b2e6564ed70762c2439b9e75f24042ef30aa2c47f97cd556e5ba95c362f5e30368e79b397b71ddba77feb6d9cc295a9b7062cf32c00cf02e9a02498e SHA512 b81cb339e8f8853503d518e37a958115c995565aa241d80307e2fb75cb46d476ce400e6871bc4beb93e0b35e456c8b7dbb49f161f8f112bd01e137770d251964
+DIST cryptography-45.0.3.tar.gz 744738 BLAKE2B 45cf4cba1babdf5cde1d22903d0e01f4796e68e4a38c6f7ef4075ea851faad4ecc1575eef1cfc3f6194aa35796a0187e5b1969ea32f9273a0c2e4a0350310cfe SHA512 e8cb59820de89d7a5b2bd2a4b79d5a040b225910eb0653ce5b89fbd694951c6b6ce928c548666e7c879fb71ec4661b426f140959bee6556c9a265c679fa51fbf
 DIST cryptography_vectors-44.0.2.tar.gz 35318019 BLAKE2B 67ed8f4af54c4469f1da21993e7220c649b1098f6e2b82fff10f8339cfd89506d6b6f64083999998408bc60fd66172e1b33844f39d41387c7ff8cc1efc52a35d SHA512 7a75078eae4a1a46d5aa87961aa2e4f28725a2feac99ea0ce00d48aa509ce00fb43176d48eab8eabaa3f7204ba8c4b2ef78b4b65187cfd5056b3c3e3116b4239
 DIST cryptography_vectors-44.0.3.tar.gz 35317973 BLAKE2B 1c76a7ddfb188db3cdd72c1458be6b249bbf9ea403767f002bb4044bdcc835d28aa3c5ff9ad15dd7721d0f54d76db499e44d9dda7cd4a35817b7a6cac6e206f8 SHA512 1287901703699053099bb8843928d0621884864d727de65d4a19d4f841271af8b2a773e8a0cbd7e850258db202bfb345439a72f57d8e5f69c6e1366618c1fa64
+DIST cryptography_vectors-45.0.2.tar.gz 35340607 BLAKE2B 433b09f69a1e69bcd5ae1346ec2564b3bcb5a7eca26bd65389a9be8383b7891d8fa63b0d81805fd30bb2f5fa136600c0c79bddb7219f45b6fb85f8ecdd713f88 SHA512 cac88b001c6a374c98cb8222477f8ed111ca873f5146143912070949dbeca3ccf7fa1d788220c6bbe67a86d88487f736b4ad536156cb47e99db0546e5f8f2d7d
+DIST cryptography_vectors-45.0.3.tar.gz 35344263 BLAKE2B 43368794c68188daa66944617c634fc6e66b30750bd36c3c9a5effc0fc0930cc36171bf5ae95d6a37ac208996b8b6b625451445f07d13a76cd6b0f1bb3feb406 SHA512 a5acf8a30779f6378761aea8618f8e8c6bf7de10980a9166adc82a47072f3f609a05f01105ddf19ec2525bbd821fda52fad6b54cd42645a20168f8db874f10a8
 DIST foreign-types-0.3.2.crate 7504 BLAKE2B 520818b702d990d296ecd31a8646850202509ccfa18edd0e1b260289619a6c351e758f317ec0824bd76eccb209b6f087057c25f1bd01a47897715013dd834867 SHA512 bf27b8243ed482c202d120383374f19ff09422535e24b9c1aebccc66529bf300ca17b8bbc76d67f98ac092e614497afe3add9dc68aa69c93074df05762f91232
 DIST foreign-types-shared-0.1.1.crate 5672 BLAKE2B d2e42e04b6657e7a69fe0bd20c672176629c743e49a55fd007bb30e289710b70045d445ae9cae0eeaa747ee708c90e8abd9b5fc39bad8ec0666befe1b696d4f1 SHA512 bafdb2143e136fb0818e2ffd90b5c862b7181647d6568947d4e4531012bbf7a57b597221ec7056c1b562dfc0c3b5dead26d1a4111ebc15e7863737a873518a4a
 DIST heck-0.5.0.crate 11517 BLAKE2B 5365ec43b2239a76b33a174f1a4292ece4147f9d382a68c6c60db78fdc8bad0afb1d51a65bcb25e96675372faa4ea37c318265030b0546ba51942f7c929e1835 SHA512 f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 DIST indoc-2.0.5.crate 14396 BLAKE2B fe838c6a855d6ff7396675a3fe9b2e0b06a93cfd4013b0b843d24d2fb81f6566528bfd1753c649646f06cb7e59262bd6ec3ed79d4e6f01d740cf0682355f2e5a SHA512 095fb56a3d87946c42a63065a8b276c2d4b9b835800014b400bb987593bf56701bad9f55d947f090740fdb7641a4f3c87fe8bfa5724709e95254d1e8e2e3616f
+DIST indoc-2.0.6.crate 17164 BLAKE2B 1a6cff95bc12ea885ef36b935bf4f1c7870d65be0ff31ffc67dcab904fa80215c1254c1803c5d0c5686252addfad3512e9e1ec79d3edcba026a879f4706926d1 SHA512 e2ea2e5c8226c802bbe0631c1a99d2edd088cbafbf978b2a7b71c7c7f47754c6d4653f466e286441b61cc46def1c7f7a02d4785caab93a61dd785211dba7d1a9
 DIST itoa-1.0.14.crate 11210 BLAKE2B b2d33dc384757963eab3ae7d80bb672d828a549967986e3af8c70fe71a0ad46c4a278da2db4dfccef99e804e6cd4934067e97c0697a33ac3302cafbc46eeb416 SHA512 ea2d38df373652ddacccd11e610dfdad4e3ae7f0d476514e6ac58092733c817bd834e8cd88c3bc4178dd5a646ba628ae626195e0aa407e8534ae3c2a7b049987
+DIST itoa-1.0.15.crate 11231 BLAKE2B 17c261baf95bff2f6cf0dbc33ab78ebbab0cf5dc56aeb7f8977377af868deb5957918f1763c2fe8c080e931489ea89ebcc16b3ebd976eeeb7663ff74989a1071 SHA512 158ca5dd4b04cb12d9292a4df63c72443adaf5aab1bd9aacdb964dc58878d847a64251f84897cb25c34648d4c973b44fef5b4c175d7c04cabc2c13b4631c2e42
 DIST libc-0.2.166.crate 760418 BLAKE2B e4a81e82d139d03b85eb061439f045f1965f6260dc4d4a769f1db19e5d682a923497ba2cf041ebebd46b90c627b91cd97f86250d8b1854945b4f2e826a04d14f SHA512 55a484456ca4d0fc90e488c5b793a6100f160c9333f0b4173f21a49e33e2ce3ae28d74eadd4f2e72e51040667f0a2a93d7edcdc727fe266ff35b8b37608cce2d
+DIST libc-0.2.172.crate 791646 BLAKE2B 3a6eb0eba1e31cf89ac792a8e667c0f68b2a0e62502710ffe77c2b06321103a30ffdc4516c0a91fd3ff44508d5304dfb04ab919bd3e723e34c66b560a20e7f86 SHA512 7bfe400ee65c1b7e540fd19a9b7eb1429a66863d5e94ee7caa83a227d19a4143316d3b401013fb7f88c8e4cdb1a40cfbd58826597c8e23799e02e29553b67e34
 DIST memoffset-0.9.1.crate 9032 BLAKE2B 0aab55fe084134bb599c52d77c96400db40949b1013e7037747ada4fcec8dc4a124b6f3755f04b36e057eb2fb4a6bd6f07d6eebcf166f8a71405ef434d802fbf SHA512 3a236c0f481e36973b9f805e454c2efe4dd375e6b4ee406b57145136c70d5fbf4e1183d563ebf3b5fbde7363bbf5f08f0d88e507aae5bda4cc75664ecd0e33aa
 DIST once_cell-1.20.2.crate 33394 BLAKE2B 79dd394fcf1637adfef28b4159ec653c8b71d2bda0e0e36a940c04e3d87698f039dc30c97f26648ecf0d9742962f1f0a117568f7c705a8a3fc167085b0ca3e80 SHA512 bc6005bdab7a154c01e2203fb553a68695727475a9a882cf906d49c054ce886ad92cb491d380b6b9fe71a81b2fd690ce91c9a6cf8dfa8508470ac9acfc8a31c8
+DIST once_cell-1.21.3.crate 34534 BLAKE2B 3578aaef305cad2fdffdc40c392775a3540bfab3f3aeafd22466d9507bf8346b9fcc200929d48525b051070c0aaa423ecbcaa12868b34dca007991effb224166 SHA512 32a87506c6f4598f3ca2c88556014ef2093d5db9a08602335e847caa537a866492fa74c894e7e1da2e4289a1d3dbffcb90a9e37a4a1453203832f434b8206990
 DIST openssl-0.10.68.crate 276578 BLAKE2B da7c42f8a87150c76cde12316fe1c170593e76a4bd55176ca5ab7a43c57d5457246bfa91bf7bbf73ca47c87a066789226529fb7ad57c5e93c551baa67f6a9eba SHA512 2b0c7f5a888b0e398ebee9c0fffb6fdb8408c36f96eb99182ebb9e162106c012334554304ddaaa6689d3ae41cdf638ba08187a40088efb95a5e9f6aca032a22f
+DIST openssl-0.10.72.crate 283852 BLAKE2B a221ff329fd068da6d88b98e32c0fb9750e074fd87eb261614ba08771df0879fefb80ed0b60a26fcf4ef808e0ff6484f7e4fcbc38146186d30ca4e74d17fa803 SHA512 ee4cfb893e7112fd274baef3283f3bc44385a3e014c9bb4eb24ffc6153fe56e2f66807d8d5874f97254390041cec3affc41bf7b2bc7e5d39bf60413ffb747786
 DIST openssl-macros-0.1.1.crate 5601 BLAKE2B 69dc1c1f3b7bc4f934cae0dce64c3efa501162e5279efd6af3b74f7a7716c04b6996b306b310f1c045cfa2eff2895314a47ecbb020a817e461c6d77d0bc11e92 SHA512 57e75c84f78fb83f884eeaedb0dd135ecb40192dad2facd908e6a575c9b65b38a2c93bca4630e09ea5a82c77d8bc8364cb2f5778cbfe9d8f484cafe3346b883c
 DIST openssl-sys-0.9.104.crate 72287 BLAKE2B d9af8f2ae8a8dfd53b3bb68433a4dd2a4b30038858ac58aa98d7a23b2d23e0b7c7d8fc36c1733d0330bcb9f51284667b2c32fc5a5bd4d9e1a5df7b98d610a997 SHA512 e812d5323bc0ec7376f176a980dd9856dad6d36513e854d333b93ce8a14c20a9ca61be88db82ba2a8ae4e086df5c3fe6965ed10ac155eb7b502e0225c0124278
 DIST openssl-sys-0.9.108.crate 78190 BLAKE2B 202b0a380bb8d462842c7c2190d8d61e3d959b10aba462a75a3f1722a2a975f6f5eaaa30078dde7b56a7c2bb3a93d776b30cf3f718a8e723c2ef14d9ca400294 SHA512 f1d2cbf26b6bf7faf840e9afa6e86e7a38a303c169f54c098433c106cfb3aa264a692419ef2ca31f734551b5f7b97cffb1a3e28984eec0324cfb60e9cf3f1865
 DIST pem-3.0.4.crate 13040 BLAKE2B 33126cd0feeeeb8b57691c50f6535c43e853b9835308d69a5afb426c7a738d260a67d5c46f091ad73e934f0347d976c6f65f88b2f7b1058eca542296191bcb9a SHA512 be743157e11ed76e5a9a60f5e58f50277910ecbf12df492b114b4211f1f1d69555702d955337ec41d368566ae1697f550e3705a195105068c617b9392c43f56d
+DIST pem-3.0.5.crate 18140 BLAKE2B 1a19acf6c5d4dafb4411688d87b668d2ea1abe8f561dc2d5de8894066c06e32c5c1392d0e6963d07bab27368a1b39a4f0520485500a1312e2ae43b5c0959ab16 SHA512 09b4a75bda0df6153799e56cdf175d88b7c88b49fda3e19fffba5aa821e433bf3bc9f254f5016131d3dd2d3146c3f6b73e71e04b81ac7d52b581c638cd60d0ff
 DIST pkg-config-0.3.31.crate 20880 BLAKE2B ab7676e810751f89639b60ae70bdebe1d57edc76319f83077c3680049a701a26e72e8cc485fe77cdc4346fe3571d32c59e7384c8c86fef17e00d7d81df5daf43 SHA512 ac3e8062ee8831a4e4fc717b5247dc7f113da7bf6d64ec95cbca7875959a2afa1497bf81d9dfc27206b5fb10027a2509d51dd9ca1c10139d7b4c78128864fdf4
+DIST pkg-config-0.3.32.crate 21370 BLAKE2B 74ded191f066bc223739b3d4afec58f23de57566e7604e3dd62001d9a095a7b6a3633fdb01fdc46960c8134a694d6bf097d9ecec62b38c4f14acafbbabd6e893 SHA512 59569110185fa665f76a13e884a67ad1578c55246abacfc18cb9f037b2d2d9ec3f2078a3adfe5cc82a451892c9ad55f918ee01362a741f57dc9ff6846a4e32e5
 DIST portable-atomic-1.10.0.crate 174760 BLAKE2B 9a05d6162c95f5140709cbd005c1997449fb6373700e8ed3966e3379898e95f3cbdb90b387f1c7deb3f1eb33125378852a7168d0d22b433813f6c082112b0365 SHA512 fb47ab53fe240d5b0824dd068c6dda473d3e71ae6f5dfccaa17262a8b6de0e1dde05d83975e53bbfcf43f10ef5c634fc024f94613937927ae93f1adad1dadb19
+DIST portable-atomic-1.11.0.crate 181258 BLAKE2B 627bd7c306f6c4d7991abd9f995b7e0ce110a7ace738690c287a43ce3b979691214e525876f8ace0c2f0d10d781fba95c7d3bf29aea28e09b05b06f4764db03f SHA512 71774f8308963c5399095c6b755befdf9ff3d28f9529b4bae1fe0f2aba733339a267aa6f0ff854e59fa5044a9b0c2c86bad3bc4fcaa951724c839b0d6a22041e
 DIST proc-macro2-1.0.92.crate 52353 BLAKE2B 9aa29fa6f1c56c0392a94a81b4c61953f4d185012cdca37e356817845535da79d7094bf43472ce63109ce479a2fd0cbef4d802afd61daf92c4db303bcac60e7e SHA512 e614f08acc0a7e97ef580479cf5b682378df1ca16f09bfb2296ebb3490a435229dea9d682c621c54ce57e8e1d3b7803eb8ff83c88bd02e07228dba6d02f14aee
+DIST proc-macro2-1.0.95.crate 51820 BLAKE2B 93229d80556ec03bce4031607d13c7902cacc2d7e2586a692ffe8543d52e3f3ba253c9c311ddedf6d9348ce8758ae8ff64577675cda2dac557f936a328de47e3 SHA512 f78e4d47ecd29c1b2315554705e445507bbfb9449afd0bf1b74df28f266ac6382ca8c3ce135ddc55c989eaee64d1794a0933a941c8ff55f543fa21c400016547
 DIST pyo3-0.23.5.crate 1088533 BLAKE2B 2efae0a42c1d33e25c5871e3f61a3cea9890d278a20e2777307752b544ab3a634059bba896a1df0df4eadd0ae3c2e63b6d637aecd6699b31fac4107e3a43a387 SHA512 efd3a86dd70c199304463c0ae18dbdf4d9176d1af13b664bdd05a1e218cffda3f29f06d868d0d852d51c3e85b7e07c39617206b3feddc913b3b622f3fcf59d5f
+DIST pyo3-0.25.0.crate 1120850 BLAKE2B 6f373129d032e6980d058ec5dbfea58a7ce0cb8ed2b32aa852a14746cfd3a541b02286676c934a5d7f7bc1bea03e986e93e44de42114f7620b487977c0092d85 SHA512 83336d284eefdef5bc26dec4880e21c608a001b4676b3628eb59b7c0011fb672ca81fca035666b714eeb158809064f9b5b0720802045d5ff8fc9f6af02813c30
 DIST pyo3-build-config-0.23.5.crate 33885 BLAKE2B 14e3897186abb772bcde147a9ebf2a70f5cbd634cb0240e1dbba71079acd2f9cd61fd263a5d32bc583e188ec84b6db8b93f018ab954ac9da66f423183ad5c176 SHA512 72aac032e3026554761eb81dc9c57591abc4d0c329c46918da13a8cc93c0532eba2fe3d971699a50890c66d8853b93a67840b0e8f1c15747d184b873dec2894a
+DIST pyo3-build-config-0.25.0.crate 34122 BLAKE2B ba098ff1c963c43d0cd1fdfaec43573ee0d9afff7cc010b7b371504ab66e1fec9233bab04c8c7656c382366d622589d0d5e865a8a271c68a9831ca657b49fcb9 SHA512 f6580bcc12bf8235bd8bdc09908f861645adfcdee31cf88d6443e628601bf3107c1d823c09dacb8e1bdaa171ae49f15e19811b9752600b799a4e86cdea081d40
 DIST pyo3-ffi-0.23.5.crate 74867 BLAKE2B 5c80f7ac77ee516a891c1cb367e27fa396e55a7504dc8f92312219a90860baba3861ca2e83a1410839b99b6b3beb4c068703b841e18ea1854f70d04fef7404bd SHA512 37c25b21acc3718eab842c04489b0c16c04d33a30fe7f3f58cd80943048203375d8788ce84153ba3720df695fc95bf9f7bccacfa02b0e669a5ddbfc44d65f86c
+DIST pyo3-ffi-0.25.0.crate 77991 BLAKE2B 0474051570bf71070eab2578e0f9278327ccc48510419d292a81887fffad753ba434db6b795536512a688426eff42ea9805f99b1a3237ec927f6c731033850b2 SHA512 e03cb71493c898408a0692ba7fb4cd704e48c307f5115159f3375fae879e46f5cd7536325d70e7dbd3aeca8ea282a0fb5b5ac609bc807e8b9cb6abbd3a9a2ca5
 DIST pyo3-macros-0.23.5.crate 8856 BLAKE2B 56e7dea9cc630e21f9e8aa43319db27f3d287baad4035bf8d921b2c8e737142e5a89decf6a04bcc095f97e035cfe4a5edd7091bba79dd68bc110b7420c29477b SHA512 bf9c12b02597cf6f119e92fe827016f393d13cfa21376811ab9bf8f49cbfd6447afe9dcbef564ad2b5b72db5338520c37c77429db8ee1ccb74de3944fc9fce7f
+DIST pyo3-macros-0.25.0.crate 8876 BLAKE2B 09c37cc5bdaec6859461a7bb4d1c28d0ddd77a448fb5097275fe7be373897900e2dcdb1c43eb4cc915e1089ac1204f4a7155c4b69478b0778e179aded1449ff0 SHA512 ee1218b6981d94a228bf55f31f0131c094728b12c19b312a77386cace2c4768ad8fc8a1a1999bf27c6a30012e20a1eb7a574d918ccacc421930c12cb1a6386ef
 DIST pyo3-macros-backend-0.23.5.crate 70938 BLAKE2B 20d5b00edf806ff19de3e3a03d10a23a29b16d544faf2bb5781032e51c3e07cd7f1a979e00b9f1abca36bc7cf1546b702ee83f85d021d74ac819b8b13bf8d140 SHA512 5e9a971d98a7b70424bf93b1f7fb326564010562dd376789be2fa6b13b89c3d34f760eb61ed49f0b013bbdfff2658d874d24a8a0b65d8f82d10d8f34b8ef5b53
+DIST pyo3-macros-backend-0.25.0.crate 75089 BLAKE2B ea4d87e16616782c60f46f97d87a002ea2873a2ab6f7335da68bab32d636988fa30834c946943d4c56c6e5992c78ba6dc2cf8b613c2a402218599ef3e7a6c5be SHA512 dc2e567a09e746893d7cea57aa456124df31b1e3cb25f5b1fabdc97cd2ae73eea1d57aa642268bdbef3dc1ba0e383893d1b5dfd9cf1f3e818f77b9fc0ef2c486
 DIST quote-1.0.37.crate 28558 BLAKE2B a7d007a69e619f853af94333e1066bb767013312bd99f147b1b153611242bcfa9c76768b1ba47278589db309a9acd61a772c8ec3b567e48439bb9d831f9326d4 SHA512 c4ed21428c1f89cf22b85d80720a7869831a9c129d694617b0ce8c258278114ab98846f3f653abf736d1c86bc9224bbd695e9a7b06aa3adf292d02e1ef14cc05
+DIST quote-1.0.40.crate 31063 BLAKE2B 09036ff3e5ebbd775c466bb936de91d4c070481eb4b98c62a4cddcda57cd7b67d63f979b321f6ec64aabee3f5da6c28e7a3efb83f4647768ba578f1bd0bd0bdb SHA512 45a76e22a2b0bec47e4ba73c3b73cc41d821dfcce9876134c5d8eed514da214aee4ce7612e372c8709f888c0d8b9b7e5442f27adb7a59f3571f0339ed7e2ac99
 DIST self_cell-1.0.4.crate 15220 BLAKE2B 9a617058652ab2a2e92434b6eef58a813ce0be5afed9525c4d4c819c25c7cd87aaa12d129c8c4ca9d74c3ea33d81e9dd295f121887070364185b9ab33021544c SHA512 042467e5f3ac0305e2a634df0b9a9379e92b54813e05c3a7652d5327a4a9a784f49e897c968c5c7a87017284d42a889b5420ad18e97ea84183e0283a46dc907a
+DIST self_cell-1.2.0.crate 16883 BLAKE2B 56bd187fabc138c530aa23dfc69a330a7d0a8f86609801924fd1f4b0cefc43a99a8ba21d05e59272c9d32b83405b4c980df4f01e529772b760a9564dd8eb0c0a SHA512 41addc9b737d0379c0236b1821d6051d31dca6a76f463e6e56c3bac9015da4243f9fedc3d57e051f68f6f0aa610383a0b2cade07b1ea17e92173e2088a625af0
 DIST shlex-1.3.0.crate 18713 BLAKE2B 18800c364d3a628f1a3125097ea82fe6286550c2997235df0bf8483a3906aacabc81308cb239887d46ba2f457cc6f8acd5aca78316707eea5098cd5666aea67d SHA512 5c8cedbe666a14b8a0874defb9208146ce64579cde52ed483e4a794cac5dde6a24bf8d684404edff582f842e1fd4fa3fbeddbe074f191e4ec4aa517aa456fe8a
+DIST syn-2.0.101.crate 299250 BLAKE2B 7018cdede66dca82e7d7a7e07e52a178687957fcfd69f1a2862094497d2fb9d78ada14b94761679bbc5f6c76c808a63e948ed071e4f65c2f9580a40bf58c9426 SHA512 05e4233a51f4d229dd4c9bd23c5224c42ec5554d02fd316dad10dfdb876aa1d379c7ea30b1ace979537da91ee746ca4fdcef7690885f83fd41ec8c9dc5984101
 DIST syn-2.0.89.crate 289852 BLAKE2B 4e2b06d2a0ea9b8970338ab61f8c5569cb7c10466dcf139576d0618c3690cfd23c98b66f0714c34839364dee72df6a6d8571f73dbf03ecc347fb1effb118fc2f SHA512 d172936f04a383b7b5e79dad328e70ea3c4faba4a88d0b6d186645413e8698434d30f53012cc9d3813f617c8bef75e95a2d064fdabae7867678abbed22bcd910
 DIST target-lexicon-0.12.16.crate 26488 BLAKE2B e7950e4a302059a1bfc9bc15618a3c1b971a17cffae117a6e8f5f63a0d82fd2bd02680301d15338612d5426d349dd24cfee30ee787a15a7d3187f2a6825e69ce SHA512 092639957c4a0391560b6442b31c47159c04d12e971010f730a6ec9cb5389e4be903ef3d7daa06db95e64dc78b6970731fb647179ebaad2b12e9ed5e9b24da27
+DIST target-lexicon-0.13.2.crate 27923 BLAKE2B 0761f0ffdc23b9c9df86b384d59611c7b8b5e29ff068f03367ad2fe84cfb6d11e1af149b9338236978e9566fedc51387db9f239d2a602db41045ac3db907faec SHA512 d25e3cc3d679cb6b6f24c03e0c24db9d6ca31b8ed42ac9531bd7637557fbba225a6c8ac4f68a8eaf3569195814d599e668a968afbc73b940a77cbc27552cc90a
 DIST unicode-ident-1.0.14.crate 47547 BLAKE2B 30e0b6d7f3a967aaf5b9d91237008a60c3a8ded53bda901696e23cea3931dd71b01ddab866dca9e31e17c395d5f5a68f2a938655b693e894962568c2cff5ca15 SHA512 7c6dcd1724e8cfedc37546d1abd49088b633dad228097acc73d7b6cab255b223e830c541144e05a00388fd8ca8066f27c18792419cfa58ee9da4460a38d0bc0a
+DIST unicode-ident-1.0.18.crate 47743 BLAKE2B 517ab42a847020515b2b871844d0571ea672340f89a762631a791eac18935ac122122fa5566e58b99ab47de179eadb5298e8ff1d05b123c4e93b7fa989c8e31f SHA512 d11f89fb696f9e2953c96a40b5478832651b268c83b9c7a700b07e768e795d6e8dc346597d1226df21219d36866768d1f640bd8edb68db8bd3d5d437b2bfd324
 DIST unindent-0.2.3.crate 7306 BLAKE2B a57407b117e99c230750c7d4a2a0899586c8271e4ba88ecb409c976905c014f42885372c234a75fbfbedf71dbed779f95f735975d150adacdcb61152a49db4c2 SHA512 2f1eb420ea3653b00d3e5fa0c2c105da8fd8a37cb3e699373c168604b799fccd5f0faf0cddce4212d119c2afb0c86b41efc3a50752b83ff7beda2bd84d360505
+DIST unindent-0.2.4.crate 7422 BLAKE2B 2e7870cd4f78240dbb1e5fb9c0f9b55c57bb40242fe668f105a0e862f1d6300e31efbffe0cdff676a5f96a8d19dfb148f88bfef1cd8a710556d777fd0f4ee37f SHA512 58bd4fd20a0b0a7200e0ea3ea70553cea135a5a8f7a2fb178520c41228f435becce4b9981019b7c73a17df87a2ee9b2a47c4cec29a3011bfe848d48b2473761b
 DIST vcpkg-0.2.15.crate 228735 BLAKE2B 6b6bacd9a7fa38919241f45a97f58cae957e58d3aac99df208a26aa718e4f1644f4ccefa31b09151e5c1952288e0e5837c363918b98c7f55079a948a952c1c50 SHA512 7322a21e8811b2fe4e79e09dc321458068ecdf1953f05d36233f3278ecc0b1dfc64194db7010dd46fcf692285f42475beb090c6c6cac0c8f9fe0eb5c770e3172
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.3.ebuild
index 9227d5174b3..3867ead3a68 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.3.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 CARGO_OPTIONAL=yes
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=maturin
-PYTHON_COMPAT=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 
 CRATES="
@@ -68,7 +68,7 @@ LICENSE+="
 	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
 "
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 
 RDEPEND="
 	>=dev-libs/openssl-1.0.2o-r6:0=
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.2.ebuild
new file mode 100644
index 00000000000..b6b58631d67
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.2.ebuild
@@ -0,0 +1,134 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=yes
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+
+CRATES="
+	asn1@0.21.3
+	asn1_derive@0.21.3
+	autocfg@1.4.0
+	base64@0.22.1
+	bitflags@2.9.1
+	cc@1.2.23
+	cfg-if@1.0.0
+	foreign-types-shared@0.1.1
+	foreign-types@0.3.2
+	heck@0.5.0
+	indoc@2.0.6
+	itoa@1.0.15
+	libc@0.2.172
+	memoffset@0.9.1
+	once_cell@1.21.3
+	openssl-macros@0.1.1
+	openssl-sys@0.9.108
+	openssl@0.10.72
+	pem@3.0.5
+	pkg-config@0.3.32
+	portable-atomic@1.11.0
+	proc-macro2@1.0.95
+	pyo3-build-config@0.25.0
+	pyo3-ffi@0.25.0
+	pyo3-macros-backend@0.25.0
+	pyo3-macros@0.25.0
+	pyo3@0.25.0
+	quote@1.0.40
+	self_cell@1.2.0
+	shlex@1.3.0
+	syn@2.0.101
+	target-lexicon@0.13.2
+	unicode-ident@1.0.18
+	unindent@0.2.4
+	vcpkg@0.2.15
+"
+
+inherit cargo distutils-r1 flag-o-matic multiprocessing pypi
+
+VEC_P=cryptography_vectors-$(ver_cut 1-3)
+DESCRIPTION="Library providing cryptographic recipes and primitives"
+HOMEPAGE="
+	https://github.com/pyca/cryptography/
+	https://pypi.org/project/cryptography/
+"
+SRC_URI+="
+	${CARGO_CRATE_URIS}
+	test? (
+		$(pypi_sdist_url cryptography_vectors "$(ver_cut 1-3)")
+	)
+"
+
+LICENSE="|| ( Apache-2.0 BSD ) PSF-2"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	>=dev-libs/openssl-1.0.2o-r6:0=
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.8:=[${PYTHON_USEDEP}]
+	' 'python*')
+"
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	${RUST_DEPEND}
+	>=dev-util/maturin-1.8.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/certifi[${PYTHON_USEDEP}]
+		>=dev-python/hypothesis-1.11.4[${PYTHON_USEDEP}]
+		dev-python/iso8601[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/pyasn1-modules[${PYTHON_USEDEP}]
+		dev-python/pytest-subtests[${PYTHON_USEDEP}]
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-python/pytz[${PYTHON_USEDEP}]
+	)
+"
+
+# Files built without CFLAGS/LDFLAGS, acceptable for rust
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/cryptography/hazmat/bindings/_rust.*.so"
+
+distutils_enable_tests pytest
+
+src_unpack() {
+	cargo_src_unpack
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	sed -i -e 's:--benchmark-disable::' pyproject.toml || die
+
+	# work around availability macros not supported in GCC (yet)
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		local darwinok=0
+		if [[ ${CHOST##*-darwin} -ge 16 ]] ; then
+			darwinok=1
+		fi
+		sed -i -e 's/__builtin_available(macOS 10\.12, \*)/'"${darwinok}"'/' \
+			src/_cffi_src/openssl/src/osrandom_engine.c || die
+	fi
+}
+
+python_configure_all() {
+	filter-lto # bug #903908
+}
+
+python_test() {
+	local -x PYTHONPATH="${PYTHONPATH}:${WORKDIR}/cryptography_vectors-${PV}"
+	local EPYTEST_IGNORE=(
+		tests/bench
+	)
+	epytest -n "$(makeopts_jobs)"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.3.ebuild
new file mode 100644
index 00000000000..b6b58631d67
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.3.ebuild
@@ -0,0 +1,134 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=yes
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+
+CRATES="
+	asn1@0.21.3
+	asn1_derive@0.21.3
+	autocfg@1.4.0
+	base64@0.22.1
+	bitflags@2.9.1
+	cc@1.2.23
+	cfg-if@1.0.0
+	foreign-types-shared@0.1.1
+	foreign-types@0.3.2
+	heck@0.5.0
+	indoc@2.0.6
+	itoa@1.0.15
+	libc@0.2.172
+	memoffset@0.9.1
+	once_cell@1.21.3
+	openssl-macros@0.1.1
+	openssl-sys@0.9.108
+	openssl@0.10.72
+	pem@3.0.5
+	pkg-config@0.3.32
+	portable-atomic@1.11.0
+	proc-macro2@1.0.95
+	pyo3-build-config@0.25.0
+	pyo3-ffi@0.25.0
+	pyo3-macros-backend@0.25.0
+	pyo3-macros@0.25.0
+	pyo3@0.25.0
+	quote@1.0.40
+	self_cell@1.2.0
+	shlex@1.3.0
+	syn@2.0.101
+	target-lexicon@0.13.2
+	unicode-ident@1.0.18
+	unindent@0.2.4
+	vcpkg@0.2.15
+"
+
+inherit cargo distutils-r1 flag-o-matic multiprocessing pypi
+
+VEC_P=cryptography_vectors-$(ver_cut 1-3)
+DESCRIPTION="Library providing cryptographic recipes and primitives"
+HOMEPAGE="
+	https://github.com/pyca/cryptography/
+	https://pypi.org/project/cryptography/
+"
+SRC_URI+="
+	${CARGO_CRATE_URIS}
+	test? (
+		$(pypi_sdist_url cryptography_vectors "$(ver_cut 1-3)")
+	)
+"
+
+LICENSE="|| ( Apache-2.0 BSD ) PSF-2"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	>=dev-libs/openssl-1.0.2o-r6:0=
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.8:=[${PYTHON_USEDEP}]
+	' 'python*')
+"
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	${RUST_DEPEND}
+	>=dev-util/maturin-1.8.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/certifi[${PYTHON_USEDEP}]
+		>=dev-python/hypothesis-1.11.4[${PYTHON_USEDEP}]
+		dev-python/iso8601[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/pyasn1-modules[${PYTHON_USEDEP}]
+		dev-python/pytest-subtests[${PYTHON_USEDEP}]
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-python/pytz[${PYTHON_USEDEP}]
+	)
+"
+
+# Files built without CFLAGS/LDFLAGS, acceptable for rust
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/cryptography/hazmat/bindings/_rust.*.so"
+
+distutils_enable_tests pytest
+
+src_unpack() {
+	cargo_src_unpack
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	sed -i -e 's:--benchmark-disable::' pyproject.toml || die
+
+	# work around availability macros not supported in GCC (yet)
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		local darwinok=0
+		if [[ ${CHOST##*-darwin} -ge 16 ]] ; then
+			darwinok=1
+		fi
+		sed -i -e 's/__builtin_available(macOS 10\.12, \*)/'"${darwinok}"'/' \
+			src/_cffi_src/openssl/src/osrandom_engine.c || die
+	fi
+}
+
+python_configure_all() {
+	filter-lto # bug #903908
+}
+
+python_test() {
+	local -x PYTHONPATH="${PYTHONPATH}:${WORKDIR}/cryptography_vectors-${PV}"
+	local EPYTEST_IGNORE=(
+		tests/bench
+	)
+	epytest -n "$(makeopts_jobs)"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index 780b68fddd6..039364074ee 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1,2 +1,2 @@
 DIST cython-3.0.12.tar.gz 2757617 BLAKE2B 064549e36e03424065eab081b60e2761d198490cfd4d7836ea236b833ada3962e6ed42ba1710b33418f8a31ac282cdc156ceb544ee21be80ee34b7a3d3f6c7fb SHA512 c4e85596eeea444fae983d32ce8731cc5d0d612d1f96b998db3aa7946e8be151a7ea62c6df163d875111e306c870656b82a8468dd873cacf84c7bd5671a39bc3
-DIST cython-3.1.0rc1.tar.gz 3158411 BLAKE2B 44540e95b8b060956654a0d92fc4b8417088816a1e3f8fc17c8575a1cbd4b71a76cc69209d58c731281a310a9f6a7e2e711f88dc6855bc487d08056203cb04d8 SHA512 b0cefe1d4e248e6044af373088902475839ae06b5855b5b3bffdce5159a0f6e54802c24715a6f6e3242a250841c2ff1e56435b7ed3e304964af01a162f8a851a
+DIST cython-3.1.1.tar.gz 3175446 BLAKE2B 4a75df724e313220321b05b7839bd406e5e923eb860337b7819c31152859396e5bda65a0a06ace196839bed729e28e51a1349c178e615ba58cf9bc80dc706b0d SHA512 5c64b5d280b234d93d02e91ab22567342350671c605df30a3ac7b41b64e0605eb0aef7bc721f68d35d6048085eaa392cb0a803df32ca902e51e2009c987d962e
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
index 74e5de7e847..99a15f0d035 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
@@ -68,8 +68,6 @@ python_test() {
 	unset CYTHON_FORCE_REGEN
 
 	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
 	"${PYTHON}" runtests.py \
 		-vv \
 		-j "$(makeopts_jobs)" \
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild
deleted file mode 100644
index 561a1b8a077..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1-r1.ebuild
+++ /dev/null
@@ -1,86 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( python3_{10..12} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 pypy3_11 python3_13{,t} )
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 multiprocessing pypi toolchain-funcs
-
-DESCRIPTION="A Python to C compiler"
-HOMEPAGE="
-	https://cython.org/
-	https://github.com/cython/cython/
-	https://pypi.org/project/Cython/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			<dev-python/numpy-2[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
-	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
-	# https://github.com/cython/cython/commit/a0794ffb47c9f44be94b3cd8fe6c639766cbda26
-	"${FILESDIR}/${P}-rdma-core-hang.patch"
-)
-
-distutils_enable_sphinx docs \
-	dev-python/jinja2 \
-	dev-python/sphinx-issues \
-	dev-python/sphinx-tabs
-
-python_prepare_all() {
-	# Needs dev-python/pip and doesn't like 'externally-managed' (bug #927995)
-	rm tests/run/coverage_cmd_src_pkg_layout.srctree || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_compile() {
-	# Python gets confused when it is in sys.path before build.
-	local -x PYTHONPATH=
-
-	distutils-r1_python_compile
-}
-
-python_test() {
-	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
-		einfo "Skipping tests on ${EPYTHON} (xfail)"
-		return
-	fi
-
-	# Needed to avoid confusing cache tests
-	unset CYTHON_FORCE_REGEN
-
-	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
-	"${PYTHON}" runtests.py \
-		-vv \
-		-j "$(makeopts_jobs)" \
-		--work-dir "${BUILD_DIR}"/tests \
-		--no-examples \
-		--no-code-style \
-		|| die "Tests fail with ${EPYTHON}"
-}
-
-python_install_all() {
-	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild
deleted file mode 100644
index 58fa8c542bf..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_rc1.ebuild
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( python3_{10..12} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 pypy3_11 python3_13{,t} )
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 multiprocessing pypi toolchain-funcs
-
-DESCRIPTION="A Python to C compiler"
-HOMEPAGE="
-	https://cython.org/
-	https://github.com/cython/cython/
-	https://pypi.org/project/Cython/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			<dev-python/numpy-2[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
-	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
-)
-
-distutils_enable_sphinx docs \
-	dev-python/jinja2 \
-	dev-python/sphinx-issues \
-	dev-python/sphinx-tabs
-
-python_prepare_all() {
-	# Needs dev-python/pip and doesn't like 'externally-managed' (bug #927995)
-	rm tests/run/coverage_cmd_src_pkg_layout.srctree || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_compile() {
-	# Python gets confused when it is in sys.path before build.
-	local -x PYTHONPATH=
-
-	distutils-r1_python_compile
-}
-
-python_test() {
-	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
-		einfo "Skipping tests on ${EPYTHON} (xfail)"
-		return
-	fi
-
-	# Needed to avoid confusing cache tests
-	unset CYTHON_FORCE_REGEN
-
-	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
-	"${PYTHON}" runtests.py \
-		-vv \
-		-j "$(makeopts_jobs)" \
-		--work-dir "${BUILD_DIR}"/tests \
-		--no-examples \
-		--no-code-style \
-		|| die "Tests fail with ${EPYTHON}"
-}
-
-python_install_all() {
-	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.1.ebuild
new file mode 100644
index 00000000000..65b4160cf93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.1.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_FULLY_TESTED=( python3_{11..14} )
+PYTHON_TESTED=( "${PYTHON_FULLY_TESTED[@]}" pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		test-full? (
+			$(python_gen_cond_dep '
+				dev-python/numpy[${PYTHON_USEDEP}]
+			' "${PYTHON_FULLY_TESTED[@]}")
+		)
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	if use elibc_musl ; then
+		# Workaround for bug #925318
+		local -x LDFLAGS="${LDFLAGS} -Wl,-z,stack-size=2097152"
+	fi
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	# PYTHON_TESTED controls whether we expect the testsuite to
+	# pass at all, while PYTHON_FULLY_TESTED allows skipping before
+	# numpy is ported (and possibly other deps in future).
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+
+	local testargs=(
+		-vv
+		-j "$(makeopts_jobs)"
+		--work-dir "${BUILD_DIR}"/tests
+
+		--no-examples
+		--no-code-style
+
+		# Fails to find embedded.c
+		--exclude 'embedded'
+		# coverage_installed_pkg needs dev-python/pip and doesn't like
+		# 'externally-managed' (bug #927995), but we don't really
+		# want automagic test dependencies at all, so just skip
+		# unimportant-for-us coverage tests entirely.
+		--exclude 'run.coverage*'
+		--exclude 'Cython.Coverage'
+		# Automagic on dev-python/python-tests, could add this in future
+		--exclude 'run.test_exceptions'
+		# TODO: Unpackaged dev-python/interpreters-pep-734 (interpreters_backport)
+		# This only shows up as a failure with >=3.13.
+		--exclude 'subinterpreters_threading_stress_test'
+	)
+
+	if [[ ${EPYTHON} == pypy3* ]] ; then
+		testargs+=(
+			# Recursion issue
+			--exclude 'run.if_else_expr'
+			--exclude 'run.test_patma*'
+			# Slight output difference (missing '<')
+			--exclude 'run.cpp_exception_ptr_just_handler'
+
+		)
+	fi
+
+	# Keep test-full for numpy as it's large and doesn't pass tests itself
+	# on niche arches.
+	if ! use test-full || ! has "${EPYTHON/./_}" "${PYTHON_FULLY_TESTED[@]}"; then
+		testargs+=(
+			--exclude 'run.numpy*'
+			--exclude 'run.ufunc'
+			--exclude 'numpy*'
+		)
+	fi
+
+	"${PYTHON}" runtests.py "${testargs[@]}" || die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/cython/metadata.xml
index 4960428b8c6..fd01ff3d838 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/metadata.xml
@@ -10,6 +10,12 @@
 		language as easy as Python itself. It's based on Pyrex, but supports
 		more cutting edge functionality and optimizations.
 	</longdescription>
+	<use>
+		<flag name="test-full">
+			Run test suite in full via additional (large) test
+			dependencies, like dev-python/numpy.
+		</flag>
+	</use>
 	<upstream>
 		<remote-id type="pypi">Cython</remote-id>
 		<remote-id type="github">cython/cython</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
index 77dd9df8987..ff73d11048e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1
 
@@ -52,7 +52,7 @@ python_test() {
 	# disable system-site-packages -- distlib has no deps, and is very
 	# fragile to packages actually installed on the system
 	sed -i -e '/system-site-packages/s:true:false:' \
-		"${BUILD_DIR}/install${EPREFIX}/usr/bin/pyvenv.cfg" || die
+		"${BUILD_DIR}/install${EPREFIX}/usr/pyvenv.cfg" || die
 
 	"${EPYTHON}" tests/test_all.py -v -x ||
 		die "Tests failed with ${EPYTHON}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
index f710cf921c3..c3798009c61 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distro/distro-1.9.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index 45a41f2110e..0f1e3c158d6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1 +1,2 @@
 DIST docutils-0.21.2.tar.gz 2204444 BLAKE2B 727c2f97fc5835a0ffa62e38ea85af366cd89ad1eaec0b8af8b1f3b12e6cddfddb65161ba34f9109952d37ba2cf8985f3c3b6905ebb2ac1c9a984cce3fb4d170 SHA512 7fafa331f5687448e80d299c20cdccc4b49819fa471b5f586bf0ab18c694ba43a70f58e7c76b0a70a16267585548389214e11a4998ad7fdc19a27f0f7644539c
+DIST docutils-0.22rc2.tar.gz 2275875 BLAKE2B 62140304e9715e31d8be69c9b65fa382832805368cbf3c184b6319405f22d6c05a16b3b28b5444b4e498c21f4bb7baee8520ef80b445123341aaab7a6a6965d6 SHA512 fcb347d29315a5c2e9f070057962094457bdaf08693c1393a649ae24bab572be027c253deb98561c5cd5a27f2d1f994cf7dea63d0cb74c3a3993c4cea45e0a48
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
index e7e5589f3b8..c4b7480a286 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -27,6 +27,14 @@ BDEPEND="
 	${RDEPEND}
 "
 
+PATCHES=(
+	# r10019 upstream
+	"${FILESDIR}/${P}-pygments-2.19.patch"
+	# this changed back at some point, but upstream didn't hit it
+	# because of https://sourceforge.net/p/docutils/bugs/500/
+	"${FILESDIR}/${P}-pillow.patch"
+)
+
 python_compile_all() {
 	# Generate html docs from reStructured text sources.
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
new file mode 100644
index 00000000000..d5ea86951ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
+HOMEPAGE="
+	https://docutils.sourceforge.io/
+	https://pypi.org/project/docutils/
+"
+
+# GPL-3+ only for emacs/rst.el
+LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
+SLOT="0"
+
+RDEPEND="
+	dev-python/pillow[${PYTHON_USEDEP}]
+	dev-python/pygments[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+"
+
+python_compile_all() {
+	# Generate html docs from reStructured text sources.
+
+	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
+	cp docutils/writers/html4css1/html4css1.css . || die
+
+	cd tools || die
+	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
+		--stylesheet-path=../html4css1.css, --traceback ../docs || die
+}
+
+src_test() {
+	cd test || die
+	distutils-r1_src_test
+}
+
+python_test() {
+	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
+}
+
+python_install() {
+	distutils-r1_python_install
+
+	# Install tools.
+	python_doscript tools/buildhtml.py
+}
+
+python_install_all() {
+	local DOCS=( *.rst )
+	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
+
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pillow.patch b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pillow.patch
new file mode 100644
index 00000000000..993283ed798
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pillow.patch
@@ -0,0 +1,15 @@
+diff --git a/test/test_writers/test_html5_polyglot_parts.py b/test/test_writers/test_html5_polyglot_parts.py
+index 7122f8469..749f541e4 100644
+--- a/test/test_writers/test_html5_polyglot_parts.py
++++ b/test/test_writers/test_html5_polyglot_parts.py
+@@ -43,10 +43,6 @@ if PIL:
+     REQUIRES_PIL = ''
+     ONLY_LOCAL = 'Can only read local images.'
+     DUMMY_PNG_NOT_FOUND = "[Errno 2] No such file or directory: 'dummy.png'"
+-    # Pillow reports the absolute path since version 10.3.0 (cf. [bugs: 485])
+-    if (tuple(int(i) for i in PIL.__version__.split('.')) >= (10, 3)):
+-        DUMMY_PNG_NOT_FOUND = ("[Errno 2] No such file or directory: '%s'"
+-                               % Path('dummy.png').resolve())
+     SCALING_OUTPUT = 'style="width: 32.0px; height: 32.0px;" '
+     NO_PIL_SYSTEM_MESSAGE = ''
+ else:
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pygments-2.19.patch b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pygments-2.19.patch
new file mode 100644
index 00000000000..e667226d19d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.2-pygments-2.19.patch
@@ -0,0 +1,106 @@
+From 5854d09635b3fa1048d84bba17de4c38805beccd Mon Sep 17 00:00:00 2001
+From: aa-turner <aa-turner@929543f6-e4f2-0310-98a6-ba3bd3dd1d04>
+Date: Fri, 7 Mar 2025 22:49:46 +0000
+Subject: [PATCH] Support Pygments 2.19 in tests
+
+git-svn-id: http://svn.code.sf.net/p/docutils/code/trunk@10019 929543f6-e4f2-0310-98a6-ba3bd3dd1d04
+---
+ .../test_rst/test_directives/test_code.py        | 16 +++++++++++-----
+ .../test_rst/test_directives/test_code_long.py   |  7 +++----
+ test/test_writers/test_html5_polyglot_parts.py   |  4 +---
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/test/test_parsers/test_rst/test_directives/test_code.py b/test/test_parsers/test_rst/test_directives/test_code.py
+index a54901dfe..a714f8fc5 100755
+--- a/test/test_parsers/test_rst/test_directives/test_code.py
++++ b/test/test_parsers/test_rst/test_directives/test_code.py
+@@ -25,10 +25,16 @@ from docutils.utils.code_analyzer import with_pygments
+ 
+ if with_pygments:
+     import pygments
+-    _pv = re.match(r'^([0-9]+)\.([0-9]*)', pygments.__version__)
+-    PYGMENTS_2_14_PLUS = (int(_pv[1]), int(_pv[2])) >= (2, 14)
++
++    pygments_version = tuple(map(int, pygments.__version__.split('.')[:2]))
++else:
++    pygments_version = (0, 0)
++
++PYGMENTS_2_14_PLUS = pygments_version >= (2, 14)
++if pygments_version >= (2, 19):
++    def_ws = '<inline classes="whitespace">\n             '
+ else:
+-    PYGMENTS_2_14_PLUS = None
++    def_ws = ' '
+ 
+ 
+ class ParserTestCase(unittest.TestCase):
+@@ -160,14 +166,14 @@ totest['code_parsing'] = [
+       # and now for something completely different
+       print(8/2)
+ """,
+-"""\
++f"""\
+ <document source="test data">
+     <literal_block classes="code python3 testclass" ids="my-function" names="my_function" xml:space="preserve">
+         <inline classes="ln">
+              7 \n\
+         <inline classes="keyword">
+             def
+-         \n\
++        {def_ws}
+         <inline classes="name function">
+             my_function
+         <inline classes="punctuation">
+diff --git a/test/test_parsers/test_rst/test_directives/test_code_long.py b/test/test_parsers/test_rst/test_directives/test_code_long.py
+index 89cb4b172..037768c01 100755
+--- a/test/test_parsers/test_rst/test_directives/test_code_long.py
++++ b/test/test_parsers/test_rst/test_directives/test_code_long.py
+@@ -22,8 +22,7 @@ from docutils.parsers.rst import Parser
+ from docutils.utils import new_document
+ from docutils.utils.code_analyzer import with_pygments
+ from test.test_parsers.test_rst.test_directives.test_code \
+-    import PYGMENTS_2_14_PLUS
+-
++    import PYGMENTS_2_14_PLUS, def_ws
+ 
+ @unittest.skipUnless(with_pygments, 'needs Pygments')
+ class ParserTestCase(unittest.TestCase):
+@@ -55,14 +54,14 @@ totest['code_parsing_long'] = [
+       # and now for something completely different
+       print(8/2)
+ """,
+-"""\
++f"""\
+ <document source="test data">
+     <literal_block classes="code python3" xml:space="preserve">
+         <inline classes="ln">
+              7 \n\
+         <inline classes="keyword">
+             def
+-         \n\
++        {def_ws}
+         <inline classes="name function">
+             my_function
+         <inline classes="punctuation">
+diff --git a/test/test_writers/test_html5_polyglot_parts.py b/test/test_writers/test_html5_polyglot_parts.py
+index 7122f8469..afe504d41 100644
+--- a/test/test_writers/test_html5_polyglot_parts.py
++++ b/test/test_writers/test_html5_polyglot_parts.py
+@@ -14,7 +14,6 @@ standard values, and any entries with empty values.
+ 
+ from pathlib import Path
+ import os
+-import re
+ import sys
+ import unittest
+ 
+@@ -30,8 +29,7 @@ from docutils.utils.code_analyzer import with_pygments
+ 
+ if with_pygments:
+     import pygments
+-    _pv = re.match(r'^([0-9]+)\.([0-9]*)', pygments.__version__)
+-    if (int(_pv[1]), int(_pv[2])) >= (2, 14):
++    if tuple(map(int, pygments.__version__.split('.')[:2])) >= (2, 14):
+         # pygments output changed in version 2.14
+         with_pygments = False
+ 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
index f82cdb0cb6d..7d12b5d6379 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/editables/editables-0.5.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
index dcf21d3e394..800de63e599 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_install() {
 	insinto /usr/lib/python/ensurepip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index ff4ed01cf98..5ff77ed9373 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,6 +1,4 @@
-DIST setuptools-75.8.2-py3-none-any.whl 1229385 BLAKE2B e2890604e9acbf23aefc94ee99927bafdc189e45c84b0e4e0b48737d120ba60590438603195e180988b26e3e8fb378812507e2a0b513bf886c3b1eb673853da5 SHA512 083447a6bd375ca99e017ec4c5e3083ee4eee32b65d911b4d5ccadfa587ec213d43562d21d0f238753cc5c54354027b8425880d7248fbbd170b0c006613f4327
-DIST setuptools-78.1.0-py3-none-any.whl 1256108 BLAKE2B 3bc6328e3ca2f98df327054c308560c48849ea3374017e72111471f4d7394bb6200d181e9ce7bc5cc2732ca365ade8e7ac79a8b1bfae1a18d0364c5dea4aa151 SHA512 89b1ba752d6b1cf7820ad0ef37ad42a6614e9b88438c63264eee09f94439608e53a51bf5ff8ce9f898300d6d628a7ed582004e6a483d774f4ec285f95e23752e
 DIST setuptools-79.0.1-py3-none-any.whl 1256281 BLAKE2B 8ae51bdd1c0ccada116757c2bd765225fcf4bedc7ada18567ae12f09b6978cdbcddd4f635a39a5568b6d3ed4388e4f73af5c33a7060f2ac0d0907fc82d8fd74f SHA512 fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
-DIST setuptools-80.2.0-py3-none-any.whl 1240763 BLAKE2B afb1a983aa8534ab20de1889fd8460bcddad7ffb956b95a830879f03982d38da5f76f71d8c45d8134d9c0223dd3771c639f95ad9e4447e4c201dfbabaca16a3d SHA512 d3b4f97ea45a7f98b9dd711ed3bef6e5faf562a2bd114aec458b196170f8ccf53e2ae12642aeed17af65a2647c258679148c1dfe136cb2b59fa7f4fdd3768ad1
-DIST setuptools-80.3.0-py3-none-any.whl 1200273 BLAKE2B 6f17d3e7ef602d31698f450714af9ee86dd3234450dfcca23d0d27d2e58c3242e77bc156d377192660cab0a3986e85615a74f611bd3b8f6951dd0cb5a3b074f4 SHA512 c6ab8430aae000d986d4edb5027f3a6f5062ff869a8ed85768ce488cb494289ab8ec85a0377928a080111b70a7959e05f9e17487eded93c84637db8a9dda6153
-DIST setuptools-80.3.1-py3-none-any.whl 1201172 BLAKE2B 4daf6a4a65a4e7c0547750addbf30f92e3a386fd7fcc2a98761ec1bee5caf6ccf506f1e201a9518c34bc278ae504f8b277d6199e23df0457a603b1c05a7bb50d SHA512 85b62d19a3762c9cb5d5b79a2f5319d4d387e334711963730e4b6a72dc73be3291bf5fb6eb40a6284a8486cbe615e8af44bc299210642f70f52d3fbfd41be26c
+DIST setuptools-80.4.0-py3-none-any.whl 1200812 BLAKE2B a3487a12084fa8582f1201b6df8cdd23de5b5fc763c5df607a4ae9a688fbd8defe064865e7f03a860819cdff1bf8c8fb98e3f94408e6511709f52eb9538feaef SHA512 2348c2e181394016f23d8ab55d9bf1104f16154729dfa891c3f57cd76d4f2fa0b96cc09b61d2a2ba73ac862c79ae03a6c57850c02c0a46ec279a78dddb06c39d
+DIST setuptools-80.8.0-py3-none-any.whl 1201470 BLAKE2B 7e958fecd9c9597d307d89c31e93fed5d15e505ad882c594c51482368f7227e0944b6ac02298cfcd5d126fc6c2398389843567a5a944ada5bfcd3aead0376766 SHA512 229e18dbaddd34e3a982e0ef8c6dccfa9a513164f54ff141a4ff0a0a3be25ab069766bda9eec4eea82c908506c0aa5eae271450605401f48ed8c94e54476ee0f
+DIST setuptools-80.9.0-py3-none-any.whl 1201486 BLAKE2B 79895683ef4df387aee698984dfdf13adb14314f2d0267f41291c1c1ca68f4383a4273f004b6f3457463913eb19f8d386f32e2630ceaceaaf27ef32c4f61b7ed SHA512 2a0420f7faaa33d2132b82895a8282688030e939db0225ad8abb95a47bdb87b45318f10985fc3cee271a9121441c1526caa363d7f2e4a4b18b1a674068766e87
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
deleted file mode 100644
index 473fddfd3cc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
index b76c3f6972d..473fddfd3cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-79.0.1.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_install() {
 	insinto /usr/lib/python/ensurepip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.1.ebuild
deleted file mode 100644
index b76c3f6972d..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.1.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.4.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.4.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.8.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.2.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.8.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
index cf71fc86453..69c8443a46b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fastjsonschema/fastjsonschema-2.21.1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
index 063c798a097..14e02f627a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{11..13} python3_13t pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
index b71377ac0b9..49b70aab191 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
@@ -1,3 +1 @@
-DIST gpep517-17.gh.tar.gz 24403 BLAKE2B 51273a2e5ea0154d3e7d974f31b31a96dfa087d8bb3a49d89960568b02632fe104e62a4217a2295ef3dcc69f86f875c4e9de1220f3ef15fbff59a44bebcaac33 SHA512 cadf5b2fbd8c00eba928c3d8c893711516f66acc9bf74fc4ad9f0261021f8f6b7c4853035e6b916deba215ecf2f1e567d82161a74b69313b7e0f296e83e75c84
-DIST gpep517-18.gh.tar.gz 28211 BLAKE2B ae5409733a96248b763e33982844866e9ba3b556b9fe0b2f4503cc052015ea7b712a3041e449ba26f8ddcfb8973f963d3c240b1e4a2e5229b3c64702ad5a19bf SHA512 7fb8feda99ac023b006ddfe77f5b71d7837e013088da0da5afeaeecd139f365487ec6c2d17603a34d4694220be12eebda54391bdc6e987b6eae633449acce97a
 DIST gpep517-19.gh.tar.gz 29279 BLAKE2B 1f3002e970de1e56004a0c6486c678ee9baa51d76c263d7356b3a63086615bf81c326b0a0ee313389ae046c7c451c17a1eed1b1cada8c61f0875ee007d5caa23 SHA512 463c3812f388ea7ef83aaf6b3b90de4036b0a8200038a654621822c02d46627f7adf2ed4c7accf016293f89b8c3a2080d9ac80d2f82caaa3fdd370aa98c4335b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild
deleted file mode 100644
index 94694d45c66..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
-
-inherit distutils-r1
-
-DESCRIPTION="A backend script to aid installing Python packages in Gentoo"
-HOMEPAGE="
-	https://pypi.org/project/gpep517/
-	https://github.com/projg2/gpep517/
-"
-SRC_URI="
-	https://github.com/projg2/gpep517/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="GPL-2+"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-1.2.3[${PYTHON_USEDEP}]
-	' 3.10)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -o tmp_path_retention_policy=all
-}
-
-python_install() {
-	python_domodule gpep517
-	python_newscript - gpep517 <<-EOF
-		#!${EPREFIX}/usr/bin/python
-		import sys
-		from gpep517.__main__ import main
-		sys.exit(main())
-	EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-18.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-18.ebuild
deleted file mode 100644
index e225bae086f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-18.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
-
-inherit distutils-r1
-
-DESCRIPTION="A backend script to aid installing Python packages in Gentoo"
-HOMEPAGE="
-	https://pypi.org/project/gpep517/
-	https://github.com/projg2/gpep517/
-"
-SRC_URI="
-	https://github.com/projg2/gpep517/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="GPL-2+"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-1.2.3[${PYTHON_USEDEP}]
-	' 3.10)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -o tmp_path_retention_policy=all
-}
-
-python_install() {
-	python_domodule gpep517
-	python_newscript - gpep517 <<-EOF
-		#!${EPREFIX}/usr/bin/python
-		import sys
-		from gpep517.__main__ import main
-		sys.exit(main())
-	EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
index bc3123e8bcf..e90e21de647 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-19.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( pypy3_11 python3_{11..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
 
 inherit distutils-r1
 
@@ -21,13 +21,10 @@ SRC_URI="
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-1.2.3[${PYTHON_USEDEP}]
-	' 3.10)
 "
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest
index 217ef9dd646..da278ac5357 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/Manifest
@@ -1 +1,2 @@
 DIST hatch-vcs-0.4.0.gh.tar.gz 10822 BLAKE2B 92b1ad1181a6bae815a6d01045836976b8767086f2a7001de9ad97f0d61737895da9a411419e28c5b2d830fca606d7d9c21265210965bc7691670f92aeab1b22 SHA512 bf40cc371c8d8e120fce83e5986fc2bdc2087fa5a4ac4a407d32617e98205ded79dcb29a00c7638ba68dd5ce09f31e84b34176627a6a34dfb7708031f4c4519a
+DIST hatch-vcs-0.5.0.gh.tar.gz 11272 BLAKE2B 5e305fed56fd1c66a296a8c582d342c422c87d11fd0679beeb7af50653493037c7e372353a33e90b7da60f5da4a5f879cc496a3ad68ac169e64ddda1b5ff706e SHA512 ed2b81df3f0b51f9ebca28c023bbf1e66088971e76439ab864838012dc28ec140eadf4f07a4b7aca66b0f5c52fd3ccc001602e6c91dcc8d6241c0b56193cba54
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
index 7ff7445fbd3..9300ab20c2f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.4.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.5.0.ebuild
new file mode 100644
index 00000000000..0ff74336e83
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatch-vcs/hatch-vcs-0.5.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
+
+inherit distutils-r1
+
+DESCRIPTION="Hatch plugin for versioning with your preferred VCS"
+HOMEPAGE="
+	https://pypi.org/project/hatch-vcs/
+	https://github.com/ofek/hatch-vcs/
+"
+SRC_URI="
+	https://github.com/ofek/hatch-vcs/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/setuptools-scm-8.2.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-vcs/git
+	)
+"
+
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
index c8fcc896280..a053ebfe7b6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.27.0.ebuild
@@ -4,8 +4,8 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( pypy3 pypy3_11 python3_{10..13} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
 
 inherit distutils-r1
 
@@ -25,6 +25,8 @@ S=${WORKDIR}/${MY_P}/backend
 LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
 
 # deps are listed in backend/src/hatchling/ouroboros.py
 # editables are optional but required for editable installs
@@ -46,6 +48,7 @@ BDEPEND="
 			dev-python/click[${PYTHON_USEDEP}]
 			dev-python/httpx[${PYTHON_USEDEP}]
 			dev-python/platformdirs[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
 			dev-python/pytest-mock[${PYTHON_USEDEP}]
 			dev-python/rich[${PYTHON_USEDEP}]
 			dev-python/tomli-w[${PYTHON_USEDEP}]
@@ -54,8 +57,6 @@ BDEPEND="
 	)
 "
 
-distutils_enable_tests pytest
-
 src_test() {
 	# top-level "tests" directory contains tests both for hatch
 	# and hatchling
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
index 748fe083f83..6f05c20ab90 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/idna/idna-3.10.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
index 52c9205cc81..dcaf87ff7c8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/installer/installer-0.7.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
index e8ac4ce3b01..68f29639e40 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-collections/jaraco-collections-5.1.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
index 1f03c21b8d7..16363dbbac6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-6.0.1-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{11..13} python3_13t pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
index 200ed01418d..772842ab6ee 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.1.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
index b851fd1a404..962c258f377 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
index 3f72cd7b1c3..2dfd037022f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jinja2/jinja2-3.1.6.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=flit
 PYPI_PN=jinja2
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 
 inherit distutils-r1 pypi
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch
new file mode 100644
index 00000000000..aade3ae3022
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lark/files/lark-1.2.2-py314.patch
@@ -0,0 +1,38 @@
+https://github.com/lark-parser/lark/issues/1480
+https://github.com/lark-parser/lark/pull/1483
+
+From 4809ce89ca005b71f6db930c4aabf6496a502795 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
+Date: Wed, 6 Nov 2024 16:47:11 +0100
+Subject: [PATCH] Wrap functools.partial in staticmethod() to add compatibility
+ with Python 3.14
+
+Fixes: #1480
+---
+ tests/test_trees.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tests/test_trees.py b/tests/test_trees.py
+index 1f69869e..07687ac0 100644
+--- a/tests/test_trees.py
++++ b/tests/test_trees.py
+@@ -254,7 +254,7 @@ def ab_method(self, a, b):
+             ab_partialmethod = partialmethod(ab_for_partialmethod, 1)
+             set_union = set(["a"]).union
+             static_add = staticmethod(add)
+-            partial_reduce_mul = partial(reduce, mul)
++            partial_reduce_mul = staticmethod(partial(reduce, mul))
+ 
+             custom_callable = CustomCallable()
+ 
+@@ -355,8 +355,8 @@ def test(prefix, s, postfix):
+ 
+         @v_args(inline=True)
+         class T(Transformer):
+-            a = functools.partial(test, "@", postfix="!")
+-            b = functools.partial(lambda s: s + "!")
++            a = staticmethod(functools.partial(test, "@", postfix="!"))
++            b = staticmethod(functools.partial(lambda s: s + "!"))
+ 
+         res = T().transform(tree)
+         assert res.children == ["@TEST1!", "test2!"]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
index 4ce565bfc04..a8a5dd0e749 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lark/lark-1.2.2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -28,6 +28,11 @@ BDEPEND="
 	)
 "
 
+PATCHES=(
+	# https://github.com/lark-parser/lark/pull/1483
+	"${FILESDIR}"/${P}-py314.patch
+)
+
 distutils_enable_tests pytest
 
 python_test() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/files/lazy-object-proxy-1.11.0-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/files/lazy-object-proxy-1.11.0-py314.patch
new file mode 100644
index 00000000000..ae80997a416
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/files/lazy-object-proxy-1.11.0-py314.patch
@@ -0,0 +1,39 @@
+From daba375a4c424ee114123122e5c1285e3db4d62e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Sat, 31 May 2025 10:52:38 +0200
+Subject: [PATCH 1/5] Loosen exception regexps for Python 3.14
+
+Python 3.14 changes the exception message for passing wrong types
+to `await` to:
+
+    TypeError: 'int' object can't be awaited
+
+Loosen the regular expression to accept both the old and the new
+exception message.
+---
+ tests/test_async_py3.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/test_async_py3.py b/tests/test_async_py3.py
+index 0d9450b..3fbba18 100644
+--- a/tests/test_async_py3.py
++++ b/tests/test_async_py3.py
+@@ -498,7 +498,7 @@ def test_await_1(lop):
+     async def foo():
+         await 1
+ 
+-    with pytest.raises(TypeError, match='object int can.t.*await'):
++    with pytest.raises(TypeError, match='int.*can.t.*await'):
+         run_async(lop.Proxy(foo))
+ 
+ 
+@@ -506,7 +506,7 @@ def test_await_2(lop):
+     async def foo():
+         await []
+ 
+-    with pytest.raises(TypeError, match='object list can.t.*await'):
++    with pytest.raises(TypeError, match='list.*can.t.*await'):
+         run_async(lop.Proxy(foo))
+ 
+ 
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.11.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.11.0.ebuild
index 9246939e914..a913bf68d54 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.11.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.11.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -30,17 +30,19 @@ distutils_enable_tests pytest
 PATCHES=(
 	# https://github.com/ionelmc/python-lazy-object-proxy/pull/79
 	"${FILESDIR}/${PN}-1.10.0-pure-tests.patch"
+	# https://github.com/ionelmc/python-lazy-object-proxy/pull/88
+	"${FILESDIR}/${P}-py314.patch"
 )
 
 python_prepare_all() {
+	distutils-r1_python_prepare_all
+
 	# No need to benchmark
 	sed \
 		-e '/benchmark/s:test_:_&:g' \
 		-e '/pytest.mark.benchmark/d' \
 		-i tests/test_lazy_object_proxy.py || die
 
-	distutils-r1_python_prepare_all
-
 	if use native-extensions; then
 		unset SETUPPY_FORCE_PURE
 	else
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
index c6533726ecf..4b78371d072 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/linkify-it-py/linkify-it-py-2.0.3.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
index 26d81a16ea3..230a5f2f8e9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.4.0-r2.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 optfeature toolchain-funcs
 
@@ -23,7 +23,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
index 8e4b43bdeb0..985a9c088e4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markdown-it-py/markdown-it-py-3.0.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
index 50f53fa58b8..2b77bd29538 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-3.0.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYPI_PN="MarkupSafe"
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
index 0d78b93cc02..b486364919f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/mdurl/mdurl-0.1.2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
index a608b58dafc..cf9172ccde7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
@@ -1,2 +1 @@
-DIST more-itertools-10.6.0.tar.gz 125009 BLAKE2B f4bade093a730f7daf035d698bfb0fb8f0f8aa6832546e30f9e6d0c39aef96e9cd326d73682c7fa5458f7e75511d759c443a58fed96e831d11375818abb020d8 SHA512 57322c80252e79d1ef82fe5cfc3a3f0208ab6f90d2e59c47491974c23fc30ad1b48d1671c06507b0489b2bdb240c52dee5419a19b96ae06a3d2bdb3a3b483eab
 DIST more_itertools-10.7.0.tar.gz 127671 BLAKE2B 0540d13c0dc2918ea612a1f8ca651f6a0a27d1ab3b6b13160f0bca07fc8b80c0d4b5c175c466cde59d24d54d8ed1cc99f1765d1a559064b82e19ead196ae515c SHA512 a0b2b5d7ae4dc6ecc3c6b81dacccbe23174f31cf6eaba4bef27bf17f8b69a083cbad54818db870289d788da8bbffc362f8b34acb838a5af1c398bd85fbd6db5d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.6.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.6.0.ebuild
deleted file mode 100644
index 88e5e0cf242..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.6.0.ebuild
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYPI_NO_NORMALIZE=1
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="More routines for operating on iterables, beyond itertools"
-HOMEPAGE="
-	https://github.com/more-itertools/more-itertools/
-	https://pypi.org/project/more-itertools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_sphinx docs \
-	dev-python/sphinx-rtd-theme
-distutils_enable_tests unittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
index 7acd5472ab8..1603935c8ac 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.7.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_sphinx docs \
 	dev-python/furo
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
index f260787634e..57e2659f32a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/msgpack/msgpack-1.1.0.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
index 606eef403fe..9a09f78dee9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/olefile/olefile-0.47.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
index 1aab3809831..9478b756fe8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-25.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="|| ( Apache-2.0 BSD-2 )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	!<dev-python/setuptools-67
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
index db6d05b9415..7c12c81e501 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pathspec/pathspec-0.12.1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch
new file mode 100644
index 00000000000..b9fe40d4704
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/files/pillow-11.2.1-py314.patch
@@ -0,0 +1,49 @@
+https://github.com/python-pillow/Pillow/pull/8948
+https://github.com/python-pillow/Pillow/commit/3c71559804e661a5f727e2007a5be51f26d9af27
+
+From c7193f74fc5ce1a0fe1742a0845165024be45ef5 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Thu, 8 May 2025 20:10:34 +1000
+Subject: [PATCH 1/3] Updated error message
+
+---
+ Tests/test_image_resample.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Tests/test_image_resample.py b/Tests/test_image_resample.py
+index ce6209c0da4..73b25ed51b2 100644
+--- a/Tests/test_image_resample.py
++++ b/Tests/test_image_resample.py
+@@ -462,7 +462,7 @@ def test_wrong_arguments(self, resample: Image.Resampling) -> None:
+         im.resize((32, 32), resample, (20, 20, 20, 100))
+         im.resize((32, 32), resample, (20, 20, 100, 20))
+ 
+-        with pytest.raises(TypeError, match="must be sequence of length 4"):
++        with pytest.raises(TypeError, match="must be (sequence|tuple) of length 4"):
+             im.resize((32, 32), resample, (im.width, im.height))  # type: ignore[arg-type]
+ 
+         with pytest.raises(ValueError, match="can't be negative"):
+
+From 215069af5ddec6f4d3b92b8bc7554a10e2efb669 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Thu, 8 May 2025 22:13:13 +1000
+Subject: [PATCH 3/3] Added support for Python 3.14
+
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index 5ecd6b8160a..5d41e27d981 100644
+--- a/setup.py
++++ b/setup.py
+@@ -46,7 +46,7 @@ def get_version() -> str:
+ ZLIB_ROOT = None
+ FUZZING_BUILD = "LIB_FUZZING_ENGINE" in os.environ
+ 
+-if sys.platform == "win32" and sys.version_info >= (3, 14):
++if sys.platform == "win32" and sys.version_info >= (3, 15):
+     import atexit
+ 
+     atexit.register(
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
index fc131fa8d8e..5972d432576 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 # setuptools wrapper
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE='tk?,threads(+)'
 
 inherit distutils-r1 toolchain-funcs virtualx
@@ -81,6 +81,8 @@ src_prepare() {
 	local PATCHES=(
 		# https://github.com/python-pillow/pillow/pull/7634
 		"${FILESDIR}/${PN}-10.2.0-cross.patch"
+		# https://github.com/python-pillow/Pillow/pull/8948
+		"${FILESDIR}/${PN}-11.2.1-py314.patch"
 	)
 
 	distutils-r1_src_prepare
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.1.1.ebuild
index e669ddb4d75..b2bbe3a90c0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.1.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 # please bump dev-python/ensurepip-pip along with this package!
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( pypy3_11 python3_{11..13} )
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
 PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
 PYTHON_REQ_USE="ssl(+),threads(+)"
 
@@ -24,8 +24,9 @@ SRC_URI="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~mips ~ppc ~riscv ~x86"
-IUSE="test-rust"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="test test-rust"
+RESTRICT="!test? ( test )"
 
 # see src/pip/_vendor/vendor.txt
 RDEPEND="
@@ -53,6 +54,7 @@ BDEPEND="
 			dev-python/ensurepip-wheel
 			dev-python/freezegun[${PYTHON_USEDEP}]
 			dev-python/pretend[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
 			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
 			dev-python/pytest-xdist[${PYTHON_USEDEP}]
 			dev-python/scripttest[${PYTHON_USEDEP}]
@@ -68,8 +70,6 @@ BDEPEND="
 	)
 "
 
-distutils_enable_tests pytest
-
 python_prepare_all() {
 	local PATCHES=(
 		"${FILESDIR}/pip-23.1-no-coverage.patch"
@@ -152,6 +152,26 @@ python_test() {
 				tests/functional/test_install_config.py::test_prompt_for_authentication
 			)
 			;;
+		python3.14*)
+			EPYTEST_DESELECT+=(
+				# TODO: segfaults
+				tests/unit/test_collector.py::test_get_index_content_directory_append_index
+				# https://github.com/python/cpython/issues/125974
+				tests/unit/test_collector.py::test_ensure_quoted_url
+				tests/unit/test_finder.py::test_finder_priority_file_over_page
+				tests/unit/test_urls.py::test_path_to_url_unix
+				tests/unit/test_collector.py::test_clean_url_path
+				tests/unit/test_collector.py::test_clean_url_path_with_local_path
+				tests/unit/test_req.py::TestRequirementSet::test_download_info_local_editable_dir
+				tests/unit/test_req.py::test_parse_editable_local
+				tests/unit/test_req.py::test_parse_editable_local_extras
+				tests/unit/test_req.py::test_get_url_from_path__archive_file
+				tests/unit/test_req.py::test_get_url_from_path__installable_dir
+				tests/functional/test_lock.py::test_lock_wheel_from_findlinks
+				tests/functional/test_lock.py::test_lock_sdist_from_findlinks
+				tests/functional/test_lock.py::test_lock_local_editable_with_dep
+			)
+			;;
 	esac
 
 	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index 7bf70ea3cb9..183e402af33 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1 +1 @@
-DIST platformdirs-4.3.7.tar.gz 21291 BLAKE2B 8abe5b99140d1968d0341c025a65cd373d798b4b3848686888e754aad95d5d7e526db9618b2f44300d5b84700655b1562fa40929362a78ed50502a6ef54a55fa SHA512 d2d131aabc448d80581e930b7bb6ced950ce7f2fe595243f0a57ab2e990f7c6669cc45fb4592971f7601f268455451881ceaf303618b5f963056e818c1580bcc
+DIST platformdirs-4.3.8.tar.gz 21362 BLAKE2B dbacac7a6692a2011b8d47abf45ec1141331743336615340d84376ca468b478b0b7d211c6d1256028ecfb81f26b8f31cb290bcb21af4714dc77f834d956c8abc SHA512 131fc9f673313d0c8ea6bc36f6efed09eedc106a37194cb35c73980841b1314fc6f5e4362180d420c071d9c173dbb11f322baab0d264d1a3d9f02f4aa1e43169
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild
index 14b98a8879c..9a26ab7ba1f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.8.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
index 05385367ceb..43abdf8073f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
@@ -1 +1 @@
-DIST pluggy-1.5.0.tar.gz 67955 BLAKE2B c63e7605b7631adf7fe3a91dae92d2ce8172510574e0b23ded159479077f91c88948487a7a4e1da30dca7da0339cb78fbb521538e67bc2bde37986970403d48f SHA512 032d41e1f2bed56eff22463c4645516e9415ee253e0a3fe5ba83a8de5e21700baae1f6384c979d2c6f622e4216a2b745eec489bc04f52a576d423e771365cc7a
+DIST pluggy-1.6.0.tar.gz 69412 BLAKE2B ccd5d0d89a2686cd1cfb25308df8cf8bcf1c3bf2348af0f0cf2ca7341d8f8fb84c7661ab2e085039f9a52958778f3dcea6247c2d690d40347fc9d7db58fe6bfc SHA512 8b88eb778ab955910bcde2b3a6c4925d0a239f932aa9b1d8a351aa21b8a922bd842f735e397ef15ed9bd8e51085a88723660e1e691888a9879e7144add32bff2
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.6.0.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.6.0.ebuild
index 4cd4eb563aa..7867b730c62 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.6.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
index fb6f8f3c428..a0b371d6e84 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/Manifest
index 8b06c52bbd5..f0409bf1395 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/Manifest
@@ -1,2 +1 @@
-DIST poetry_core-2.1.2.tar.gz 364452 BLAKE2B 0ba281c8a30c43ed9c93b5ae8bfad85664eede117e5a9ecb2f98686201a2a77f88bbe8870b72d9998afba8a70e3f9147d002614c411196c5e183ef43b2d9dbc8 SHA512 4cd6f91acf108539b478bded2d930947a177b36eaf10bbb25092c6617a2391fc9f4286ef25186642fcd25750967df375c183434446275c91a5b456e972b1c9c8
 DIST poetry_core-2.1.3.tar.gz 365027 BLAKE2B d3cd1536a8466f784b2cd6a835997c480cdc11d24afe4e0b757879b2acc4795e33485fc9bf6adccf5afbf475d4b1748959fb146a6c01cf8508d6c27a7abe52e0 SHA512 eb82164aef3ce00fc14d55db8065b95feca15a78e1c69ca58c8c0b1018404b173a80c61d448513f938535a03e73df99978b51b3494065bd1c99bc8a14e224ba8
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.2.ebuild
deleted file mode 100644
index 1a278a88e97..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.2.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( pypy3 pypy3_11 python3_{10..13} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Poetry PEP 517 Build Backend"
-HOMEPAGE="
-	https://github.com/python-poetry/poetry-core/
-	https://pypi.org/project/poetry-core/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
-
-# check inside vendors/pyproject.toml
-# (note that some are indirect deps)
-RDEPEND="
-	>=dev-python/fastjsonschema-2.21.1[${PYTHON_USEDEP}]
-	>=dev-python/lark-1.2.2[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.2.1[${PYTHON_USEDEP}]
-	' 3.10)
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			dev-python/build[${PYTHON_USEDEP}]
-			dev-python/pytest-mock[${PYTHON_USEDEP}]
-			dev-python/tomli-w[${PYTHON_USEDEP}]
-			>=dev-python/trove-classifiers-2022.5.19[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20.21[${PYTHON_USEDEP}]
-			dev-vcs/git
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	# remove vendoring of dependencies
-	rm -r src/poetry/core/_vendor || die
-	sed -e '/__vendor_site__/d' -i src/poetry/core/__init__.py || die
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
-		einfo "Skipping tests on ${EPYTHON} (unported deps)"
-		return
-	fi
-
-	# Poetry expects test to be run inside a git repository, otherwise
-	# VCS-related logic doesn't get triggered.  An empty repository
-	# suffices, though.
-	git init || die
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
index bb27669c074..05ef208ae94 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/poetry-core/poetry-core-2.1.3.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
 PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
 
 inherit distutils-r1 pypi
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
 
 # check inside vendors/pyproject.toml
 # (note that some are indirect deps)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
index dcc2cfd77c3..3ed190f94ed 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
index 7ace5ffe427..063bd7bb01b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.19.1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
 PYPI_PN=${PN^}
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 bash-completion-r1 pypi
 
@@ -40,6 +40,18 @@ EPYTEST_DESELECT=(
 EPYTEST_XDIST=1
 distutils_enable_tests pytest
 
+python_test() {
+	if [[ ${EPYTHON} == python3.14* ]] ; then
+		EPYTEST_IGNORE+=(
+			# https://github.com/python/cpython/issues/133653
+			# https://github.com/python/cpython/pull/133813
+			tests/test_cmdline.py
+		)
+	fi
+
+	epytest
+}
+
 src_install() {
 	distutils-r1_src_install
 	newbashcomp external/pygments.bashcomp pygmentize
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
index 88bad0a895c..83f7ac8dbf9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyproject-hooks/pyproject-hooks-1.2.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -22,9 +22,6 @@ KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390
 BDEPEND="
 	test? (
 		dev-python/testpath[${PYTHON_USEDEP}]
-		$(python_gen_cond_dep '
-			dev-python/tomli[${PYTHON_USEDEP}]
-		' 3.10)
 	)
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
index 841211e8df8..54eab123176 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pysocks/pysocks-1.7.1-r2.ebuild
@@ -7,7 +7,7 @@ EAPI=8
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
 PYPI_PN=PySocks
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/requests/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/requests/Manifest
index efbbda4ca0b..1c23363adb0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/requests/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/requests/Manifest
@@ -1 +1,2 @@
+DIST requests-2.32.3-patches.tar.xz 20028 BLAKE2B fb224c96f85d7f8f9c7c0ca7fc188ddcf12abe6239a83e4ec1fb96f949ed27007ea98a412fea2eb7d132a191ff20cec4cd0da20da10255125d8ab7890dc8c27e SHA512 be04a6a55ff3184c22b20a8f185fd7c6478db44d451fe396e61687a5f58d24b915a18f94fc888f6744eae745ede47831abdb1bca73e31fd26cf4478340b130e9
 DIST requests-2.32.3.tar.gz 131218 BLAKE2B c36bd80e0544e83b80c001e6bfdde7b8552e65b888d44d781f95d5a6302dd34dfd4368e18dbfeab3a014d7170946c502e3bf3a6dbd027a60a2f0f535c674d75c SHA512 20d413597ff4803a62156ada25ef2e8a5edd0d4dbf7d79cc7fcd88d51a76e019a7dacf41d7c3d546306f37c506ede68f16b9afea57c918db64e702382b1ae420
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/requests/requests-2.32.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/requests/requests-2.32.3.ebuild
index d4ba48307a3..a5eca5f4c18 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/requests/requests-2.32.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/requests/requests-2.32.3.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 
 inherit distutils-r1 pypi
@@ -17,6 +17,8 @@ HOMEPAGE="
 	https://pypi.org/project/requests/
 "
 
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-2.32.3-patches.tar.xz"
+
 LICENSE="Apache-2.0"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
@@ -41,6 +43,14 @@ BDEPEND="
 	)
 "
 
+PATCHES=(
+	# https://github.com/psf/requests/pull/6897
+	"${WORKDIR}/${PN}-2.32.3-patches/${PN}-2.32.3-tests.patch"
+	"${WORKDIR}/${PN}-2.32.3-patches/${PN}-2.32.3-tests-regenerate.patch"
+	# https://github.com/psf/requests/pull/6924
+	"${WORKDIR}/${PN}-2.32.3-patches/${PN}-2.32.3-tests-more.patch"
+)
+
 distutils_enable_tests pytest
 
 python_test() {
@@ -53,12 +63,9 @@ python_test() {
 		# require IPv4 interface in 10.* range
 		tests/test_requests.py::TestTimeout::test_connect_timeout
 		tests/test_requests.py::TestTimeout::test_total_timeout_connect
-		# TODO: openssl?
-		tests/test_requests.py::TestRequests::test_pyopenssl_redirect
-		# flask-2
-		tests/test_requests.py::TestRequests::test_cookie_sent_on_redirect
-		tests/test_requests.py::TestRequests::test_cookie_removed_on_expire
-		tests/test_requests.py::TestPreparingURLs::test_redirecting_to_bad_url
+		# As of 2.32.3, with python-3.13.3, despite the patches we've
+		# backported, this still seems to fail. Maybe openssl-3.5?
+		tests/test_requests.py::TestPreparingURLs::test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert
 	)
 
 	case ${EPYTHON} in
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
index c700abef86d..0b78c4bd444 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch
new file mode 100644
index 00000000000..4684f2b469e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/files/rich-14.0.0-py314.patch
@@ -0,0 +1,84 @@
+https://github.com/Textualize/rich/pull/3622
+
+From 91bbeac3ec8b87790865be974260d44adc8def61 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Tue, 28 Jan 2025 10:03:26 +0100
+Subject: [PATCH] Skip tests which are expected to fail with Python 3.14
+
+---
+ tests/test_inspect.py | 9 +++++++++
+ tests/test_pretty.py  | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/tests/test_inspect.py b/tests/test_inspect.py
+index 130e8df12..fd1d26e2c 100644
+--- a/tests/test_inspect.py
++++ b/tests/test_inspect.py
+@@ -43,6 +43,11 @@
+     reason="rendered differently on py3.13",
+ )
+ 
++skip_py314 = pytest.mark.skipif(
++    sys.version_info.minor == 14 and sys.version_info.major == 3,
++    reason="rendered differently on py3.14",
++)
++
+ skip_pypy3 = pytest.mark.skipif(
+     hasattr(sys, "pypy_version_info"),
+     reason="rendered differently on pypy3",
+@@ -139,6 +144,7 @@ def test_inspect_empty_dict():
+     assert render({}).startswith(expected)
+ 
+ 
++@skip_py314
+ @skip_py313
+ @skip_py312
+ @skip_py311
+@@ -219,6 +225,7 @@ def test_inspect_integer_with_value():
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python38_and_python39():
+     expected = (
+         "╭──────────────── <class 'int'> ─────────────────╮\n"
+@@ -257,6 +264,7 @@ def test_inspect_integer_with_methods_python38_and_python39():
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python310only():
+     expected = (
+         "╭──────────────── <class 'int'> ─────────────────╮\n"
+@@ -299,6 +307,7 @@ def test_inspect_integer_with_methods_python310only():
+ @skip_py310
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_inspect_integer_with_methods_python311():
+     # to_bytes and from_bytes methods on int had minor signature change -
+     # they now, as of 3.11, have default values for all of their parameters
+diff --git a/tests/test_pretty.py b/tests/test_pretty.py
+index 90be42f87..29331d9d5 100644
+--- a/tests/test_pretty.py
++++ b/tests/test_pretty.py
+@@ -38,6 +38,10 @@
+     sys.version_info.minor == 13 and sys.version_info.major == 3,
+     reason="rendered differently on py3.13",
+ )
++skip_py314 = pytest.mark.skipif(
++    sys.version_info.minor == 14 and sys.version_info.major == 3,
++    reason="rendered differently on py3.14",
++)
+ 
+ 
+ def test_install() -> None:
+@@ -639,6 +643,7 @@ class Nada:
+ @skip_py311
+ @skip_py312
+ @skip_py313
++@skip_py314
+ def test_attrs_broken() -> None:
+     @attr.define
+     class Foo:
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
index 3fb0c38348f..5cf4037f031 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=poetry
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit distutils-r1 optfeature
 
@@ -26,9 +26,6 @@ RDEPEND="
 	dev-python/colorama[${PYTHON_USEDEP}]
 	>=dev-python/markdown-it-py-2.2.0[${PYTHON_USEDEP}]
 	>=dev-python/pygments-2.13.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/typing-extensions-4.0.0[${PYTHON_USEDEP}]
-	' 3.10)
 "
 BDEPEND="
 	test? (
@@ -36,6 +33,11 @@ BDEPEND="
 	)
 "
 
+PATCHES=(
+	# https://github.com/Textualize/rich/pull/3622
+	"${FILESDIR}"/${PN}-14.0.0-py314.patch
+)
+
 distutils_enable_tests pytest
 
 python_test() {
@@ -62,6 +64,11 @@ python_test() {
 				tests/test_inspect.py::test_inspect_integer_with_methods_python311
 			)
 			;;
+		python3.14*)
+			EPYTEST_DESELECT+=(
+				# Span vs Style
+				tests/test_text.py::test_assemble_meta
+			)
 	esac
 
 	local -x COLUMNS=80
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
index 32c888a1ded..08b01bd3e37 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
@@ -1,3 +1 @@
-DIST setuptools_scm-8.2.1.tar.gz 78075 BLAKE2B e026c02cd172b6a7cbcea93c2ceeeaaff9912722063523b1f12039b7d9c147a9b5d1267e907867e27d8c8deb14e9d32e4c48cdf5683ec796a0c1fc01dabf1843 SHA512 4afa1bba1a9e3791be5b2cda945ee9c6a0d3b085a528ec9d74ca4e3649522d947594aade9e146164df3548a853aed96c62a14c617d38b50a7797f8e1f53f7ab1
-DIST setuptools_scm-8.3.0.tar.gz 78025 BLAKE2B e500924090316b94a0c3c67794eba1d0ebbe65ffa2ba0a37636fc9c3f82e66ad36e50e5ec09a44b17631285ee17fa473a3c2e408b60144efc3ef8a9f9ba3473d SHA512 11c401b6075b1da5cbf0108a1d6464f885b0086960643cc7dd4750f20879a6cc9af947ecb80bb5f4e3aaa4e2b6c98301d6207cd466e49b7bcdf55fe995299783
 DIST setuptools_scm-8.3.1.tar.gz 78088 BLAKE2B 6cedb55fc16830d12a28fe5b662c371b134bc4d7ef0e6de446b71152e5d83a031cf763b0753042c96745e82bf9dc42fa7cfee05a9a7e7824a4cf659b0a401a51 SHA512 e924abf81c7ee466241c5d66c39b416c8b308f01df9e1498c55ad6ed9812fbf883d8bcafd6fdcdcb96c5ec42b868ae04088de1870ca09a650fa07eb3ea9901c8
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild
deleted file mode 100644
index c99de4cc8f4..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Manage versions by scm tags via setuptools"
-HOMEPAGE="
-	https://github.com/pypa/setuptools-scm/
-	https://pypi.org/project/setuptools-scm/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-# there's an optional dep on rich for cute logs
-RDEPEND="
-	dev-python/packaging[${PYTHON_USEDEP}]
-	>=dev-python/setuptools-61[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.2[${PYTHON_USEDEP}]
-	' 3.10)
-"
-BDEPEND="
-	dev-python/setuptools[${PYTHON_USEDEP}]
-	test? (
-		dev-python/build[${PYTHON_USEDEP}]
-		dev-python/typing-extensions[${PYTHON_USEDEP}]
-		dev-vcs/git
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=(
-		# the usual nondescript gpg-agent failure
-		testing/test_git.py::test_git_getdate_signed_commit
-
-		# fetching from the Internet
-		testing/test_regressions.py::test_pip_download
-
-		# calls flake8, unpredictable
-		testing/test_functions.py::test_dump_version_flake8
-	)
-
-	if has_version dev-python/nose; then
-		EPYTEST_DESELECT+=(
-			# https://bugs.gentoo.org/892639
-			testing/test_integration.py::test_pyproject_support
-		)
-	fi
-
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.0.ebuild
deleted file mode 100644
index b3466e7f8a3..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.0.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Manage versions by scm tags via setuptools"
-HOMEPAGE="
-	https://github.com/pypa/setuptools-scm/
-	https://pypi.org/project/setuptools-scm/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-# there's an optional dep on rich for cute logs
-RDEPEND="
-	dev-python/packaging[${PYTHON_USEDEP}]
-	>=dev-python/setuptools-61[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.2[${PYTHON_USEDEP}]
-	' 3.10)
-"
-BDEPEND="
-	dev-python/setuptools[${PYTHON_USEDEP}]
-	test? (
-		dev-python/build[${PYTHON_USEDEP}]
-		dev-python/typing-extensions[${PYTHON_USEDEP}]
-		dev-vcs/git
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=(
-		# the usual nondescript gpg-agent failure
-		testing/test_git.py::test_git_getdate_signed_commit
-
-		# fetching from the Internet
-		testing/test_regressions.py::test_pip_download
-
-		# calls flake8, unpredictable
-		testing/test_functions.py::test_dump_version_flake8
-	)
-
-	if has_version dev-python/nose; then
-		EPYTEST_DESELECT+=(
-			# https://bugs.gentoo.org/892639
-			testing/test_integration.py::test_pyproject_support
-		)
-	fi
-
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
index b3466e7f8a3..40df192cf1b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.3.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -17,15 +17,12 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # there's an optional dep on rich for cute logs
 RDEPEND="
 	dev-python/packaging[${PYTHON_USEDEP}]
 	>=dev-python/setuptools-61[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.2[${PYTHON_USEDEP}]
-	' 3.10)
 "
 BDEPEND="
 	dev-python/setuptools[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 8544804e3a3..87c413a4654 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,6 +1,4 @@
-DIST setuptools-75.8.2.tar.gz 1344083 BLAKE2B 7d4dff2c0948bb411ef5f70e5f5f91bc0e230b155a97419d263f88e54a94390fd7dcadad14105f4d886a25024bf4c95e776ae7b25e4b1d6f17e45e6060b99da2 SHA512 adf7f5d2eab7621b03c86e3f96857b176631108dc8a0eba2b16b87e394bff0b607998bc24cc074cd3f7b0ed6dbe0bd753cce5af2f108fce2473fb50b22f32913
-DIST setuptools-78.1.0.tar.gz 1367827 BLAKE2B d82320d11829e43e6841cd6b5a9bd4e16cfc9e7e2f97f64ac2ab1956ed68587ca6c74a07781f6afeefd3a949c23dee374460bdd327b7a5d908f33b2882f3d87d SHA512 e0b9562a8b3bb7a6b664da84ef37e4f4f71df5dd3129b636ece798878e62bf4be60ff6b6643a98b7047e540e14c931eeb54b4e08c583ac1a86ffb5dc5e921c68
 DIST setuptools-79.0.1.tar.gz 1367909 BLAKE2B d495a22753400b3b0ef71423e2c9b5adaad1a065d1f9638b5da8161b29c453495701c3efaa3abd2482777e186ba992bd7b57090dfc711d9cdfdaa8254616a8ff SHA512 5b68d7cc775f4318e178f7d7f69c60a01b1abc607411e88c88e3507a08bd85eed241b915d4be5f3ada90df4b68718056c2ba032943c1f53fe68d171c7d728179
-DIST setuptools-80.2.0.tar.gz 1354232 BLAKE2B 2eb5f9b51632c865533bb018e268da7e9b52f1cecdb9da0eb0da713ee4e44d0827c6340b5c1f663d3b8b4df08849c32972498980de287fab6101593d5aeb47ca SHA512 a684eb3ef4049c6d05aca9cd77a015e63047cdc84460af798ac1dc1d87a970370176ac7fd87e250be155e61dddd77e89ad84adb5557f04d1a1059cd449c08c53
-DIST setuptools-80.3.0.tar.gz 1314475 BLAKE2B 26fb2b0408221a51f4664a983927be79936b89e3daffb71f1d6ad76a2b752ee10f3958ac9be9fb7d8c78906b6cff33b19c16d248649600d6921083bdfc841d04 SHA512 f492360d8eec2a33a70328cf6e7e017290dea510ffa14fe12ef0161bd72a46d6078ff099a885f256ced0862c3551b6ef3af449a4638b309f6b55070dcd482c51
-DIST setuptools-80.3.1.tar.gz 1315082 BLAKE2B 65207edf080d80599b2fe82caed638221bbe1155f745fd8cd02bd9da5934b1880782eb285f5be44088e189684385e7fbbd2bd0750fcd27aaf556f0a44214573d SHA512 be5157aa1f1a7f1e3e11b971ffedac509303d4919d590c1f741dd1c4966c5dc83168b458d3aad66dd9874c7f8f4c8c5bbded6b4dbf6ed91f0d05b1c65229a789
+DIST setuptools-80.4.0.tar.gz 1315008 BLAKE2B e41541fdd6e6adad6ed2f39f2c344c944336e89c24b6d9de9984c8a0234c61dba05b15df805639d380e840b0a15b98a3998c251b764340b5251624827be0934a SHA512 d4d55d9f7bdecbf26e3de6e5a99245db4b69a203a37475539ce4a3b8c6e6b9f1c47f5dc29b4d6a4dc971cabc6714ae7bc0a55f99e214d9402b47bb3dd89b58a4
+DIST setuptools-80.8.0.tar.gz 1319720 BLAKE2B 0416a838d4806c646b6c957f120c0ea265b63429142de9ffa2708233f55500055f1fd5b8b8760950a73eb348ecbec2168c35d3beb1b3888de2e6df85913f5702 SHA512 e2b54c43b0925a911aee7738ca71e62e448ac5732332b375ebf5b55aeda1abfb59b06afbb40662d37b9a65f499b5a64ee2878f28e915059d4c7d0a61d408e8a1
+DIST setuptools-80.9.0.tar.gz 1319958 BLAKE2B ab367912eec92b0d1251916d09c1dd2e311767eec87225beaff870dff923b47ba1732d2f7393b7d9e55d1ff1249c612e4403019e0021048951f9fc3b775c04c9 SHA512 36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
deleted file mode 100644
index a4fd87dbb97..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
index f57414ffa01..84658b820dc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-79.0.1.ebuild
@@ -7,8 +7,8 @@ EAPI=8
 # please bump dev-python/ensurepip-setuptools along with this package!
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_TESTED=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.2.0.ebuild
deleted file mode 100644
index 56dbefde5b3..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.2.0.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{11..13} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-		# TODO
-		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
index f85cc1d403c..a69951f06b4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.4.0.ebuild
@@ -7,8 +7,8 @@ EAPI=8
 # please bump dev-python/ensurepip-setuptools along with this package!
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_TESTED=( python3_{11..13} pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t python3_14 python3_14t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
@@ -26,7 +26,6 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
 	dev-python/jaraco-collections[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -34,12 +33,6 @@ RDEPEND="
 	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
 	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
 	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
 "
 BDEPEND="
 	${RDEPEND}
@@ -99,7 +92,9 @@ python_test() {
 
 	local EPYTEST_DESELECT=(
 		# network
+		setuptools/tests/integration/test_pbr.py::test_pbr_integration
 		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
 		setuptools/tests/test_distutils_adoption.py
 		setuptools/tests/test_editable_install.py
 		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
@@ -123,6 +118,7 @@ python_test() {
 		# relies on -Werror
 		setuptools/_static.py::setuptools._static.Dict
 		setuptools/_static.py::setuptools._static.List
+		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
 		# TODO
 		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.8.0.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.8.0.ebuild
index 558dbf01291..b3f6452e8dd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.8.0.ebuild
@@ -7,8 +7,8 @@ EAPI=8
 # please bump dev-python/ensurepip-setuptools along with this package!
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{11..13} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_TESTED=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
@@ -118,6 +118,7 @@ python_test() {
 		# relies on -Werror
 		setuptools/_static.py::setuptools._static.Dict
 		setuptools/_static.py::setuptools._static.List
+		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
 		# TODO
 		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
index 56dbefde5b3..b3f6452e8dd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
@@ -7,8 +7,8 @@ EAPI=8
 # please bump dev-python/ensurepip-setuptools along with this package!
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{11..13} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_TESTED=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
 PYTHON_REQ_USE="xml(+)"
 
 inherit distutils-r1 pypi
@@ -26,7 +26,6 @@ IUSE="test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	!<dev-python/setuptools-rust-1.8.0
 	dev-python/jaraco-collections[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -34,9 +33,6 @@ RDEPEND="
 	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
 	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
 	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-	!<=dev-libs/gobject-introspection-1.76.1-r0
-	!=dev-libs/gobject-introspection-1.78.1-r0
-	!=dev-libs/gobject-introspection-1.80.1-r1
 "
 BDEPEND="
 	${RDEPEND}
@@ -96,6 +92,7 @@ python_test() {
 
 	local EPYTEST_DESELECT=(
 		# network
+		setuptools/tests/integration/test_pbr.py::test_pbr_integration
 		setuptools/tests/test_build_meta.py::test_legacy_editable_install
 		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
 		setuptools/tests/test_distutils_adoption.py
@@ -121,6 +118,7 @@ python_test() {
 		# relies on -Werror
 		setuptools/_static.py::setuptools._static.Dict
 		setuptools/_static.py::setuptools._static.List
+		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
 		# TODO
 		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
index 767557b2983..88c5b5d52de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/six/six-1.17.0.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
index 677180f7d67..d613a56d2c8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
@@ -1 +1,2 @@
 DIST snakeoil-0.10.10.tar.gz 174648 BLAKE2B b71a7006bef87527b1fca1dac4608ba38c33f38de23d7b3533ee5333b3671f69b0300c18a737d663532ce1a60f092fb4d9a40f1edab020604c4a78e92053ad59 SHA512 606204d80f099334abfc73475982b724da78117753a545ebcee9378f7cc88cd67e42c0f3c4dbf98c9c138dddf2bcf067ca47add664fde8454e4185bb8e8474d1
+DIST snakeoil-0.10.11.tar.gz 174701 BLAKE2B 5dba8eac3fdd6dfc88fcb2ffac8cd16f18c28485d39e6726708f98f0c86cdc6d101bf343da75c505f34c59c0bede89b0adbc268bc6d93a996cfefce4e968ac75 SHA512 6cd4fb1449e1ccf74bf8042afa4e113704eb328c89ff1def59581e96031082b27d78f46574796f59a612148947626d727b13a04134bc895e96f2f4733ce54c41
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.11.ebuild
new file mode 100644
index 00000000000..20516defe07
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.11.ebuild
@@ -0,0 +1,30 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+inherit distutils-r1
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/snakeoil.git
+		https://github.com/pkgcore/snakeoil.git"
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	inherit pypi
+fi
+
+DESCRIPTION="misc common functionality and useful optimizations"
+HOMEPAGE="https://github.com/pkgcore/snakeoil"
+
+LICENSE="BSD BSD-2 MIT"
+SLOT="0"
+
+RDEPEND="
+	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
+"
+
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
index 086b0670ec2..20516defe07 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 inherit distutils-r1
 
@@ -26,8 +26,5 @@ SLOT="0"
 RDEPEND="
 	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
 "
-BDEPEND="
-	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
-"
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
index e44ac2de4a9..891d42fb629 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.2.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index a0ef531182f..0808d7839f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1,3 +1 @@
-DIST trove_classifiers-2025.4.11.15.tar.gz 16321 BLAKE2B b011b524d267506aef4d91ac6d365e08e419fb57b424259b080de8cb7205cd8c4c6df52e29532b9dc19ca36f41b0793ac25a8824e9d2328735357efa369b2157 SHA512 5eb5d892a751105319c003e4a370d2f69b614a1f2bea8904865b7da9f4d2648ffe57fba1cebc1ec21dab74d02b3223eb72af478ddd69635e45b0424621cefa9a
-DIST trove_classifiers-2025.4.28.22.tar.gz 16883 BLAKE2B 9598b19874f7deaeb15333a7f97cb91a7d82fe34d26d6d4e526bf857ed777539cad89949628196f2bbff187511fc5bca2327aeaacec4052611c5f2d82c4bb8a8 SHA512 4863ff031d9c83177099b5c1e04e2a22396055209b88e60dd44e22a8357889f27572444e0a1fbef65b7b37919cb9d7f8cb548b7007fd878d8fe92c9cd39b864e
-DIST trove_classifiers-2025.5.1.12.tar.gz 16876 BLAKE2B 27ae91479d2a811978b3f1447568f5849341a7fda5c825ebf0dd0502d85f206d63f4687463708031637da4313d0182abc05b6b710a6f32fd714167ac766a587d SHA512 af3c0ee51e7ce3e7ec0eb1fd901ac3d0c02f6c0ba1c77d3ba66e0770bf5300144f636dcbf608f046a21789cfc780f651be222b7d23f359a672fde0210af966b5
+DIST trove_classifiers-2025.5.9.12.tar.gz 16940 BLAKE2B f6143f341d280eca611269c1a04b7f795d8f8733e97518d81d5872b8e1e13f745f7428737993a5c50285de24f56f899737d05fe073c683ddd69765b6081a6ebe SHA512 ee858f52c08b867fe4845ebb19f9b431308d216b5313e2bc030d63340860205d40125ef6cee218f734ccd49e5ae36011c8e3415f03d0ace182cb518ed5f2318d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild
deleted file mode 100644
index 5f05a4286c3..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.28.22.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
-HOMEPAGE="
-	https://github.com/pypa/trove-classifiers/
-	https://pypi.org/project/trove-classifiers/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease hatchling bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "trove-classifiers"
-		version = "${PV}"
-		description = "Canonical source for classifiers on PyPI (pypi.org)."
-
-		[project.scripts]
-		trove-classifiers = "trove_classifiers.__main__:cli"
-	EOF
-}
-
-python_test() {
-	epytest
-	"${EPYTHON}" -m tests.lib || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild
deleted file mode 100644
index 2e0e947a067..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.1.12.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3_11 python3_{11..13} python3_13t )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
-HOMEPAGE="
-	https://github.com/pypa/trove-classifiers/
-	https://pypi.org/project/trove-classifiers/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease hatchling bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "trove-classifiers"
-		version = "${PV}"
-		description = "Canonical source for classifiers on PyPI (pypi.org)."
-
-		[project.scripts]
-		trove-classifiers = "trove_classifiers.__main__:cli"
-	EOF
-}
-
-python_test() {
-	epytest
-	"${EPYTHON}" -m tests.lib || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
index b09ba5eba8f..a6d5e8b1756 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.5.9.12.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
 
 inherit distutils-r1 pypi
 
@@ -33,6 +33,9 @@ src_configure() {
 		name = "trove-classifiers"
 		version = "${PV}"
 		description = "Canonical source for classifiers on PyPI (pypi.org)."
+
+		[project.scripts]
+		trove-classifiers = "trove_classifiers.__main__:cli"
 	EOF
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
index 7563b9a0b51..3ad6dfe6683 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index 0f20cd99fb1..6d69f66d25c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1 +1,2 @@
 DIST typing_extensions-4.13.2.tar.gz 106967 BLAKE2B 6a0dfd0cb94f8411342f547f2b209a3c8afd32c818ec837c9ce63191392ba5f89c31279f35d7ca8c0a2f2cda99ea23084c3fad4bc3787f20e31741665e174645 SHA512 2cd798939362ee0d7ddbffe69b1d0fdd72b9574c1bd7300caee73d36c457ea64ea635c87ecc6188db9ffaaca272b1c8dd978a42c591ae0dfdca5632317ddb18c
+DIST typing_extensions-4.14.0rc1.tar.gz 107459 BLAKE2B 5be5ca9f8e29f26f0cf61d7125caaab830d70e13199f1b0407d04eef18587e144737553cf6ed750f31188723821743d80b16b91c93cd4a4714402e1e1ac3df57 SHA512 0c37102ca65695dd71431aac63457f76c09bb974e32fb8e22cc54e386c6307701a3e58fc21cd2883409a2c6ea6eae337c5184030eda7c5f3580c721ac681ad32
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch
new file mode 100644
index 00000000000..d1086c2c359
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/files/typing-extensions-4.13.2-py314.patch
@@ -0,0 +1,422 @@
+From 2354c1a8d21cf8f6d6f6a9d54bb3a69b5908e035 Mon Sep 17 00:00:00 2001
+From: Jelle Zijlstra <jelle.zijlstra@gmail.com>
+Date: Fri, 2 May 2025 19:45:27 -0700
+Subject: [PATCH 1/2] Fix test failures on Python 3.14 (#566)
+
+---
+ src/test_typing_extensions.py | 40 ++++++++++++++++++++++++-----------
+ src/typing_extensions.py      |  9 ++++++--
+ 2 files changed, 35 insertions(+), 14 deletions(-)
+
+diff --git a/src/test_typing_extensions.py b/src/test_typing_extensions.py
+index 584b0fa..7b08f72 100644
+--- a/src/test_typing_extensions.py
++++ b/src/test_typing_extensions.py
+@@ -901,10 +901,12 @@ class Cls:
+ 
+ class DeprecatedCoroTests(BaseTestCase):
+     def test_asyncio_iscoroutinefunction(self):
+-        self.assertFalse(asyncio.coroutines.iscoroutinefunction(func))
+-        self.assertFalse(asyncio.coroutines.iscoroutinefunction(Cls.func))
+-        self.assertTrue(asyncio.coroutines.iscoroutinefunction(coro))
+-        self.assertTrue(asyncio.coroutines.iscoroutinefunction(Cls.coro))
++        with warnings.catch_warnings():
++            warnings.simplefilter("ignore", DeprecationWarning)
++            self.assertFalse(asyncio.coroutines.iscoroutinefunction(func))
++            self.assertFalse(asyncio.coroutines.iscoroutinefunction(Cls.func))
++            self.assertTrue(asyncio.coroutines.iscoroutinefunction(coro))
++            self.assertTrue(asyncio.coroutines.iscoroutinefunction(Cls.coro))
+ 
+     @skipUnless(TYPING_3_12_ONLY or TYPING_3_13_0_RC, "inspect.iscoroutinefunction works differently on Python < 3.12")
+     def test_inspect_iscoroutinefunction(self):
+@@ -7228,7 +7230,7 @@ class TypeVarTests(BaseTestCase):
+ 
+     def test_bound_errors(self):
+         with self.assertRaises(TypeError):
+-            TypeVar('X', bound=Union)
++            TypeVar('X', bound=Optional)
+         with self.assertRaises(TypeError):
+             TypeVar('X', str, float, bound=Employee)
+         with self.assertRaisesRegex(TypeError,
+@@ -8213,19 +8215,26 @@ class TestGetAnnotations(BaseTestCase):
+             get_annotations(f2, format=Format.FORWARDREF),
+             {"a": "undefined"},
+         )
+-        self.assertEqual(get_annotations(f2, format=2), {"a": "undefined"})
++        # Test that the raw int also works
++        self.assertEqual(
++            get_annotations(f2, format=Format.FORWARDREF.value),
++            {"a": "undefined"},
++        )
+ 
+         self.assertEqual(
+             get_annotations(f1, format=Format.STRING),
+             {"a": "int"},
+         )
+-        self.assertEqual(get_annotations(f1, format=3), {"a": "int"})
++        self.assertEqual(
++            get_annotations(f1, format=Format.STRING.value),
++            {"a": "int"},
++        )
+ 
+         with self.assertRaises(ValueError):
+             get_annotations(f1, format=0)
+ 
+         with self.assertRaises(ValueError):
+-            get_annotations(f1, format=4)
++            get_annotations(f1, format=42)
+ 
+     def test_custom_object_with_annotations(self):
+         class C:
+@@ -8264,10 +8273,17 @@ class TestGetAnnotations(BaseTestCase):
+         foo.__annotations__ = {"a": "foo", "b": "str"}
+         for format in Format:
+             with self.subTest(format=format):
+-                self.assertEqual(
+-                    get_annotations(foo, format=format),
+-                    {"a": "foo", "b": "str"},
+-                )
++                if format is Format.VALUE_WITH_FAKE_GLOBALS:
++                    with self.assertRaisesRegex(
++                        ValueError,
++                        "The VALUE_WITH_FAKE_GLOBALS format is for internal use only"
++                    ):
++                        get_annotations(foo, format=format)
++                else:
++                    self.assertEqual(
++                        get_annotations(foo, format=format),
++                        {"a": "foo", "b": "str"},
++                    )
+ 
+         self.assertEqual(
+             get_annotations(foo, eval_str=True, locals=locals()),
+diff --git a/src/typing_extensions.py b/src/typing_extensions.py
+index fa89c83..d089d5e 100644
+--- a/src/typing_extensions.py
++++ b/src/typing_extensions.py
+@@ -4153,8 +4153,9 @@ _PEP_649_OR_749_IMPLEMENTED = (
+ 
+ class Format(enum.IntEnum):
+     VALUE = 1
+-    FORWARDREF = 2
+-    STRING = 3
++    VALUE_WITH_FAKE_GLOBALS = 2
++    FORWARDREF = 3
++    STRING = 4
+ 
+ 
+ if _PEP_649_OR_749_IMPLEMENTED:
+@@ -4198,6 +4199,10 @@ else:
+ 
+         """
+         format = Format(format)
++        if format is Format.VALUE_WITH_FAKE_GLOBALS:
++            raise ValueError(
++                "The VALUE_WITH_FAKE_GLOBALS format is for internal use only"
++            )
+ 
+         if eval_str and format is not Format.VALUE:
+             raise ValueError("eval_str=True is only supported with format=Format.VALUE")
+From 62740a52eca38414efc9ce01b361ab45eae7c38e Mon Sep 17 00:00:00 2001
+From: Jelle Zijlstra <jelle.zijlstra@gmail.com>
+Date: Mon, 5 May 2025 09:50:14 -0700
+Subject: [PATCH 2/2] Fix tests on Python 3.14 (#592)
+
+---
+ src/test_typing_extensions.py | 117 ++++++++++++++++++++++++++++++----
+ src/typing_extensions.py      |  67 +++++++++++++++----
+ 2 files changed, 161 insertions(+), 23 deletions(-)
+
+diff --git a/src/test_typing_extensions.py b/src/test_typing_extensions.py
+index 7b08f72..9742b98 100644
+--- a/src/test_typing_extensions.py
++++ b/src/test_typing_extensions.py
+@@ -440,6 +440,48 @@ class BaseTestCase(TestCase):
+             raise self.failureException(message)
+ 
+ 
++class EqualToForwardRef:
++    """Helper to ease use of annotationlib.ForwardRef in tests.
++
++    This checks only attributes that can be set using the constructor.
++
++    """
++
++    def __init__(
++        self,
++        arg,
++        *,
++        module=None,
++        owner=None,
++        is_class=False,
++    ):
++        self.__forward_arg__ = arg
++        self.__forward_is_class__ = is_class
++        self.__forward_module__ = module
++        self.__owner__ = owner
++
++    def __eq__(self, other):
++        if not isinstance(other, (EqualToForwardRef, typing.ForwardRef)):
++            return NotImplemented
++        if sys.version_info >= (3, 14) and self.__owner__ != other.__owner__:
++            return False
++        return (
++            self.__forward_arg__ == other.__forward_arg__
++            and self.__forward_module__ == other.__forward_module__
++            and self.__forward_is_class__ == other.__forward_is_class__
++        )
++
++    def __repr__(self):
++        extra = []
++        if self.__forward_module__ is not None:
++            extra.append(f", module={self.__forward_module__!r}")
++        if self.__forward_is_class__:
++            extra.append(", is_class=True")
++        if sys.version_info >= (3, 14) and self.__owner__ is not None:
++            extra.append(f", owner={self.__owner__!r}")
++        return f"EqualToForwardRef({self.__forward_arg__!r}{''.join(extra)})"
++
++
+ class Employee:
+     pass
+ 
+@@ -5075,6 +5117,64 @@ class TypedDictTests(BaseTestCase):
+                 x: str
+ 
+ 
++    def test_annotations(self):
++        # _type_check is applied
++        with self.assertRaisesRegex(TypeError, "Plain typing.Optional is not valid as type argument"):
++            class X(TypedDict):
++                a: Optional
++
++        # _type_convert is applied
++        class Y(TypedDict):
++            a: None
++            b: "int"
++        if sys.version_info >= (3, 14):
++            import annotationlib
++
++            fwdref = EqualToForwardRef('int', module=__name__)
++            self.assertEqual(Y.__annotations__, {'a': type(None), 'b': fwdref})
++            self.assertEqual(Y.__annotate__(annotationlib.Format.FORWARDREF), {'a': type(None), 'b': fwdref})
++        else:
++            self.assertEqual(Y.__annotations__, {'a': type(None), 'b': typing.ForwardRef('int', module=__name__)})
++
++    @skipUnless(TYPING_3_14_0, "Only supported on 3.14")
++    def test_delayed_type_check(self):
++        # _type_check is also applied later
++        class Z(TypedDict):
++            a: undefined  # noqa: F821
++
++        with self.assertRaises(NameError):
++            Z.__annotations__
++
++        undefined = Final
++        with self.assertRaisesRegex(TypeError, "Plain typing.Final is not valid as type argument"):
++            Z.__annotations__
++
++        undefined = None  # noqa: F841
++        self.assertEqual(Z.__annotations__, {'a': type(None)})
++
++    @skipUnless(TYPING_3_14_0, "Only supported on 3.14")
++    def test_deferred_evaluation(self):
++        class A(TypedDict):
++            x: NotRequired[undefined]  # noqa: F821
++            y: ReadOnly[undefined]  # noqa: F821
++            z: Required[undefined]  # noqa: F821
++
++        self.assertEqual(A.__required_keys__, frozenset({'y', 'z'}))
++        self.assertEqual(A.__optional_keys__, frozenset({'x'}))
++        self.assertEqual(A.__readonly_keys__, frozenset({'y'}))
++        self.assertEqual(A.__mutable_keys__, frozenset({'x', 'z'}))
++
++        with self.assertRaises(NameError):
++            A.__annotations__
++
++        import annotationlib
++        self.assertEqual(
++            A.__annotate__(annotationlib.Format.STRING),
++            {'x': 'NotRequired[undefined]', 'y': 'ReadOnly[undefined]',
++             'z': 'Required[undefined]'},
++        )
++
++
+ class AnnotatedTests(BaseTestCase):
+ 
+     def test_repr(self):
+@@ -5887,7 +5987,7 @@ class ConcatenateTests(BaseTestCase):
+         U2 = Unpack[Ts]
+         self.assertEqual(C2[U1], (str, int, str))
+         self.assertEqual(C2[U2], (str, Unpack[Ts]))
+-        self.assertEqual(C2["U2"], (str, typing.ForwardRef("U2")))
++        self.assertEqual(C2["U2"], (str, EqualToForwardRef("U2")))
+ 
+         if (3, 12, 0) <= sys.version_info < (3, 12, 4):
+             with self.assertRaises(AssertionError):
+@@ -7196,8 +7296,8 @@ class TypeVarTests(BaseTestCase):
+             self.assertEqual(X | "x", Union[X, "x"])
+             self.assertEqual("x" | X, Union["x", X])
+             # make sure the order is correct
+-            self.assertEqual(get_args(X | "x"), (X, typing.ForwardRef("x")))
+-            self.assertEqual(get_args("x" | X), (typing.ForwardRef("x"), X))
++            self.assertEqual(get_args(X | "x"), (X, EqualToForwardRef("x")))
++            self.assertEqual(get_args("x" | X), (EqualToForwardRef("x"), X))
+ 
+     def test_union_constrained(self):
+         A = TypeVar('A', str, bytes)
+@@ -8770,7 +8870,7 @@ class TestEvaluateForwardRefs(BaseTestCase):
+             type_params=None,
+             format=Format.FORWARDREF,
+         )
+-        self.assertEqual(evaluated_ref, typing.ForwardRef("doesnotexist2"))
++        self.assertEqual(evaluated_ref, EqualToForwardRef("doesnotexist2"))
+ 
+     def test_evaluate_with_type_params(self):
+         # Use a T name that is not in globals
+@@ -8857,13 +8957,6 @@ class TestEvaluateForwardRefs(BaseTestCase):
+         obj = object()
+         self.assertIs(evaluate_forward_ref(typing.ForwardRef("int"), globals={"int": obj}), obj)
+ 
+-    def test_fwdref_value_is_cached(self):
+-        fr = typing.ForwardRef("hello")
+-        with self.assertRaises(NameError):
+-            evaluate_forward_ref(fr)
+-        self.assertIs(evaluate_forward_ref(fr, globals={"hello": str}), str)
+-        self.assertIs(evaluate_forward_ref(fr), str)
+-
+     @skipUnless(TYPING_3_9_0, "Needs PEP 585 support")
+     def test_fwdref_with_owner(self):
+         self.assertEqual(
+@@ -8908,7 +9001,7 @@ class TestEvaluateForwardRefs(BaseTestCase):
+         self.assertEqual(get_args(evaluated_ref1b), (Y[Tx],))
+ 
+         with self.subTest("nested string of TypeVar"):
+-            evaluated_ref2 = evaluate_forward_ref(typing.ForwardRef("""Y["Y['Tx']"]"""), locals={"Y": Y})
++            evaluated_ref2 = evaluate_forward_ref(typing.ForwardRef("""Y["Y['Tx']"]"""), locals={"Y": Y, "Tx": Tx})
+             self.assertEqual(get_origin(evaluated_ref2), Y)
+             if not TYPING_3_9_0:
+                 self.skipTest("Nested string 'Tx' stays ForwardRef in 3.8")
+diff --git a/src/typing_extensions.py b/src/typing_extensions.py
+index d089d5e..baa6c4f 100644
+--- a/src/typing_extensions.py
++++ b/src/typing_extensions.py
+@@ -13,6 +13,9 @@ import types as _types
+ import typing
+ import warnings
+ 
++if sys.version_info >= (3, 14):
++    import annotationlib
++
+ __all__ = [
+     # Super-special typing primitives.
+     'Any',
+@@ -1014,21 +1017,31 @@ else:
+                 tp_dict.__orig_bases__ = bases
+ 
+             annotations = {}
++            own_annotate = None
+             if "__annotations__" in ns:
+                 own_annotations = ns["__annotations__"]
+-            elif "__annotate__" in ns:
+-                # TODO: Use inspect.VALUE here, and make the annotations lazily evaluated
+-                own_annotations = ns["__annotate__"](1)
++            elif sys.version_info >= (3, 14):
++                if hasattr(annotationlib, "get_annotate_from_class_namespace"):
++                    own_annotate = annotationlib.get_annotate_from_class_namespace(ns)
++                else:
++                    # 3.14.0a7 and earlier
++                    own_annotate = ns.get("__annotate__")
++                if own_annotate is not None:
++                    own_annotations = annotationlib.call_annotate_function(
++                        own_annotate, Format.FORWARDREF, owner=tp_dict
++                    )
++                else:
++                    own_annotations = {}
+             else:
+                 own_annotations = {}
+             msg = "TypedDict('Name', {f0: t0, f1: t1, ...}); each t must be a type"
+             if _TAKES_MODULE:
+-                own_annotations = {
++                own_checked_annotations = {
+                     n: typing._type_check(tp, msg, module=tp_dict.__module__)
+                     for n, tp in own_annotations.items()
+                 }
+             else:
+-                own_annotations = {
++                own_checked_annotations = {
+                     n: typing._type_check(tp, msg)
+                     for n, tp in own_annotations.items()
+                 }
+@@ -1041,7 +1054,8 @@ else:
+             for base in bases:
+                 base_dict = base.__dict__
+ 
+-                annotations.update(base_dict.get('__annotations__', {}))
++                if sys.version_info <= (3, 14):
++                    annotations.update(base_dict.get('__annotations__', {}))
+                 required_keys.update(base_dict.get('__required_keys__', ()))
+                 optional_keys.update(base_dict.get('__optional_keys__', ()))
+                 readonly_keys.update(base_dict.get('__readonly_keys__', ()))
+@@ -1051,8 +1065,8 @@ else:
+             # is retained for backwards compatibility, but only for Python
+             # 3.13 and lower.
+             if (closed and sys.version_info < (3, 14)
+-                       and "__extra_items__" in own_annotations):
+-                annotation_type = own_annotations.pop("__extra_items__")
++                       and "__extra_items__" in own_checked_annotations):
++                annotation_type = own_checked_annotations.pop("__extra_items__")
+                 qualifiers = set(_get_typeddict_qualifiers(annotation_type))
+                 if Required in qualifiers:
+                     raise TypeError(
+@@ -1066,8 +1080,8 @@ else:
+                     )
+                 extra_items_type = annotation_type
+ 
+-            annotations.update(own_annotations)
+-            for annotation_key, annotation_type in own_annotations.items():
++            annotations.update(own_checked_annotations)
++            for annotation_key, annotation_type in own_checked_annotations.items():
+                 qualifiers = set(_get_typeddict_qualifiers(annotation_type))
+ 
+                 if Required in qualifiers:
+@@ -1085,7 +1099,38 @@ else:
+                     mutable_keys.add(annotation_key)
+                     readonly_keys.discard(annotation_key)
+ 
+-            tp_dict.__annotations__ = annotations
++            if sys.version_info >= (3, 14):
++                def __annotate__(format):
++                    annos = {}
++                    for base in bases:
++                        if base is Generic:
++                            continue
++                        base_annotate = base.__annotate__
++                        if base_annotate is None:
++                            continue
++                        base_annos = annotationlib.call_annotate_function(
++                            base.__annotate__, format, owner=base)
++                        annos.update(base_annos)
++                    if own_annotate is not None:
++                        own = annotationlib.call_annotate_function(
++                            own_annotate, format, owner=tp_dict)
++                        if format != Format.STRING:
++                            own = {
++                                n: typing._type_check(tp, msg, module=tp_dict.__module__)
++                                for n, tp in own.items()
++                            }
++                    elif format == Format.STRING:
++                        own = annotationlib.annotations_to_string(own_annotations)
++                    elif format in (Format.FORWARDREF, Format.VALUE):
++                        own = own_checked_annotations
++                    else:
++                        raise NotImplementedError(format)
++                    annos.update(own)
++                    return annos
++
++                tp_dict.__annotate__ = __annotate__
++            else:
++                tp_dict.__annotations__ = annotations
+             tp_dict.__required_keys__ = frozenset(required_keys)
+             tp_dict.__optional_keys__ = frozenset(optional_keys)
+             tp_dict.__readonly_keys__ = frozenset(readonly_keys)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild
similarity index 77%
rename from sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild
index af150e64e6c..68dcf5db0b8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2-r2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -29,6 +29,12 @@ BDEPEND="
 
 distutils_enable_tests unittest
 
+PATCHES=(
+	# https://github.com/python/typing_extensions/pull/566
+	# https://github.com/python/typing_extensions/pull/592
+	"${FILESDIR}/${P}-py314.patch"
+)
+
 python_test() {
 	cd src || die
 	eunittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.14.0_rc1.ebuild
new file mode 100644
index 00000000000..63f6412380a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.14.0_rc1.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
+HOMEPAGE="
+	https://pypi.org/project/typing-extensions/
+	https://github.com/python/typing_extensions/
+"
+
+LICENSE="PSF-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	>=dev-python/flit-core-3.11[${PYTHON_USEDEP}]
+	test? (
+		dev-python/test[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+python_test() {
+	cd src || die
+	eunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
index e4cea1adb89..484a801a568 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/uc-micro-py/uc-micro-py-1.0.3.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
index 64e4b470b6b..3ff57c71646 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=hatchling
-PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_TESTED=( python3_{11..14} pypy3_11 )
 PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
 PYTHON_REQ_USE="ssl(+)"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch b/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch
new file mode 100644
index 00000000000..49dba4e2e57
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/files/wheel-0.45.1-test.patch
@@ -0,0 +1,125 @@
+From 36877e99122e8df90d4aa41d414999857d6d852d Mon Sep 17 00:00:00 2001
+From: shenxianpeng <xianpeng.shen@gmail.com>
+Date: Sun, 16 Mar 2025 01:35:32 +0800
+Subject: [PATCH] Fixed test failures (#651)
+
+---
+ tests/test_bdist_wheel.py            |  4 ++--
+ tests/test_tagopt.py                 | 18 +++++++++---------
+ tests/testdata/unicode.dist/setup.py |  2 +-
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tests/test_bdist_wheel.py b/tests/test_bdist_wheel.py
+index fcb2dfc..21eddd0 100644
+--- a/tests/test_bdist_wheel.py
++++ b/tests/test_bdist_wheel.py
+@@ -79,9 +79,9 @@ def test_no_scripts(wheel_paths):
+ 
+ 
+ def test_unicode_record(wheel_paths):
+-    path = next(path for path in wheel_paths if "unicode.dist" in path)
++    path = next(path for path in wheel_paths if "unicode_dist" in path)
+     with ZipFile(path) as zf:
+-        record = zf.read("unicode.dist-0.1.dist-info/RECORD")
++        record = zf.read("unicode_dist-0.1.dist-info/RECORD")
+ 
+     assert "åäö_日本語.py".encode() in record
+ 
+diff --git a/tests/test_tagopt.py b/tests/test_tagopt.py
+index 5335af4..5733e1a 100644
+--- a/tests/test_tagopt.py
++++ b/tests/test_tagopt.py
+@@ -14,7 +14,7 @@ SETUP_PY = """\
+ from setuptools import setup, Extension
+ 
+ setup(
+-    name="Test",
++    name="test",
+     version="1.0",
+     author_email="author@example.com",
+     py_modules=["test"],
+@@ -63,7 +63,7 @@ def test_default_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -76,7 +76,7 @@ def test_build_number(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name == f"Test-1.0-1-py{sys.version_info[0]}-none-any.whl"
++    assert wheels[0].name == f"test-1.0-1-py{sys.version_info[0]}-none-any.whl"
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -89,7 +89,7 @@ def test_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -101,7 +101,7 @@ def test_universal_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -114,7 +114,7 @@ def test_universal_beats_explicit_tag(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -129,7 +129,7 @@ def test_universal_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -144,7 +144,7 @@ def test_pythontag_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py32-")
++    assert wheels[0].name.startswith("test-1.0-py32-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+@@ -157,7 +157,7 @@ def test_legacy_wheel_section_in_setup_cfg(temp_pkg):
+     assert dist_dir.is_dir()
+     wheels = list(dist_dir.iterdir())
+     assert len(wheels) == 1
+-    assert wheels[0].name.startswith("Test-1.0-py2.py3-")
++    assert wheels[0].name.startswith("test-1.0-py2.py3-")
+     assert wheels[0].suffix == ".whl"
+ 
+ 
+diff --git a/tests/testdata/unicode.dist/setup.py b/tests/testdata/unicode.dist/setup.py
+index ec66d1e..46ef0a1 100644
+--- a/tests/testdata/unicode.dist/setup.py
++++ b/tests/testdata/unicode.dist/setup.py
+@@ -3,7 +3,7 @@ from __future__ import annotations
+ from setuptools import setup
+ 
+ setup(
+-    name="unicode.dist",
++    name="unicode_dist",
+     version="0.1",
+     description="A testing distribution \N{SNOWMAN}",
+     packages=["unicodedist"],
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
index ebf512c733d..7fa0a7ca64b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.45.1.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
@@ -28,14 +28,14 @@ BDEPEND="
 	)
 "
 
-EPYTEST_DESELECT=(
-	# fails if any setuptools plugin imported the module first
-	tests/test_bdist_wheel.py::test_deprecated_import
-)
-
 distutils_enable_tests pytest
 
 src_prepare() {
+	local PATCHES=(
+		# https://github.com/pypa/wheel/pull/651
+		"${FILESDIR}/${P}-test.patch"
+	)
+
 	distutils-r1_src_prepare
 
 	# unbundle packaging
@@ -46,6 +46,17 @@ src_prepare() {
 }
 
 python_test() {
+	local EPYTEST_DESELECT=(
+		# fails if any setuptools plugin imported the module first
+		tests/test_bdist_wheel.py::test_deprecated_import
+
+		# broken by setuptools license changes
+		# upstream removed the tests already
+		tests/test_bdist_wheel.py::test_licenses_default
+		tests/test_bdist_wheel.py::test_licenses_deprecated
+		tests/test_bdist_wheel.py::test_licenses_override
+	)
+
 	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 	epytest
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
index 6a78a190c4f..df1535bef91 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
@@ -3,3 +3,4 @@ DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
 DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
+DIST glib-2.84.2.tar.xz 5617588 BLAKE2B 31592cbeca58f03c138a02b0cd953b6bd2cdcbfa39283241affd1bff439d6376f0420b4b715856963c64903f3646cf89890f709f514a85d93fb3bbe26b99d516 SHA512 430928d7d7a442fc3927ca943f2569035fe8768768a0ebc6720ae1ef152b56fc5f8d4215d21b4828cc2f39a8632c907ed2c52a0c8566da1c533a2e049a1a121f
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.2.ebuild
new file mode 100644
index 00000000000..bb3d561f1bd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.2.ebuild
@@ -0,0 +1,78 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+GNOME_ORG_MODULE="glib"
+PYTHON_COMPAT=( python3_{11..14} )
+PYTHON_REQ_USE="xml(+)"
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_SINGLE_IMPL=1
+
+inherit gnome.org distutils-r1
+
+DESCRIPTION="GDBus code and documentation generator"
+HOMEPAGE="https://www.gtk.org/"
+
+S="${WORKDIR}/glib-${PV}/gio/gdbus-2.0/codegen"
+
+LICENSE="LGPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	>=dev-libs/glib-${PV}
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-libs/libxslt
+	app-text/docbook-xsl-stylesheets
+	>=dev-python/docutils-0.21.1
+"
+
+python_prepare_all() {
+	PATCHES=(
+		"${FILESDIR}/${PN}-2.56.1-sitedir.patch"
+	)
+	distutils-r1_python_prepare_all
+
+	local MAJOR_VERSION=$(ver_cut 1)
+	local MINOR_VERSION=$(ver_cut 2)
+	sed -e 's:@PYTHON@:python:' gdbus-codegen.in > gdbus-codegen || die
+	sed -e "s:@VERSION@:${PV}:" \
+		-e "s:@MAJOR_VERSION@:${MAJOR_VERSION}:" \
+		-e "s:@MINOR_VERSION@:${MINOR_VERSION}:" config.py.in > config.py || die
+	cp "${FILESDIR}/setup.py-2.32.4" setup.py || die "cp failed"
+	sed -e "s/@PV@/${PV}/" -i setup.py || die "sed setup.py failed"
+}
+
+do_xsltproc_command() {
+	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/glib-utils)
+	xsltproc \
+		--nonet \
+		--stringparam man.output.quietly 1 \
+		--stringparam funcsynopsis.style ansi \
+		--stringparam man.th.extra1.suppress 1 \
+		--stringparam man.authors.section.enabled 0 \
+		--stringparam man.copyright.section.enabled 0 \
+		-o "${2}" \
+		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
+		"${1}" || die "manpage generation failed"
+}
+
+src_compile() {
+	distutils-r1_src_compile
+	rst2man \
+		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.rst" \
+		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
+}
+
+src_test() {
+	einfo "Skipping tests. This package is tested by dev-libs/glib"
+	einfo "when merged with FEATURES=test"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all # no-op, but prevents QA warning
+	doman "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
index 6a78a190c4f..df1535bef91 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
@@ -3,3 +3,4 @@ DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
 DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
+DIST glib-2.84.2.tar.xz 5617588 BLAKE2B 31592cbeca58f03c138a02b0cd953b6bd2cdcbfa39283241affd1bff439d6376f0420b4b715856963c64903f3646cf89890f709f514a85d93fb3bbe26b99d516 SHA512 430928d7d7a442fc3927ca943f2569035fe8768768a0ebc6720ae1ef152b56fc5f8d4215d21b4828cc2f39a8632c907ed2c52a0c8566da1c533a2e049a1a121f
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.2.ebuild
new file mode 100644
index 00000000000..a8beae9e148
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.2.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_COMPAT=( python3_{11..14} )
+GNOME_ORG_MODULE="glib"
+
+inherit gnome.org python-single-r1
+
+DESCRIPTION="Build utilities for GLib using projects"
+HOMEPAGE="https://www.gtk.org/"
+
+LICENSE="LGPL-2.1+"
+SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-python/docutils-0.21.1
+"
+
+src_configure() { :; }
+
+do_rst2man_command() {
+	rst2man \
+		--syntax-highlight=none \
+		"${1}" "${2}" || die "manpage generation failed"
+}
+
+src_compile() {
+	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-genmarshal.in > gobject/glib-genmarshal || die
+	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-mkenums.in > gobject/glib-mkenums || die
+	sed -e "s:@GLIB_VERSION@:${PV}:g;s:@PYTHON@:python:g" glib/gtester-report.in > glib/gtester-report || die
+	do_rst2man_command docs/reference/gobject/glib-genmarshal.rst docs/reference/gobject/glib-genmarshal.1
+	do_rst2man_command docs/reference/gobject/glib-mkenums.rst docs/reference/gobject/glib-mkenums.1
+	do_rst2man_command docs/reference/glib/gtester-report.rst docs/reference/glib/gtester-report.1
+}
+
+src_install() {
+	python_fix_shebang gobject/glib-genmarshal
+	python_fix_shebang gobject/glib-mkenums
+	python_fix_shebang glib/gtester-report
+	exeinto /usr/bin
+	doexe gobject/glib-genmarshal
+	doexe gobject/glib-mkenums
+	doexe glib/gtester-report
+	doman docs/reference/gobject/glib-genmarshal.1
+	doman docs/reference/gobject/glib-mkenums.1
+	doman docs/reference/glib/gtester-report.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
index ea3a44b9af9..9b0bed1ea89 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.3.ebuild
@@ -9,7 +9,7 @@ SRC_URI="mirror://gnu/gperf/${P}.tar.gz"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_prepare() {
 	default
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
index c1af23451b1..75ad9a92751 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
@@ -1,2 +1,4 @@
 DIST maturin-1.8.3-vendor.tar.xz 15014308 BLAKE2B 5dec263a5297108e5ac36ca6a05f7013f0bcc1704e8b5038418ac7c17d979dc449e1a06ec3a5b6439498b3473e68765fd2ae69ed671b9d4d9aef8e20f325a1a9 SHA512 106e7d0a013f715e1eb8008d31518317bb7e66c3d429c2972ddcfb457afc89de4359d4d85f19fce50861eff219063e666106e284916290e6cca08e7dd6c54889
 DIST maturin-1.8.3.gh.tar.gz 544455 BLAKE2B 0e0115331a8e23d03b8c96348b505d9573988c1f6fdbf9c179d6c94a0d3aa3d448727babb9d7f6e85ae2bc3f2a8201c7b32dbba894228f0035055662449b1556 SHA512 b4f79df7b099777d6068d2705fd6ca6a79c0a96c77530dcca26fef5d09b39a57feabab9d3871fc5b4760df234955329222dc29a86df5404d880140f1a3736431
+DIST maturin-1.8.6-vendor.tar.xz 15035340 BLAKE2B 0bc4016f460c704ac2be81af27842f65ddec9c69ea6a7c29fc421dc863c629109e4efbb6d87825d05c8d33f9e4803eb63081726a8d6d6dcd710c78ed6bca6f9c SHA512 c338cf375640f75d9b9c0151ea9e4ba99781ec6ca065f39e27020c37ce0505c085844d16426df8597063e1f15a965575150a0b25fe6bfc3841c483a45a80a12d
+DIST maturin-1.8.6.gh.tar.gz 551946 BLAKE2B 4fbeadeb25b69e99286238c9f7b7acb2bdde05242af760a0279664277334831a8cd03db49ddb3a0d528b6acd827d3ee3863e283318270ee53c3710c103c7461f SHA512 2616b3bcdbb96c77a3efeda5a24841675fded9d1299507c64905c94e57af15afa855c329f013a1e36527c2b8de4bf7acfb060e5d2828558da658a7b86d88bf8f
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.6.ebuild
new file mode 100644
index 00000000000..ff22f711934
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.6.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+# rustls+ring is unused, so openssl license can be skipped
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	app-arch/xz-utils
+	ssl? ( dev-libs/openssl:= )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index 899a0fef99f..990a78cd9b1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,7 +1,3 @@
-DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
-DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
-DIST linux-6.13.tar.xz 148523052 BLAKE2B 9f617ecb3f2393b57ba03c654fea62a7213f24c835989f333a1ef29492af551bfa7d9ad786d5ef1484854adc77c7c6af38fb09a72d994d305695f512c325e77f SHA512 1137e6440132b0958f89165440e99208f82b204e7245ae69dc9c808df97d13ce8f58136db92407e0e93394fa7f6283ec7a34597c6e92a5b6d9025e0960357957
 DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
+DIST linux-6.15.tar.xz 151168812 BLAKE2B 465596c6dc053ff3a3966302a906d3edb4f7ee1ef82f8c20b96360196d3414f5b1deeafa67b8340fcdecd3617280ba9b756d7073ad15c707865e256397b4af53 SHA512 d03788ffa8d8ae1b84ef1286bb44a08fc01432e509dfec6cccae5c5a5a47201d378aec2bcd21e6f0bbd1e625b26f47780c06ee9c1cef3775358f98b160923f30
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
-DIST patch-6.11.7.xz 669756 BLAKE2B f2ec79bd337eaa61c7203c00ce61b3e5afa9eee38a3e38e63a7fc9270af86674e5c369ca7ddfe4fa5f79601b1c874af1ce732bd8987529c7db2f2f9ca54ba85b SHA512 031c22e2fa7e1c7808f50dc2120a35d10a0b81d30636c5d19146fe12558999517f132213b72c39a32d8cc2c0e14e16ff64cac63ef97f8be0ebe8e709a3de8156
-DIST patch-6.13.5.xz 459896 BLAKE2B 08f3dc28f8f9cbf561570dc74b1a7070be07f966c442e9a4baf98fc5d7b18ec9d15360911049747ecbc1fe91c3f32188006ce85817caf2ba10925bf9456d76cf SHA512 d1d4b60f6072291624fcab6c630e8cd06795ad84282ad7fd55b1ab288b762a092b8486d2905f1de8e91e7b0e7d6e9a0046bd76d8e7352ff7ab5129e2ef67613b
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.7-r1.ebuild
deleted file mode 100644
index 50b81258992..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.11.7-r1.ebuild
+++ /dev/null
@@ -1,347 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( {16..19} )
-PYTHON_COMPAT=( python3_{10..13} )
-inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
-
-DESCRIPTION="Userland tools for Linux Performance Counters"
-HOMEPAGE="https://perf.wiki.kernel.org/"
-
-LINUX_V="${PV:0:1}.x"
-if [[ ${PV} == *_rc* ]] ; then
-	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
-	PATCH_VERSION=$(ver_cut 1-3)
-	LINUX_PATCH=patch-${PV//_/-}.xz
-	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
-		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
-elif [[ ${PV} == *.*.* ]] ; then
-	# stable-release series
-	LINUX_VER=$(ver_cut 1-2)
-	LINUX_PATCH=patch-${PV}.xz
-	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
-else
-	LINUX_VER=${PV}
-fi
-
-LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
-SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
-
-S_K="${WORKDIR}/linux-${LINUX_VER}"
-S="${S_K}/tools/perf"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~loong ppc ppc64 ~riscv x86 ~amd64-linux ~x86-linux"
-IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 audit babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl python slang systemtap tcmalloc unwind zstd"
-
-REQUIRED_USE="
-	${PYTHON_REQUIRED_USE}
-"
-
-# setuptools (and Python) are always needed even if not building Python bindings
-BDEPEND="
-	${LINUX_PATCH+dev-util/patchutils}
-	${PYTHON_DEPS}
-	>=app-arch/tar-1.34-r2
-	dev-python/setuptools[${PYTHON_USEDEP}]
-	app-alternatives/yacc
-	app-alternatives/lex
-	virtual/pkgconfig
-	doc? (
-		app-text/asciidoc
-		app-text/sgml-common
-		app-text/xmlto
-		sys-process/time
-	)
-"
-
-RDEPEND="
-	audit? ( sys-process/audit )
-	babeltrace? ( dev-util/babeltrace:0/1 )
-	bpf? (
-		dev-libs/libbpf
-		dev-util/bpftool
-		dev-util/pahole
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}=
-			llvm-core/llvm:${LLVM_SLOT}=
-		')
-	)
-	caps? ( sys-libs/libcap )
-	capstone? ( dev-libs/capstone )
-	crypt? ( dev-libs/openssl:= )
-	gtk? ( x11-libs/gtk+:2 )
-	java? ( virtual/jre:* )
-	libpfm? ( dev-libs/libpfm:= )
-	libtraceevent? ( dev-libs/libtraceevent )
-	libtracefs? ( dev-libs/libtracefs )
-	lzma? ( app-arch/xz-utils )
-	numa? ( sys-process/numactl )
-	perl? ( dev-lang/perl:= )
-	python? ( ${PYTHON_DEPS} )
-	slang? ( sys-libs/slang )
-	systemtap? ( dev-debug/systemtap )
-	tcmalloc? ( dev-util/google-perftools )
-	unwind? ( sys-libs/libunwind:= )
-	zstd? ( app-arch/zstd:= )
-	dev-libs/elfutils
-	sys-libs/binutils-libs:=
-	sys-libs/zlib
-	virtual/libcrypt
-"
-
-DEPEND="${RDEPEND}
-	>=sys-kernel/linux-headers-5.10
-	java? ( virtual/jdk )
-"
-
-QA_FLAGS_IGNORED=(
-	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
-	'usr/libexec/perf-core/dlfilters/.*' # plugins
-)
-
-pkg_pretend() {
-	if ! use doc ; then
-		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
-		ewarn "And without man pages, you won't get any --help output for perf and its"
-		ewarn "sub-tools."
-	fi
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		~DEBUG_INFO
-		~FTRACE
-		~FTRACE_SYSCALLS
-		~FUNCTION_TRACER
-		~KALLSYMS
-		~KALLSYMS_ALL
-		~KPROBES
-		~KPROBE_EVENTS
-		~PERF_EVENTS
-		~UPROBES
-		~UPROBE_EVENTS
-	"
-
-	use bpf && llvm-r1_pkg_setup
-	# We enable python unconditionally as libbpf always generates
-	# API headers using python script
-	python_setup
-
-	if use bpf ; then
-		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT"
-	fi
-
-	linux-info_pkg_setup
-}
-
-# src_unpack and src_prepare are copied to dev-util/bpftool since
-# it's building from the same tarball, please keep it in sync with bpftool
-src_unpack() {
-	local paths=(
-		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
-		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
-		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
-		'tools/scripts/*'
-	)
-
-	# We expect the tar implementation to support the -j option (both
-	# GNU tar and libarchive's tar support that).
-	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
-	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
-		"${paths[@]/#/linux-${LINUX_VER}/}" || die
-
-	if [[ -n ${LINUX_PATCH} ]] ; then
-		eshopts_push -o noglob
-		ebegin "Filtering partial source patch"
-		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
-		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
-		eend $? || die "filterdiff failed"
-		test -s ${P}.patch || die "patch is empty?!"
-		eshopts_pop
-	fi
-
-	local a
-	for a in ${A}; do
-		[[ ${a} == ${LINUX_SOURCES} ]] && continue
-		[[ ${a} == ${LINUX_PATCH} ]] && continue
-		unpack ${a}
-	done
-}
-
-src_prepare() {
-	default
-	if [[ -n ${LINUX_PATCH} ]] ; then
-		pushd "${S_K}" >/dev/null || die
-		eapply "${WORKDIR}"/${P}.patch
-		eapply "${FILESDIR}"/perf-6.11.7-annotate.patch
-		popd || die
-	fi
-
-	pushd "${S_K}" >/dev/null || die
-	popd || die
-
-	# Drop some upstream too-developer-oriented flags and fix the
-	# Makefile in general
-	sed -i \
-		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
-		"${S}"/Makefile.perf || die
-	# A few places still use -Werror w/out $(WERROR) protection.
-	sed -i -e 's@-Werror@@' \
-		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
-		"${S_K}"/tools/lib/perf/Makefile || die
-
-	# Avoid the call to make kernelversion
-	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
-	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
-
-	# The code likes to compile local assembly files which lack ELF markings.
-	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
-}
-
-puse() { usex $1 "" 1; }
-perf_make() {
-	# The arch parsing is a bit funky.  The perf tools package is integrated
-	# into the kernel, so it wants an ARCH that looks like the kernel arch,
-	# but it also wants to know about the split value -- i386/x86_64 vs just
-	# x86.  We can get that by telling the func to use an older linux version.
-	# It's kind of a hack, but not that bad ...
-
-	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
-
-	local arch=$(tc-arch-kernel)
-	local java_dir
-	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
-
-	# sync this with the whitelist in tools/perf/Makefile.config
-	local disable_libdw
-	if ! use amd64 && ! use x86 && \
-	   ! use arm && \
-	   ! use arm64 && \
-	   ! use ppc && ! use ppc64 \
-	   ! use s390 && \
-	   ! use riscv && \
-	   ! use loong
-	then
-		disable_libdw=1
-	fi
-
-	# perf directly invokes LD for linking without going through CC, on mips
-	# it is required to specify the emulation.  port of below buildroot patch
-	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
-	local linker="$(tc-getLD)"
-	if use mips
-	then
-		if use big-endian
-		then
-			use abi_mips_n64 && linker+=" -m elf64btsmip"
-			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
-			use abi_mips_o32 && linker+=" -m elf32btsmip"
-		else
-			use abi_mips_n64 && linker+=" -m elf64ltsmip"
-			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
-			use abi_mips_o32 && linker+=" -m elf32ltsmip"
-		fi
-	fi
-
-	# FIXME: NO_CORESIGHT
-	local emakeargs=(
-		V=1 VF=1
-		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
-		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
-		CLANG="${CHOST}-clang"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-		prefix="${EPREFIX}/usr" bindir_relative="bin"
-		tipdir="share/doc/${PF}"
-		EXTRA_CFLAGS="${CFLAGS}"
-		EXTRA_LDFLAGS="${LDFLAGS}"
-		ARCH="${arch}"
-		BUILD_BPF_SKEL=$(usex bpf 1 "") \
-		BUILD_NONDISTRO=1
-		JDIR="${java_dir}"
-		CORESIGHT=
-		GTK2=$(usex gtk 1 "")
-		feature-gtk2-infobar=$(usex gtk 1 "")
-		NO_AUXTRACE=
-		NO_BACKTRACE=
-		NO_CAPSTONE=$(puse capstone)
-		NO_DEMANGLE=
-		NO_JEVENTS=$(puse python)
-		NO_JVMTI=$(puse java)
-		NO_LIBAUDIT=$(puse audit)
-		NO_LIBBABELTRACE=$(puse babeltrace)
-		NO_LIBBIONIC=1
-		NO_LIBBPF=$(puse bpf)
-		NO_LIBCAP=$(puse caps)
-		NO_LIBCRYPTO=$(puse crypt)
-		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
-		NO_LIBELF=
-		NO_LIBLLVM=$(puse bpf)
-		NO_LIBNUMA=$(puse numa)
-		NO_LIBPERL=$(puse perl)
-		NO_LIBPFM4=$(puse libpfm)
-		NO_LIBPYTHON=$(puse python)
-		NO_LIBTRACEEVENT=$(puse libtraceevent)
-		NO_LIBUNWIND=$(puse unwind)
-		NO_LIBZSTD=$(puse zstd)
-		NO_SDT=$(puse systemtap)
-		NO_SHELLCHECK=1
-		NO_SLANG=$(puse slang)
-		NO_LZMA=$(puse lzma)
-		NO_ZLIB=
-		TCMALLOC=$(usex tcmalloc 1 "")
-		WERROR=0
-		DEBUG=$(usex debug 1 "")
-		LIBDIR="/usr/libexec/perf-core"
-		libdir="${EPREFIX}/usr/$(get_libdir)"
-		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
-		"$@"
-	)
-	emake "${emakeargs[@]}"
-}
-
-src_compile() {
-	filter-lto
-
-	perf_make -f Makefile.perf
-	use doc && perf_make -C Documentation man
-}
-
-src_test() {
-	:
-}
-
-src_install() {
-	_install_python_ext() {
-		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
-	}
-
-	perf_make -f Makefile.perf install DESTDIR="${D}"
-
-	if use python; then
-		python_foreach_impl _install_python_ext
-	fi
-
-	if use gtk; then
-		local libdir
-		libdir="$(get_libdir)"
-		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
-		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
-		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
-			"${ED}"/usr/libexec/perf-core || die
-	fi
-
-	dodoc CREDITS
-
-	dodoc *txt Documentation/*.txt
-
-	# perf needs this decompressed to print out tips for users
-	docompress -x /usr/share/doc/${PF}/tips.txt
-
-	if use doc ; then
-		doman Documentation/*.1
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.12-r1.ebuild
deleted file mode 100644
index c8df399468c..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.12-r1.ebuild
+++ /dev/null
@@ -1,351 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( {16..19} )
-PYTHON_COMPAT=( python3_{10..13} python3_13t)
-inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
-
-DESCRIPTION="Userland tools for Linux Performance Counters"
-HOMEPAGE="https://perf.wiki.kernel.org/"
-
-LINUX_V="${PV:0:1}.x"
-if [[ ${PV} == *_rc* ]] ; then
-	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
-	PATCH_VERSION=$(ver_cut 1-3)
-	LINUX_PATCH=patch-${PV//_/-}.xz
-	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
-		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
-elif [[ ${PV} == *.*.* ]] ; then
-	# stable-release series
-	LINUX_VER=$(ver_cut 1-2)
-	LINUX_PATCH=patch-${PV}.xz
-	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
-else
-	LINUX_VER=${PV}
-fi
-
-LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
-SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
-
-S_K="${WORKDIR}/linux-${LINUX_VER}"
-S="${S_K}/tools/perf"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
-IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 audit babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl python slang systemtap tcmalloc unwind zstd"
-
-REQUIRED_USE="
-	${PYTHON_REQUIRED_USE}
-"
-
-# setuptools (and Python) are always needed even if not building Python bindings
-BDEPEND="
-	${LINUX_PATCH+dev-util/patchutils}
-	${PYTHON_DEPS}
-	>=app-arch/tar-1.34-r2
-	dev-python/setuptools[${PYTHON_USEDEP}]
-	app-alternatives/yacc
-	app-alternatives/lex
-	virtual/pkgconfig
-	doc? (
-		app-text/asciidoc
-		app-text/sgml-common
-		app-text/xmlto
-		sys-process/time
-	)
-"
-
-RDEPEND="
-	audit? ( sys-process/audit )
-	babeltrace? ( dev-util/babeltrace:0/1 )
-	bpf? (
-		dev-libs/libbpf
-		dev-util/bpftool
-		dev-util/pahole
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}=
-			llvm-core/llvm:${LLVM_SLOT}=
-		')
-	)
-	caps? ( sys-libs/libcap )
-	capstone? ( dev-libs/capstone )
-	crypt? ( dev-libs/openssl:= )
-	gtk? ( x11-libs/gtk+:2 )
-	java? ( virtual/jre:* )
-	libpfm? ( dev-libs/libpfm:= )
-	libtraceevent? ( dev-libs/libtraceevent )
-	libtracefs? ( dev-libs/libtracefs )
-	lzma? ( app-arch/xz-utils )
-	numa? ( sys-process/numactl )
-	perl? ( dev-lang/perl:= )
-	python? ( ${PYTHON_DEPS} )
-	slang? ( sys-libs/slang )
-	systemtap? ( dev-debug/systemtap )
-	tcmalloc? ( dev-util/google-perftools )
-	unwind? ( sys-libs/libunwind:= )
-	zstd? ( app-arch/zstd:= )
-	dev-libs/elfutils
-	sys-libs/binutils-libs:=
-	sys-libs/zlib
-	virtual/libcrypt
-"
-
-DEPEND="${RDEPEND}
-	>=sys-kernel/linux-headers-5.10
-	java? ( virtual/jdk )
-"
-
-QA_FLAGS_IGNORED=(
-	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
-	'usr/libexec/perf-core/dlfilters/.*' # plugins
-)
-
-pkg_pretend() {
-	if ! use doc ; then
-		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
-		ewarn "And without man pages, you won't get any --help output for perf and its"
-		ewarn "sub-tools."
-	fi
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		~!SCHED_OMIT_FRAME_POINTER
-		~DEBUG_INFO
-		~FRAME_POINTER
-		~FTRACE
-		~FTRACE_SYSCALLS
-		~FUNCTION_TRACER
-		~KALLSYMS
-		~KALLSYMS_ALL
-		~KPROBES
-		~KPROBE_EVENTS
-		~PERF_EVENTS
-		~STACKTRACE
-		~TRACEPOINTS
-		~UPROBES
-		~UPROBE_EVENTS
-	"
-
-	use bpf && llvm-r1_pkg_setup
-	# We enable python unconditionally as libbpf always generates
-	# API headers using python script
-	python_setup
-
-	if use bpf ; then
-		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT ~UNWINDER_FRAME_POINTER"
-	fi
-
-	linux-info_pkg_setup
-}
-
-# src_unpack and src_prepare are copied to dev-util/bpftool since
-# it's building from the same tarball, please keep it in sync with bpftool
-src_unpack() {
-	local paths=(
-		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
-		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
-		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
-		'tools/scripts/*'
-	)
-
-	# We expect the tar implementation to support the -j option (both
-	# GNU tar and libarchive's tar support that).
-	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
-	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
-		"${paths[@]/#/linux-${LINUX_VER}/}" || die
-
-	if [[ -n ${LINUX_PATCH} ]] ; then
-		eshopts_push -o noglob
-		ebegin "Filtering partial source patch"
-		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
-		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
-		eend $? || die "filterdiff failed"
-		test -s ${P}.patch || die "patch is empty?!"
-		eshopts_pop
-	fi
-
-	local a
-	for a in ${A}; do
-		[[ ${a} == ${LINUX_SOURCES} ]] && continue
-		[[ ${a} == ${LINUX_PATCH} ]] && continue
-		unpack ${a}
-	done
-}
-
-src_prepare() {
-	default
-	if [[ -n ${LINUX_PATCH} ]] ; then
-		pushd "${S_K}" >/dev/null || die
-		eapply "${WORKDIR}"/${P}.patch
-		popd || die
-	fi
-
-	pushd "${S_K}" >/dev/null || die
-	# Gentoo patches go here
-	popd || die
-
-	# Drop some upstream too-developer-oriented flags and fix the
-	# Makefile in general
-	sed -i \
-		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
-		"${S}"/Makefile.perf || die
-	# A few places still use -Werror w/out $(WERROR) protection.
-	sed -i -e 's@-Werror@@' \
-		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
-		"${S_K}"/tools/lib/perf/Makefile || die
-
-	# Avoid the call to make kernelversion
-	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
-	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
-
-	# The code likes to compile local assembly files which lack ELF markings.
-	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
-}
-
-puse() { usex $1 "" 1; }
-perf_make() {
-	# The arch parsing is a bit funky.  The perf tools package is integrated
-	# into the kernel, so it wants an ARCH that looks like the kernel arch,
-	# but it also wants to know about the split value -- i386/x86_64 vs just
-	# x86.  We can get that by telling the func to use an older linux version.
-	# It's kind of a hack, but not that bad ...
-
-	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
-
-	local arch=$(tc-arch-kernel)
-	local java_dir
-	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
-
-	# sync this with the whitelist in tools/perf/Makefile.config
-	local disable_libdw
-	if ! use amd64 && ! use x86 && \
-	   ! use arm && \
-	   ! use arm64 && \
-	   ! use ppc && ! use ppc64 \
-	   ! use s390 && \
-	   ! use riscv && \
-	   ! use loong
-	then
-		disable_libdw=1
-	fi
-
-	# perf directly invokes LD for linking without going through CC, on mips
-	# it is required to specify the emulation.  port of below buildroot patch
-	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
-	local linker="$(tc-getLD)"
-	if use mips
-	then
-		if use big-endian
-		then
-			use abi_mips_n64 && linker+=" -m elf64btsmip"
-			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
-			use abi_mips_o32 && linker+=" -m elf32btsmip"
-		else
-			use abi_mips_n64 && linker+=" -m elf64ltsmip"
-			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
-			use abi_mips_o32 && linker+=" -m elf32ltsmip"
-		fi
-	fi
-
-	# FIXME: NO_CORESIGHT
-	local emakeargs=(
-		V=1 VF=1
-		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
-		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
-		CLANG="${CHOST}-clang"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-		prefix="${EPREFIX}/usr" bindir_relative="bin"
-		tipdir="share/doc/${PF}"
-		EXTRA_CFLAGS="${CFLAGS}"
-		EXTRA_LDFLAGS="${LDFLAGS}"
-		ARCH="${arch}"
-		BUILD_BPF_SKEL=$(usex bpf 1 "") \
-		BUILD_NONDISTRO=1
-		JDIR="${java_dir}"
-		CORESIGHT=
-		GTK2=$(usex gtk 1 "")
-		feature-gtk2-infobar=$(usex gtk 1 "")
-		NO_AUXTRACE=
-		NO_BACKTRACE=
-		NO_CAPSTONE=$(puse capstone)
-		NO_DEMANGLE=
-		NO_JEVENTS=$(puse python)
-		NO_JVMTI=$(puse java)
-		NO_LIBAUDIT=$(puse audit)
-		NO_LIBBABELTRACE=$(puse babeltrace)
-		NO_LIBBIONIC=1
-		NO_LIBBPF=$(puse bpf)
-		NO_LIBCAP=$(puse caps)
-		NO_LIBCRYPTO=$(puse crypt)
-		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
-		NO_LIBELF=
-		NO_LIBLLVM=$(puse bpf)
-		NO_LIBNUMA=$(puse numa)
-		NO_LIBPERL=$(puse perl)
-		NO_LIBPFM4=$(puse libpfm)
-		NO_LIBPYTHON=$(puse python)
-		NO_LIBTRACEEVENT=$(puse libtraceevent)
-		NO_LIBUNWIND=$(puse unwind)
-		NO_LIBZSTD=$(puse zstd)
-		NO_SDT=$(puse systemtap)
-		NO_SHELLCHECK=1
-		NO_SLANG=$(puse slang)
-		NO_LZMA=$(puse lzma)
-		NO_ZLIB=
-		TCMALLOC=$(usex tcmalloc 1 "")
-		WERROR=0
-		DEBUG=$(usex debug 1 "")
-		LIBDIR="/usr/libexec/perf-core"
-		libdir="${EPREFIX}/usr/$(get_libdir)"
-		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
-		"$@"
-	)
-	emake "${emakeargs[@]}"
-}
-
-src_compile() {
-	filter-lto
-
-	perf_make -f Makefile.perf
-	use doc && perf_make -C Documentation man
-}
-
-src_test() {
-	:
-}
-
-src_install() {
-	_install_python_ext() {
-		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
-	}
-
-	perf_make -f Makefile.perf install DESTDIR="${D}"
-
-	if use python; then
-		python_foreach_impl _install_python_ext
-	fi
-
-	if use gtk; then
-		local libdir
-		libdir="$(get_libdir)"
-		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
-		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
-		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
-			"${ED}"/usr/libexec/perf-core || die
-	fi
-
-	dodoc CREDITS
-
-	dodoc *txt Documentation/*.txt
-
-	# perf needs this decompressed to print out tips for users
-	docompress -x /usr/share/doc/${PF}/tips.txt
-
-	if use doc ; then
-		doman Documentation/*.1
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.13.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.15.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.13.5.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.15.ebuild
index 1ad4d07300a..6ca04f5fbb6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.13.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.15.ebuild
@@ -3,8 +3,8 @@
 
 EAPI=8
 
-LLVM_COMPAT=( {16..19} )
-PYTHON_COMPAT=( python3_{10..13} python3_13t)
+LLVM_COMPAT=( {18..20} )
+PYTHON_COMPAT=( python3_{10..14} python3_{13,14}t)
 inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
 
 DESCRIPTION="Userland tools for Linux Performance Counters"
@@ -35,7 +35,7 @@ S="${S_K}/tools/perf"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
-IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl +python +slang systemtap tcmalloc unwind zstd"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl +python +slang systemtap tcmalloc unwind"
 
 REQUIRED_USE="
 	${PYTHON_REQUIRED_USE}
@@ -49,6 +49,7 @@ BDEPEND="
 	dev-python/setuptools[${PYTHON_USEDEP}]
 	app-alternatives/yacc
 	app-alternatives/lex
+	sys-apps/which
 	virtual/pkgconfig
 	doc? (
 		app-text/asciidoc
@@ -85,7 +86,7 @@ RDEPEND="
 	systemtap? ( dev-debug/systemtap )
 	tcmalloc? ( dev-util/google-perftools )
 	unwind? ( sys-libs/libunwind:= )
-	zstd? ( app-arch/zstd:= )
+	app-arch/zstd:=
 	dev-libs/elfutils
 	sys-libs/binutils-libs:=
 	sys-libs/zlib
@@ -289,7 +290,6 @@ perf_make() {
 		NO_LIBPYTHON=$(puse python)
 		NO_LIBTRACEEVENT=$(puse libtraceevent)
 		NO_LIBUNWIND=$(puse unwind)
-		NO_LIBZSTD=$(puse zstd)
 		NO_SDT=$(puse systemtap)
 		NO_SHELLCHECK=1
 		NO_SLANG=$(puse slang)
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
index c3a622f7dc0..323d414e1db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.4.3.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/acct-user.eclass b/sdk_container/src/third_party/portage-stable/eclass/acct-user.eclass
index b3bcff7e550..5e34a7efcfb 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/acct-user.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/acct-user.eclass
@@ -1,4 +1,4 @@
-# Copyright 2019-2024 Gentoo Authors
+# Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: acct-user.eclass
@@ -337,10 +337,11 @@ acct-user_pkg_preinst() {
 		return
 	fi
 
+	local groups=( ${_ACCT_USER_GROUPS} )
+
 	if egetent passwd "${ACCT_USER_NAME}" >/dev/null; then
 		elog "User ${ACCT_USER_NAME} already exists"
 	else
-		local groups=( ${_ACCT_USER_GROUPS} )
 		local aux_groups=${groups[*]:1}
 		local opts=(
 			--system
@@ -370,14 +371,30 @@ acct-user_pkg_preinst() {
 
 	if [[ ${_ACCT_USER_HOME} != /dev/null ]]; then
 		# default ownership to user:group
-		if [[ -z ${_ACCT_USER_HOME_OWNER} ]]; then
-			if [[ -n ${ROOT} ]]; then
-				local euid=$(egetent passwd ${ACCT_USER_NAME} | cut -d: -f3)
-				local egid=$(egetent passwd ${ACCT_USER_NAME} | cut -d: -f4)
-				_ACCT_USER_HOME_OWNER=${euid}:${egid}
-			else
-				_ACCT_USER_HOME_OWNER=${ACCT_USER_NAME}:${groups[0]}
+		local user=${ACCT_USER_NAME}
+		local group=${groups[0]}
+		if [[ -n ${ROOT} ]]; then
+			# resolve user:group to uid:gid
+			if [[ ${_ACCT_USER_HOME_OWNER} == *:* ]]; then
+				user=${_ACCT_USER_HOME_OWNER%:*}
+				group=${_ACCT_USER_HOME_OWNER#*:}
+			elif [[ -n ${_ACCT_USER_HOME_OWNER} ]]; then
+				user=${_ACCT_USER_HOME_OWNER}
+				group=
+			fi
+			local euid= egid=
+			if [[ -n ${user} ]]; then
+				euid=$(egetent passwd "${user}" | cut -d: -f3)
+				if [[ -z ${group} ]]; then
+					egid=$(egetent passwd "${user}" | cut -d: -f4)
+				fi
+			fi
+			if [[ -n ${group} ]]; then
+				egid=$(egetent group "${group}" | cut -d: -f3)
 			fi
+			_ACCT_USER_HOME_OWNER=${euid}:${egid}
+		elif [[ -z ${_ACCT_USER_HOME_OWNER} ]]; then
+			_ACCT_USER_HOME_OWNER=${user}:${group}
 		fi
 		# Path might be missing due to INSTALL_MASK, etc.
 		# https://bugs.gentoo.org/691478
diff --git a/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass b/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
index f37b8482781..1866bb5fa62 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/autotools.eclass
@@ -93,7 +93,7 @@ _LATEST_AUTOCONF=( 2.72-r1:2.72 )
 # Do NOT change this variable in your ebuilds!
 # If you want to force a newer minor version, you can specify the correct
 # WANT value by using a colon:  <PV>:<WANT_AUTOMAKE>
-_LATEST_AUTOMAKE=( 1.17-r1:1.17 1.16.5:1.16 )
+_LATEST_AUTOMAKE=( 1.18:1.18 1.17-r1:1.17 )
 
 _automake_atom="dev-build/automake"
 _autoconf_atom="dev-build/autoconf"
@@ -378,7 +378,14 @@ eaclocal() {
 	# See bug #677002
 	if [[ ! -f "${T}"/aclocal/dirlist ]] ; then
 		mkdir "${T}"/aclocal || die
-		cat <<- EOF > "${T}"/aclocal/dirlist || die
+		if [[ "${LIBTOOLIZE:-}" == 'slibtoolize' ]]; then
+			cat <<- EOF > "${T}"/aclocal/dirlist || die
+				${BROOT}/usr/share/slibtool
+				${ESYSROOT}/usr/share/slibtool
+			EOF
+		fi
+
+		cat <<- EOF >> "${T}"/aclocal/dirlist || die
 			${BROOT}/usr/share/aclocal
 			${ESYSROOT}/usr/share/aclocal
 		EOF
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 880e33cd741..62e092b6231 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -134,13 +134,20 @@
 #
 # - sip - sipbuild backend
 #
-# - standalone - standalone build systems without external deps
-#   (used for bootstrapping).
+# - standalone - standalone/local build systems
 #
 # - uv-build - uv-build backend (using dev-python/uv)
 #
-# The variable needs to be set before the inherit line.  The eclass
-# adds appropriate build-time dependencies and verifies the value.
+# The variable needs to be set before the inherit line.  If another
+# value than "standalone" and "no" is used, The eclass adds appropriate
+# build-time dependencies, verifies the value and calls the appropriate
+# modern entry point for the backend.  With DISTUTILS_UPSTREAM_PEP517,
+# this variable can be used to override the upstream build backend.
+#
+# The value of "standalone" indicates that upstream is using a custom,
+# local build backend.  In this mode, the eclass does not add any
+# dependencies, disables build backend verification and uses the exact
+# entry point listed in pyproject.toml.
 #
 # The special value "no" indicates that the package has no build system.
 # This is not equivalent to unset DISTUTILS_USE_PEP517 (legacy mode).
@@ -162,6 +169,12 @@
 # overriden to workaround the eclass check, when it is desirable
 # to build the wheel using other backend than the one used upstream.
 #
+# When using it, ideally it should list the build backend actually used
+# upstream, so the eclass will throw an error if that backend changes
+# (and therefore overrides may need to change as well).  As a special
+# case, setting it to "standalone" disables the check entirely (while
+# still forcing the backend, unlike DISTUTILS_USE_PEP517=standalone).
+#
 # Please note that even in packages using PEP621 metadata, there can
 # be subtle differences between the behavior of different PEP517 build
 # backends, for example regarding finding package files.  When using
@@ -215,7 +228,7 @@
 # This is an optimization that can avoid the overhead of calling into
 # the build system in pure Python packages and packages using the stable
 # Python ABI.
-: ${DISTUTILS_ALLOW_WHEEL_REUSE=1}
+: "${DISTUTILS_ALLOW_WHEEL_REUSE=1}"
 
 # @ECLASS_VARIABLE: BUILD_DIR
 # @OUTPUT_VARIABLE
@@ -1150,11 +1163,23 @@ _distutils-r1_get_backend() {
 		fi
 	fi
 
+	# if DISTUTILS_USE_PEP517 is "standalone", we respect the exact
+	# backend used in pyproject.toml; otherwise we force the backend
+	# based on DISTUTILS_USE_PEP517
 	if [[ ${DISTUTILS_USE_PEP517} == standalone ]]; then
 		echo "${build_backend}"
 		return
 	fi
 
+	# we can output it early, even if we die below
+	echo "$(_distutils-r1_key_to_backend "${DISTUTILS_USE_PEP517}")"
+
+	# skip backend verification if DISTUTILS_UPSTREAM_PEP517
+	# is "standalone"
+	if [[ ${DISTUTILS_UPSTREAM_PEP517} == standalone ]]; then
+		return
+	fi
+
 	# verify that the ebuild correctly specifies the build backend
 	local expected_backend=$(
 		_distutils-r1_key_to_backend \
@@ -1189,8 +1214,6 @@ _distutils-r1_get_backend() {
 			> "${T}"/.distutils_deprecated_backend_warned || die
 		fi
 	fi
-
-	echo "$(_distutils-r1_key_to_backend "${DISTUTILS_USE_PEP517}")"
 }
 
 # @FUNCTION: distutils_wheel_install
@@ -1662,7 +1685,8 @@ distutils-r1_python_install() {
 		# let's explicitly verify these assumptions
 
 		# remove files that we've created explicitly
-		rm "${reg_scriptdir}"/{"${EPYTHON}",python3,python,pyvenv.cfg} || die
+		rm "${reg_scriptdir}"/{"${EPYTHON}",python3,python} || die
+		rm "${reg_scriptdir}"/../pyvenv.cfg || die
 
 		# Automagically do the QA check to avoid issues when bootstrapping
 		# prefix.
@@ -2030,7 +2054,12 @@ _distutils-r1_post_python_compile() {
 		ln -s "${PYTHON}" "${bindir}/${EPYTHON}" || die
 		ln -s "${EPYTHON}" "${bindir}/python3" || die
 		ln -s "${EPYTHON}" "${bindir}/python" || die
-		cat > "${bindir}"/pyvenv.cfg <<-EOF || die
+		# python3.14 changed venv logic so that:
+		# 1) pyvenv.cfg location explicitly determines prefix
+		#    (i.e. we no longer can be put in bin/)
+		# 2) "home =" key must be present
+		cat > "${bindir}"/../pyvenv.cfg <<-EOF || die
+			home = ${EPREFIX}/usr/bin
 			include-system-site-packages = true
 		EOF
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/edo.eclass b/sdk_container/src/third_party/portage-stable/eclass/edo.eclass
index 5fd77a676a8..a308851aca7 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/edo.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/edo.eclass
@@ -1,4 +1,4 @@
-# Copyright 2022-2024 Gentoo Authors
+# Copyright 2022-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: edo.eclass
@@ -36,8 +36,26 @@ _EDO_ECLASS=1
 # Executes a short 'command' with any given arguments and exits on failure
 # unless called under 'nonfatal'.
 edo() {
-	einfo "$@"
-	"$@" || die -n "Failed to run command: $@"
+	# list of special characters taken from sh_contains_shell_metas
+	# in shquote.c (bash-5.2)
+	local a out regex='[] '\''"\|&;()<>!{}*[?^$`]|^[#~]|[=:]~'
+
+	[[ $# -ge 1 ]] || die "edo: at least one argument needed"
+
+	if [[ ${EAPI} = 7 ]]; then
+		# no @Q in bash-4.2
+		out=" $*"
+	else
+		for a; do
+			# quote if (and only if) necessary
+			[[ ${a} =~ ${regex} || ! ${a} =~ ^[[:print:]]+$ ]] && a=${a@Q}
+			out+=" ${a}"
+		done
+	fi
+
+	einfon
+	printf '%s\n' "${out:1}" >&2
+	"$@" || die -n "Failed to run command: ${1}"
 }
 
 # @FUNCTION: edob
diff --git a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
index 85274c91121..f22854c646c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
@@ -46,7 +46,7 @@ setup-allowed-flags() {
 _setup-allowed-flags() {
 	ALLOWED_FLAGS=(
 		-pipe -O '-O[123szg]' '-mcpu=*' '-march=*' '-mtune=*' '-mfpmath=*'
-		-flto '-flto=*' -fno-lto
+		-flto '-flto=*' -fno-lto -ffat-lto-objects
 
 		# Hardening flags
 		'-fstack-protector*'
diff --git a/sdk_container/src/third_party/portage-stable/eclass/linux-mod-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/linux-mod-r1.eclass
index 16c280219ef..786e0fb7961 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/linux-mod-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/linux-mod-r1.eclass
@@ -1259,6 +1259,7 @@ _modules_set_makeargs() {
 		# unrealistic when building modules that often have slow releases,
 		# but note that the kernel will still pass some -Werror=bad-thing
 		CONFIG_WERROR=
+		CONFIG_OBJTOOL_WERROR=
 
 		# these are only needed if using these arguments for installing, lets
 		# eclass handle strip, sign, compress, and depmod (CONFIG_ should
diff --git a/sdk_container/src/third_party/portage-stable/eclass/llvm-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/llvm-utils.eclass
index abe8bb7d7d0..98fc8140841 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/llvm-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/llvm-utils.eclass
@@ -126,10 +126,9 @@ llvm_fix_tool_path() {
 llvm_prepend_path() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	local prefix
-	case ${1--d} in
+	local prefix=${ESYSROOT}
+	case ${1} in
 		-d)
-			prefix=${ESYSROOT}
 			shift
 			;;
 		-b)
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index ef05a58e1b1..a1ca388ab73 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -40,8 +40,8 @@ inherit multiprocessing toolchain-funcs
 # All supported Python implementations, most preferred last.
 _PYTHON_ALL_IMPLS=(
 	pypy3_11
-	python3_13t
-	python3_{11..13}
+	python3_{13..14}t
+	python3_{11..14}
 )
 readonly _PYTHON_ALL_IMPLS
 
@@ -81,7 +81,7 @@ _python_verify_patterns() {
 	local impl pattern
 	for pattern; do
 		case ${pattern} in
-			-[23]|3.[89]|3.1[0-3])
+			-[23]|3.[89]|3.1[0-4])
 				continue
 				;;
 		esac
@@ -137,7 +137,7 @@ _python_set_impls() {
 			# please keep them in sync with _PYTHON_ALL_IMPLS
 			# and _PYTHON_HISTORICAL_IMPLS
 			case ${i} in
-				pypy3_11|python3_9|python3_1[1-3]|python3_13t)
+				pypy3_11|python3_9|python3_1[1-4]|python3_1[3-4]t)
 					;;
 				jython2_7|pypy|pypy1_[89]|pypy2_0|pypy3|python2_[5-7]|python3_[1-9]|python3_10)
 					obsolete+=( "${i}" )
@@ -230,9 +230,7 @@ _python_impl_matches() {
 				fi
 				return 0
 				;;
-			3.10)
-				;;
-			3.8|3.9|3.1[1-3])
+			3.[89]|3.1[0-4])
 				[[ ${impl%t} == python${pattern/./_} || ${impl} == pypy${pattern/./_} ]] &&
 					return 0
 				;;
@@ -626,29 +624,11 @@ python_optimize() {
 	local jobs=$(makeopts_jobs)
 	local d
 	for d; do
-		# make sure to get a nice path without //
-		local instpath=${d#${D}}
-		instpath=/${instpath##/}
-
 		einfo "Optimize Python modules for ${instpath}"
-		case "${EPYTHON}" in
-			python3.8)
-				# both levels of optimization are separate since 3.5
-				"${PYTHON}" -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				"${PYTHON}" -O -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				"${PYTHON}" -OO -m compileall -j "${jobs}" -q -f -d "${instpath}" "${d}"
-				;;
-			python*|pypy3*)
-				# Python 3.9+
-				"${PYTHON}" -m compileall -j "${jobs}" -o 0 -o 1 -o 2 --hardlink-dupes -q -f -d "${instpath}" "${d}"
-				;;
-			pypy|jython2.7)
-				"${PYTHON}" -m compileall -q -f -d "${instpath}" "${d}"
-				;;
-			*)
-				die "${FUNCNAME}: unexpected EPYTHON=${EPYTHON}"
-				;;
-		esac
+		# NB: '-s' makes the path relative, so we need '-p /' to make it
+		# absolute again; https://github.com/python/cpython/issues/133503
+		"${PYTHON}" -m compileall -j "${jobs}" -o 0 -o 1 -o 2 \
+			--hardlink-dupes -q -f -s "${D}" -p / "${d}"
 	done
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
index 2cc0dd7d23d..2ab5b7dfe00 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
@@ -84,7 +84,6 @@ declare -A -g -r _RUST_LLVM_MAP=(
 	["1.76.0"]=17
 	["1.75.0"]=17
 	["1.74.1"]=17
-	["1.71.1"]=16
 )
 
 # @ECLASS_VARIABLE: _RUST_SLOTS_ORDERED
@@ -111,7 +110,6 @@ declare -a -g -r _RUST_SLOTS_ORDERED=(
 	"1.76.0"
 	"1.75.0"
 	"1.74.1"
-	"1.71.1"
 )
 
 # == user control knobs ==
@@ -250,22 +248,25 @@ _rust_set_globals() {
 	local usedep="${RUST_REQ_USE+[${RUST_REQ_USE}]}"
 
 	# If we're not using LLVM, we can just generate a simple Rust dependency
-	# In time we need to implement trivial dependencies
-	# (>=RUST_MIN_VER) where RUST_MAX_VER isnt't set,
-	# however the previous attempt to do this ran into issues
-	# where `emerge ... --keep-going` ate legacy non-slotted
-	# Rust blockers resutling in the non-slotted version never
-	# being removed and breaking builds. #943206 #943143
 	if [[ -z "${RUST_NEEDS_LLVM}" ]]; then
 		rust_dep=( "|| (" )
-		# depend on each slot between RUST_MIN_VER and RUST_MAX_VER; it's a bit specific but
-		# won't hurt as we only ever add newer Rust slots.
-		for slot in "${_RUST_SLOTS[@]}"; do
+		# We can be more flexible if we generate a simpler, open-ended dependency
+		# when we don't have a max version set.
+		if [[ -z "${RUST_MAX_VER}" ]]; then
 			rust_dep+=(
-				"dev-lang/rust-bin:${slot}${usedep}"
-				"dev-lang/rust:${slot}${usedep}"
+				">=dev-lang/rust-bin-${RUST_MIN_VER}:*${usedep}"
+				">=dev-lang/rust-${RUST_MIN_VER}:*${usedep}"
 			)
-		done
+		else
+			# depend on each slot between RUST_MIN_VER and RUST_MAX_VER; it's a bit specific but
+			# won't hurt as we only ever add newer Rust slots.
+			for slot in "${_RUST_SLOTS[@]}"; do
+				rust_dep+=(
+					"dev-lang/rust-bin:${slot}${usedep}"
+					"dev-lang/rust:${slot}${usedep}"
+				)
+			done
+		fi
 		rust_dep+=( ")" )
 		RUST_DEPEND="${rust_dep[*]}"
 	else
diff --git a/sdk_container/src/third_party/portage-stable/eclass/ssl-cert.eclass b/sdk_container/src/third_party/portage-stable/eclass/ssl-cert.eclass
index 240f9f12cc9..bc1e3ab9db5 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/ssl-cert.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/ssl-cert.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: ssl-cert.eclass
@@ -22,6 +22,8 @@ esac
 if [[ -z ${_SSL_CERT_ECLASS} ]]; then
 _SSL_CERT_ECLASS=1
 
+inherit edo
+
 # @ECLASS_VARIABLE: SSL_CERT_MANDATORY
 # @PRE_INHERIT
 # @DESCRIPTION:
@@ -42,10 +44,16 @@ _SSL_CERT_ECLASS=1
 
 if [[ "${SSL_DEPS_SKIP}" == "0" ]]; then
 	if [[ "${SSL_CERT_MANDATORY}" == "0" ]]; then
-		BDEPEND="${SSL_CERT_USE}? ( dev-libs/openssl )"
+		RDEPEND="${SSL_CERT_USE}? ( dev-libs/openssl )"
+		if [[ ${EAPI} != 7 ]]; then
+			IDEPEND="${SSL_CERT_USE}? ( dev-libs/openssl )"
+		fi
 		IUSE="${SSL_CERT_USE}"
 	else
-		BDEPEND="dev-libs/openssl"
+		RDEPEND="dev-libs/openssl"
+		if [[ ${EAPI} != 7 ]]; then
+			IDEPEND="dev-libs/openssl"
+		fi
 	fi
 fi
 
@@ -61,9 +69,6 @@ gen_cnf() {
 	SSL_CONF="${T}/${$}ssl.cnf"
 	# Location of the CA serial file
 	SSL_SERIAL="${T}/${$}ca.ser"
-	# Location of some random files OpenSSL can use: don't use
-	# /dev/u?random here -- doesn't work properly on all platforms
-	SSL_RANDOM="${T}/environment:${T}/eclass-debug.log:/etc/resolv.conf"
 
 	# These can be overridden in the ebuild
 	SSL_DAYS="${SSL_DAYS:-730}"
@@ -125,11 +130,8 @@ get_base() {
 #
 gen_key() {
 	local base=$(get_base "$1")
-	ebegin "Generating ${SSL_BITS} bit RSA key${1:+ for CA}"
-		openssl genrsa -rand "${SSL_RANDOM}" \
-			-out "${base}.key" "${SSL_BITS}" &> /dev/null
-	eend $?
-
+	nonfatal edob -m "Generating ${SSL_BITS} bit RSA key${1:+ for CA}" \
+		openssl genrsa -out "${base}.key" "${SSL_BITS}"
 	return $?
 }
 
@@ -142,11 +144,9 @@ gen_key() {
 #
 gen_csr() {
 	local base=$(get_base "$1")
-	ebegin "Generating Certificate Signing Request${1:+ for CA}"
-	openssl req -config "${SSL_CONF}" -new \
-		-key "${base}.key" -out "${base}.csr" &>/dev/null
-	eend $?
-
+	nonfatal edob -m "Generating Certificate Signing Request${1:+ for CA}" \
+		openssl req -config "${SSL_CONF}" -new \
+			-key "${base}.key" -out "${base}.csr"
 	return $?
 }
 
@@ -162,21 +162,19 @@ gen_csr() {
 gen_crt() {
 	local base=$(get_base "$1")
 	if [ "${1}" ] ; then
-		ebegin "Generating self-signed X.509 Certificate for CA"
-		openssl x509 -extfile "${SSL_CONF}" \
-			-${SSL_MD} \
-			-days ${SSL_DAYS} -req -signkey "${base}.key" \
-			-in "${base}.csr" -out "${base}.crt" &>/dev/null
+		nonfatal edob -m "Generating self-signed X.509 Certificate for CA" \
+			openssl x509 -extfile "${SSL_CONF}" \
+				-${SSL_MD} \
+				-days ${SSL_DAYS} -req -signkey "${base}.key" \
+				-in "${base}.csr" -out "${base}.crt"
 	else
 		local ca=$(get_base 1)
-		ebegin "Generating authority-signed X.509 Certificate"
-		openssl x509 -extfile "${SSL_CONF}" \
-			-days ${SSL_DAYS} -req -CAserial "${SSL_SERIAL}" \
-			-CAkey "${ca}.key" -CA "${ca}.crt" -${SSL_MD} \
-			-in "${base}.csr" -out "${base}.crt" &>/dev/null
+		nonfatal edob -m "Generating authority-signed X.509 Certificate" \
+			openssl x509 -extfile "${SSL_CONF}" \
+				-days ${SSL_DAYS} -req -CAserial "${SSL_SERIAL}" \
+				-CAkey "${ca}.key" -CA "${ca}.crt" -${SSL_MD} \
+				-in "${base}.csr" -out "${base}.crt"
 	fi
-	eend $?
-
 	return $?
 }
 
@@ -212,9 +210,8 @@ install_cert() {
 	fi
 
 	case ${EBUILD_PHASE} in
-	unpack|prepare|configure|compile|test|install)
-		die "install_cert cannot be called in ${EBUILD_PHASE}"
-		;;
+		config|preinst|postinst) ;;
+		*) die "install_cert cannot be called in ${EBUILD_PHASE}" ;;
 	esac
 
 	# Generate a CA environment #164601
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 93d4792af4d..418ca888f14 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -338,7 +338,7 @@ if [[ ${PN} != kgcc64 && ${PN} != gcc-* ]] ; then
 	# and https://rust-gcc.github.io/2023/04/24/gccrs-and-gcc13-release.html for why
 	# it was disabled in 13.
 	tc_version_is_at_least 14.0.0_pre20230423 ${PV} && IUSE+=" rust" TC_FEATURES+=( rust )
-	tc_version_is_at_least 14.2.1_p20241026 ${PV} && IUSE+=" time64"
+	tc_version_is_at_least 13.3.1_p20250522 ${PV} && IUSE+=" time64"
 	tc_version_is_at_least 15.0.0_pre20241124 ${PV} && IUSE+=" libgdiagnostics"
 	tc_version_is_at_least 15.0.1_pre20250316 ${PV} && IUSE+=" cobol"
 fi
@@ -1139,6 +1139,15 @@ toolchain_setup_ada() {
 	! tc-is-cross-compiler && _toolchain_make_gnat_wrappers
 
 	export CC="$(tc-getCC) -specs=${T}/ada.spec"
+
+	if ver_test ${PV} -lt 13 && [[ ${CTARGET} == hppa* ]] ; then
+		# For HPPA, the ada-bootstrap binaries seem to default
+		# to -fstack-protector still (maybe because of cross-building)
+		# so we need to override it for <13 (which ignores -fstack-protector)
+		# as SSP doesn't exist there. The GNAT configure test gets confused
+		# by GCC warning about this otherwise.
+		CC+=" -fno-stack-protector"
+	fi
 }
 
 # @FUNCTION: toolchain_setup_d
@@ -1180,7 +1189,7 @@ toolchain_src_configure() {
 
 	downgrade_arch_flags
 	gcc_do_filter_flags
-	if [[ ${PN} != kgcc64 && ${PN} != gcc-* ]] && tc_version_is_at_least 14.2.1_p20241026 ${PV}; then
+	if [[ ${PN} != kgcc64 && ${PN} != gcc-* ]] && tc_version_is_at_least 13.3.1_p20250522 ${PV}; then
 		append-cppflags "-D_GENTOO_TIME64_FORCE=$(usex time64 1 0)"
 	fi
 
@@ -2680,8 +2689,8 @@ toolchain_src_install() {
 	# Hack for C++ modules
 	if ! is_crosscompile && tc_version_is_at_least 15.0.1_pre20250316 ${PV}; then
 		# PR19266 (bug #948394)
-		sed -i -e "s,\.\./lib/gcc/${CHOST}/${GCCMAJOR}/include/,include/," \
-			"${ED}"/usr/lib/gcc/${CHOST}/${GCCMAJOR}/libstdc++.modules.json || die
+		find "${ED}"/usr/lib/gcc/${CHOST}/${GCCMAJOR} -name libstdc++.modules.json \
+			-exec sed -i -e "s,\"source-path\": \".*gcc/${CHOST}/${GCCMAJOR}/include/,\"source-path\": \"include/," "{}" + || die
 	fi
 
 	# As gcc installs object files built against both ${CHOST} and ${CTARGET}
@@ -2780,6 +2789,8 @@ toolchain_src_install() {
 	# Don't scan .gox files for executable stacks - false positives
 	export QA_EXECSTACK="usr/lib*/go/*/*.gox"
 	export QA_WX_LOAD="usr/lib*/go/*/*.gox"
+	# Workaround bug #793770
+	export QA_PRESTRIPPED="usr/lib*/go/*/*/*.gox"
 
 	# Disable RANDMMAP so PCH works, bug #301299
 	pax-mark -r "${ED}/libexec/gcc/${CTARGET}/${GCC_CONFIG_VER}/cc1"
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Base64 b/sdk_container/src/third_party/portage-stable/licenses/Base64
new file mode 100644
index 00000000000..7ae49b808e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/Base64
@@ -0,0 +1,5 @@
+    Copyright (c) 1999, Bob Withers - bwit@pobox.com
+
+This code may be freely used for any purpose, either personal
+or commercial, provided the authors copyright notice remains
+intact.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/FFT2D b/sdk_container/src/third_party/portage-stable/licenses/FFT2D
new file mode 100644
index 00000000000..83738a418ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/FFT2D
@@ -0,0 +1,5 @@
+Copyright Takuya OOURA, 1996-2001
+
+You may use, copy, modify and distribute this code for any purpose
+(include commercial use) and without fee. Please refer to this package
+when you modify this code.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Ms-PL b/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
index 20919c80537..a5dd3ca5cae 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
+++ b/sdk_container/src/third_party/portage-stable/licenses/Ms-PL
@@ -1,81 +1,65 @@
-                      Microsoft Permissive License (Ms-PL)
-
-    
-
-   This license governs use of the accompanying software. If you use the
-   software, you accept this license. If you do not accept the license, do
-   not use the software.
-
-    
-
-1. Definitions
-
-   The terms "reproduce," "reproduction," "derivative works," and
-   "distribution" have the same meaning here as under U.S. copyright law.
-
-   A "contribution" is the original software, or any additions or changes to
-   the software.
-
-   A "contributor" is any person that distributes its contribution under this
-   license.
-
-    "Licensed patents" are a contributor's patent claims that read directly
-   on its contribution.
-
- 
-
-2. Grant of Rights
-
-   (A) Copyright Grant- Subject to the terms of this license, including the
-   license conditions and limitations in section 3, each contributor grants
-   you a non-exclusive, worldwide, royalty-free copyright license to
-   reproduce its contribution, prepare derivative works of its contribution,
-   and distribute its contribution or any derivative works that you create.
-
-   (B) Patent Grant- Subject to the terms of this license, including the
-   license conditions and limitations in section 3, each contributor grants
-   you a non-exclusive, worldwide, royalty-free license under its licensed
-   patents to make, have made, use, sell, offer for sale, import, and/or
-   otherwise dispose of its contribution in the software or derivative works
-   of the contribution in the software.
-
- 
-
-3. Conditions and Limitations
-
-    (A) No Trademark License- This license does not grant you rights to use
-   any contributors' name, logo, or trademarks.
-
-   (B) If you bring a patent claim against any contributor over patents that
-   you claim are infringed by the software, your patent license from such
-   contributor to the software ends automatically.
-
-   (C) If you distribute any portion of the software, you must retain all
-   copyright, patent, trademark, and attribution notices that are present in
-   the software.
-
-   (D) If you distribute any portion of the software in source code form, you
-   may do so only under this license by including a complete copy of this
-   license with your distribution. If you distribute any portion of the
-   software in compiled or object code form, you may only do so under a
-   license that complies with this license.
-
-   (E) The software is licensed "as-is." You bear the risk of using it. The
-   contributors give no express warranties, guarantees or conditions. You may
-   have additional consumer rights under your local laws which this license
-   cannot change. To the extent permitted under your local laws, the
-   contributors exclude the implied warranties of merchantability, fitness
-   for a particular purpose and non-infringement.
-
-   (F) If you distribute the software or derivative works with programs you
-   develop, you agree to indemnify, defend, and hold harmless all
-   contributors from any claims, including attorneys' fees, related to the
-   distribution or use of your programs.  For clarity, you have no such
-   obligations to a contributor for any claims based solely on the unmodified
-   contributions of that contributor.
-
-    (G) If you make any additions or changes to the original software, you
-   may only distribute them under a new namespace.  In addition, you will
-   clearly identify your changes or additions as your own.
-
-    
+Microsoft Public License (Ms-PL)
+
+This license governs use of the accompanying software. If you use the
+software, you accept this license. If you do not accept the license,
+do not use the software.
+
+ 1. Definitions
+
+    The terms "reproduce," "reproduction," "derivative works," and
+    "distribution" have the same meaning here as under U.S. copyright
+    law.
+
+    A "contribution" is the original software, or any additions or
+    changes to the software.
+
+    A "contributor" is any person that distributes its contribution
+    under this license.
+
+    "Licensed patents" are a contributor's patent claims that read
+    directly on its contribution.
+
+ 2. Grant of Rights
+
+    (A) Copyright Grant- Subject to the terms of this license,
+    including the license conditions and limitations in section 3,
+    each contributor grants you a non-exclusive, worldwide,
+    royalty-free copyright license to reproduce its contribution,
+    prepare derivative works of its contribution, and distribute its
+    contribution or any derivative works that you create.
+
+    (B) Patent Grant- Subject to the terms of this license, including
+    the license conditions and limitations in section 3, each
+    contributor grants you a non-exclusive, worldwide, royalty-free
+    license under its licensed patents to make, have made, use, sell,
+    offer for sale, import, and/or otherwise dispose of its
+    contribution in the software or derivative works of the
+    contribution in the software.
+
+ 3. Conditions and Limitations
+
+    (A) No Trademark License- This license does not grant you rights
+    to use any contributors' name, logo, or trademarks.
+
+    (B) If you bring a patent claim against any contributor over
+    patents that you claim are infringed by the software, your patent
+    license from such contributor to the software ends automatically.
+
+    (C) If you distribute any portion of the software, you must retain
+    all copyright, patent, trademark, and attribution notices that are
+    present in the software.
+
+    (D) If you distribute any portion of the software in source code
+    form, you may do so only under this license by including a
+    complete copy of this license with your distribution. If you
+    distribute any portion of the software in compiled or object code
+    form, you may only do so under a license that complies with this
+    license.
+
+    (E) The software is licensed "as-is." You bear the risk of using
+    it. The contributors give no express warranties, guarantees, or
+    conditions. You may have additional consumer rights under your
+    local laws which this license cannot change. To the extent
+    permitted under your local laws, the contributors exclude the
+    implied warranties of merchantability, fitness for a particular
+    purpose and non-infringement.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2017.06.13 b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2017.06.13
new file mode 100644
index 00000000000..f37c14d1319
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2017.06.13
@@ -0,0 +1,66 @@
+SOFTWARE DEVELOPER KITS, SAMPLES AND TOOLS LICENSE AGREEMENT (with distribution rights)
+
+IMPORTANT - READ BEFORE DOWNLOADING, INSTALLING, COPYING OR USING THE LICENSED SOFTWARE
+READ CAREFULLY: This Software Developer Kits, Samples and Tools License Agreement ("Agreement"), made and entered into as of the time and date of click through action ("Effective Date"), is a legal agreement between you and NVIDIA Corporation ("NVIDIA") and governs the use of the following NVIDIA deliverables to the extent provided to you under this Agreement: API's, source code and header files, data sets and assets (examples include images, textures, models, scenes, videos, native API input/output files), binary software and/or documentation (collectively, "Licensed Software"). By downloading, installing, copying, or otherwise using the Licensed Software, you agree to be bound by the terms of this Agreement. If you do NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT DOWNLOAD, INSTALL, COPY OR USE THE NVIDIA LICENSED SOFTWARE. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE ENTITY TO THIS AGREEMENT, IN WHICH CASE "YOU" WILL MEAN THE ENTITY YOU REPRESENT. IF YOU DON'T HAVE SUCH AUTHORITY, OR IF YOU DON'T ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT, THEN NVIDIA IS UNWILLING TO LICENSE THE LICENSED SOFTWARE TO YOU, AND YOU MAY NOT DOWNLOAD, INSTALL, COPY OR USE IT.
+
+1. LICENSE.
+
+1.1 License Grant. Subject to the terms of this Agreement, NVIDIA hereby grants you a nonexclusive, non-transferable, worldwide, revocable, limited, royalty-free, fully paid-up license during the term of this Agreement to:
+       (i) install, use and reproduce the Licensed Software delivered by NVIDIA plus make modifications and create derivative works of the source code and header files delivered by NVIDIA, provided that the software is executed only in hardware products as specified by NVIDIA in the accompanying documentation (such as release notes) as supported, to develop, test and service your products (each, a "Customer Product") that are interoperable with supported hardware products. If the NVIDIA documentation is silent, the supported hardware consists of certain NVIDIA GPUs; and
+       (ii) incorporate Licensed Software as delivered by NVIDIA (including source code and header files as modified by you) into a Customer Product in binary format only and sub-license and distribute a Customer Product for use by your recipients only in the hardware products specified by NVIDIA as supported, provided that: (a) all such distributions by you or your distribution channels are consistent with the terms of this Agreement; and (b) you must enter into enforceable agreements with your recipients that binds them to terms that are consistent with the terms set forth in this Agreement for their use of the software binaries, including (without limitation) terms relating to the license grant and license restrictions, confidentiality and protection of NVIDIA's intellectual property rights in and to the software you distributed. You are liable for the distribution and the use of distributed software if you failed to comply or enforce the distribution requirements of this Agreement. You agree to notify NVIDIA in writing of any known or suspected use or distribution of the Licensed Software that are not in compliance with the terms of this Agreement.
+
+1.2 Enterprise and Contractor Usage. Under this Agreement you may allow (i) your Enterprise employees, and (ii) individuals who work primarily for your Enterprise on a contractor basis and from your secure network (each a "Contractor") to access and use the Licensed Software pursuant to the terms in Section 1 solely to perform work on your behalf, provided further that with respect to Contractors: (i) you obtain a written agreement from the Contractor which contains terms and obligations with respect to access to or use of Licensed Software no less protective of NVIDIA than those set forth in this Agreement, and (ii) such Contractor's access and use expressly excludes any sublicensing or distribution rights for the Licensed Software. You are responsible for the compliance with the terms and conditions of this Agreement by your Enterprise and Contractors. Any act or omission that if committed by you would constitute a breach of this Agreement shall be deemed to constitute a breach of this Agreement if committed by your Enterprise or Contractors. "Enterprise" means you or any company or legal entity for which you accepted the terms of this Agreement, and their subsidiaries of which your company or legal entity owns more than fifty percent (50%) of the issued and outstanding equity.
+
+1.3 No Support. NVIDIA is under no obligation to provide support for the Licensed Software or to provide any error corrections or updates to the Licensed Software under this Agreement.
+
+1.4 Product Specific Terms. With respect to the Iray Developer Edition Licensed Software, a separate license is required from NVIDIA to enable or use the Iray runtime in any given machine.
+
+1.5 Notification. You are required to notify NVIDIA prior to use of the NVIDIA DesignWorks Licensed Software in a commercial application (including a plug-in to a commercial application). Please send notification by visiting https://developer.nvidia.com/sw-notification and submitting the web form requested information. NVIDIA will request company name, DesignWorks software and version used, platform, commercial application release date, and weblink to product/video. Failure to notify NVIDIA pursuant to this section shall be considered a material breach of this Agreement.
+
+2. LIMITATIONS.
+
+2.1 License Restrictions. Except as expressly authorized in this Agreement, you agree that you will not (nor authorize third parties to): (i) copy and use software that was licensed to you for use in one or more devices in other unlicensed devices (provided that copies solely for backup purposes are allowed); (ii) reverse engineer, decompile, disassemble (except to the extent applicable laws specifically require that such activities be permitted) or attempt to derive the source code, underlying ideas, algorithm or structure of software provided to you in object code form; (iii) sell, transfer, assign, distribute, rent, loan, lease, sublicense or otherwise make available the Licensed Software or its functionality to third parties (a) as an application services provider or service bureau, (b) by operating hosted/virtual system environments, (c) by hosting, time sharing or providing any other type of services, or (d) otherwise by means of the internet; (iv) modify, translate or otherwise create any derivative works of any of the Licensed Software; (v) remove, alter, cover or obscure any proprietary notice that appears on or with the Licensed Software or any copies thereof; (vi) use the Licensed Software, or allow its use, transfer, transmission or export in violation of any applicable export control laws, rules or regulations; (vii) distribute, permit access to, or sublicense the Licensed Software as a stand-alone product; (viii) bypass, disable, circumvent or remove any form of copy protection, encryption, security or digital rights management or authentication mechanism used by NVIDIA in connection with the Licensed Software, or use the Licensed Software together with any authorization code, serial number, or other copy protection device not supplied by NVIDIA directly or through an authorized reseller; (ix) use the Licensed Software for the purpose of developing competing products or technologies or assisting a third party in such activities; (x) use the Licensed Software with any system or application where the use or failure of such system or application can reasonably be expected to threaten or result in personal injury, death, or catastrophic loss including, without limitation, use in connection with any nuclear, avionics, navigation, military, medical, life support or other life critical application ("Critical Applications"), unless the parties have entered into a Critical Applications agreement; (xi) distribute any modification or derivative work you make to the Licensed Software under or by reference to the same name as used by NVIDIA; or (xii) use the Licensed Software in any manner that would cause the Licensed Software to become subject to an Open Source License. Nothing in this Agreement shall be construed to give you a right to use, or otherwise obtain access to, any source code from which the software or any portion thereof is compiled or interpreted. You acknowledge that NVIDIA does not design, test, manufacture or certify the Licensed Software for use in the context of a Critical Application and NVIDIA shall not be liable to you or any third party, in whole or in part, for any claims or damages arising from such use. You agree to defend, indemnify and hold harmless NVIDIA and its affiliates, and their respective employees, contractors, agents, officers and directors, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, fines, restitutions and expenses (including but not limited to attorney's fees and costs incident to establishing the right of indemnification) arising out of or related to you and your Enterprise, and their respective employees, contractors, agents, distributors, resellers, end users, officers and directors use of Licensed Software outside of the scope of this Agreement or any other breach of the terms of this Agreement. "Open Source License" includes, without limitation, a software license that requires as a condition of use, modification, and/or distribution of such software that the software be (x) disclosed or distributed in source code form; (y) be licensed for the purpose of making derivative works; or (z) be redistributable at no charge.
+
+2.2 Third Party License Obligations. You acknowledge and agree that the Licensed Software may include or incorporate third party technology (collectively "Third Party Components"), which is provided for use in or with the software and not otherwise used separately. If the Licensed Software includes or incorporates Third Party Components, then the third-party pass-through terms and conditions ("Third Party Terms") for the particular Third Party Component will be bundled with the software or otherwise made available online as indicated by NVIDIA and will be incorporated by reference into this Agreement. In the event of any conflict between the terms in this Agreement and the Third Party Terms, the Third Party Terms shall govern. Copyright to Third Party Components are held by the copyright holders indicated in the copyright notices indicated in the Third Party Terms.
+
+Audio/Video Encoders and Decoders. You acknowledge and agree that it is your sole responsibility to obtain any additional third party licenses required to make, have made, use, have used, sell, import, and offer for sale your products or services that include or incorporate any Third Party Components and content relating to audio and/or video encoders and decoders from, including but not limited to, Microsoft, Thomson, Fraunhofer IIS, Sisvel S.p.A., MPEG-LA, and Coding Technologies as NVIDIA does not grant to you under this Agreement any necessary patent rights with respect to audio and/or video encoders and decoders.
+
+2.3 Limited Rights. Your rights in the Licensed Software are limited to those expressly granted in Section 1 and no other licenses are granted whether by implication, estoppel or otherwise. NVIDIA reserves all rights, title and interest in and to the Licensed Software not expressly granted under this Agreement.
+
+3. CONFIDENTIALITY. Neither party will use the other party's Confidential Information, except as necessary for the performance of this Agreement, nor will either party disclose such Confidential Information to any third party, except to personnel of NVIDIA and its affiliates, you, your Enterprise, your Enterprise Contractors, and each party's legal and financial advisors that have a need to know such Confidential Information for the performance of this Agreement, provided that each such personnel, employee and Contractor is subject to a written agreement that includes confidentiality obligations consistent with those set forth herein. Each party will use all reasonable efforts to maintain the confidentiality of all of the other party's Confidential Information in its possession or control, but in no event less than the efforts that it ordinarily uses with respect to its own Confidential Information of similar nature and importance. The foregoing obligations will not restrict either party from disclosing the other party's Confidential Information or the terms and conditions of this Agreement as required under applicable securities regulations or pursuant to the order or requirement of a court, administrative agency, or other governmental body, provided that the party required to make such disclosure (i) gives reasonable notice to the other party to enable it to contest such order or requirement prior to its disclosure (whether throu gh protective orders or otherwise), (ii) uses reasonable effort to obtain confidential treatment or similar protection to the fullest extent possible to avoid such public disclosure, and (iii) discloses only the minimum amount of information necessary to comply with such requirements.
+
+"Confidential Information" means the Licensed Software (unless made publicly available by NVIDIA without confidentiality obligations), and any NVIDIA business, marketing, pricing, research and development, know-how, technical, scientific, financial status, proposed new products or other information disclosed by NVIDIA to you which, at the time of disclosure, is designated in writing as confidential or proprietary (or like written designation), or orally identified as confidential or proprietary or is otherwise reasonably identifiable by parties exercising reasonable business judgment as confidential. Confidential Information does not and will not include information that: (i) is or becomes generally known to the public through no fault of or breach of this Agreement by the receiving party; (ii) is rightfully known by the receiving party at the time of disclosure without an obligation of confidentiality; (iii) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (iv) is rightfully obtained by the receiving party from a third party without restriction on use or disclosure.
+
+4. OWNERSHIP.
+
+4.1 Ownership of Licensed Software. The Licensed Software, and the respective intellectual property rights therein, is and will remain the sole and exclusive property of NVIDIA and its licensors, whether the Licensed Software is separate from or combined with any other products or materials. You shall not knowingly engage in any act or omission that would impair NVIDIA's and/or its licensors' intellectual property rights in the Licensed Software or any other materials, information, processes or subject matter proprietary to NVIDIA. NVIDIA's licensors are intended third party beneficiaries with the right to enforce provisions of this Agreement with respect to their Confidential Information and/or intellectual property rights.
+
+4.2 Modifications. You have no obligation to provide your permitted modifications to NVIDIA. You hold all rights, title and interest in and to the modifications to and derivative works of the NVIDIA source code and header files that you create as permitted hereunder, subject to NVIDIA's underlying intellectual property rights in and to the NVIDIA software; provided, however that you grant NVIDIA, its affiliates and their respective customers an irrevocable, perpetual, nonexclusive, worldwide, royalty-free paid-up license to make, have made, use, have used, reproduce, sell, license, distribute, sublicense, transfer and otherwise commercialize modifications and derivative works including (without limitation) with the Licensed Software or other products, technologies or materials.
+
+5. FEEDBACK. You have no obligation to provide Feedback to NVIDIA. However, NVIDIA and/or its affiliates may use and include any Feedback that you provide to improve the Licensed Software or other NVIDIA products, technologies or materials. Accordingly, if you provide Feedback, you agree that NVIDIA and/or its affiliates may at their option, and may permit its licensees, to make, have made, use, have used, reproduce, sell, license, distribute, sublicense, transfer and otherwise commercialize the Feedback in the Licensed Software or in other products, technologies or materials without the payment of any royalties or fees to you. All Feedback becomes the sole property of NVIDIA and may be used in any manner NVIDIA sees fit, and you hereby assign to NVIDIA all of your right, title and interest in and to any Feedback. NVIDIA has no obligation to respond to Feedback or to incorporate Feedback into the Licensed Software. "Feedback" means any and all suggestions, feature requests, comments or other feedback relating to the Licensed Software, including possible enhancements or modifications thereto.
+
+6. NO WARRANTIES. THE LICENSED SOFTWARE IS PROVIDED BY NVIDIA "AS IS" AND "WITH ALL FAULTS," AND NVIDIA EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND OR NATURE, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES OF OPERABILITY, CONDITION, VALUE, ACCURACY OF DATA, OR QUALITY, AS WELL AS ANY WARRANTIES OF MERCHANTABILITY, SYSTEM INTEGRATION, WORKMANSHIP, SUITABILITY, NON-INFRINGEMENT, FITNESS FOR A PARTICULAR PURPOSE, OR THE ABSENCE OF ANY DEFECTS THEREIN, WHETHER LATENT OR PATENT. NO WARRANTY IS MADE BY NVIDIA ON THE BASIS OF TRADE USAGE, COURSE OF DEALING OR COURSE OF TRADE. NVIDIA DOES NOT WARRANT THAT THE LICENSED SOFTWARE WILL MEET YOUR REQUIREMENTS OR THAT THE OPERATION THEREOF WILL BE UNINTERRUPTED OR ERROR- FREE, OR THAT ALL ERRORS WILL BE CORRECTED. YOU ACKNOWLEDGE THAT NVIDIA'S OBLIGATIONS UNDER THIS AGREEMENT ARE FOR THE BENEFIT OF YOU ONLY. Nothing in this warranty section affects any statutory rights of consumers or other recipients to the extent that they cannot be waived or limited by contract under applicable law.
+
+7. LIMITATION OF LIABILITY. TO THE MAXIMUM EXTENT PERMITTED BY LAW NVIDIA OR ITS LICENSORS SHALL NOT BE LIABLE FOR ANY SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR ANY LOST PROFITS, LOSS OF USE, LOSS OF DATA OR LOSS OF GOODWILL), OR THE COSTS OF PROCURING SUBSTITUTE PRODUCTS, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OR PERFORMANCE OF THE LICENSED SOFTWARE, WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED UPON BREACH OF CONTRACT, BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER CAUSE OF ACTION OR THEORY OF LIABILITY. IN NO EVENT WILL NVIDIA'S TOTAL CUMULATIVE LIABILITY UNDER OR ARISING OUT OF THIS AGREEMENT EXCEED THE GREATER OF THE NET AMOUNT NVIDIA RECEIVED FOR YOUR USE OF THE LICENSED SOFTWARE ONE HUNDRED U.S. DOLLARS (US $100). THE NATURE OF THE LIABILITY, THE NUMBER OF CLAIMS OR SUITS OR THE NUMBER OF PARTIES WITHIN YOUR ENTERPRISE THAT ACCEPTED THE TERMS OF THIS AGREEMENT SHALL NOT ENLARGE OR EXTEND THIS LIMIT. THE FOREGOING LIMITATIONS SHALL APPLY REGARDLESS OF WHETHER NVIDIA OR ITS LICENSORS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF WHETHER ANY REMEDY FAILS ITS ESSENTIAL PURPOSE.
+
+8. TERM AND TERMINATION. This Agreement and your licenses hereunder shall become effective upon the Effective Date and shall remain in effect unless and until terminated as follows: (i) automatically if you breach any of the terms of this Agreement; or (ii) by either party upon written notice if the other party becomes the subject of a voluntary or involuntary petition in bankruptcy or any proceeding relating to insolvency, receivership, liquidation or composition for the benefit of creditors, if that petition or proceeding is not dismissed with prejudice within sixty (60) days after filing, or if a party ceases to do business; (iii) by you, upon ceasing to use the Licensed Software provided under this Agreement; or (iv) by NVIDIA upon written notice if you commence or participate in any legal proceeding against NVIDIA, with respect to the Licensed Software that is the subject of the proceeding during the pendency of such legal proceeding. Termination of this Agreement regardless of cause or nature shall be without prejudice to any other rights or remedies of the parties and shall be without liability for any loss or damage occasioned thereby. Upon any expiration or termination of this Agreement (i) you must promptly discontinue use of the Licensed Software, and (ii) you must promptly destroy or return to NVIDIA all copies of the Licensed Software and all portions thereof in your possession or control, and each party will promptly destroy or return to the other all of the other party's Confidential Information within its possession or control, provided that your prior distributions in accordance with this Agreement are not affected by the expiration or termination of this Agreement. Upon written request, you will certify in writing that you have complied with your obligations under this section. Sections 2 through 9 will survive the expiration or termination of this Agreement for any reason.
+
+9. GENERAL.
+
+This Agreement constitutes the entire agreement of the parties with respect to the subject matter hereto and supersedes all prior negotiations, conversations, or discussions between the parties relating to the subject matter hereto, oral or written, and all past dealings or industry custom. Any additional and/or conflicting terms and conditions on purchase order(s) or any other documen ts issued by you are null, void, and invalid. Any amendment or waiver under this Agreement must be in writing and signed by representatives of both parties.
+
+This Agreement and the rights and obligations thereunder may not be assigned by you, in whole or in part, including by merger, consolidation, dissolution, operation of law, or any other manner, without written consent of NVIDIA, and any purported assignment in violation of this provision shall be void and of no effect. NVIDIA may assign, delegate or transfer this Agreement and its rights and obligations hereunder, and if to a non-affiliate you will be notified.
+
+Each party acknowledges and agrees that the other is an independent contractor in the performance of this Agreement, and each party is solely responsible for all of its employees, agents, contractors, and labor costs and expenses arising in connection therewith. The parties are not partners, joint ventures or otherwise affiliated, and neither has any authority to make any statements, representations or commitments of any kind to bind the other party without prior written consent.
+
+Neither party will be responsible for any failure or delay in its performance under this Agreement (except for any payment obligations) to the extent due to causes beyond its reasonable control for so long as such force majeure event continues in effect.
+
+This Agreement will be governed by and construed under the laws of the State of Delaware and the United States without regard to the conflicts of law provisions thereof and without regard to the United Nations Convention on Contracts for the Internationa l Sale of Goods. The parties consent to the personal jurisdiction of the federal and state courts located in Santa Clara County, California. You acknowledge and agree that a breach of any of your promises or agreements contained in this Agreement may result in irreparable and continuing injury to NVIDIA for which monetary damages may not be an adequate remedy and therefore NVIDIA is entitled to seek injunctive relief as well as such other and further relief as may be appropriate. If any court of competent jurisdiction determines that any provision of this Agreement is illegal, invalid or unenforceable, the remaining provisions will remain in full force and effect. Unless otherwise specified, remedies are cumulative.
+
+The Licensed Software has been developed entirely at private expense and is "commercial items" consisting of "commercial computer software" and "commercial computer software documentation" provided with RESTRICTED RIGHTS. Use, duplication or disclosure by the U.S. Government or a U.S. Government subcontractor is subject to the restrictions set forth in this Agreement pursuant to DFARS 227.7202-3(a) or as set forth in subparagraphs (c)(1) and (2) of the Commercial Computer Software - Restricted Rights clause at FAR 52.227-19, as applicable. Contractor/manufacturer is NVIDIA, 2701 San Tomas Expressway, Santa Clara, CA 95050.
+
+You acknowledge that the Licensed Software described under this Agreement is subject to export control under the U.S. Export Administration Regulations (EAR) and economic sanctions regulations administered by the U.S. Department of Treasury's Office of Foreign Assets Control (OFAC). Therefore, you may not export, reexport or transfer in-country the Licensed Software without first obtaining any license or other approval that may be required by BIS and/or OFAC. You are responsible for any violation of the U.S. or other applicable export control or economic sanctions laws, regulations and requirements related to the Licensed Software. By accepting this SLA, you confirm that you are not a resident or citizen of any country currently embargoed by the U.S. and tha t you are not otherwise prohibited from receiving the Licensed Software.
+
+Any notice delivered by NVIDIA to you under this Agreement will be delivered via mail, email or fax. Please direct your legal notices or other correspondence to NVIDIA Corporation, 2701 San Tomas Expressway, Santa Clara, California 95050, United States of America, Attention: Legal Department.
+
+DESIGNWORKS NVIDIA SDKS, SAMPLES AND TOOLS AGREEMENT, DISTRIBUTION RIGHTS (V.13.06.2017)
diff --git a/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2020.10.12 b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2020.10.12
new file mode 100644
index 00000000000..de47586b95e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-SDK-v2020.10.12
@@ -0,0 +1,133 @@
+LICENSE AGREEMENT FOR NVIDIA SOFTWARE DEVELOPMENT KITS
+
+This license agreement, including exhibits attached (“Agreement”) is a legal agreement between you and NVIDIA Corporation (“NVIDIA”) and governs your use of a NVIDIA software development kit (“SDK”).
+
+Each SDK has its own set of software and materials, but here is a description of the types of items that may be included in a SDK: source code, header files, APIs, data sets and assets (examples include images, textures, models, scenes, videos, native API input/output files), binary software, sample code, libraries, utility programs, programming code and documentation.
+
+This Agreement can be accepted only by an adult of legal age of majority in the country in which the SDK is used.
+
+If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have the legal authority to bind the entity to this Agreement, in which case “you” will mean the entity you represent.
+
+If you don’t have the required age or authority to accept this Agreement, or if you don’t accept all the terms and conditions of this Agreement, do not download, install or use the SDK.
+
+You agree to use the SDK only for purposes that are permitted by (a) this Agreement, and (b) any applicable law, regulation or generally accepted practices or guidelines in the relevant jurisdictions.
+
+License.
+
+1.1 Grant
+
+Subject to the terms of this Agreement, NVIDIA hereby grants you a non-exclusive, non-transferable license, without the right to sublicense (except as expressly provided in this Agreement) to:
+
+Install and use the SDK,
+
+Modify and create derivative works of sample source code delivered in the SDK, and
+
+Distribute those portions of the SDK that are identified in this Agreement as distributable, as incorporated in object code format into a software application that meets the distribution requirements indicated in this Agreement.
+
+1.2 Distribution Requirements
+
+These are the distribution requirements for you to exercise the distribution grant:
+
+Your application must have material additional functionality, beyond the included portions of the SDK.
+
+The distributable portions of the SDK shall only be accessed by your application.
+
+The following notice shall be included in modifications and derivative works of sample source code distributed: “This software contains source code provided by NVIDIA Corporation.”
+
+Unless a developer tool is identified in this Agreement as distributable, it is delivered for your internal use only.
+
+The terms under which you distribute your application must be consistent with the terms of this Agreement, including (without limitation) terms relating to the license grant and license restrictions and protection of NVIDIA’s intellectual property rights. Additionally, you agree that you will protect the privacy, security and legal rights of your application users.
+
+You agree to notify NVIDIA in writing of any known or suspected distribution or use of the SDK not in compliance with the requirements of this Agreement, and to enforce the terms of your agreements with respect to distributed SDK.
+
+1.3 Authorized Users
+
+You may allow employees and contractors of your entity or of your subsidiary(ies) to access and use the SDK from your secure network to perform work on your behalf.
+
+If you are an academic institution you may allow users enrolled or employed by the academic institution to access and use the SDK from your secure network.
+
+You are responsible for the compliance with the terms of this Agreement by your authorized users. If you become aware that your authorized users didn’t follow the terms of this Agreement, you agree to take reasonable steps to resolve the non-compliance and prevent new occurrences.
+
+1.4 Pre-Release SDK The SDK versions identified as alpha, beta, preview or otherwise as pre-release, may not be fully functional, may contain errors or design flaws, and may have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercial versions of NVIDIA software and materials. Use of a pre-release SDK may result in unexpected results, loss of data, project delays or other unpredictable damage or loss. You may use a pre-release SDK at your own risk, understanding that pre-release SDKs are not intended for use in production or business-critical systems. NVIDIA may choose not to make available a commercial version of any pre-release SDK. NVIDIA may also choose to abandon development and terminate the availability of a pre-release SDK at any time without liability. 1.5 Updates
+
+NVIDIA may, at its option, make available patches, workarounds or other updates to this SDK. Unless the updates are provided with their separate governing terms, they are deemed part of the SDK licensed to you as provided in this Agreement.
+
+You agree that the form and content of the SDK that NVIDIA provides may change without prior notice to you. While NVIDIA generally maintains compatibility between versions, NVIDIA may in some cases make changes that introduce incompatibilities in future versions of the SDK.
+
+1.6 Third Party Licenses
+
+The SDK may come bundled with, or otherwise include or be distributed with, third-party software licensed by a NVIDIA supplier and/or open source software provided under an open source license. Use of third-party software is subject to the third-party license terms, or in the absence of third-party terms, the terms of this Agreement. Copyright to third party software is held by the copyright holders indicated in the third-party software or license.
+
+1.7 Reservation of Rights
+
+NVIDIA reserves all rights, title and interest in and to the SDK not expressly granted to you under this Agreement.
+
+Limitations.
+
+The following license limitations apply to your use of the SDK:
+
+2.1 You may not reverse engineer, decompile or disassemble, or remove copyright or other proprietary notices from any portion of the SDK or copies of the SDK.
+
+2.2 Except as expressly provided in this Agreement, you may not copy, sell, rent, sublicense, transfer, distribute, modify, or create derivative works of any portion of the SDK. For clarity, you may not distribute or sublicense the SDK as a stand-alone product.
+
+2.3 Unless you have an agreement with NVIDIA for this purpose, you may not indicate that an application created with the SDK is sponsored or endorsed by NVIDIA.
+
+2.4 You may not bypass, disable, or circumvent any encryption, security, digital rights management or authentication mechanism in the SDK.
+
+2.5 You may not use the SDK in any manner that would cause it to become subject to an open source software license. As examples, licenses that require as a condition of use, modification, and/or distribution that the SDK be (i) disclosed or distributed in source code form; (ii) licensed for the purpose of making derivative works; or (iii) redistributable at no charge.
+
+2.6 Unless you have an agreement with NVIDIA for this purpose, you may not use the SDK with any system or application where the use or failure of the system or application can reasonably be expected to threaten or result in personal injury, death, or catastrophic loss. Examples include use in avionics, navigation, military, medical, life support or other life critical applications. NVIDIA does not design, test or manufacture the SDK for these critical uses and NVIDIA shall not be liable to you or any third party, in whole or in part, for any claims or damages arising from such uses.
+
+2.7 You agree to defend, indemnify and hold harmless NVIDIA and its affiliates, and their respective employees, contractors, agents, officers and directors, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, fines, restitutions and expenses (including but not limited to attorney’s fees and costs incident to establishing the right of indemnification) arising out of or related to your use of the SDK outside of the scope of this Agreement, or not in compliance with its terms.
+
+Ownership.
+
+3.1 NVIDIA or its licensors hold all rights, title and interest in and to the SDK and its modifications and derivative works, including their respective intellectual property rights, subject to your rights under Section 3.2. This SDK may include software and materials from NVIDIA’s licensors, and these licensors are intended third party beneficiaries that may enforce this Agreement with respect to their intellectual property rights.
+
+3.2 You hold all rights, title and interest in and to your applications and your derivative works of the sample source code delivered in the SDK, including their respective intellectual property rights, subject to NVIDIA’s rights under section 3.1.
+
+3.3 You may, but don’t have to, provide to NVIDIA suggestions, feature requests or other feedback regarding the SDK, including possible enhancements or modifications to the SDK. For any feedback that you voluntarily provide, you hereby grant NVIDIA and its affiliates a perpetual, non-exclusive, worldwide, irrevocable license to use, reproduce, modify, license, sublicense (through multiple tiers of sublicensees), and distribute (through multiple tiers of distributors) it without the payment of any royalties or fees to you. NVIDIA will use feedback at its choice. NVIDIA is constantly looking for ways to improve its products, so you may send feedback to NVIDIA through the developer portal at https://developer.nvidia.com.
+
+No Warranties.
+
+THE SDK IS PROVIDED BY NVIDIA “AS IS” AND “WITH ALL FAULTS.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, NVIDIA AND ITS AFFILIATES EXPRESSLY DISCLAIM ALL WARRANTIES OF ANY KIND OR NATURE, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, OR THE ABSENCE OF ANY DEFECTS THEREIN, WHETHER LATENT OR PATENT. NO WARRANTY IS MADE ON THE BASIS OF TRADE USAGE, COURSE OF DEALING OR COURSE OF TRADE.
+
+Limitations of Liability.
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, NVIDIA AND ITS AFFILIATES SHALL NOT BE LIABLE FOR ANY SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR ANY LOST PROFITS, LOSS OF USE, LOSS OF DATA OR LOSS OF GOODWILL, OR THE COSTS OF PROCURING SUBSTITUTE PRODUCTS, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OR PERFORMANCE OF THE SDK, WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED UPON BREACH OF CONTRACT, BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER CAUSE OF ACTION OR THEORY OF LIABILITY. IN NO EVENT WILL NVIDIA’S AND ITS AFFILIATES TOTAL CUMULATIVE LIABILITY UNDER OR ARISING OUT OF THIS AGREEMENT EXCEED US$10.00. THE NATURE OF THE LIABILITY OR THE NUMBER OF CLAIMS OR SUITS SHALL NOT ENLARGE OR EXTEND THIS LIMIT.
+
+These exclusions and limitations of liability shall apply regardless if NVIDIA or its affiliates have been advised of the possibility of such damages, and regardless of whether a remedy fails its essential purpose. These exclusions and limitations of liability form an essential basis of the bargain between the parties, and, absent any of these exclusions or limitations of liability, the provisions of this Agreement, including, without limitation, the economic terms, would be substantially different.
+
+Termination.
+
+6.1 This Agreement will continue to apply until terminated by either you or NVIDIA as described below.
+
+6.2 If you want to terminate this Agreement, you may do so by stopping to use the SDK.
+
+6.3 NVIDIA may, at any time, terminate this Agreement if: (i) you fail to comply with any term of this Agreement and the non-compliance is not fixed within thirty (30) days following notice from NVIDIA (or immediately if you violate NVIDIA’s intellectual property rights); (ii) you commence or participate in any legal proceeding against NVIDIA with respect to the SDK; or (iii) NVIDIA decides to no longer provide the SDK in a country or, in NVIDIA’s sole discretion, the continued use of it is no longer commercially viable.
+
+6.4 Upon any termination of this Agreement, you agree to promptly discontinue use of the SDK and destroy all copies in your possession or control. Your prior distributions in accordance with this Agreement are not affected by the termination of this Agreement. Upon written request, you will certify in writing that you have complied with your commitments under this section. Upon any termination of this Agreement all provisions survive except for the licenses granted to you.
+
+General.
+
+If you wish to assign this Agreement or your rights and obligations, including by merger, consolidation, dissolution or operation of law, contact NVIDIA to ask for permission. Any attempted assignment not approved by NVIDIA in writing shall be void and of no effect. NVIDIA may assign, delegate or transfer this Agreement and its rights and obligations, and if to a non-affiliate you will be notified.
+
+You agree to cooperate with NVIDIA and provide reasonably requested information to verify your compliance with this Agreement.
+
+This Agreement will be governed in all respects by the laws of the United States and of the State of Delaware as those laws are applied to contracts entered into and performed entirely within Delaware by Delaware residents, without regard to the conflicts of laws principles. The United Nations Convention on Contracts for the International Sale of Goods is specifically disclaimed. You agree to all terms of this Agreement in the English language.
+
+The state or federal courts residing in Santa Clara County, California shall have exclusive jurisdiction over any dispute or claim arising out of this Agreement. Notwithstanding this, you agree that NVIDIA shall still be allowed to apply for injunctive remedies or an equivalent type of urgent legal relief in any jurisdiction.
+
+If any court of competent jurisdiction determines that any provision of this Agreement is illegal, invalid or unenforceable, such provision will be construed as limited to the extent necessary to be consistent with and fully enforceable under the law and the remaining provisions will remain in full force and effect. Unless otherwise specified, remedies are cumulative.
+
+Each party acknowledges and agrees that the other is an independent contractor in the performance of this Agreement.
+
+The SDK has been developed entirely at private expense and is “commercial items” consisting of “commercial computer software” and “commercial computer software documentation” provided with RESTRICTED RIGHTS. Use, duplication or disclosure by the U.S. Government or a U.S. Government subcontractor is subject to the restrictions in this Agreement pursuant to DFARS 227.7202-3(a) or as set forth in subparagraphs (b)(1) and (2) of the Commercial Computer Software - Restricted Rights clause at FAR 52.227-19, as applicable. Contractor/manufacturer is NVIDIA, 2788 San Tomas Expressway, Santa Clara, CA 95051.
+
+The SDK is subject to United States export laws and regulations. You agree that you will not ship, transfer or export the SDK into any country, or use the SDK in any manner, prohibited by the United States Bureau of Industry and Security or economic sanctions regulations administered by the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC), or any applicable export laws, restrictions or regulations. These laws include restrictions on destinations, end users and end use. By accepting this Agreement, you confirm that you are not a resident or citizen of any country currently embargoed by the U.S. and that you are not otherwise prohibited from receiving the SDK.
+
+Any notice delivered by NVIDIA to you under this Agreement will be delivered via mail, email or fax. You agree that any notices that NVIDIA sends you electronically will satisfy any legal communication requirements. Please direct your legal notices or other correspondence to NVIDIA Corporation, 2788 San Tomas Expressway, Santa Clara, California 95051, United States of America, Attention: Legal Department.
+
+This Agreement and any exhibits incorporated into this Agreement constitute the entire agreement of the parties with respect to the subject matter of this Agreement and supersede all prior negotiations or documentation exchanged between the parties relating to this subject matter. Any additional and/or conflicting terms on documents issued by you are null, void, and invalid. Any amendment or waiver under this Agreement shall be in writing and signed by representatives of both parties.
+
+(v. October 12, 2020)
diff --git a/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-cuSPARSELt-v2020.10.12 b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-cuSPARSELt-v2020.10.12
new file mode 100644
index 00000000000..0549d7301a0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/NVIDIA-cuSPARSELt-v2020.10.12
@@ -0,0 +1,13 @@
+cuSPARSELt SUPPLEMENT TO SOFTWARE LICENSE AGREEMENT FOR NVIDIA SOFTWARE DEVELOPMENT KITS
+
+The terms in this supplement govern your use of the NVIDIA cuSPARSELt SDK under the terms of your license agreement (“Agreement”) as modified by this supplement. Capitalized terms used but not defined below have the meaning assigned to them in the Agreement.
+
+This supplement is an exhibit to the Agreement and is incorporated as an integral part of the Agreement. In the event of conflict between the terms in this supplement and the terms in the Agreement, the terms in this supplement govern.
+
+License Scope. The SDK is licensed for you to develop applications only for use in systems with NVIDIA GPUs.
+
+Distribution. The following portions of the SDK are distributable under the Agreement: the runtimes files ending with .so and .h as part of your application.
+
+Licensing. If the distribution terms in this Agreement are not suitable for your organization, or for any questions regarding this Agreement, please contact NVIDIA at nvidia-compute-license-questions@nvidia.com
+
+(v. October 12, 2020)
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Plex b/sdk_container/src/third_party/portage-stable/licenses/Plex
deleted file mode 100644
index fb6e74a5750..00000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/Plex
+++ /dev/null
@@ -1,54 +0,0 @@
-Revised January 1, 2020
-
-IMPORTANT—PLEASE READ THE FOLLOWING TERMS OF SERVICE (REFERENCED HEREIN AS “TOS”) BEFORE OR WHEN USING THE PLEX WEBSITE, A PLEX SOFTWARE, MOBILE, OR WEB APPLICATION(S), OR ANY RELATED PLEX SERVICE(S) (referenced collectively herein as the “Plex Solution”). PLEX GmbH (“Plex”) IS WILLING TO LICENSE AND PERMIT USE OF THE PLEX SOLUTION SUBJECT AT ALL TIMES TO AGREEMENT WITH THIS TOS. BY USING OR OTHERWISE ACCESSING THE PLEX SOLUTION, YOU ACCEPT AND AGREE TO THIS TOS. IF YOU DO NOT AGREE TO THIS TOS, DO NOT USE THE PLEX SOLUTION.
-
-LICENSE.
-1.1. Plex Solution Overview. For more information regarding the currently available Plex Solution, please click here. The Plex Solution is provided pursuant to this TOS to individual persons (and not entities) residing in the countries or regions where Plex makes available its products and services.
-1.2. General Plex Solution Grant. The Plex Solution is made available by Plex, and this TOS provides to you (identified herein as “you” or a “user” or with “your” (as further described below)) a personal (non-commercial), revocable, limited, non-exclusive, nontransferable, and non-sublicensable license to access and use the Plex Solution (by you and your Authorized Users (as defined below)) conditioned on your continued compliance with this TOS. You may print and download Plex materials and information from the Plex Solution solely for your personal use, provided that all hard copies contain all copyright and other applicable notices contained in (or that are required to be displayed with) such materials and information and that you (or your Authorized User(s)) do not further distribute or disclose such materials and information. The content layout, formatting, and features (or functionality) of and online or remote access processes for the Plex Solution shall be as made available by Plex in its sole discretion. You also acknowledge and agree to the following: (i) Plex has the right to control and direct the means, manner, and method by which the Plex Solution is provided; (ii) Plex may, from time to time, engage independent contractors, consultants, or subcontractors to aid Plex in providing the Plex Solution or use thereof; and (iii) Plex has the right to provide the Plex Solution to others.
-1.3. PMS Software Download(s). Plex may make downloadable software or a mobile application(s) available through or as a part of the Plex Solution for use in connection with your personal media management (“PMS Software”). The right to use the PMS Software is provided as a part of the grant (above) to use the Plex Solution in accordance with this TOS and subject to the following additional obligations. You may only use the PMS Software on a device or hardware that you own or control and as a part of your use of the Plex Solution or other Plex service. You hereby acknowledge that the PMS Software may include or allow integration with certain third-party executable modules that may be subject to additional license terms and conditions. Please click here for more information regarding such modules, but unless otherwise indicated, references to the Plex Solution herein shall include the PMS Software and any integrated third-party executable module(s) that you utilize.
-1.4. Content Available Through the Plex Solution. In connection with the foregoing grant to use the Plex Solution, the Plex Solution allows you to view or otherwise access original Plex or third party Content. “Content” includes, but is not limited to, text, graphics, photos, sounds, audio, and videos in the form of, by way of example and not limitation, news reports, podcasts, videos, and music. The availability of such Content may change and not all Content is available in all formats. Use of the Content is subject to the license grant for the Plex Solution, but in addition, shall remain non-transferable and may be subject to additional license grant terms set by the respective third party licensor(s). Third-party Content displayed or accessible through the Plex Solution is protected by copyright and other intellectual property law and belongs to the respective owner(s) or licensor(s). This TOS does not grant you the right to copy (further), distribute, prepare derivative works, publicly display, or otherwise use any Content. You are expressly prohibited from engaging in or facilitating the unauthorized sharing or distribution of Content.
-1.5. Plex Solution Updates. Plex may, but is not obligated to, update the Plex Solution with updates, upgrades, enhancements, improvements, additions, new or incremental features or functionality of and generally made available through the Plex Solution (as determined by Plex in its sole discretion), or modifications that are provided as part of product support and any other support or maintenance services that Plex provides as part of or otherwise in connection with the Plex Solution (collectively, “Plex Solution Updates”). In some instances, you may be required to consent to or to agree to use and implement an applicable Plex Solution Update in a timely manner, including, without limitation, as a means to protect the Plex Solution from unauthorized use, content, or data. If you decline a Plex Solution Update, you may not be able to use or access the Plex Solution (in whole or in part), and Plex shall have no responsibility or liability for any continued use. Unless otherwise indicated, references to the Plex Solution include any Plex Solution Updates.
-1.6. Support. This TOS does not entitle you to any support or installation service (collectively, “Support”). Any such Support that may be made available by Plex, in its sole discretion, shall be subject to separate terms and conditions with Plex.
-1.7. Authorized User(s). Subject to any third party license restrictions for applicable Content, you may enable members of your immediate family and for whom you will be responsible (each, an “Authorized User(s)”) to access and use the Plex Solution so long as all such use remains in compliance with this TOS. Nevertheless, you acknowledge and agree that you shall be responsible for monitoring your own and your Authorized User(s)’s use of the Plex Solution and for maintaining compliance with this TOS and any third party license restrictions for applicable Content. Any breach of this TOS by an Authorized User(s) shall constitute a breach by you. Unless otherwise indicated, references to “you” or “your” throughout this TOS therefore mean you, your Authorized User(s), and the person or entity named on your account with Plex.
-LICENSE GRANT RESTRICTIONS. This TOS is only a license and not an assignment or sale. Plex transfers no ownership or intellectual property interest or title in and to the Plex Solution to you or anyone else. Further, Plex reserves all rights not expressly granted by this TOS. Accordingly, you may not modify, translate, decompile, create derivative work(s) of, copy, distribute, disassemble, broadcast, transmit, publish, remove or alter any proprietary notices or labels, license, sublicense (other than to an Authorized User(s)), transfer, sell, mirror, frame, exploit, rent, lease, private label, grant a security interest in, or otherwise use in any manner not expressly permitted herein (or by Plex) the Plex Solution. In particular, and without limitation of the foregoing, there is no right to distribute further the PMS Software to the public or in excess of the limited license (above). Moreover, this TOS does not grant any right to modify the PMS Software or provide a right or license in or to any third-party executable module(s) or accessible content beyond the limited and express grant herein.
-INTERFACING SOFTWARE. “Interfacing Software” means any software that you obtain or provide and that accesses or calls any PMS Software provided by Plex as part of the Plex Solution including, but not limited to, plug-ins for the Plex Solution, channel plug-ins, metadata agents, and client applications that communicate directly or indirectly with the Plex Solution. You are responsible and liable for any Interfacing Software, including any data collection that may be undertaken or occur through the Interfacing Software. Plex encourages the implementation and adherence of data collection and use practices substantially similar to those articulated in the privacy policy of Plex (identified below). By making, or assisting others in making, available any Interfacing Software, you hereby grant Plex a worldwide, non-exclusive, and royalty-free right and license to use (including testing, hosting, and linking to), copy, publicly perform, publicly display (including screenshots), reproduce in copies for distribution, market or promote (as a part of the Plex Solution or other services of Plex), and distribute the copies of any Interfacing Software (or its associated name). In connection therewith, you hereby agree to provide and include (or link to) a privacy notice summarizing practices consistent with the privacy policy of Plex noted below and include in the source code of the Interfacing Software a copyright notice of the form: Copyright © <year> <copyright holders>. Any data collection by Plex shall be in a manner consistent with Plex’s privacy policy (noted below). Subject to the inclusion by Plex of this notice (if first provided to Plex by you), you grant, and authorize Plex to grant on your behalf, if necessary, a license, free of charge, to any person obtaining a copy of the Interfacing Software and associated documentation files from Plex, to deal in the Interfacing Software without restriction, including, without limitation, the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Interfacing Software, and to permit persons to whom the Interfacing Software is furnished to do so. You represent and warrant that you have all rights necessary to make the foregoing grants, and you further agree that you will use and integrate the Interfacing Software in a manner consistent with acceptable use of the Plex Solution pursuant to this TOS. You may notify us (please click here) if you do not wish for Plex to use the Interfacing Software that was created by and is owned by you. Any such notification must include all requested information and representations (as indicated by Plex). Plex will comply with such a proper request and cease its own use of the Interfacing Software, but Plex must be granted a transition period of at least thirty (30) days after receipt of the request to comply. Plex, however, shall not be obligated to confirm removal or cessation of the Interfacing Software by you or others (including Authorized Users) outside its control.
-GENERAL USER OBLIGATIONS. You represent that you are at least eighteen (18) years of age (or the legal age of majority, whichever is greater) and will, at all times, provide true, accurate, current, and complete information when submitting information or materials on or through the Plex Solution, including, without limitation, when you provide information via a Plex Solution registration, account, or submission form. You are responsible for completing any registration(s) or account requirements for access to applicable third party Content available through the Plex Solution. Individuals under the age of eighteen (18) (or the applicable age of majority) may utilize the Plex Solution only with the involvement and acceptance of (this TOS by) a parent or legal guardian and then solely as an Authorized User under a parent or legal guardian’s account. You further represent that you (or the person agreeing to, accepting, or acting under this TOS) are authorized to act on behalf of the person or entity named on the account with Plex. In addition, you agree to abide by all applicable local, state, national, and international laws and regulations with respect to your use of the Plex Solution. In particular, you may not take any action that will infringe on the intellectual property rights of Plex or any other third party. You acknowledge that unauthorized use of copyrighted content of others may subject you to civil and criminal penalties, including possible monetary damages, for copyright infringement. You also acknowledge and agree that use of the Internet and the Plex Solution is solely at your own risk. You further understand that by using the Plex Solution you may encounter content that you may find offensive, indecent, or objectionable. You assume all responsibility for obtaining and paying for all licenses and costs for third-party software and hardware necessary for access to the Plex Solution, and for maintaining and backing-up your content and data.
-USER CONTENT & ACCEPTABLE USE. The Plex Solution enables you to access content, data, communication, and other interactive features and functionality (with such uploaded, downloaded, shared, or exchanged information or content referenced collectively herein as a “User Content”). Distribution of User Content may be subject to third-party rights. You agree that by using the Plex Solution you will not upload, post, display, or transmit any of the following:
-anything which defames, harasses, threatens, offends, or in any way violates or infringes on the rights (including, without limitation, patents, copyrights, or trademark rights) of others;
-anything which may damage, lessen, or harm the goodwill or reputation of Plex and its services;
-anything which involves the impersonation of any other person or entity;
-anything which constitutes viral or harmful programming code, files, or software;
-anything which constitutes junk mail, spam, or unauthorized advertising; or
-anything which is unlawful.
-Plex reserves the right to establish additional practices, parameters, and limits in its sole discretion concerning the display or availability of any User Content. Further, Plex shall not have any obligation to incorporate or utilize any User Content that does not correspond to or meet Plex’s technical or usage practices, parameters, and limits.
-
-PERMISSION TO USE USER CONTENT. You continue to retain any ownership rights you have in the User Content you make available to Plex and/or the Plex Solution. However, by submitting or making available any type of User Content, you automatically and hereby grant to Plex a royalty-free, transferable, sub-licensable and non-exclusive right and license to use or act on any such User Content in furtherance of and in connection with the operation of the Plex Solution. The rights you grant are limited to the purpose of providing and operating the Plex Solution. You specifically acknowledge that the Plex Solution facilitates distribution of the User Content, and as a part of the foregoing grant, you permit any user with whom you share content a non-exclusive license to access and use the User Content through the Plex Solution as permitted through the functionality of the Plex Solution. You represent that you have all necessary rights to make the foregoing grants and to otherwise make User Content(s) available to Plex and for (and through) the Plex Solution.
-NO PRE-SCREENING OF USER CONTENT; REMOVAL. Plex is not responsible for pre-screening or editing your or any other user’s User Content, support forum posts, or any other communications and encourages all of its users to use reasonable discretion and caution in evaluating or reviewing any such content or communications. Moreover, Plex does not endorse, oppose, or edit any opinion or information provided by you or another user (unless separately and expressly provided by Plex) and does not make any representation with respect to, nor does it endorse the accuracy, integrity, quality, acceptability, completeness, timeliness, lawfulness, suitability, or reliability of any User Content or communications displayed, uploaded, or distributed by you or any other user. You also acknowledge that Plex has no control over the extent to which any idea, content, or information may be used by any party or person once it’s posted, shared, or displayed. Nevertheless, Plex reserves the right to take any action within its control with respect to User Content (or parts thereof), support forum posts, or any other communications that Plex reasonably believes is necessary to: (i) satisfy any applicable law, regulation, legal process or governmental request; (ii) enforce this TOS, including investigation of potential violations hereof; (iii) detect, prevent, or otherwise address fraud, security, or technical issues; (iv) respond to user support requests; (v) protect the rights, property, or safety of Plex, its users, or the public; or (vi) address any act or omission that Plex believes in good faith violates this TOS and/or is, or is potentially, unlawful or harmful to Plex, its services, or goodwill.
-ACCOUNT. You may be required to provide certain personal information necessary to create an account with Plex. You may be required to create login credentials, such as a user name and password, or adhere to other particular access requirements as designated by Plex in its sole discretion from time to time. You are solely responsible for the activity that occurs on your account and agree to keep your login credentials confidential and secure. You acknowledge that Plex may not provide controls that restrict the maturity level of content available through the Plex Solution. If you allow your child (under the age of 18 or the legal age of majority, whichever is greater) to access your Plex account, you are solely responsible for monitoring your child’s use of the Plex Solution and determining what maturity level is appropriate for or accessible to your child. You shall immediately notify Plex if you suspect or become aware of any loss or theft of or unauthorized use of your access credentials.
-SUBSCRIPTION & SALES.
-9.1. Subscription. Plex currently offers access to the Plex Solution at no cost. However, Plex may make available fee-based subscription offering(s). Please click here for more information. The subscription cost, subscription term, available trial period (if any), renewal information, and permitted payment methods will be specified at the time of order. All subscriptions are billed immediately in advance and are final unless otherwise indicated by Plex or as may be required under applicable law. There will be no refunds or credits for partial months, upgrades/downgrades, or nonuse.
-9.2. Subscription Changes & Renewal. Subscription fees are subject to change (with prior notice) and shall apply to the upcoming renewal period (if any) as indicated. Such notice may be provided by email or by posting the changes to your Plex account, the Plex website, or through the Plex Solution. When you enroll in any recurring subscription arrangement, you authorize Plex to automatically charge the billing source you provided Plex at the time you enrolled for the subscription term specified (at the time of enrollment) until the subscription ends or you cancel your enrollment. To avoid being charged for the next renewal period, you must cancel at least one (1) day prior to the end of the then-current Plex subscription term. You may cancel by clicking here. For any change (upgrade or downgrade) in your subscription that you make or request, your fee and method of payment will be automatically adjusted and charged (as applicable) at the new rate on your next billing cycle. Downgrading your subscription may cause the loss of content, features, or capacity of your account.
-9.3. Payment. Plex shall charge and you shall be responsible for payment of all taxes, tariffs, levies, or duties (except that Plex does collect VAT in certain countries). Unless otherwise indicated by Plex in writing, all amounts are immediately due and payable upon order (or renewal). Upon placing an order, you therefore agree to pay using the payment method indicated and grant authorization to Plex to charge the applicable (fee) to your payment provider. All transactions, however, are void where prohibited by law and Plex may request particular information in order to confirm the order and method of payment. Plex also reserves the right to terminate or suspend access to the Plex Solution if you fail to pay any amounts when due. Unless otherwise specified herein, all obligations with respect to the amounts due to Plex under the TOS shall survive any expiration or termination of the TOS.
-PROPRIETARY RIGHTS. The Plex Solution is owned by Plex GmbH or its licensor(s). Copyright 2016-2018 © Plex GmbH and/or its licensor(s). All rights reserved. All content available through the Plex Solution, unless otherwise indicated, is protected by copyright, trade secret, or other intellectual property laws. PLEX, the Plex logo, and all other names, logos, and icons identifying Plex and its solutions, products, and services are proprietary trademarks of Plex, and any use of such marks without the express written permission of Plex is strictly prohibited. Please see the Plex Trademarks and Guidelines policy statement available here for more information regarding the trademarks or service marks of Plex. Other service, product, or company names mentioned herein may be the trademarks and/or service marks of their respective owners.
-THIRD-PARTY CONTENT. Third-party content displayed or accessible through the Plex Solution is protected by copyright and other intellectual property law and belongs to the respective owner. Use of the third-party content is subject to the terms of use of the third party providing such content. This TOS does not grant you the right to copy, distribute, prepare derivative works, publicly display, or otherwise use any third-party content. You are expressly prohibited from engaging in or facilitating the unauthorized sharing or distribution of third-party content.
-CONFIDENTIALITY. You acknowledge and agree that the Plex Solution contains confidential or nonpublic information that is the trade secret(s) of Plex and/or its licensors (the “Confidential Information”). You agree to secure and protect the confidentiality of the Confidential Information of Plex (and/or its licensors) in a manner consistent with the maintenance of Plex’s rights therein, using at least as great a degree of care as you use to maintain the confidentiality of your own confidential information of a similar nature, but in no event using less than reasonable efforts. You shall not, nor permit any third party to, sell, transfer, publish, disclose, or otherwise make available any portion of the Confidential Information to third parties, except as expressly authorized in this TOS.
-FEEDBACK. Plex welcomes your feedback and suggestions about Plex’s products or services or with respect to how to improve the Plex Solution. By transmitting any suggestions, information, material, or other content (collectively, “Feedback”) to Plex, you represent and warrant that such Feedback does not infringe or violate the intellectual property or proprietary rights of any third party (including, without limitation, patents, copyrights, or trademark rights) and that you have all rights necessary to convey to Plex and enable Plex to use such Feedback. In addition, any Feedback received by Plex will be deemed to include a royalty-free, perpetual, irrevocable, transferable, non-exclusive right and license from you for Plex to adopt, publish, reproduce, disseminate, transmit, distribute, copy, use, create derivative works of, and display (in whole or in part) worldwide, or act on such Feedback without additional approval or consideration, in any form, media, or technology now known or later developed for the full term of any rights that may exist therein, and you hereby waive any claim to the contrary.
-MOBILE USAGE. The Plex Solution offers a tool(s) or display functionality that is available to you via your mobile phone or other mobile computing device (“Mobile Plex Solution(s)”). Please note that your mobile carrier’s normal messaging, data, and other rates and fees will apply to your use of the Mobile Plex Solution(s). In addition, downloading, installing, or using certain Mobile Plex Solution(s) may be prohibited or restricted by your mobile carrier, and not all Mobile Plex Solution(s) may work with all carriers or devices or in all locations. Therefore, you are solely responsible for checking with your mobile carrier to determine if the Mobile Plex Solution(s) are available for your mobile devices; what restrictions, if any, may be applicable to your use of the Mobile Plex Solution(s); and how much such use will cost you. Nevertheless, your use of the Plex Solution shall be strictly in accordance with this TOS.
-LINKS TO OTHER SITES OR APPLICATIONS. Plex may provide links, in its sole discretion, to other sites or applications on the Internet, including to the Plex Store. Such other sites are maintained by third parties over which Plex exercises no control. These links do not imply an endorsement with respect to any third party or any third-party web site or the information, products, or services provided by any third party. Plex encourages review of the applicable terms, conditions or notices governing use of these third party sites or applications.
-THIRD-PARTY PLATFORMS & NETWORKS. Certain features allow you to synchronize your content across third-party platforms and networks. These features will enhance the performance of the Plex Solution and allow you to better integrate and harmonize the Plex Solution with information stored on or used with third-party networks. Using this functionality typically requires you to login to your account on the third-party service, and you do so at your own risk. You should always review, and if necessary, adjust your privacy settings on these networks and platforms before linking or connecting them to the Plex Solution. You expressly acknowledge and agree that Plex is in no way responsible or liable for any such third-party services or features.
-ADDITIONAL TERMS AND CONDITIONS.Additional notices, terms, and conditions may apply to certain subscription arrangements (including sign-up or registration), Plex products, solutions, or services, receipt of (or access to) certain content, participation in a particular program, and/or to specific portions or features of the Plex Solution. Without limitation of the foregoing, you hereby agree that (a) this TOS operates in addition to any terms of use imposed or required by any digital download platform from which you download the Plex Solution (“App Provider Terms”); and (b) the terms of this TOS supplement and do not alter or amend any such App Provider Terms.
-PRIVACY POLICY. Please see Plex’s Privacy Policy for a summary of Plex’s personally identifiable information collection and use practices. Plex is not responsible for your use of Interfacing Software or of and any data collection or related usage practices associated with your operation or maintenance of any Interfacing Software. You further agree that any notices, agreements, disclosures, or other communications that Plex sends you electronically (using the contact information you provide through the Plex Solution) will satisfy any legal communication requirements.
-REPRESENTATION(S). You represent and warrant that (i) the person accepting this TOS has the legal authority to bind the named person on the account, and (ii) he or she has the right, power, and authority to (a) enter into this TOS, (b) make the respective and applicable representations and warranties contained herein, and (c) commit to and perform the respective duties, obligations, and covenants set forth hereunder.
-DISCLAIMER. THE PLEX SOLUTION IS PROVIDED ON AN “AS-IS” AND “AS AVAILABLE” BASIS AND MAY INCLUDE ERRORS, OMISSIONS, OR OTHER INACCURACIES. PLEX MAY MAKE MODIFICATIONS AND/OR CHANGES IN THE PLEX SOLUTION AT ANY TIME AND FOR ANY REASON. OTHER THAN THE RIGHT TO FULFILL ITS OBLIGATIONS UNDER THIS TOS, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PLEX EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF INTERFERENCE WITH ENJOYMENT OF INFORMATION, SECURITY, NON-INFRINGEMENT, MERCHANTABILITY, QUALITY, OR FITNESS FOR A PARTICULAR PURPOSE. MOREOVER, YOU ACKNOWLEDGE AND AGREE THAT PLEX DOES NOT WARRANT THAT THE PLEX SOLUTION WILL OPERATE FREE OF VIRUSES, MALWARE, OR HARMFUL PROGRAMMING SOFTWARE (OR CODE), ERROR-FREE, UNINTERRUPTED, OR IN A MANNER THAT WILL MEET YOUR REQUIREMENTS OR MEET ANY LEGAL, TECHNICAL, OR CERTIFICATION STANDARD. BECAUSE THE PLEX SOLUTION IS BASED ON YOUR CONTENT AND DATA, THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PLEX SOLUTION IS WITH YOU. IF THIS DISCLAIMER OF WARRANTY IS HELD TO BE UNENFORCEABLE BY A COURT OF COMPETENT JURISDICTION IN ANY MANNER, THEN ALL EXPRESS AND/OR IMPLIED WARRANTIES MANDATED BY SUCH COURT SHALL BE LIMITED IN DURATION TO A PERIOD OF THIRTY (30) DAYS FROM THE COMMENCEMENT OF THE INITIAL PERIOD FOR THE PLEX SOLUTION AND NO WARRANTIES SHALL APPLY AFTER THIS THIRTY (30) DAY PERIOD.
-LIMITATION OF LIABILITY. YOU EXPRESSLY ABSOLVE AND RELEASE PLEX FROM ANY CLAIM OF HARM RESULTING FROM A CAUSE BEYOND PLEX’S CONTROL, INCLUDING, WITHOUT LIMITATION, ANY DAMAGE CAUSED BY HARDWARE, FILES, SYSTEMS, SOFTWARE, SERVICES, OR NETWORKS OUTSIDE THE CONTROL OF PLEX. PLEX IS NOT RESPONSIBLE OR LIABLE FOR YOUR OR ANY OTHER PERSON’S USE OF ANY INTERFACING SOFTWARE (OUTSIDE ITS CONTROL). MOREOVER, ALL USER CONTENT (OR OTHER DATA OR CONTENT) YOU ACCESS THROUGH THE PLEX SOLUTION IS AT YOUR OWN RISK. IN CONNECTION THEREWITH, YOU SPECIFICALLY ACKNOWLEDGE THAT PLEX SHALL NOT BE LIABLE FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OF YOUR USE (OR DELAY IN USE) OF OR FAILURE TO STORE ANY DATA OR CONTENT MADE AVAILABLE THROUGH THE PLEX SOLUTION AND SHALL NOT BE LIABLE FOR ANY USE OF ANY USER CONTENT BY OTHERS, INCLUDING YOUR AUTHORIZED USERS. MOREOVER, IN NO EVENT SHALL PLEX BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF THE PLEX SOLUTION OR WITH THE DELAY OR INABILITY TO USE THE PLEX SOLUTION, EVEN IF PLEX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. NOTWITHSTANDING THE FOREGOING, TOTAL LIABILITY OF PLEX FOR BREACH OF THIS TOS IS CESSATION OF USE OF THE PLEX SOLUTION AND FOR ANY OTHER REASON RELATED TO OR ARISING OUT OF YOUR USE OF THE PLEX SOLUTION WHATSOEVER FOR AN AMOUNT NOT EXCEEDING $100 OR THE TOTAL AMOUNT ACTUALLY PAID BY YOU TO PLEX DURING THE PAST THREE MONTHS IN CONNECTION WITH YOUR INDIVIDUAL USE OF THE PLEX SOLUTION, WHICHEVER IS GREATER. You and Plex agree to only bring claims arising from this TOS on an individual basis and not as a plaintiff or class member in any purported class or representative action or proceeding. Unless you and Plex agree otherwise, more than one person’s or party’s claims may not be consolidated. You and Plex agree that relief (including monetary, injunctive, and declaratory relief) may be awarded only in favor of the individual party seeking relief and only to the extent necessary to provide relief necessitated by that party’s individual claim(s).
-INDEMNIFICATION. You agree to indemnify, defend, and hold Plex (and its affiliated companies, contractors, employees, agents, and suppliers and partners) harmless from any and all claims, suits, actions, liabilities, losses, costs, damages, expenses, and any other liabilities, including, without limitation, attorneys’ fees, arising out of or related in any manner to your breach or alleged breach of this TOS, your Interfacing Software, or for any violation or alleged violation of the rights (including, without limitation, patents, copyrights, or trademark rights) of any other person or entity by your User Content.
-ARBITRATION. You agree that all disputes between you and Plex (whether or not such dispute involves a third party) with regard to your relationship with Plex, including, without limitation, disputes related to this TOS, your use of the Plex Solution, and/or rights of privacy and/or publicity, will be resolved by binding, individual arbitration. Without limiting Plex’s right to seek injunctive or other equitable relief (as set forth below), any disputes arising with respect to this TOS between you and Plex (“parties”) shall be referred to an arbitrator affiliated with the Judicial Arbitration and Mediation Services, Inc. (“JAMS”). The arbitrator shall be selected by joint agreement of the parties. In the event the parties cannot agree on an arbitrator within thirty (30) days of the initiating party providing the other party with written notice that it plans to seek arbitration, the parties shall each select an arbitrator affiliated with JAMS, which arbitrators shall jointly select a third such arbitrator to resolve the dispute. Arbitration shall be conducted under the rules then prevailing of JAMS/ENDISPUTE Streamlined Arbitration Rules and Procedures in effect at the time of filing of the demand for arbitration. The parties specifically incorporate the terms of California Code of Civil Procedure Section 1283.05 with respect to discovery. The arbitrator’s award shall be binding and may be entered as a judgment in any court of competent jurisdiction. The arbitration proceeding shall be carried on and heard in Santa Clara County, California using the English language. In any action or proceeding to enforce rights under this TOS, the prevailing party will be entitled to recover costs and reasonable attorneys’ fees from the other party. You may bring claims only on your own behalf. Neither you nor Plex will participate in a class-wide arbitration for any claims covered by this TOS. This dispute resolution provision will be governed by the Federal Arbitration Act.
-GOVERNING LAW. The Plex Solution is controlled and operated by Plex from its offices within the United States. This TOS has been made in and will be construed and enforced in accordance with the laws of the State of California as applied to agreements entered into and completely performed in the State of California. You access and use the Plex Solution on your own volition and are responsible for compliance with all applicable laws with respect to your access and use of the Plex Solution. Additionally, Plex’s headquarters are located in the United States. Please be aware that information you provide to Plex, or that Plex obtains as a result of your use of the Plex Solution, may be processed and transferred to the United States and be subject to United States law. Subject to the foregoing arbitration right, any action to enforce this TOS will be brought in the courts presiding in the Superior Court of Santa Clara County and the United States District Court for the Northern District of California, and all parties to this TOS expressly agree to be subject to the jurisdiction of such courts. You and Plex waive trial by jury. Moreover, you may bring claims only on your own behalf. Neither you nor Plex will participate in a class action or class-wide arbitration for any claims covered by this TOS. You also agree not to participate in claims brought in a private attorney general or representative capacity, or consolidated claims involving another person’s account, if Plex is a party to the proceeding.
-COMMUNICATIONS AND NOTICE. Any communication(s) or notice (and any related materials or information) to be sent pursuant to this TOS shall be in the English language and shall be deemed provided: (a) upon receipt if by personal delivery; (b) upon receipt if sent by certified or registered U.S. Mail (return receipt requested); (c) one day after it is sent if by next-day delivery by a major commercial delivery service; or (d) with respect to termination of this TOS or for information applicable generally to end users of the Plex Solution, to the email address designated by you.
-EXPORT CONTROL AND LEGAL COMPLIANCE. You represent and warrant that you are not (a) located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a “terrorist supporting” country; and (b) listed on any U.S. Government list of prohibited or restricted parties. You hereby agree that (i) you will comply with all applicable Sanctions and Export Control Laws, (ii) you are solely responsible for ensuring that the Plex Solution is used, disclosed, and/or transported only in accordance with all applicable Sanctions and Export Control Laws, and (iii) you will not re-export or transfer the Plex Solution, in any form, directly or indirectly, to any person or entity based in Cuba, Iran, Syria, Sudan, South Sudan, or North Korea.
-ENFORCING SECURITY. You may not use the Plex Solution or any of Plex’s data, systems, network, or services to engage in, foster, or promote illegal, abusive, or irresponsible behavior, including, without limitation, accessing or using Plex data, systems, or networks in an unauthorized manner, attempting to probe, scan, or test the vulnerability of a Plex system or network, circumventing any Plex security or authentication measures, monitoring Plex data or traffic, interfering with any Plex services, collecting or using from the Plex Solution email addresses, screen names, or other identifiers, collecting or using from the Plex Solution information without the consent of the owner or licensor, using any false, misleading, or deceptive TCP-IP packet header information, using the Plex Solution to distribute software or tools that gather information, distributing advertisements, or engaging in conduct that it likely to result in retaliation against Plex or its data, systems, or network. Actual or attempted unauthorized use of the Plex Solution may result in criminal and/or civil prosecution, including, without limitation, punishment under the Computer Fraud and Abuse Act of 1986 under U.S. federal law. Plex reserves the right to view, monitor, and record activity through the Plex Solution without notice or permission from you. Any information obtained by monitoring, reviewing, or recording is subject to review by law enforcement organizations in connection with investigation or prosecution of possible criminal or unlawful activity through the Plex Solution as well as to disclosures required by or under applicable law or related government agency actions. Plex will also comply with all court orders or subpoenas involving requests for such information. In addition to the foregoing, Plex reserves the right to, at any time and without notice, modify, update, suspend, terminate, or interrupt operation of or access to the Plex Solution, or any portion of the Plex Solution in order to protect the Plex Solution or Plex.
-INJUNCTIVE RELIEF. You acknowledge that any breach, threatened or actual, of this TOS, including, without limitation, with respect to unauthorized use of Plex proprietary assets, will cause irreparable injury to Plex, such injury would not be quantifiable in monetary damages, and Plex would not have an adequate remedy at law. You therefore agree that Plex shall be entitled, in addition to other available remedies, to seek and be awarded an injunction or other appropriate equitable relief from a court of competent jurisdiction restraining any breach, threatened or actual, of your obligations under any provision of this TOS. Accordingly, you hereby waive any requirement that Plex post any bond or other security in the event any injunctive or equitable relief is sought by or awarded to Plex to enforce any provision of this TOS.
-TERM AND TERMINATION. This TOS will take effect (or re-take effect) at the (and each) time you begin installing, accessing, or using the Plex Solution, WHICHEVER IS EARLIEST, and is effective until terminated as set forth below. Plex reserves the right to terminate this TOS at any time on reasonable grounds, which shall specifically include, without limitation, discontinuation of the Plex Solution (or related services) as an offering of the Plex business, nonpayment, termination of account, fraudulent or unlawful activity, or actions or omissions that violate this TOS, subject to the survival rights of certain provisions identified below. In addition, Plex shall have the right to take appropriate administrative and/or legal action in the event of breach or (alleged) criminal activity, including alerting legal authorities, as it deems necessary in its sole discretion. You may also terminate this TOS at any time by providing Plex with notice of cancellation, but all applicable provisions of this TOS will survive termination, as identified below. You may close your account by clicking here. Upon termination and in accordance with law, your right to access and use the Plex Solution shall cease (regardless of the subscription period) and you must immediately destroy all copies of any aspect of the Plex Solution in your possession. Termination shall result in deactivation or deletion of your account with Plex. The provisions concerning Content, License Grant Restrictions, Proprietary Rights, Permission to Use User Content, Proprietary Rights, Feedback, Confidentiality, Additional Terms and Conditions, Disclaimer of Warranty, Limitation of Liability, Indemnification (for a period of one year after termination), Arbitration, Governing Law, Enforcing Security, Injunctive Relief, Term and Termination, Waiver & Severability, and Entire Agreement will survive the termination of this TOS for any reason. Further, Plex shall not be responsible for any damage that may result or arise out of termination of this TOS.
-WAIVER & SEVERABILITY. Failure to insist on strict performance of any of the terms and conditions of this TOS will not operate as a waiver of any subsequent default or failure of performance. No waiver by Plex of any right under this TOS will be deemed to be either a waiver of any other right or provision or a waiver of that same right or provision at any other time. If any part of this TOS is determined to be invalid or unenforceable pursuant to applicable law including, but not limited to, the warranty disclaimers, venue, claim, and liability limitations set forth above, then the invalid or unenforceable provision will be deemed superseded by a valid, enforceable, provision that most clearly matches the intent of the original provision and the remainder of this TOS shall continue in effect.
-ENTIRE AGREEMENT. No joint venture, partnership, employment, or agency relationship exists between you and Plex as a result of this TOS or your utilization of the Plex Solution, and you do not have any authority of any kind to bind Plex in any respect whatsoever. This TOS represents the entire agreement between you and Plex with respect to your individual use of the Plex Solution. This TOS is not assignable, transferable, or sub-licensable by you except with Plex’s prior written consent. Plex may transfer, assign, or delegate this TOS and its rights and obligations without consent. Please note that Plex reserves the right to change the terms and conditions of this TOS and the terms and conditions under which the Plex Solution and its offerings are extended to you by posting online a revised TOS or mailing and/or e-mailing notice thereof to you. In addition, Plex may add, modify, or delete any aspect, program, functionality, or feature of the Plex Solution. Your continued use of the Plex Solution following any addition, modification, or deletion will be conclusively deemed acceptance of any change to the terms and conditions of this TOS. Accordingly, please review this TOS found at this location on a periodic basis.
-CONTACT INFORMATION. If you have questions regarding the Plex Solution or if you are interested in obtaining more information concerning Plex or its products, services, or solutions, please contact Plex.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/RSAL-2 b/sdk_container/src/third_party/portage-stable/licenses/RSAL-2
new file mode 100644
index 00000000000..458da09d0a3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/RSAL-2
@@ -0,0 +1,163 @@
+Redis Source Available License 2.0 (RSALv2) Agreement
+=====================================================
+
+Last Update: December 30, 2023
+
+Acceptance
+----------
+
+This Agreement sets forth the terms and conditions on which the Licensor
+makes available the Software. By installing, downloading, accessing,
+Using, or distributing any of the Software, You agree to all of the
+terms and conditions of this Agreement.
+
+If You are receiving the Software on behalf of Your Company, You
+represent and warrant that You have the authority to agree to this
+Agreement on behalf of such entity.
+
+The Licensor reserves the right to update this Agreement from time to
+time.
+
+The terms below have the meanings set forth below for purposes of this
+Agreement:
+
+Definitions
+-----------
+
+Agreement: this Redis Source Available License 2.0 Agreement.
+
+Control: ownership, directly or indirectly, of substantially all the
+assets of an entity, or the power to direct its management and policies
+by vote, contract, or otherwise.
+
+License: the License as described in the License paragraph below.
+
+Licensor: the entity offering these terms, which includes Redis Ltd. on
+behalf of itself and its subsidiaries and affiliates worldwide.
+
+Modify, Modified, or Modification: copy from or adapt all or part of the
+work in a fashion requiring copyright permission other than making an
+exact copy. The resulting work is called a Modified version of the
+earlier work.
+
+Redis: the Redis software as described in redis.com redis.io.
+
+Software: certain Software components designed to work with Redis and
+provided to You under this Agreement.
+
+Trademark: the trademarks, service marks, and any other similar rights.
+
+Use: anything You do with the Software requiring one of Your Licenses.
+
+You: the recipient of the Software, the individual or entity on whose
+behalf You are agreeing to this Agreement.
+
+Your Company: any legal entity, sole proprietorship, or other kind of
+organization that You work for, plus all organizations that have control
+over, are under the control of, or are under common control with that
+organization.
+
+Your Licenses: means all the Licenses granted to You for the Software
+under this Agreement.
+
+License
+-------
+
+The Licensor grants You a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute,
+make available, and prepare derivative works of the Software, in each
+case subject to the limitations and conditions below.
+
+Limitations
+-----------
+
+You may not make the functionality of the Software or a Modified version
+available to third parties as a service or distribute the Software or a
+Modified version in a manner that makes the functionality of the
+Software available to third parties.
+
+Making the functionality of the Software or Modified version available
+to third parties includes, without limitation, enabling third parties to
+interact with the functionality of the Software or Modified version in
+distributed form or remotely through a computer network, offering a
+product or service, the value of which entirely or primarily derives
+from the value of the Software or Modified version, or offering a
+product or service that accomplishes for users the primary purpose of
+the Software or Modified version.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the Licensor in the Software. Any use of the Licensor's
+Trademarks is subject to applicable law.
+
+Patents
+-------
+
+The Licensor grants You a License, under any patent claims the Licensor
+can License, or becomes able to License, to make, have made, use, sell,
+offer for sale, import and have imported the Software, in each case
+subject to the limitations and conditions in this License. This License
+does not cover any patent claims that You cause to be infringed by
+Modifications or additions to the Software. If You or Your Company make
+any written claim that the Software infringes or contributes to
+infringement of any patent, your patent License for the Software granted
+under this Agreement ends immediately. If Your Company makes such a
+claim, your patent License ends immediately for work on behalf of Your
+Company.
+
+Notices
+-------
+
+You must ensure that anyone who gets a copy of any part of the Software
+from You also gets a copy of the terms and conditions in this Agreement.
+
+If You modify the Software, You must include in any Modified copies of
+the Software prominent notices stating that You have Modified the
+Software.
+
+No Other Rights
+---------------
+
+The terms and conditions of this Agreement do not imply any Licenses
+other than those expressly granted in this Agreement.
+
+Termination
+-----------
+
+If You Use the Software in violation of this Agreement, such Use is not
+Licensed, and Your Licenses will automatically terminate. If the
+Licensor provides You with a notice of your violation, and You cease all
+violations of this License no later than 30 days after You receive that
+notice, Your Licenses will be reinstated retroactively. However, if You
+violate this Agreement after such reinstatement, any additional
+violation of this Agreement will cause your Licenses to terminate
+automatically and permanently.
+
+No Liability
+------------
+
+As far as the law allows, the Software comes as is, without any
+warranty or condition, and the Licensor will not be liable to You for
+any damages arising out of this Agreement or the Use or nature of the
+Software, under any kind of legal claim.
+
+Governing Law and Jurisdiction
+------------------------------
+
+If You are located in Asia, Pacific, Americas, or other jurisdictions
+not listed below, the Agreement will be construed and enforced in all
+respects in accordance with the laws of the State of California, U.S.A.,
+without reference to its choice of law rules. The courts located in the
+County of Santa Clara, California, have exclusive jurisdiction for all
+purposes relating to this Agreement.
+
+If You are located in Israel, the Agreement will be construed and
+enforced in all respects in accordance with the laws of the State of
+Israel without reference to its choice of law rules. The courts located
+in the Central District of the State of Israel have exclusive
+jurisdiction for all purposes relating to this Agreement.
+
+If You are located in Europe, United Kingdom, Middle East or Africa, the
+Agreement will be construed and enforced in all respects in accordance
+with the laws of England and Wales without reference to its choice of
+law rules. The competent courts located in London, England, have
+exclusive jurisdiction for all purposes relating to this Agreement.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/SunSoft b/sdk_container/src/third_party/portage-stable/licenses/SunSoft
new file mode 100644
index 00000000000..b54cb52278e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/SunSoft
@@ -0,0 +1,6 @@
+Copyright (C) 1993-2004 by Sun Microsystems, Inc. All rights reserved.
+
+Developed at SunSoft, a Sun Microsystems, Inc. business.
+Permission to use, copy, modify, and distribute this
+software is freely granted, provided that this notice
+is preserved.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015 b/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015
new file mode 100644
index 00000000000..cd535409d60
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/Unicode-DFS-2015
@@ -0,0 +1,57 @@
+UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
+
+Unicode Data Files include all data files under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+and http://www.unicode.org/cldr/data/.
+Unicode Data Files do not include PDF online code charts under the
+directory http://www.unicode.org/Public/.
+Software includes any source code published in the Unicode Standard
+or under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+and http://www.unicode.org/cldr/data/.
+
+NOTICE TO USER: Carefully read the following legal agreement.
+BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
+DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
+YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT.
+IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
+THE DATA FILES OR SOFTWARE.
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2015 Unicode, Inc. All rights reserved.
+Distributed under the Terms of Use in
+http://www.unicode.org/copyright.html.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Unicode data files and any associated documentation
+(the "Data Files") or Unicode software and any associated documentation
+(the "Software") to deal in the Data Files or Software
+without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of
+the Data Files or Software, and to permit persons to whom the Data Files
+or Software are furnished to do so, provided that
+(a) this copyright and permission notice appear with all copies
+of the Data Files or Software,
+(b) this copyright and permission notice appear in associated
+documentation, and
+(c) there is clear notice in each modified Data File or in the Software
+as well as in the documentation associated with the Data File(s) or
+Software that the data or software has been modified.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
+NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
+DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder
+shall not be used in advertising or otherwise to promote the sale,
+use or other dealings in these Data Files or Software without prior
+written authorization of the copyright holder.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent b/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent
new file mode 100644
index 00000000000..6a787310780
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/X11-Lucent
@@ -0,0 +1,10 @@
+Permission to use, copy, modify, and distribute this software for any
+purpose without fee is hereby granted, provided that this entire notice
+is included in all copies of any software which is or includes a copy
+or modification of this software and in all copies of the supporting
+documentation for such software.
+
+THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
+WARRANTY.  IN PARTICULAR, NEITHER THE AUTHORS NOR LUCENT TECHNOLOGIES MAKE ANY
+REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
+OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0-r5.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0-r5.ebuild
index 29ce9aa6554..e65ca789afe 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0-r5.ebuild
@@ -48,8 +48,8 @@ src_prepare() {
 }
 
 src_configure() {
-	# netlib.c:2292:5: warning: implicit declaration of function ‘sched_setaffinity’
-	# nettest_omni.c:2943:5: warning: implicit declaration of function ‘splice’
+	# netlib.c:2292:5: warning: implicit declaration of function 'sched_setaffinity'
+	# nettest_omni.c:2943:5: warning: implicit declaration of function 'splice'
 	# TODO: drop once https://github.com/HewlettPackard/netperf/pull/73 merged
 	append-cppflags -D_GNU_SOURCE
 
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0_p20210121.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0_p20210121.ebuild
index 35ba7901bc3..634236baa46 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0_p20210121.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/netperf/netperf-2.7.0_p20210121.ebuild
@@ -49,8 +49,8 @@ src_prepare() {
 }
 
 src_configure() {
-	# netlib.c:2292:5: warning: implicit declaration of function ‘sched_setaffinity’
-	# nettest_omni.c:2943:5: warning: implicit declaration of function ‘splice’
+	# netlib.c:2292:5: warning: implicit declaration of function 'sched_setaffinity'
+	# nettest_omni.c:2943:5: warning: implicit declaration of function 'splice'
 	# TODO: drop once https://github.com/HewlettPackard/netperf/pull/73 merged
 	append-cppflags -D_GNU_SOURCE
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
index 211061187c9..fd2df383c0e 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.48-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -33,7 +33,7 @@ RDEPEND="
 	>=dev-libs/libuv-1.42.0:=
 	dev-libs/openssl:=
 	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
 	libedit? ( dev-libs/libedit )
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
index 9d1fac1aba0..5b553e924df 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.50-r1.ebuild
@@ -33,7 +33,7 @@ RDEPEND="
 	>=dev-libs/libuv-1.42.0:=
 	dev-libs/openssl:=
 	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
 	libedit? ( dev-libs/libedit )
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild
index 8189ad3c49f..2de61a41bc0 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild
@@ -8,7 +8,7 @@ HOMEPAGE="https://www.isc.org/bind/ https://gitlab.isc.org/isc-projects/bind9"
 
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="+caps doc gssapi idn libedit readline xml"
 
 RDEPEND="=net-dns/bind-9.18*[caps?,doc?,gssapi?,idn?,xml?]"
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
index 630ce742456..404a2f3e554 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
@@ -1,3 +1,5 @@
 DIST bind-9.18.29.tar.xz 5562720 BLAKE2B f3e7de6936362bcce4993e401ed8fdd9d597459e82ad908a918fff1da619f91ef4896595ea210b43f2b492d763d7be2b71105495858da55431b60874c7fd2312 SHA512 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
 DIST bind-9.18.31.tar.xz 5385812 BLAKE2B e069ab3caab887a87220b54804e5b19a4c21b8d3e4e8f1bc6a7135b3990a228d6c48b1ca4a22c75242485275eff1de145a9aff89addf81124e7dfcafd8ab30cf SHA512 e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
+DIST bind-9.18.37.tar.xz 5358128 BLAKE2B 59753a594e1e8249b9104377260701a9453eeecb6a233a94a33c6a134a6368c5c0b9473c4e08d956d0746a331dc7b121550f5e426a521d6c8d0441d9164f0547 SHA512 9789cb3fa7739cc7e1b137d1642861d9517adc4391e2f8c526bfa271e13f7489794ed20cb5f64c26e432d7b79cfe7aa1f7d59c476fd2749bc2dccfb85c514943
 DIST bind-9.20.7.tar.xz 5655168 BLAKE2B c5198939382e7295b4dfcb2ddbd86e5bccc10047d5e963dab2381404eb7a14543218e3caa438b395a2982cb607da84012f3a76a41c790a48ed615238bc080b5c SHA512 b9570c0c6588819108017d30dc7fb5e2f34361f941186d29da3d2830bbe3333c8c16bdb6581f5bec4786d90b74db860a9cad5f66d4f1c65168eae69f401a9df0
+DIST bind-9.20.9.tar.xz 5668452 BLAKE2B 40a1428d2da9d92b3604f04234b2ff44701abcf2ea22883caea7fb4ee157547125fd68accb8fe10853ff64cd5018fa89e36eeb53021fa3ee9bc056e05ac228d6 SHA512 78efb4c4a5d78bd04efe222982efa1d6bb6748965e40d816d9e4329d6f2687a43d1e439bc3f98c00c85abaf8fc435063bcbe2d96a61b252fe3df0a8affa19f8f
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
index ba1fbcbae74..445b15be4e1 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.29-r3.ebuild
@@ -37,7 +37,7 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
index d4b6c103bbc..65e278b7e4c 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.31-r2.ebuild
@@ -37,7 +37,7 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37.ebuild
new file mode 100644
index 00000000000..0a4c293f4a6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r8 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r2.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r2.ebuild
index a19f5a14882..1d743ff4028 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.7-r2.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 LICENSE="MPL-2.0"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemd systemtap test xml"
 RESTRICT="!test? ( test )"
 
 DEPEND="
@@ -38,7 +38,8 @@ DEPEND="
 	idn? ( net-dns/libidn2 )
 	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	xml? ( dev-libs/libxml2 )
+	systemd? ( sys-apps/systemd:= )
+	xml? ( dev-libs/libxml2:= )
 "
 RDEPEND="
 	${DEPEND}
@@ -54,6 +55,9 @@ BDEPEND="
 	test? (
 		dev-util/cmocka
 	)
+	systemtap? (
+		dev-debug/systemtap
+	)
 "
 
 src_prepare() {
@@ -68,6 +72,11 @@ src_configure() {
 	# are available. Force fallback to prebuilt ones.
 	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
 
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
 	local myeconfargs=(
 		--prefix="${EPREFIX}"/usr
 		--sysconfdir="${EPREFIX}"/etc/bind
@@ -83,12 +92,14 @@ src_configure() {
 		$(use_with doh libnghttp2)
 		$(use_enable static-libs static)
 		$(use_enable geoip)
+		$(use_enable systemtap tracing)
 		$(use_with test cmocka)
 		$(use_with geoip maxminddb)
 		$(use_with gssapi)
 		$(use_with idn libidn2)
 		$(use_with jemalloc)
 		$(use_with lmdb)
+		$(use_with systemd libsystemd)
 		$(use_with xml libxml2)
 	)
 
@@ -125,7 +136,7 @@ src_install() {
 	fi
 
 	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
+	newins "${FILESDIR}"/named.conf-r9 named.conf
 	newins "${FILESDIR}"/named.conf.auth named.conf.auth
 
 	newinitd "${FILESDIR}"/named.init-r15 named
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.9.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.9.ebuild
new file mode 100644
index 00000000000..1a0f962c054
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.9.ebuild
@@ -0,0 +1,289 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemd systemtap test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	systemd? ( sys-apps/systemd:= )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+	systemtap? (
+		dev-debug/systemtap
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with systemd libsystemd)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/files/named.conf-r9 b/sdk_container/src/third_party/portage-stable/net-dns/bind/files/named.conf-r9
new file mode 100644
index 00000000000..62b34bc6e9a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/files/named.conf-r9
@@ -0,0 +1,165 @@
+/*
+ * Refer to the named.conf(5) and named(8) man pages, and the documentation
+ * in /usr/share/doc/bind-* for more details.
+ * Online versions of the documentation can be found here:
+ * https://kb.isc.org/article/AA-01031
+ *
+ * If you are going to set up an authoritative server, make sure you
+ * understand the hairy details of how DNS works. Even with simple mistakes,
+ * you can break connectivity for affected parties, or cause huge amounts of
+ * useless Internet traffic.
+ */
+
+acl "xfer" {
+	/* Deny transfers by default except for the listed hosts.
+	 * If we have other name servers, place them here.
+	 */
+	none;
+};
+
+/*
+ * You might put in here some ips which are allowed to use the cache or
+ * recursive queries
+ */
+acl "trusted" {
+	127.0.0.0/8;
+	::1/128;
+};
+
+options {
+	directory "/var/bind";
+	pid-file "/run/named/named.pid";
+
+	/* https://www.isc.org/solutions/dlv >=bind-9.7.x only */
+	//bindkeys-file "/etc/bind/bind.keys";
+
+	listen-on-v6 { ::1; };
+	listen-on { 127.0.0.1; };
+
+	allow-query {
+		/*
+		 * Accept queries from our "trusted" ACL.  We will
+		 * allow anyone to query our master zones below.
+		 * This prevents us from becoming a free DNS server
+		 * to the masses.
+		 */
+		trusted;
+	};
+
+	allow-query-cache {
+		/* Use the cache for the "trusted" ACL. */
+		trusted;
+	};
+
+	allow-recursion {
+		/* Only trusted addresses are allowed to use recursion. */
+		trusted;
+	};
+
+	allow-transfer {
+		/* Zone tranfers are denied by default. */
+		none;
+	};
+
+	allow-update {
+		/* Don't allow updates, e.g. via nsupdate. */
+		none;
+	};
+
+	/*
+	* If you've got a DNS server around at your upstream provider, enter its
+	* IP address here, and enable the line below. This will make you benefit
+	* from its cache, thus reduce overall DNS traffic in the Internet.
+	*
+	* Uncomment the following lines to turn on DNS forwarding, and change
+	*  and/or update the forwarding ip address(es):
+	*/
+/*
+	forward first;
+	forwarders {
+	//	123.123.123.123;	// Your ISP NS
+	//	124.124.124.124;	// Your ISP NS
+	//	4.2.2.1;		// Level3 Public DNS
+	//	4.2.2.2;		// Level3 Public DNS
+		8.8.8.8;		// Google Open DNS
+		8.8.4.4;		// Google Open DNS
+	};
+
+*/
+
+	//dnssec-validation yes;
+
+	/*
+	 * As of bind 9.8.0:
+	 * "If the root key provided has expired,
+	 * named will log the expiration and validation will not work."
+	 */
+	dnssec-validation auto;
+
+	/* if you have problems and are behind a firewall: */
+	//query-source address * port 53;
+};
+
+/*
+logging {
+	channel default_log {
+		file "/var/log/named/named.log" versions 5 size 50M;
+		print-time yes;
+		print-severity yes;
+		print-category yes;
+	};
+
+	category default { default_log; };
+	category general { default_log; };
+};
+*/
+
+include "/etc/bind/rndc.key";
+controls {
+	inet 127.0.0.1 port 953 allow { 127.0.0.1/32; ::1/128; } keys { "rndc-key"; };
+};
+
+zone "." in {
+	type hint;
+	file "/var/bind/named.cache";
+};
+
+zone "localhost" IN {
+	type master;
+	file "pri/localhost.zone";
+	notify no;
+};
+
+/*
+ * Briefly, a zone which has been declared delegation-only will be effectively
+ * limited to containing NS RRs for subdomains, but no actual data beyond its
+ * own apex (for example, its SOA RR and apex NS RRset). This can be used to
+ * filter out "wildcard" or "synthesized" data from NAT boxes or from
+ * authoritative name servers whose undelegated (in-zone) data is of no
+ * interest.
+ * See http://www.isc.org/software/bind/delegation-only for more info
+ */
+
+//zone "COM" { type delegation-only; };
+//zone "NET" { type delegation-only; };
+
+//zone "YOUR-DOMAIN.TLD" {
+//	type master;
+//	file "/var/bind/pri/YOUR-DOMAIN.TLD.zone";
+//	allow-query { any; };
+//	allow-transfer { xfer; };
+//};
+
+//zone "YOUR-SLAVE.TLD" {
+//	type slave;
+//	file "/var/bind/sec/YOUR-SLAVE.TLD.zone";
+//	masters { <MASTER>; };
+
+	/* Anybody is allowed to query but transfer should be controlled by the master. */
+//	allow-query { any; };
+//	allow-transfer { none; };
+
+	/* The master should be the only one who notifies the slaves, shouldn't it? */
+//	allow-notify { <MASTER>; };
+//	notify no;
+//};
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml b/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
index 5dfa7226e58..1f55c6ba273 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
@@ -12,5 +12,6 @@
 		<flag name="fixed-rrset">Enables fixed rrset-order option</flag>
 		<flag name="gssapi">Enable gssapi support</flag>
 		<flag name="lmdb">Enable LMDB support to store configuration for 'addzone' zones</flag>
+		<flag name="systemtap">Build support for profiling and tracing using <pkg>dev-debug/systemtap</pkg></flag>
 	</use>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.5.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.5.ebuild
index c65a89fb20a..90e34546815 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.5.ebuild
@@ -18,7 +18,7 @@ SRC_URI="
 LICENSE="MIT ISC"
 # Subslot = SONAME of libcares.so.2
 SLOT="0/2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
index afca750b459..9ec1656c94f 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
@@ -1 +1,2 @@
 DIST ipset-7.23.tar.bz2 695655 BLAKE2B a596630d12a8bcc1383475627e5e62b7be4c17570ae9d3650b9dbcac0ec46324e1ac7c0e7e11f674fb5354871538f6f15e57476ac752b1ac1415023d837904e6 SHA512 5a43c790abf157a55db5a9a22cb5f28a225f5c7969beda81566a2259aa82c9d852979eb805b11b4347f47c6a0c2cc4de6f14e4733bee5b562844422a45fb9dab
+DIST ipset-7.24.tar.bz2 695548 BLAKE2B 52e05313353e7b5fe969d5f113794238356bf900b4e7ac4693c05164ecde0826d0e911dcae67bb4103f49b587f94f561d14dcfebb78c5c231013fda7d36a81da SHA512 18ccb49bd38083f0556b11e1d17f43791c52a2b094c9a500b6f770796b17e8e70c3860a628eac2252eb672b1fc9de734d3a0e0823d61dd9be7b4188adc6dd214
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset-net_namespace.patch b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset-net_namespace.patch
new file mode 100644
index 00000000000..5349635967c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset-net_namespace.patch
@@ -0,0 +1,11 @@
+--- a/configure.ac	2025-05-22 22:36:57.332625302 -0000
++++ b/configure.ac	2025-05-22 22:37:17.729090112 -0000
+@@ -401,7 +401,7 @@ fi
+ 
+ AC_MSG_CHECKING([kernel source for id in struct pernet_operations])
+ if test -f $ksourcedir/include/net/net_namespace.h && \
+-   $AWK '/^struct pernet_operations /,/^}/' $ksourcedir/include/net/net_namespace.h | $GREP -q 'int \*id;'; then
++   $AWK '/^struct pernet_operations /,/^}/' $ksourcedir/include/net/net_namespace.h | $GREP -qE 'int \*id;|int \* const id'; then
+ 	AC_MSG_RESULT(yes)
+ 	AC_SUBST(HAVE_NET_OPS_ID, define)
+ else
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.24.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.24.ebuild
new file mode 100644
index 00000000000..953c5079e24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.24.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MODULES_OPTIONAL_IUSE=modules
+inherit autotools bash-completion-r1 linux-mod-r1 systemd
+
+DESCRIPTION="IPset tool for iptables, successor to ippool"
+HOMEPAGE="https://ipset.netfilter.org/ https://git.netfilter.org/ipset/"
+SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+RDEPEND="
+	net-firewall/iptables
+	net-libs/libmnl:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( ChangeLog INSTALL README UPGRADE )
+
+# configurable from outside, e.g. /etc/portage/make.conf
+IP_NF_SET_MAX=${IP_NF_SET_MAX:-256}
+
+PATCHES=(
+	"${FILESDIR}/${PN}-bash-completion.patch"
+	"${FILESDIR}/${PN}-net_namespace.patch"
+)
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+pkg_setup() {
+	get_version
+	CONFIG_CHECK="NETFILTER"
+	ERROR_NETFILTER="ipset requires NETFILTER support in your kernel."
+	CONFIG_CHECK+=" NETFILTER_NETLINK"
+	ERROR_NETFILTER_NETLINK="ipset requires NETFILTER_NETLINK support in your kernel."
+	# It does still build without NET_NS, but it may be needed in future.
+	#CONFIG_CHECK="${CONFIG_CHECK} NET_NS"
+	#ERROR_NET_NS="ipset requires NET_NS (network namespace) support in your kernel."
+	CONFIG_CHECK+=" !PAX_CONSTIFY_PLUGIN"
+	ERROR_PAX_CONSTIFY_PLUGIN="ipset contains constified variables (#614896)"
+
+	build_modules=0
+	if use modules; then
+		if linux_config_src_exists && linux_chkconfig_builtin "MODULES" ; then
+			if linux_chkconfig_present "IP_NF_SET" || \
+				linux_chkconfig_present "IP_SET"; then #274577
+				eerror "There is IP{,_NF}_SET or NETFILTER_XT_SET support in your kernel."
+				eerror "Please either build ipset with modules USE flag disabled"
+				eerror "or rebuild kernel without IP_SET support and make sure"
+				eerror "there is NO kernel ip_set* modules in /lib/modules/<your_kernel>/... ."
+				die "USE=modules and in-kernel ipset support detected."
+			else
+				einfo "Modular kernel detected. Gonna build kernel modules..."
+				build_modules=1
+			fi
+		else
+			eerror "Nonmodular kernel detected, but USE=modules. Either build"
+			eerror "modular kernel (without IP_SET) or disable USE=modules"
+			die "Nonmodular kernel detected, will not build kernel modules"
+		fi
+	fi
+
+	[[ ${build_modules} -eq 1 ]] && linux-mod-r1_pkg_setup
+}
+
+src_configure() {
+	export bashcompdir="$(get_bashcompdir)"
+
+	econf \
+		--enable-bashcompl \
+		$(use_with modules kmod) \
+		--with-maxsets=${IP_NF_SET_MAX} \
+		--with-ksource="${KV_DIR}" \
+		--with-kbuild="${KV_OUT_DIR}"
+}
+
+src_compile() {
+	einfo "Building userspace"
+
+	local modlist=( xt_set=kernel/net/netfilter/ipset/:"${S}":kernel/net/netfilter/:
+					em_ipset=kernel/net/sched:"${S}":kernel/net/sched/:modules )
+
+	for i in ip_set{,_bitmap_{ip{,mac},port},_hash_{ip{,mac,mark,port{,ip,net}},mac,net{,port{,net},iface,net}},_list_set}; do
+		modlist+=( ${i}=kernel/net/netfilter/ipset/:"${S}":kernel/net/netfilter/ipset )
+	done
+
+	emake
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Building kernel modules"
+		linux-mod-r1_src_compile
+	fi
+}
+
+src_install() {
+	einfo "Installing userspace"
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+
+	newinitd "${FILESDIR}"/ipset.initd-r7 ${PN}
+	newconfd "${FILESDIR}"/ipset.confd-r1 ${PN}
+	systemd_newunit "${FILESDIR}"/ipset.systemd-r1 ${PN}.service
+	keepdir /var/lib/ipset
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Installing kernel modules"
+		linux-mod-r1_src_install
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest
index b09d48227e0..894ce3c7bc3 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest
@@ -1,3 +1 @@
-DIST iptables-1.8.10.tar.xz 641168 BLAKE2B 417b33fcfc7edeba169caef26ed0322798f6b82500840509f6c10b97b4ef3f11932c0393fc8dcc5946264442bf8ee959a594b6fbd5dc92012cfad30edf130520 SHA512 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153
 DIST iptables-1.8.11.tar.xz 649284 BLAKE2B 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1 SHA512 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
-DIST iptables-1.8.9.tar.xz 637848 BLAKE2B 37ba80be0ee7049c4d3ee5689b273b4d2cc6e6fb9ebb297e86976b5750f987f2ae4536013fe1749ae79b6989c241eaece3202019fafd47d842c7a4fe3e5093b1 SHA512 e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch
deleted file mode 100644
index 16c894f185e..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-https://git.netfilter.org/iptables/commit/?id=78850e7dba64a949c440dbdbe557f59409c6db48
-
-From 78850e7dba64a949c440dbdbe557f59409c6db48 Mon Sep 17 00:00:00 2001
-From: Markus Boehme <markubo@amazon.com>
-Date: Mon, 3 Apr 2023 23:13:47 +0200
-Subject: [PATCH] ip6tables: Fix checking existence of rule
-
-Pass the proper entry size when creating a match mask for checking the
-existence of a rule. Failing to do so causes wrong results.
-
-Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com>
-Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables")
-Signed-off-by: Markus Boehme <markubo@amazon.com>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
----
- iptables/ip6tables.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 345af451..9afc32c1 100644
---- a/iptables/ip6tables.c
-+++ b/iptables/ip6tables.c
-@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
- 	int ret = 1;
- 	unsigned char *mask;
- 
--	mask = make_delete_mask(matches, target, sizeof(fw));
-+	mask = make_delete_mask(matches, target, sizeof(*fw));
- 	for (i = 0; i < nsaddrs; i++) {
- 		fw->ipv6.src = saddrs[i];
- 		fw->ipv6.smsk = smasks[i];
--- 
-2.42.0.283.g2d96d420d3-goog
-
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-format-security.patch b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-format-security.patch
deleted file mode 100644
index a95c4360098..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-1.8.9-format-security.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-https://git.netfilter.org/iptables/commit/?id=ed4082a7405a5838c205a34c1559e289949200cc
-
-From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 12 Jan 2023 14:38:44 +0100
-Subject: extensions: NAT: Fix for -Werror=format-security
-
-Have to pass either a string literal or format string to xt_xlate_add().
-
-Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
---- a/extensions/libxt_NAT.c
-+++ b/extensions/libxt_NAT.c
-@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r,
- 	if (r->flags & NF_NAT_RANGE_PROTO_OFFSET)
- 		return 0;
- 
--	xt_xlate_add(xl, tgt);
-+	xt_xlate_add(xl, "%s", tgt);
- 	if (strlen(range_str))
- 		xt_xlate_add(xl, " to %s", range_str);
- 	if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) {
--- 
-cgit v1.2.3
-
-
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10-r1.ebuild
deleted file mode 100644
index 2ffa21efe82..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10-r1.ebuild
+++ /dev/null
@@ -1,179 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit systemd toolchain-funcs autotools flag-o-matic
-
-DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://www.netfilter.org/projects/iptables/"
-SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
-
-LICENSE="GPL-2"
-# Subslot reflects PV when libxtables and/or libip*tc was changed
-# the last time.
-SLOT="0/1.8.3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="conntrack netlink nftables pcap static-libs test"
-RESTRICT="!test? ( test )"
-# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
-REQUIRED_USE="test? ( conntrack nftables )"
-
-COMMON_DEPEND="
-	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
-	netlink? ( net-libs/libnfnetlink )
-	nftables? (
-		>=net-libs/libmnl-1.0:=
-		>=net-libs/libnftnl-1.2.6:=
-	)
-	pcap? ( net-libs/libpcap )
-"
-DEPEND="
-	${COMMON_DEPEND}
-	virtual/os-headers
-	>=sys-kernel/linux-headers-4.4:0
-"
-BDEPEND="
-	virtual/pkgconfig
-	nftables? (
-		app-alternatives/lex
-		app-alternatives/yacc
-	)
-"
-RDEPEND="
-	${COMMON_DEPEND}
-	nftables? ( net-misc/ethertypes )
-	!<net-firewall/ebtables-2.0.11-r1
-	!<net-firewall/arptables-0.0.5-r1
-"
-IDEPEND=">=app-eselect/eselect-iptables-20220320"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
-)
-
-src_prepare() {
-	# Use the saner headers from the kernel
-	rm include/linux/{kernel,types}.h || die
-
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# Some libs use $(AR) rather than libtool to build, bug #444282
-	tc-export AR
-
-	# Hack around struct mismatches between userland & kernel for some ABIs
-	# bug #472388
-	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
-
-	sed -i \
-		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
-		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
-		configure || die
-
-	local myeconfargs=(
-		--sbindir="${EPREFIX}/sbin"
-		--libexecdir="${EPREFIX}/$(get_libdir)"
-		--enable-devel
-		--enable-ipv6
-		--enable-shared
-		$(use_enable nftables)
-		$(use_enable pcap bpf-compiler)
-		$(use_enable pcap nfsynproxy)
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	emake V=1
-}
-
-src_install() {
-	default
-
-	# Managed by eselect-iptables
-	# https://bugs.gentoo.org/881295
-	rm "${ED}/usr/bin/iptables-xml" || die
-
-	dodoc iptables/iptables.xslt
-
-	# All the iptables binaries are in /sbin, so might as well
-	# put these small files in with them
-	into /
-	dosbin iptables/iptables-apply
-	dosym iptables-apply /sbin/ip6tables-apply
-	doman iptables/iptables-apply.8
-
-	insinto /usr/include
-	doins include/ip{,6}tables.h
-	insinto /usr/include/iptables
-	doins include/iptables/internal.h
-
-	keepdir /var/lib/ip{,6}tables
-	newinitd "${FILESDIR}"/${PN}-r3.init iptables
-	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
-	dosym iptables /etc/init.d/ip6tables
-	newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
-
-	if use nftables; then
-		# Bug #647458
-		rm "${ED}"/etc/ethertypes || die
-
-		# Bugs #660886 and #669894
-		rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
-	fi
-
-	systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_postinst() {
-	local default_iptables="xtables-legacy-multi"
-	if ! eselect iptables show &>/dev/null; then
-		elog "Current iptables implementation is unset, setting to ${default_iptables}"
-		eselect iptables set "${default_iptables}"
-	fi
-
-	if use nftables; then
-		local tables
-		for tables in {arp,eb}tables; do
-			if ! eselect ${tables} show &>/dev/null; then
-				elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
-				eselect ${tables} set xtables-nft-multi
-			fi
-		done
-	fi
-
-	eselect iptables show
-}
-
-pkg_prerm() {
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Unsetting iptables symlinks before removal"
-		eselect iptables unset
-	fi
-
-	if ! has_version 'net-firewall/ebtables'; then
-		elog "Unsetting ebtables symlinks before removal"
-		eselect ebtables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting ebtables symlinks to ebtables-legacy"
-		eselect ebtables set ebtables-legacy
-	fi
-
-	if ! has_version 'net-firewall/arptables'; then
-		elog "Unsetting arptables symlinks before removal"
-		eselect arptables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting arptables symlinks to arptables-legacy"
-		eselect arptables set arptables-legacy
-	fi
-
-	# The eselect module failing should not be fatal
-	return 0
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10.ebuild
deleted file mode 100644
index 393d59e8671..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.10.ebuild
+++ /dev/null
@@ -1,182 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript
-
-DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://www.netfilter.org/projects/iptables/"
-SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
-
-LICENSE="GPL-2"
-# Subslot reflects PV when libxtables and/or libip*tc was changed
-# the last time.
-SLOT="0/1.8.3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="conntrack netlink nftables pcap static-libs test"
-RESTRICT="!test? ( test )"
-# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
-REQUIRED_USE="test? ( conntrack nftables )"
-
-COMMON_DEPEND="
-	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
-	netlink? ( net-libs/libnfnetlink )
-	nftables? (
-		>=net-libs/libmnl-1.0:=
-		>=net-libs/libnftnl-1.2.6:=
-	)
-	pcap? ( net-libs/libpcap )
-"
-DEPEND="
-	${COMMON_DEPEND}
-	virtual/os-headers
-	>=sys-kernel/linux-headers-4.4:0
-"
-BDEPEND="
-	virtual/pkgconfig
-	nftables? (
-		app-alternatives/lex
-		app-alternatives/yacc
-	)
-"
-RDEPEND="
-	${COMMON_DEPEND}
-	nftables? ( net-misc/ethertypes )
-	!<net-firewall/ebtables-2.0.11-r1
-	!<net-firewall/arptables-0.0.5-r1
-"
-IDEPEND=">=app-eselect/eselect-iptables-20220320"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
-)
-
-src_prepare() {
-	# Use the saner headers from the kernel
-	rm include/linux/{kernel,types}.h || die
-
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# Some libs use $(AR) rather than libtool to build, bug #444282
-	tc-export AR
-
-	# Hack around struct mismatches between userland & kernel for some ABIs
-	# bug #472388
-	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
-
-	sed -i \
-		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
-		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
-		configure || die
-
-	local myeconfargs=(
-		--sbindir="${EPREFIX}/sbin"
-		--libexecdir="${EPREFIX}/$(get_libdir)"
-		--enable-devel
-		--enable-ipv6
-		--enable-shared
-		$(use_enable nftables)
-		$(use_enable pcap bpf-compiler)
-		$(use_enable pcap nfsynproxy)
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	emake V=1
-}
-
-src_install() {
-	default
-
-	# Managed by eselect-iptables
-	# https://bugs.gentoo.org/881295
-	rm "${ED}/usr/bin/iptables-xml" || die
-
-	dodoc iptables/iptables.xslt
-
-	# All the iptables binaries are in /sbin, so might as well
-	# put these small files in with them
-	into /
-	dosbin iptables/iptables-apply
-	dosym iptables-apply /sbin/ip6tables-apply
-	doman iptables/iptables-apply.8
-
-	insinto /usr/include
-	doins include/ip{,6}tables.h
-	insinto /usr/include/iptables
-	doins include/iptables/internal.h
-
-	keepdir /var/lib/ip{,6}tables
-	newinitd "${FILESDIR}"/${PN}-r3.init iptables
-	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
-	dosym iptables /etc/init.d/ip6tables
-	newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
-
-	if use nftables; then
-		# Bug #647458
-		rm "${ED}"/etc/ethertypes || die
-
-		# Bugs #660886 and #669894
-		rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
-	fi
-
-	systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
-
-	# Move important libs to /lib, bug #332175
-	gen_usr_ldscript -a ip{4,6}tc xtables
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_postinst() {
-	local default_iptables="xtables-legacy-multi"
-	if ! eselect iptables show &>/dev/null; then
-		elog "Current iptables implementation is unset, setting to ${default_iptables}"
-		eselect iptables set "${default_iptables}"
-	fi
-
-	if use nftables; then
-		local tables
-		for tables in {arp,eb}tables; do
-			if ! eselect ${tables} show &>/dev/null; then
-				elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
-				eselect ${tables} set xtables-nft-multi
-			fi
-		done
-	fi
-
-	eselect iptables show
-}
-
-pkg_prerm() {
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Unsetting iptables symlinks before removal"
-		eselect iptables unset
-	fi
-
-	if ! has_version 'net-firewall/ebtables'; then
-		elog "Unsetting ebtables symlinks before removal"
-		eselect ebtables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting ebtables symlinks to ebtables-legacy"
-		eselect ebtables set ebtables-legacy
-	fi
-
-	if ! has_version 'net-firewall/arptables'; then
-		elog "Unsetting arptables symlinks before removal"
-		eselect arptables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting arptables symlinks to arptables-legacy"
-		eselect arptables set arptables-legacy
-	fi
-
-	# The eselect module failing should not be fatal
-	return 0
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9-r2.ebuild
deleted file mode 100644
index d726e124e30..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9-r2.ebuild
+++ /dev/null
@@ -1,181 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit systemd toolchain-funcs autotools flag-o-matic
-
-DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://www.netfilter.org/projects/iptables/"
-SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
-
-LICENSE="GPL-2"
-# Subslot reflects PV when libxtables and/or libip*tc was changed
-# the last time.
-SLOT="0/1.8.3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="conntrack netlink nftables pcap static-libs test"
-RESTRICT="!test? ( test )"
-# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
-REQUIRED_USE="test? ( conntrack nftables )"
-
-COMMON_DEPEND="
-	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
-	netlink? ( net-libs/libnfnetlink )
-	nftables? (
-		>=net-libs/libmnl-1.0:=
-		>=net-libs/libnftnl-1.1.6:=
-	)
-	pcap? ( net-libs/libpcap )
-"
-DEPEND="
-	${COMMON_DEPEND}
-	virtual/os-headers
-	>=sys-kernel/linux-headers-4.4:0
-"
-BDEPEND="
-	virtual/pkgconfig
-	nftables? (
-		app-alternatives/lex
-		app-alternatives/yacc
-	)
-"
-RDEPEND="
-	${COMMON_DEPEND}
-	nftables? ( net-misc/ethertypes )
-	!<net-firewall/ebtables-2.0.11-r1
-	!<net-firewall/arptables-0.0.5-r1
-"
-IDEPEND=">=app-eselect/eselect-iptables-20220320"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
-	"${FILESDIR}"/${P}-format-security.patch
-	"${FILESDIR}"/${PN}-1.8.9-fix-checking-existence-of-rule.patch
-)
-
-src_prepare() {
-	# Use the saner headers from the kernel
-	rm include/linux/{kernel,types}.h || die
-
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# Some libs use $(AR) rather than libtool to build, bug #444282
-	tc-export AR
-
-	# Hack around struct mismatches between userland & kernel for some ABIs
-	# bug #472388
-	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
-
-	sed -i \
-		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
-		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
-		configure || die
-
-	local myeconfargs=(
-		--sbindir="${EPREFIX}/sbin"
-		--libexecdir="${EPREFIX}/$(get_libdir)"
-		--enable-devel
-		--enable-ipv6
-		--enable-shared
-		$(use_enable nftables)
-		$(use_enable pcap bpf-compiler)
-		$(use_enable pcap nfsynproxy)
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	emake V=1
-}
-
-src_install() {
-	default
-
-	# Managed by eselect-iptables
-	# https://bugs.gentoo.org/881295
-	rm "${ED}/usr/bin/iptables-xml" || die
-
-	dodoc iptables/iptables.xslt
-
-	# All the iptables binaries are in /sbin, so might as well
-	# put these small files in with them
-	into /
-	dosbin iptables/iptables-apply
-	dosym iptables-apply /sbin/ip6tables-apply
-	doman iptables/iptables-apply.8
-
-	insinto /usr/include
-	doins include/ip{,6}tables.h
-	insinto /usr/include/iptables
-	doins include/iptables/internal.h
-
-	keepdir /var/lib/ip{,6}tables
-	newinitd "${FILESDIR}"/${PN}-r3.init iptables
-	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
-	dosym iptables /etc/init.d/ip6tables
-	newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
-
-	if use nftables; then
-		# Bug #647458
-		rm "${ED}"/etc/ethertypes || die
-
-		# Bugs #660886 and #669894
-		rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
-	fi
-
-	systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_postinst() {
-	local default_iptables="xtables-legacy-multi"
-	if ! eselect iptables show &>/dev/null; then
-		elog "Current iptables implementation is unset, setting to ${default_iptables}"
-		eselect iptables set "${default_iptables}"
-	fi
-
-	if use nftables; then
-		local tables
-		for tables in {arp,eb}tables; do
-			if ! eselect ${tables} show &>/dev/null; then
-				elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
-				eselect ${tables} set xtables-nft-multi
-			fi
-		done
-	fi
-
-	eselect iptables show
-}
-
-pkg_prerm() {
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Unsetting iptables symlinks before removal"
-		eselect iptables unset
-	fi
-
-	if ! has_version 'net-firewall/ebtables'; then
-		elog "Unsetting ebtables symlinks before removal"
-		eselect ebtables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting ebtables symlinks to ebtables-legacy"
-		eselect ebtables set ebtables-legacy
-	fi
-
-	if ! has_version 'net-firewall/arptables'; then
-		elog "Unsetting arptables symlinks before removal"
-		eselect arptables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting arptables symlinks to arptables-legacy"
-		eselect arptables set arptables-legacy
-	fi
-
-	# The eselect module failing should not be fatal
-	return 0
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9.ebuild
deleted file mode 100644
index 89c01328251..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.9.ebuild
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript
-
-DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://www.netfilter.org/projects/iptables/"
-SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
-
-LICENSE="GPL-2"
-# Subslot reflects PV when libxtables and/or libip*tc was changed
-# the last time.
-SLOT="0/1.8.3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="conntrack netlink nftables pcap static-libs"
-
-COMMON_DEPEND="
-	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
-	netlink? ( net-libs/libnfnetlink )
-	nftables? (
-		>=net-libs/libmnl-1.0:=
-		>=net-libs/libnftnl-1.1.6:=
-	)
-	pcap? ( net-libs/libpcap )
-"
-DEPEND="
-	${COMMON_DEPEND}
-	virtual/os-headers
-	>=sys-kernel/linux-headers-4.4:0
-"
-BDEPEND="
-	virtual/pkgconfig
-	nftables? (
-		app-alternatives/lex
-		app-alternatives/yacc
-	)
-"
-RDEPEND="
-	${COMMON_DEPEND}
-	nftables? ( net-misc/ethertypes )
-	!<net-firewall/ebtables-2.0.11-r1
-	!<net-firewall/arptables-0.0.5-r1
-"
-IDEPEND=">=app-eselect/eselect-iptables-20220320"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.8.4-no-symlinks.patch
-	"${FILESDIR}"/${P}-format-security.patch
-)
-
-src_prepare() {
-	# Use the saner headers from the kernel
-	rm include/linux/{kernel,types}.h || die
-
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# Some libs use $(AR) rather than libtool to build, bug #444282
-	tc-export AR
-
-	# Hack around struct mismatches between userland & kernel for some ABIs
-	# bug #472388
-	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
-
-	sed -i \
-		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
-		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
-		configure || die
-
-	local myeconfargs=(
-		--sbindir="${EPREFIX}/sbin"
-		--libexecdir="${EPREFIX}/$(get_libdir)"
-		--enable-devel
-		--enable-ipv6
-		--enable-shared
-		$(use_enable nftables)
-		$(use_enable pcap bpf-compiler)
-		$(use_enable pcap nfsynproxy)
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	emake V=1
-}
-
-src_install() {
-	default
-
-	# Managed by eselect-iptables
-	# https://bugs.gentoo.org/881295
-	rm "${ED}/usr/bin/iptables-xml" || die
-
-	dodoc iptables/iptables.xslt
-
-	# All the iptables binaries are in /sbin, so might as well
-	# put these small files in with them
-	into /
-	dosbin iptables/iptables-apply
-	dosym iptables-apply /sbin/ip6tables-apply
-	doman iptables/iptables-apply.8
-
-	insinto /usr/include
-	doins include/ip{,6}tables.h
-	insinto /usr/include/iptables
-	doins include/iptables/internal.h
-
-	keepdir /var/lib/ip{,6}tables
-	newinitd "${FILESDIR}"/${PN}-r3.init iptables
-	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
-	dosym iptables /etc/init.d/ip6tables
-	newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
-
-	if use nftables; then
-		# Bug #647458
-		rm "${ED}"/etc/ethertypes || die
-
-		# Bugs #660886 and #669894
-		rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
-	fi
-
-	systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
-
-	# Move important libs to /lib, bug #332175
-	gen_usr_ldscript -a ip{4,6}tc xtables
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_postinst() {
-	local default_iptables="xtables-legacy-multi"
-	if ! eselect iptables show &>/dev/null; then
-		elog "Current iptables implementation is unset, setting to ${default_iptables}"
-		eselect iptables set "${default_iptables}"
-	fi
-
-	if use nftables; then
-		local tables
-		for tables in {arp,eb}tables; do
-			if ! eselect ${tables} show &>/dev/null; then
-				elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
-				eselect ${tables} set xtables-nft-multi
-			fi
-		done
-	fi
-
-	eselect iptables show
-}
-
-pkg_prerm() {
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Unsetting iptables symlinks before removal"
-		eselect iptables unset
-	fi
-
-	if ! has_version 'net-firewall/ebtables'; then
-		elog "Unsetting ebtables symlinks before removal"
-		eselect ebtables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting ebtables symlinks to ebtables-legacy"
-		eselect ebtables set ebtables-legacy
-	fi
-
-	if ! has_version 'net-firewall/arptables'; then
-		elog "Unsetting arptables symlinks before removal"
-		eselect arptables unset
-	elif [[ -z ${REPLACED_BY_VERSION} ]]; then
-		elog "Resetting arptables symlinks to arptables-legacy"
-		eselect arptables set arptables-legacy
-	fi
-
-	# The eselect module failing should not be fatal
-	return 0
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
index 3ea3c26c108..49c3f0569c6 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/Manifest
@@ -1,6 +1,4 @@
 DIST nftables-1.1.1.tar.xz 989700 BLAKE2B f273c78369ba755049c6afa63eba195cf29f926fa8fc9bf344022904c00a8c6c4259cc5093e23993a55fd25790af575305df79a7c28624fa7082661b2eed70d0 SHA512 676413d4adadffb15d52c1f8f6432636cab83a7bcda1a18d9f0e6b58819a2c027a49922588c02bd9ad386de930eaa697bfe74c0938b595bf1ee485bfa7cf2e50
 DIST nftables-1.1.1.tar.xz.sig 566 BLAKE2B b7debda3373972f69af9b4b23e1b66a8fd156440187aafba605bb7342c267207e5aa628256e96432ebd4583a6a9436e1969a33636111d2bd8d57185a01e2d502 SHA512 fc23034c512f686167203e827ff2a8f7cb64530211ce92a28793bd49577ce3bf519ffbe910b0071cb21925898497cb5cbf70121c68bfcdbfa4460c63a14203ac
-DIST nftables-1.1.2.tar.xz 1035116 BLAKE2B caa8e8fecb7a832a316ee3cbcf6726dd9774a28bf92f24ac3b331a4ce4d3222a038a5688396c12bc2d63f9a96f9961b6f5b1f476488480d09174b7ba3325527a SHA512 b43f1a7773bf8a14d6599f479bab7fc8763bf9c011b487f98b8f52f10d4b84cfe9ebc1a5fcc3dfa84ac891582bbdc761cb294c0b90181cc2ba5d9e98b058c436
-DIST nftables-1.1.2.tar.xz.sig 566 BLAKE2B 79892fc481a1bc7b3adea25c86140221225f8cd615cea5c90c445f3e60d30f32cf5ed54ae45e8fe8228d1cde71daabb9632bb71e55703b7e205f66fe37cedc34 SHA512 578017e2dc1288c6c705e5554c200e5c9e234529609063ffc8ef125a3342488dae61ff30b0361f81e135a396e05c553c4a7d1f5ee8beb7bff3016b09b920a6f9
 DIST nftables-1.1.3.tar.xz 990172 BLAKE2B 35f4ece6c27b29a14bc71bb7893971134950509a713e84453e1f87df6b07cda327314d6dbbf048032a047652b8817f8ee8a5d74a56e356088495edd1dbbed000 SHA512 b5c244cb6db73eb232e5c999e07403b60c543efb9c4b9991838cc9c43a1bd08ca7b2926233536cbb0cc66e2a9acc4fbddc4b5565f5665e753c107a8739a86040
 DIST nftables-1.1.3.tar.xz.sig 566 BLAKE2B 4f0e9c89213b46d3445a729bf96b1790adc53725f31134f9028297e99d83ac43f5094f9cfa0efee903dc691781dd5d67a814583ff1c645776f1a46266dc2681f SHA512 7aa972c146e0dfaacc8faaef9b9ebbe419f7cbc5814d1fb978b35a4972d384aabe2e6e053fefc6d5d042acb9bff5f35e5f97cbee0c4a0152c53ab9c2e5b0335f
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
index 339c354ab8f..f570106f986 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.1-r1.ebuild
@@ -21,7 +21,7 @@ else
 		https://netfilter.org/projects/nftables/files/${P}.tar.xz
 		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
 	"
-	KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	KEYWORDS="amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.2.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.2.ebuild
deleted file mode 100644
index 8e90c611107..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/nftables/nftables-1.1.2.ebuild
+++ /dev/null
@@ -1,236 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
-inherit eapi9-ver edo linux-info distutils-r1 systemd verify-sig
-
-DESCRIPTION="Linux kernel firewall, NAT and packet mangling tools"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-
-if [[ ${PV} =~ ^[9]{4,}$ ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
-	BDEPEND="app-alternatives/yacc"
-else
-	inherit libtool
-	SRC_URI="
-		https://netfilter.org/projects/nftables/files/${P}.tar.xz
-		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
-	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-netfilter-20240415 )"
-fi
-
-# See COPYING: new code is GPL-2+, existing code is GPL-2
-LICENSE="GPL-2 GPL-2+"
-SLOT="0/1"
-IUSE="debug doc +gmp json libedit python +readline static-libs test xtables"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=net-libs/libmnl-1.0.4:=
-	>=net-libs/libnftnl-1.2.9:=
-	gmp? ( dev-libs/gmp:= )
-	json? ( dev-libs/jansson:= )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-	xtables? ( >=net-firewall/iptables-1.6.1:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	app-alternatives/lex
-	virtual/pkgconfig
-	doc? (
-		app-text/asciidoc
-		>=app-text/docbook2X-0.8.8-r4
-	)
-	python? ( ${DISTUTILS_DEPS} )
-"
-
-REQUIRED_USE="
-	python? ( ${PYTHON_REQUIRED_USE} )
-	libedit? ( !readline )
-"
-
-src_prepare() {
-	default
-
-	if [[ ${PV} =~ ^[9]{4,}$ ]] ; then
-		eautoreconf
-	else
-		elibtoolize
-	fi
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sbindir="${EPREFIX}"/sbin
-		$(use_enable debug)
-		$(use_enable doc man-doc)
-		$(use_with !gmp mini_gmp)
-		$(use_with json)
-		$(use_with libedit cli editline)
-		$(use_with readline cli readline)
-		$(use_enable static-libs static)
-		$(use_with xtables)
-	)
-
-	econf "${myeconfargs[@]}"
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_configure
-		popd >/dev/null || die
-	fi
-}
-
-src_compile() {
-	default
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_test() {
-	emake check
-
-	if [[ ${EUID} == 0 ]]; then
-		edo tests/shell/run-tests.sh -v
-	else
-		ewarn "Skipping shell tests (requires root)"
-	fi
-
-	if use python; then
-		pushd tests/py >/dev/null || die
-		distutils-r1_src_test
-		popd >/dev/null || die
-	fi
-}
-
-python_test() {
-	if [[ ${EUID} == 0 ]]; then
-		edo "${EPYTHON}" nft-test.py
-	else
-		ewarn "Skipping Python tests (requires root)"
-	fi
-}
-
-src_install() {
-	default
-
-	if ! use doc && [[ ! ${PV} =~ ^[9]{4,}$ ]]; then
-		pushd doc >/dev/null || die
-		doman *.?
-		popd >/dev/null || die
-	fi
-
-	# Do it here instead of in src_prepare to avoid eautoreconf
-	# rmdir lets us catch if more files end up installed in /etc/nftables
-	dodir /usr/share/doc/${PF}/skels/
-	mv "${ED}"/etc/nftables/osf "${ED}"/usr/share/doc/${PF}/skels/osf || die
-	rmdir "${ED}"/etc/nftables || die
-
-	exeinto /usr/libexec/${PN}
-	newexe "${FILESDIR}"/libexec/${PN}-mk.sh ${PN}.sh
-	newconfd "${FILESDIR}"/${PN}-mk.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}-mk.init-r1 ${PN}
-	keepdir /var/lib/nftables
-
-	systemd_dounit "${FILESDIR}"/systemd/${PN}-load.service
-	systemd_dounit "${FILESDIR}"/systemd/${PN}-store.service
-
-	if use python ; then
-		pushd py >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	local stderr
-
-	# There's a history of regressions with nftables upgrades. Perform a
-	# safety check to help us spot them earlier. For the check to pass, the
-	# currently loaded ruleset, if any, must be successfully evaluated by
-	# the newly built instance of nft(8).
-	if [[ -n ${ROOT} ]] || [[ ! -d /sys/module/nftables ]] || [[ ! -x /sbin/nft ]]; then
-		# Either nftables isn't yet in use or nft(8) cannot be executed.
-		return
-	elif ! stderr=$(umask 177; /sbin/nft -t list ruleset 2>&1 >"${T}"/ruleset.nft); then
-		# Report errors induced by trying to list the ruleset but don't
-		# treat them as being fatal.
-		printf '%s\n' "${stderr}" >&2
-	elif [[ ${stderr} == *"is managed by iptables-nft"* ]]; then
-		# Rulesets generated by iptables-nft are special in nature and
-		# will not always be printed in a way that constitutes a valid
-		# syntax for ntf(8). Ignore them.
-		return
-	elif set -- "${ED}"/usr/lib*/libnftables.so;
-		! LD_LIBRARY_PATH=${1%/*} "${ED}"/sbin/nft -c -f -- "${T}"/ruleset.nft
-	then
-		eerror "Your currently loaded ruleset cannot be parsed by the newly built instance of"
-		eerror "nft. This probably means that there is a regression introduced by v${PV}."
-		eerror "(To make the ebuild fail instead of warning, set NFTABLES_ABORT_ON_RELOAD_FAILURE=1.)"
-		if [[ -n ${NFTABLES_ABORT_ON_RELOAD_FAILURE} ]] ; then
-			die "Aborting because of failed nft reload!"
-		fi
-	fi
-}
-
-pkg_postinst() {
-	local save_file
-	save_file="${EROOT}"/var/lib/nftables/rules-save
-
-	# In order for the nftables-load systemd service to start
-	# the save_file must exist.
-	if [[ ! -f "${save_file}" ]]; then
-		( umask 177; touch "${save_file}" )
-	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
-		ewarn "Your system has dangerous permissions for ${save_file}"
-		ewarn "It is probably affected by bug #691326."
-		ewarn "You may need to fix the permissions of the file. To do so,"
-		ewarn "you can run the command in the line below as root."
-		ewarn "    'chmod 600 \"${save_file}\"'"
-	fi
-
-	if has_version 'sys-apps/systemd'; then
-		if ver_replacing -lt "1.1.1-r1"; then
-			elog "Starting with ${PN}-1.1.1-r1, the ${PN}-restore.service has"
-			elog "been split into ${PN}-load.service and ${PN}-store.service."
-			elog
-		fi
-		elog "If you wish to enable the firewall rules on boot (on systemd) you"
-		elog "will need to enable the nftables-load service."
-		elog "    'systemctl enable ${PN}-load.service'"
-		elog
-		elog "Enable nftables-store.service if you want firewall rules to be"
-		elog "saved at shutdown."
-	fi
-
-	if has_version 'sys-apps/openrc'; then
-		elog "If you wish to enable the firewall rules on boot (on openrc) you"
-		elog "will need to enable the nftables service."
-		elog "    'rc-update add ${PN} default'"
-		elog
-		elog "If you are creating or updating the firewall rules and wish to save"
-		elog "them to be loaded on the next restart, use the \"save\" functionality"
-		elog "in the init script."
-		elog "    'rc-service ${PN} save'"
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
index 6c722804a3b..427fc00cfa1 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -46,6 +46,7 @@ PATCHES=(
 	"${FILESDIR}/${PN}-6.12-ln_in_destdir.patch" #766594
 	"${FILESDIR}/${PN}-6.15-musl.patch"
 	"${FILESDIR}/${PN}-7.0-no-clobber-fortify-source.patch"
+	"${FILESDIR}/${PN}-7.0-musl.patch"
 )
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
index 53562db9382..c46b5251d34 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.3.ebuild
@@ -44,6 +44,7 @@ DOCS="doc/linux-cifs-client-guide.odt"
 
 PATCHES=(
 	"${FILESDIR}/${PN}-7.3-no-clobber-fortify-source.patch"
+	"${FILESDIR}/${PN}-7.0-musl.patch"
 )
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch
new file mode 100644
index 00000000000..cca3a936604
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/files/cifs-utils-7.0-musl.patch
@@ -0,0 +1,63 @@
+https://lore.kernel.org/linux-cifs/CALMA0xaVdk3qwkb-92QqF2+6z+=oxbBWDR1hYEoE2WUc7jVGkw@mail.gmail.com/T/#u
+
+From abd3d9a2d4f8a5dc4d90daddc7cf0c62d954f03a Mon Sep 17 00:00:00 2001
+From: "Z. Liu" <zhixu.liu@gmail.com>
+Date: Fri, 2 May 2025 23:08:41 +0800
+Subject: [PATCH] getcifsacl, setcifsacl: use <libgen.h> for basename
+
+basename() is defined in <libgen.h> only in musl, while glibc defines it
+in <string.h> too, which is not standard behavior.
+
+Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
+
+diff --git a/getcifsacl.c b/getcifsacl.c
+index 97471e9..6c6356f 100644
+--- a/getcifsacl.c
++++ b/getcifsacl.c
+@@ -33,6 +33,7 @@
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <errno.h>
++#include <libgen.h>
+ #include <limits.h>
+ #include <ctype.h>
+ #include <linux/limits.h>
+diff --git a/setcifsacl.c b/setcifsacl.c
+index b199118..3cb603c 100644
+--- a/setcifsacl.c
++++ b/setcifsacl.c
+@@ -47,6 +47,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <errno.h>
++#include <libgen.h>
+ #include <limits.h>
+ #include <ctype.h>
+ #include <linux/limits.h>
+-- 
+2.45.2
+
+From ae644b56a4446f520a75217f9288775e127ab2c8 Mon Sep 17 00:00:00 2001
+From: "Z. Liu" <zhixu.liu@gmail.com>
+Date: Tue, 13 May 2025 07:31:46 +0800
+Subject: [PATCH] cifscreds: use <libgen.h> for basename
+
+fix another implicit declaration of function 'basename' in musl
+
+Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
+
+diff --git a/cifscreds.c b/cifscreds.c
+index f552bc8..295059f 100644
+--- a/cifscreds.c
++++ b/cifscreds.c
+@@ -29,6 +29,7 @@
+ #include <keyutils.h>
+ #include <getopt.h>
+ #include <errno.h>
++#include <libgen.h>
+ #include "cifskey.h"
+ #include "mount.h"
+ #include "resolve_host.h"
+-- 
+2.45.2
+
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.7.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.7.ebuild
index b71f2f9b624..774b460f441 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.7.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..12} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.8.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.8.ebuild
index 14c64b2ad49..6e77e457865 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.8.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..12} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.9.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.9.ebuild
index bd4f6d5797f..61f2ddeda8d 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.19.9.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..12} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.5.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.5.ebuild
index 92740c1a10d..9bd9c33a73a 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.5.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
index 6e10e7221e5..eeaee81bb91 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.7.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -16,7 +16,7 @@ if [[ ${PV} == *_rc* ]]; then
 	SRC_URI="https://download.samba.org/pub/samba/rc/${MY_P}.tar.gz"
 else
 	SRC_URI="https://download.samba.org/pub/samba/stable/${MY_P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv sparc x86"
 fi
 S="${WORKDIR}/${MY_P}"
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8.ebuild
index ba5c0cd3c89..4e028f7b9c9 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.20.8.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -88,7 +88,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.0.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.0.ebuild
index fb93abd5924..88881ecd868 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.0.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -27,11 +27,13 @@ IUSE+=" iprint json ldap llvm-libunwind pam profiling-data python quota +regedit
 IUSE+=" snapper spotlight syslog system-heimdal +system-mitkrb5 systemd test unwind winbind"
 IUSE+=" zeroconf"
 
+# ldap needs ads (bug #941578)
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	addc? ( json python !system-mitkrb5 winbind )
 	ads? ( acl ldap python winbind )
 	cluster? ( ads )
 	gpg? ( addc )
+	ldap? ( ads )
 	spotlight? ( json )
 	test? ( python )
 	!ads? ( !addc )
@@ -87,7 +89,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
@@ -262,7 +264,6 @@ multilib_src_configure() {
 		--without-winexe
 		$(multilib_native_use_with acl acl-support)
 		$(multilib_native_usex addc '' '--without-ad-dc')
-		$(multilib_native_use_with ads)
 		$(multilib_native_use_enable ceph cephfs)
 		$(multilib_native_use_with cluster cluster-support)
 		$(multilib_native_use_enable cups)
@@ -287,6 +288,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable zeroconf avahi)
 		$(multilib_native_usex test '--enable-selftest' '')
 		$(usev system-mitkrb5 "--with-system-mitkrb5 ${ESYSROOT}/usr $(multilib_native_usex addc --with-experimental-mit-ad-dc '')")
+		$(use_with ads)
 		$(use_with debug lttng)
 		$(use_with ldap)
 		$(use_with profiling-data)
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.1.ebuild
index 71fd45394a0..2cdfea3e095 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -27,11 +27,13 @@ IUSE+=" iprint json ldap llvm-libunwind lmdb pam profiling-data python quota"
 IUSE+=" +regedit selinux snapper spotlight syslog system-heimdal +system-mitkrb5"
 IUSE+=" systemd test unwind winbind zeroconf"
 
+# ldap needs ads (bug #941578)
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	addc? ( json python !system-mitkrb5 winbind )
 	ads? ( acl ldap python winbind )
 	cluster? ( ads )
 	gpg? ( addc )
+	ldap? ( ads )
 	spotlight? ( json )
 	test? ( python )
 	!ads? ( !addc )
@@ -87,7 +89,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
@@ -266,7 +268,6 @@ multilib_src_configure() {
 		--without-winexe
 		$(multilib_native_use_with acl acl-support)
 		$(multilib_native_usex addc '' '--without-ad-dc')
-		$(multilib_native_use_with ads)
 		$(multilib_native_use_enable ceph cephfs)
 		$(multilib_native_use_with cluster cluster-support)
 		$(multilib_native_use_enable cups)
@@ -291,6 +292,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable zeroconf avahi)
 		$(multilib_native_usex test '--enable-selftest' '')
 		$(usev system-mitkrb5 "--with-system-mitkrb5 ${ESYSROOT}/usr $(multilib_native_usex addc --with-experimental-mit-ad-dc '')")
+		$(use_with ads)
 		$(use_with debug lttng)
 		$(use_with ldap)
 		$(use_with profiling-data)
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.4.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.4.ebuild
index 71fd45394a0..2cdfea3e095 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -27,11 +27,13 @@ IUSE+=" iprint json ldap llvm-libunwind lmdb pam profiling-data python quota"
 IUSE+=" +regedit selinux snapper spotlight syslog system-heimdal +system-mitkrb5"
 IUSE+=" systemd test unwind winbind zeroconf"
 
+# ldap needs ads (bug #941578)
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	addc? ( json python !system-mitkrb5 winbind )
 	ads? ( acl ldap python winbind )
 	cluster? ( ads )
 	gpg? ( addc )
+	ldap? ( ads )
 	spotlight? ( json )
 	test? ( python )
 	!ads? ( !addc )
@@ -87,7 +89,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
@@ -266,7 +268,6 @@ multilib_src_configure() {
 		--without-winexe
 		$(multilib_native_use_with acl acl-support)
 		$(multilib_native_usex addc '' '--without-ad-dc')
-		$(multilib_native_use_with ads)
 		$(multilib_native_use_enable ceph cephfs)
 		$(multilib_native_use_with cluster cluster-support)
 		$(multilib_native_use_enable cups)
@@ -291,6 +292,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable zeroconf avahi)
 		$(multilib_native_usex test '--enable-selftest' '')
 		$(usev system-mitkrb5 "--with-system-mitkrb5 ${ESYSROOT}/usr $(multilib_native_usex addc --with-experimental-mit-ad-dc '')")
+		$(use_with ads)
 		$(use_with debug lttng)
 		$(use_with ldap)
 		$(use_with profiling-data)
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.5.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.5.ebuild
index 71fd45394a0..2cdfea3e095 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.21.5.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -27,11 +27,13 @@ IUSE+=" iprint json ldap llvm-libunwind lmdb pam profiling-data python quota"
 IUSE+=" +regedit selinux snapper spotlight syslog system-heimdal +system-mitkrb5"
 IUSE+=" systemd test unwind winbind zeroconf"
 
+# ldap needs ads (bug #941578)
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	addc? ( json python !system-mitkrb5 winbind )
 	ads? ( acl ldap python winbind )
 	cluster? ( ads )
 	gpg? ( addc )
+	ldap? ( ads )
 	spotlight? ( json )
 	test? ( python )
 	!ads? ( !addc )
@@ -87,7 +89,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
@@ -266,7 +268,6 @@ multilib_src_configure() {
 		--without-winexe
 		$(multilib_native_use_with acl acl-support)
 		$(multilib_native_usex addc '' '--without-ad-dc')
-		$(multilib_native_use_with ads)
 		$(multilib_native_use_enable ceph cephfs)
 		$(multilib_native_use_with cluster cluster-support)
 		$(multilib_native_use_enable cups)
@@ -291,6 +292,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable zeroconf avahi)
 		$(multilib_native_usex test '--enable-selftest' '')
 		$(usev system-mitkrb5 "--with-system-mitkrb5 ${ESYSROOT}/usr $(multilib_native_usex addc --with-experimental-mit-ad-dc '')")
+		$(use_with ads)
 		$(use_with debug lttng)
 		$(use_with ldap)
 		$(use_with profiling-data)
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.0.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.0.ebuild
index 7be7132823d..3fa4ed236dd 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/samba/samba-4.22.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="threads(+),xml(+)"
 inherit python-single-r1 flag-o-matic waf-utils multilib-minimal linux-info systemd pam tmpfiles
 
@@ -27,11 +27,13 @@ IUSE+=" iprint json ldap llvm-libunwind lmdb pam profiling-data python quota"
 IUSE+=" +regedit selinux snapper spotlight syslog system-heimdal +system-mitkrb5"
 IUSE+=" systemd test unwind winbind zeroconf"
 
+# ldap needs ads (bug #941578)
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	addc? ( json python !system-mitkrb5 winbind )
 	ads? ( acl ldap python winbind )
 	cluster? ( ads )
 	gpg? ( addc )
+	ldap? ( ads )
 	spotlight? ( json )
 	test? ( python )
 	!ads? ( !addc )
@@ -87,7 +89,7 @@ COMMON_DEPEND="
 		)
 		ads? (
 			dev-python/dnspython:=[${PYTHON_USEDEP}]
-			net-dns/bind-tools[gssapi]
+			net-dns/bind[gssapi]
 		)
 	')
 	acl? ( virtual/acl )
@@ -266,7 +268,6 @@ multilib_src_configure() {
 		--without-winexe
 		$(multilib_native_use_with acl acl-support)
 		$(multilib_native_usex addc '' '--without-ad-dc')
-		$(multilib_native_use_with ads)
 		$(multilib_native_use_enable ceph cephfs)
 		$(multilib_native_use_with cluster cluster-support)
 		$(multilib_native_use_enable cups)
@@ -291,6 +292,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable zeroconf avahi)
 		$(multilib_native_usex test '--enable-selftest' '')
 		$(usev system-mitkrb5 "--with-system-mitkrb5 ${ESYSROOT}/usr $(multilib_native_usex addc --with-experimental-mit-ad-dc '')")
+		$(use_with ads)
 		$(use_with debug lttng)
 		$(use_with ldap)
 		$(use_with profiling-data)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
index a28046f1628..f19183e2c56 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/Manifest
@@ -1,7 +1,3 @@
-DIST libnftnl-1.2.6.tar.xz 336684 BLAKE2B a08010b26db0c7a5429f33a92ca4f17e8e158005befa5f7e3f37d60456d1b481a3f95f46c0bcec74e98ab040940f533acc279672226f0abc6ce73a26ff56718a SHA512 0c8c369eec84b0c568f0067598bece6e3be9a0fbd977e443ae3b14a5a6d842a6086ceb5426a65f8c77204709655f148c1241193f1a928f8c12154a57e3548b34
-DIST libnftnl-1.2.6.tar.xz.sig 566 BLAKE2B 8ad336d0d8c693beb6335e874ad62040257e0c4527f8acb32fcc8b4889eea88ba3a42c9b2b795db6f6e3d148066ee0a9217b1e30c7e784c793458dd480ee624a SHA512 61288aa03fb80d43d09866ce549815202f682b30b283cf3119ced0fe59536d10f1c029e433651d1cb31115e977b660886a153f3361f5cafdbb0ed6da602e5b2f
-DIST libnftnl-1.2.7.tar.xz 343876 BLAKE2B 42decbfdfce07c4743e7a55cf3d5d03a244ab6ac5e0f33107322ab44edcc96d360ac02f0376786656a5f7d43986499474e20a5b835f838e06d12efb017dd8eb4 SHA512 24ff3e7e97f51cb5dfda2fbd2f5e175abcec0dd58f94936022800ec356ff004a531f0915df72278b867769ba71473d407b01d52cc33a3cafb043d9a90b051f9d
-DIST libnftnl-1.2.7.tar.xz.sig 566 BLAKE2B ad79b0a149d37c0ae32bcf8c64b34e02146242ce731f6860bd8d63d90e96a58e04616d543783b8edc13a0f2ca6286c16c9d8b17c34d8e8920f680a17ee70bde0 SHA512 8bf9188a287850a5057be452541871af69187c4dacde580c57be15e7f3357ab4a874745f326880260e2c2b1486e59b684db41b0d8afd57bab9d77ad62ba052bd
 DIST libnftnl-1.2.8.tar.xz 343732 BLAKE2B 274fcdd9c7c0de173e9b2b35d79613e3f6f41d56a9223145d87f93d4f7c0bb085fd622581ecc69f248be4641874fd60b294ebf12cb4d4ed1ceea9b410ef70187 SHA512 c57030f34c50b09ae2fbf8dac5d9cf431eaaa5a5a08098e3e4c146a8bd4ae9b7753f5d2de5f2d0a6c15e5ba0c39f51275c9d8b03bdedeaadbafa6c96f9a972b6
 DIST libnftnl-1.2.8.tar.xz.sig 566 BLAKE2B 2c8eae671d41f84b1ded96f7dc98e214a240cc4025265e3008b986554c2d30d830c5f15c2e4b77d0a80d889cd7a0a85403c80bc905019734611baa25575b9daf SHA512 f56a5f049dab8397f4ff84070d782f17b701b46bd42c84cb3fb2b7241a7543f0b5f2877e7d6d95fb942f36119e54c939f89af964ea08858d2c41dc9fd7323b16
 DIST libnftnl-1.2.9.tar.xz 345708 BLAKE2B c29591c78afae0d76b3c412d95999ad5e3d7e581dd1187858a1e57f7b6ff74caf1910724f553de6d716b37529cdf44f23a7a37ff63f04e554d294af398e06df5 SHA512 48f6a3e67ad368340690bed2c8db8d0fab5528f23bc9cf3f5f6dca81c90db340b526d7dbeff1fb59989337e80d3b16cf02443e2a2d5c07b54c8963d2bf4c56e3
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild
deleted file mode 100644
index ec50cf89c56..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild
+++ /dev/null
@@ -1,71 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
-inherit linux-info verify-sig
-
-DESCRIPTION="Netlink API to the in-kernel nf_tables subsystem"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-
-if [[ ${PV} =~ ^[9]{4,}$ ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
-else
-	SRC_URI="
-		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
-		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
-	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
-fi
-
-LICENSE="GPL-2"
-SLOT="0/11" # libnftnl.so version
-IUSE="examples static-libs test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=net-libs/libmnl-1.0.4:=
-"
-BDEPEND+="
-	virtual/pkgconfig
-"
-DEPEND="${RDEPEND}"
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-
-	[[ ${PV} =~ ^[9]{4,}$ ]] && eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	if use examples; then
-		find examples/ -name 'Makefile*' -delete || die "Could not rm examples"
-		dodoc -r examples
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6.ebuild
deleted file mode 100644
index 4cb87555a86..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6.ebuild
+++ /dev/null
@@ -1,73 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
-inherit linux-info usr-ldscript verify-sig
-
-DESCRIPTION="Netlink API to the in-kernel nf_tables subsystem"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-
-if [[ ${PV} =~ ^[9]{4,}$ ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
-else
-	SRC_URI="
-		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
-		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
-	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
-fi
-
-LICENSE="GPL-2"
-SLOT="0/11" # libnftnl.so version
-IUSE="examples static-libs test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=net-libs/libmnl-1.0.4:=
-"
-BDEPEND+="
-	virtual/pkgconfig
-"
-DEPEND="${RDEPEND}"
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-
-	[[ ${PV} =~ ^[9]{4,}$ ]] && eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nftnl
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	if use examples; then
-		find examples/ -name 'Makefile*' -delete || die "Could not rm examples"
-		dodoc -r examples
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.7.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.7.ebuild
deleted file mode 100644
index ec50cf89c56..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.7.ebuild
+++ /dev/null
@@ -1,71 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
-inherit linux-info verify-sig
-
-DESCRIPTION="Netlink API to the in-kernel nf_tables subsystem"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-
-if [[ ${PV} =~ ^[9]{4,}$ ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
-else
-	SRC_URI="
-		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
-		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
-	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
-fi
-
-LICENSE="GPL-2"
-SLOT="0/11" # libnftnl.so version
-IUSE="examples static-libs test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=net-libs/libmnl-1.0.4:=
-"
-BDEPEND+="
-	virtual/pkgconfig
-"
-DEPEND="${RDEPEND}"
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-
-	[[ ${PV} =~ ^[9]{4,}$ ]] && eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	if use examples; then
-		find examples/ -name 'Makefile*' -delete || die "Could not rm examples"
-		dodoc -r examples
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/files/nghttp2-1.65.0-gcc16.patch b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/files/nghttp2-1.65.0-gcc16.patch
new file mode 100644
index 00000000000..9ec93985404
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/files/nghttp2-1.65.0-gcc16.patch
@@ -0,0 +1,29 @@
+https://github.com/nghttp2/nghttp2/commit/1440e883475488ddda25556c7b3d9f78694716ba
+
+From 1440e883475488ddda25556c7b3d9f78694716ba Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyich@gmail.com>
+Date: Fri, 30 May 2025 21:20:51 +0100
+Subject: [PATCH] src/template.h: add missing `cstdint` include
+
+Without the change build against upcoming gcc-16 fails as:
+
+    template.h:457:9: error: ISO C++ forbids declaration of 'type name' with no type [-fpermissive]
+      457 |   const uint8_t, N == std::dynamic_extent ? std::dynamic_extent : N * sizeof(T)>
+          |         ^~~~~~~
+---
+ src/template.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/template.h b/src/template.h
+index e154057fd4..4f0622b2c4 100644
+--- a/src/template.h
++++ b/src/template.h
+@@ -27,6 +27,7 @@
+ 
+ #include "nghttp2_config.h"
+ 
++#include <cstdint>
+ #include <cstring>
+ #include <cstdio>
+ #include <cstdlib>
+
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
index bd68d3e0955..dd90ced922b 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0-r2.ebuild
@@ -35,11 +35,15 @@ RDEPEND="
 		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
 	)
 	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )
+	xml? ( >=dev-libs/libxml2-2.7.7:2=[${MULTILIB_USEDEP}] )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
+PATCHES=(
+	"${FILESDIR}"/${P}-gcc16.patch
+)
+
 src_prepare() {
 	default
 	[[ ${PV} == 9999 ]] && eautoreconf
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild
deleted file mode 100644
index 4aaf85ea7b6..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-1.65.0.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit cmake-multilib
-
-DESCRIPTION="HTTP/2 C Library"
-HOMEPAGE="https://nghttp2.org/"
-SRC_URI="https://github.com/nghttp2/nghttp2/releases/download/v${PV}/${P}.tar.xz"
-
-LICENSE="MIT"
-SLOT="0/1.14" # 1.<SONAME>
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="debug hpack-tools jemalloc static-libs systemd test utils xml"
-
-REQUIRED_USE="test? ( static-libs )"
-RESTRICT="!test? ( test )"
-
-SSL_DEPEND="
-	>=dev-libs/openssl-1.0.2:0=[-bindist(-),${MULTILIB_USEDEP}]
-"
-RDEPEND="
-	hpack-tools? ( >=dev-libs/jansson-2.5:= )
-	jemalloc? ( dev-libs/jemalloc:=[${MULTILIB_USEDEP}] )
-	utils? (
-		${SSL_DEPEND}
-		>=dev-libs/libev-4.15[${MULTILIB_USEDEP}]
-		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
-		net-dns/c-ares:=[${MULTILIB_USEDEP}]
-	)
-	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
-
-multilib_src_configure() {
-	#TODO: enable HTTP3
-	#requires quictls/openssl, libngtcp2, libngtcp2_crypto_quictls, libnghttp3
-	local mycmakeargs=(
-		-DENABLE_EXAMPLES=OFF
-		-DENABLE_FAILMALLOC=OFF
-		-DENABLE_HTTP3=OFF
-		-DENABLE_WERROR=OFF
-		-DENABLE_THREADS=ON
-		-DENABLE_DEBUG=$(usex debug)
-		-DENABLE_HPACK_TOOLS=$(multilib_native_usex hpack-tools)
-		$(cmake_use_find_package hpack-tools Jansson)
-		-DWITH_JEMALLOC=$(multilib_native_usex jemalloc)
-		-DBUILD_STATIC_LIBS=$(usex static-libs)
-		-DBUILD_TESTING=$(usex test)
-		$(cmake_use_find_package systemd Systemd)
-		-DENABLE_APP=$(multilib_native_usex utils)
-		-DWITH_LIBXML2=$(multilib_native_usex xml)
-	)
-	cmake_src_configure
-}
-
-multilib_src_test() {
-	eninja check
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
index 9f6a317734d..60883face4f 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/nghttp2/nghttp2-9999.ebuild
@@ -35,7 +35,7 @@ RDEPEND="
 		>=sys-libs/zlib-1.2.3[${MULTILIB_USEDEP}]
 	)
 	systemd? ( >=sys-apps/systemd-209 )
-	xml? ( >=dev-libs/libxml2-2.7.7:2[${MULTILIB_USEDEP}] )
+	xml? ( >=dev-libs/libxml2-2.7.7:2=[${MULTILIB_USEDEP}] )
 "
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.4.4-prebuilt-rpcgen.patch b/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.4.4-prebuilt-rpcgen.patch
new file mode 100644
index 00000000000..ef881a92c13
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.4.4-prebuilt-rpcgen.patch
@@ -0,0 +1,43 @@
+From 7dc8c2a5051208c8808405c8bbdb3fca0cf43f74 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <chewi@gentoo.org>
+Date: Fri, 2 May 2025 16:39:19 +0100
+Subject: [PATCH] configure.ac: Add --with-prebuilt-rpcgen option for
+ cross-compiling
+
+If given an argument, it will use that program to generate the rpcsvc
+headers. Otherwise, it will use "rpcgen" from the PATH.
+
+Closes: https://github.com/thkukuk/rpcsvc-proto/issues/13
+Signed-off-by: James Le Cuirot <chewi@gentoo.org>
+--- a/configure.ac
++++ b/configure.ac
+@@ -23,4 +23,18 @@ AM_GNU_GETTEXT([external])
+ AM_GNU_GETTEXT_VERSION([0.20.2])
+ AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.2])
+ 
++RPCGEN='$(top_builddir)/rpcgen/rpcgen'
++AC_ARG_WITH([prebuilt-rpcgen],
++  AS_HELP_STRING(
++    [--with-prebuilt-rpcgen],
++    [use prebuilt rpcgen to generate rpcsvc headers]
++  ),
++  AS_CASE([$withval],
++    [no],  [],
++    [yes], [RPCGEN=rpcgen],
++           [RPCGEN=$withval]
++  )
++)
++AC_SUBST([RPCGEN])
++
+ AC_OUTPUT([Makefile rpcgen/Makefile rpcsvc/Makefile po/Makefile.in])
+--- a/rpcsvc/Makefile.am
++++ b/rpcsvc/Makefile.am
+@@ -12,4 +12,4 @@ nodist_rpcsvc_HEADERS = klm_prot.h nlm_prot.h rstat.h spray.h \
+ 	nfs_prot.h rquota.h sm_inter.h
+ 
+ .x.h:
+-	$(top_builddir)/rpcgen/rpcgen -h -o $@ $<
++	$(RPCGEN) -h -o $@ $<
+-- 
+2.49.0
+
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/rpcsvc-proto-1.4.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/rpcsvc-proto-1.4.4-r1.ebuild
new file mode 100644
index 00000000000..7f825b44e13
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/rpcsvc-proto/rpcsvc-proto-1.4.4-r1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools toolchain-funcs
+
+DESCRIPTION="rpcsvc protocol definitions from glibc"
+HOMEPAGE="https://github.com/thkukuk/rpcsvc-proto"
+SRC_URI="https://github.com/thkukuk/rpcsvc-proto/releases/download/v${PV}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1+ BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	!<sys-libs/glibc-2.26
+	virtual/libintl
+"
+DEPEND="${RDEPEND}"
+# sys-devel/gettext is only for libintl detection macros.
+BDEPEND="sys-devel/gettext"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.4.4-prebuilt-rpcgen.patch
+)
+
+src_prepare() {
+	default
+	eautoreconf
+
+	# Search for a valid 'cpp' command.
+	# The CPP envvar might contain '${CC} -E', which does not work for rpcgen.
+	# Bug 718138, 870031, 870061.
+	local x cpp=
+	for x in {${CHOST}-,}{,clang-}cpp; do
+		if type -P "${x}" >/dev/null; then
+			cpp=${x}
+			break
+		fi
+	done
+	[[ -n ${cpp} ]] || die "Unable to find cpp"
+	sed -i -e "s/CPP = \"cpp\";/CPP = \"${cpp}\";/" rpcgen/rpc_main.c || die
+}
+
+src_configure() {
+	local myconf=()
+
+	if tc-is-cross-compiler; then
+		mkdir "${WORKDIR}"/build || die
+		pushd "${WORKDIR}"/build >/dev/null || die
+		ECONF_SOURCE="${S}" econf_build
+		popd >/dev/null || die
+		myconf+=( --with-prebuilt-rpcgen="${WORKDIR}"/build/rpcgen/rpcgen )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	tc-is-cross-compiler && emake -C "${WORKDIR}"/build/rpcgen
+	emake
+}
+
+src_install() {
+	default
+
+	# provided by sys-fs/quota[rpc]
+	rm "${ED}"/usr/include/rpcsvc/rquota.{x,h} || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index 6f6b67b13aa..a21c7e37b49 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -2,5 +2,5 @@ DIST curl-8.12.1.tar.xz 2768160 BLAKE2B 2b3e3d91041881c0951ad470736266105d3b9720
 DIST curl-8.12.1.tar.xz.asc 488 BLAKE2B 2a6563609c9f7ada84ca2c7048ad9406809eef4cc958760d2ab3d1b7be58d26247e579bd025870609e80ebb00295026aae30614b84e3a81bdf3ed3dbd0f5ed70 SHA512 41fc5582935090d13940d86974fdea3ea901dd5dab156c16029a87f811d2535172c59dc8dc366f2ffc37bcf85accbecb5aa765bc7b83c2991a3ef402bf25af69
 DIST curl-8.13.0.tar.xz 2773628 BLAKE2B 6869634ad50f015d5c7526699034d5a3f27d9588bc32eacc8080dbd6c690f63b1f25cee40d3fdf8fd9dd8535c305ea9c5edf1d5a02bc6d9ce60fd8c88230aca0 SHA512 d266e460f162ee455b56726e5b7247b2d1aa5265ae12081513fc0c5c79e785a594097bc71d505dc9bcd2c2f6f1ff6f4bab9dbd9d120bb76d06c5be8521a8ca7d
 DIST curl-8.13.0.tar.xz.asc 488 BLAKE2B bd568ec32a44ef7c14c38e4830bcc7711dac726e950325292f1e5de76e619839685300c5afac32330127324327e71ce0d6e574f6e95bcc4a48957345152bc86a SHA512 07f79c7fd7c305c96e10a5f52797254aed7d2a1f3577c8626b8d617855ceb82634ac6787bfa0b7130a4ed72c3a9945d3c9ba5b7be54df8bafa07ded1c62ef2be
-DIST curl-8.14.0-rc1.tar.xz 2807988 BLAKE2B 026f0706c23cf865cbcbb36159a1b5a65759534591675f87be06378c652e9c0b6a8c91d4fa78f7889152293a50621521af8431c7f3aecfedac26743368485f29 SHA512 e9bd9e5c95580ee04171de937ff852c30b4606ef28a0250c1fdd231d7155089d3591e0dbed1f10280c9868b66329c1c9badf9a0e15e3e2721ab103627e92caa3
-DIST curl-8.14.0-rc1.tar.xz.asc 488 BLAKE2B b44bbb1a9e769d64f17a7bca00e54468e3d2e915566431358fd3b764767afb29f64510c718fccbed7ea15b94c7575c3efb161d16fe17fe113851a0e4bbf16b1f SHA512 f02e0fd84bffcbe31fa6ccdba41729be86404241c177087500d4d992278d217ea55d73a9bc260b601ddeef70738e45b799a2bd49c68db05adfe8c127434f5708
+DIST curl-8.14.0.tar.xz 2819512 BLAKE2B d8b7d58e6923366265a1d95d3a6f14002729dfb95d88b17ec925d096bd199b206f6c9645e1e4be3bc2d295e8898c35990eda6f45329396f38753725907e402a1 SHA512 d9f49cac0b93dbc53879713cc017392b4277d84b489bbf2ef3b585c6a50eea6c3a7b80043286b34062af04329560f2dc321f315b0038ce93435aa9bbcaec1eea
+DIST curl-8.14.0.tar.xz.asc 488 BLAKE2B 9fa2fe756d7c170b4fc883bd0c23eb103d947e8328d56ea3dea53403d3cd01626ada943595179955f55a77eb8f4da65b5e4d74fe5627fc8c5ab4d88efbb5df3e SHA512 7c147ddb5e141dd9951e2ef6b23fa120318c0e631fb36861b80fce61b4b19ca08273a6b95627f46a8172945fb51bd790ffc74dee0a4b0de860dad518963b4710
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0-r1.ebuild
index 0f146fdc07c..59963eb1e4c 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0-r1.ebuild
@@ -22,7 +22,7 @@ else
 		S="${WORKDIR}/${P//_/-}"
 	else
 		CURL_URI="https://curl.se/download/"
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 	SRC_URI="
 		${CURL_URI}${P//_/-}.tar.xz
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0_rc1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0.ebuild
index bdceb348fcc..db6300f056b 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.0.ebuild
@@ -177,6 +177,7 @@ QA_CONFIG_IMPL_DECL_SKIP=(
 PATCHES=(
 	"${FILESDIR}/${PN}-prefix-4.patch"
 	"${FILESDIR}/${PN}-respect-cflags-3.patch"
+	"${FILESDIR}/${P}-add_handle-resizing.patch"
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.14.0-add_handle-resizing.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.14.0-add_handle-resizing.patch
new file mode 100644
index 00000000000..0bbf0262bd1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.14.0-add_handle-resizing.patch
@@ -0,0 +1,187 @@
+https://github.com/curl/curl/commit/d16ccbd55de80c271fe822f4ba8b6271fd9166ff
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 28 May 2025 14:04:31 +0200
+Subject: [PATCH] multi: fix add_handle resizing
+
+Due to someone being stupid, the resizing of the multi's transfer
+table was actually shrinking it. Oh my.
+
+Add test751 to reproduce, add code assertion.
+
+Fixes #17473
+Reported-by: Jeroen Ooms
+Closes #17475
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -347,7 +347,8 @@ static CURLMcode multi_xfers_add(struct Curl_multi *multi,
+   if(unused <= min_unused) {
+      /* make it a 64 multiple, since our bitsets frow by that and
+       * small (easy_multi) grows to at least 64 on first resize. */
+-    unsigned int newsize = ((capacity + min_unused) + 63) / 64;
++    unsigned int newsize = (((capacity + min_unused) + 63) / 64) * 64;
++    DEBUGASSERT(newsize > capacity);
+     /* Grow the bitsets first. Should one fail, we do not need
+      * to downsize the already resized ones. The sets continue
+      * to work properly when larger than the table, but not
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -107,7 +107,7 @@ test709 test710 test711 test712 test713 test714 test715 test716 test717 \
+ test718 test719 test720 test721 test722 test723 test724 test725 test726 \
+ test727 test728 test729 test730 test731 test732 test733 test734 test735 \
+ test736 test737 test738 test739 test740 test741 test742 test743 test744 \
+-test745 test746 test747 test748 test749 test750 \
++test745 test746 test747 test748 test749 test750 test751 \
+ \
+ test780 test781 test782 test783 test784 test785 test786 test787 test788 \
+ test789 test790 test791 \
+--- /dev/null
++++ b/tests/data/test751
+@@ -0,0 +1,33 @@
++<testcase>
++<info>
++<keywords>
++MULTI
++</keywords>
++</info>
++<reply>
++<data>
++</data>
++</reply>
++
++# Client-side
++<client>
++<server>
++none
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++
++<name>
++multi - add many easy handles
++</name>
++<command>
++</command>
++</file>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++</verify>
++</testcase>
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -50,6 +50,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq                     \
+  lib659 lib661 lib666 lib667 lib668 \
+  lib670 lib671 lib672 lib673 lib674 lib676 lib677 lib678 lib694 lib695   \
+  lib696 \
++ lib751 \
+  lib1156 \
+  lib1301 \
+  lib1308 \
+@@ -349,6 +350,9 @@ lib695_SOURCES = lib695.c $(SUPPORTFILES)
+ lib696_SOURCES = lib556.c $(SUPPORTFILES) $(WARNLESS)
+ lib696_CPPFLAGS = $(AM_CPPFLAGS) -DLIB696
+ 
++lib751_SOURCES = lib751.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib751_LDADD = $(TESTUTIL_LIBS)
++
+ lib1301_SOURCES = lib1301.c $(SUPPORTFILES) $(TESTUTIL)
+ lib1301_LDADD = $(TESTUTIL_LIBS)
+ 
+--- /dev/null
++++ b/tests/libtest/lib751.c
+@@ -0,0 +1,92 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "test.h"
++
++#include "testutil.h"
++#include "warnless.h"
++#include "memdebug.h"
++
++#define TEST_HANG_TIMEOUT 60 * 1000
++
++/*
++ * Get a single URL without select().
++ */
++
++CURLcode test(char *URL)
++{
++  CURL *easies[1000];
++  CURLM *m;
++  CURLcode res = CURLE_FAILED_INIT;
++  CURLMcode mres;
++  int i;
++
++  (void)URL;
++  memset(easies, 0, sizeof(easies));
++
++  curl_global_init(CURL_GLOBAL_DEFAULT);
++  m = curl_multi_init();
++  if(!m) {
++    res = CURLE_OUT_OF_MEMORY;
++    goto test_cleanup;
++  }
++
++  for(i = 0; i < 1000; i++) {
++    CURL *e = curl_easy_init();
++    if(!e) {
++      res = CURLE_OUT_OF_MEMORY;
++      goto test_cleanup;
++    }
++    easies[i] = e;
++
++    res = curl_easy_setopt(e, CURLOPT_URL, "https://www.example.com/");
++    if(!res)
++      res = curl_easy_setopt(e, CURLOPT_VERBOSE, 1L);
++    if(res)
++      goto test_cleanup;
++
++    mres = curl_multi_add_handle(m, e);
++    if(mres != CURLM_OK) {
++      printf("MULTI ERROR: %s\n", curl_multi_strerror(mres));
++      res = CURLE_FAILED_INIT;
++      goto test_cleanup;
++    }
++  }
++
++test_cleanup:
++
++  if(res)
++    printf("ERROR: %s\n", curl_easy_strerror(res));
++
++  for(i = 0; i < 1000; i++) {
++    if(easies[i]) {
++      curl_multi_add_handle(m, easies[i]);
++      curl_easy_cleanup(easies[i]);
++      easies[i] = NULL;
++    }
++  }
++  curl_multi_cleanup(m);
++  curl_global_cleanup();
++
++  return res;
++}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
index 497d1d0d69d..2fa671c41f7 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
@@ -16,10 +16,10 @@
 		<flag name="gnutls">Enable gnutls ssl backend</flag>
 		<flag name="gopher">Enable Gopher protocol support</flag>
 		<flag name="hsts">Enable HTTP Strict Transport Security</flag>
-		<flag name="imap">Enable Internet Message Access Protocol support</flag>
-		<flag name="mbedtls">Enable mbedtls ssl backend</flag>
 		<flag name="http3">Enable HTTP/3 support</flag>
 		<flag name="httpsrr">Enable HTTPS Resource Record support</flag>
+		<flag name="imap">Enable Internet Message Access Protocol support</flag>
+		<flag name="mbedtls">Enable mbedtls ssl backend</flag>
 		<flag name="openssl">Enable openssl ssl backend</flag>
 		<flag name="pop3">Enable Post Office Protocol 3 support</flag>
 		<flag name="progress-meter">Enable the progress meter</flag>
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
index 302b37c9ef7..626c724ce7f 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="sctp"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild
index d53d606a538..b940dbab0cc 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
index ea4f6fc4ee2..1ccce7545e6 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.4.1.ebuild
@@ -27,7 +27,7 @@ else
 		SRC_DIR="src-previews"
 	else
 		SRC_DIR="src"
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	SRC_URI="https://rsync.samba.org/ftp/rsync/${SRC_DIR}/${P/_/}.tar.gz
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
index 8a6b89fc30b..cbd50fb185d 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.19.ebuild
@@ -775,6 +775,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
index a001cc4d9e3..512535934e2 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.8-r1.ebuild
@@ -779,6 +779,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
index b6bac7149c3..b76192650eb 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.9.ebuild
@@ -787,6 +787,7 @@ multilib_src_install() {
 			einfo "Install the smbk5pwd module"
 			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
 			emake DESTDIR="${D}" \
+				prefix="${EPREFIX}/usr" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
 			newdoc README smbk5pwd-README
diff --git a/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/Manifest b/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/Manifest
index ecd31c84ea6..3ff26717d6e 100644
--- a/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/Manifest
@@ -1,2 +1,2 @@
-DIST wireguard-tools-1.0.20210424.tar.xz 96816 BLAKE2B 4787624d296c22241ff366c799eb07e1e718534eab9c998df24003380ed9743f76c3b8f779c7e534404573583c9654a43527d4c96de0def78a3d88d30ca6985e SHA512 b919c7ce1e8ee8660ccc1490d3dad7817f3d6f0ab79f26866e8ed10d40545a9ddca67959ff6cc84ac36a91683c1f58d274d91d47f40c0b9a7bfee4009dcbbf59
 DIST wireguard-tools-1.0.20210914.tar.xz 99744 BLAKE2B 020f4a61597dafc6663e9ee5659f9401416692f5dc8e23afe8d59054bffd32c92814ff2e1f99d6ffe558fdfcf756afc1838e4d425847f892ad4b627a077fe614 SHA512 6727ea65551dbb064457449b93a943bd6534ca93bc7fa5704c2f6826266c98688ee9ea28731fda57a5245d5f63c05f3899fcca54e40c0b6251b7c4796e957445
+DIST wireguard-tools-1.0.20250521.tar.xz 100340 BLAKE2B a476720a14e6c547f985d74a9924767d63ce30f09608170858a25cfd98c4762b78cdb9784aa0cee92545424955d4de5bfa932dff7cd852f563656bf6f8d0ad19 SHA512 93a9ef1caaf8494f7f43fd2557c6499414481bcc7006e10ee9ad7cc520a0d0751e5fb65f6d554424ed9f2ef7a3ad510413d7aa021d829e6a631e81d24d7f47eb
diff --git a/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20210424.ebuild b/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20250521.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20210424.ebuild
rename to sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20250521.ebuild
index fe2c1bcf40a..bdc12b17e4a 100644
--- a/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20210424.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-vpn/wireguard-tools/wireguard-tools-1.0.20250521.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://git.zx2c4.com/wireguard-tools"
 else
 	SRC_URI="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${PV}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index d05c1282691..8ddfa194ea6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
+# Alfred Wingate (2025-05-13)
+# Need dev-libs/libdispatch which is not keyworded here
+gnustep-base/gnustep-base libdispatch
+
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
 # dev-qt/qtbase:6 is not keyworded here
 media-libs/openal gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/make.defaults
index 94528821471..d536bfdedd6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 ARCH="amd64"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index a9695303324..bbb8ebfb676 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,15 @@
 
 #--- END OF EXAMPLES ---
 
+# Mike Gilbert <floppym@gentoo.org> (2025-05-13)
+# media-libs/libsdl3 is keyworded here.
+net-misc/freerdp -sdl3
+
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# dev-python/sigstore is keyworded here.
+>=dev-lang/python-3.14 -verify-sig
+>=dev-python/python-tests-3.14 -verify-sig
+
 # Jimi Huotari <chiitoo@gentoo.org> (2025-04-24)
 # Unmask on amd64.
 lxqt-base/lxqt-meta -wayland
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index 35c81ed9072..8f08233a5c9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -28,6 +28,7 @@ media-sound/liblc3 -test
 # dev-util/nvidia-cuda-toolkit may never be stabilized
 media-video/ffmpeg npp
 media-video/ffmpeg-compat npp
+media-libs/osl clang-cuda
 
 # Sam James <sam@gentoo.org> (2025-02-13)
 # sys-cluster/corosync is marked stable here
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index 6fa65aba43d..4f6141bd7fb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -4,6 +4,15 @@
 # Unmask the flag which corresponds to ARCH.
 -amd64
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+-spng
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+-openni
+-openni2
+
 # Thomas Bettler <thomas.bettler@gmail.com> (2024-11-04)
 # media-libs/tiff only keyworded on amd64
 -lerc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 14e7a6983dd..19800aa16e8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Jay Faulkner <jayf@gentoo.org> (2025-06-01)
+# Requires >=net-libs/nodejs-18[npm]
+dev-util/claude-code
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2025-04-04)
 # Requires dev-qt/qtwebengine
 dev-util/nsight-compute
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
index 6f659904c72..0428d5699af 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-04-04)
+# Requires dev-qt/qtwebengine
+dev-util/nvidia-cuda-toolkit nsight
+
 # Nowa Ammerlaan <nowa@gentoo.org> (2025-02-03)
 # QtWebView is masked here
 dev-python/pyside webview
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
index 84f43bbcff7..354bd10d41b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
@@ -1,10 +1,6 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Sam James <sam@gentoo.org> (2024-02-17)
-# Broken on arm, see bug #924649 (https://github.com/golang/go/issues/65601).
->=net-vpn/tailscale-1.60.0
-
 # Sam James <sam@gentoo.org> (2020-06-24)
 # Valgrind lacks support for < ARMv7
 # https://valgrind.org/info/platforms.html
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 8b647557cc1..88fc685ee5e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,22 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# oidn is not available on 32 bits arch
+media-gfx/blender oidn
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-04-21)
 # ocamlopt is not available on 32 bits arch
 >=dev-lang/ocaml-5 ocamlopt
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
index a7f97c88407..3392eaf5797 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
@@ -4,6 +4,11 @@
 # Unmask the flag which corresponds to ARCH.
 -arm
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+-openni
+-openni2
+
 # Sam James <sam@gentoo.org> (2024-06-13)
 # Needs as-yet-unkeyworded KF6 (bug #934215)
 kde
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index 04df7369136..a46f3d2beaa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
+# Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
+# test add dependency on torchvision, not read for arm64
+sci-ml/datasets test
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
 # dependencies not arm64 ready
 sci-ml/caffe2 distributed gloo fbgemm nnpack onednn qnnpack rocm xnnpack
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
index eb3669e0a16..79bb11cae00 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -arm64
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+-spng
+
 # Sam James <sam@gentoo.org> (2025-02-19)
 # x11-drivers/xf86-input-wacom is available here
 -input_devices_wacom
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index ddacbeecd89..aaf1e6ad875 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,15 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Mike Gilbert <floppym@gentoo.org> (2025-05-13)
+# media-libs/libsdl3 is missing keywords.
+net-misc/freerdp sdl3
+
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# dev-python/sigstore is not keyworded everywhere.
+>=dev-lang/python-3.14 verify-sig
+>=dev-python/python-tests-3.14 verify-sig
+
 # Jimi Huotari <chiitoo@gentoo.org> (2025-04-24)
 # lxqt-base/lxqt-wayland-session is only keyworded for amd64 at this time.
 lxqt-base/lxqt-meta wayland
@@ -139,6 +148,7 @@ dev-lang/ispc gpu
 # Experimental and only available on a subset of architectures
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
 
 # Ionen Wolkens <ionen@gentoo.org> (2023-12-02)
 # dev-qt/qtwebengine:6 and dev-qt/qtremoteobjects:6 have few keywords.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 4dd8214f5b7..60cd7027580 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -1,6 +1,15 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# media-libs/libspng only keyworded on amd64, arm64
+spng
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# only keyworded on amd64, arm
+openni
+openni2
+
 # Thomas Bettler <thomas.bettler@gmail.com> (2024-11-04)
 # media-libs/tiff only keyworded on amd64
 lerc
@@ -170,51 +179,34 @@ nvidia
 oci8-instant-client
 oracle
 
-# not keyworded on non-x86 systems
-video_cards_geode
-
-# not needed on non-x86, non-amd64 systems
+input_devices_synaptics
 input_devices_vmmouse
+input_devices_wacom
+video_cards_asahi
 video_cards_ast
 video_cards_d3d12
+video_cards_exynos
+video_cards_freedreno
+video_cards_geode
 video_cards_i915
 video_cards_i965
+video_cards_imagination
 video_cards_intel
+video_cards_lima
 video_cards_nvidia
 video_cards_nvk
-video_cards_vesa
-video_cards_via
-video_cards_vmware
-video_cards_virtualbox
-
-# not needed on non-x86, non-amd64, non-mips systems
-video_cards_siliconmotion
-
-# not needed on non-arm systems
-video_cards_exynos
-video_cards_freedreno
-video_cards_lima
 video_cards_omap
 video_cards_panfrost
+video_cards_qxl
+video_cards_siliconmotion
 video_cards_tegra
 video_cards_v3d
 video_cards_vc4
-
-# James Le Cuirot <chewi@gentoo.org>
-# Vivante is only available for arm and mips.
+video_cards_vesa
+video_cards_via
+video_cards_virtualbox
 video_cards_vivante
-
-# linux-only drivers
-video_cards_qxl
-
-# drivers with virtgpu DRM native-context support
-# these could be unmasked on all architectures with qemu system target but
-# unmasking only tested and actually used ones is a sane default.
-video_cards_asahi
-
-# not needed on non-x86, non-amd64, non-ppc systems
-input_devices_synaptics
-input_devices_wacom
+video_cards_vmware
 
 # Robert Buchholz <rbu@gentoo.org> (2007-06-03)
 # Only works on x86 or amd64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index b875a6e8f82..bf4a42108b4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -4,6 +4,14 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Hans de Graaff <graaff@gentoo.org> (2025-05-31)
+# Requires large parts of dev-ruby/rails to be keyworded.
+dev-ruby/minitest-hooks test
+
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index 4dfdb4b3e5c..b479e4444b4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -1,6 +1,11 @@
 # Copyright 2022-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# WANG Xuerui <xen0n@gentoo.org> (2025-05-29)
+# dist-server pulls in the libmount crate which is unmaintained and depends
+# on outdated nix that does not support loong
+dev-util/sccache dist-server
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/make.defaults
index 58248d7c6cd..9f932f8ed4d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/make.defaults
@@ -18,3 +18,10 @@ DEFAULT_ABI="m68k"
 MULTILIB_ABIS="m68k"
 LIBDIR_m68k="lib"
 CHOST_m68k="${CHOST}"
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-05-13)
+# Since Python 3.13 is still masked, we need to re-enable Python 3.12
+# and explicitly disable 3.13
+PYTHON_SINGLE_TARGET="python3_12 -python3_13 -python3_13t -python3_14 -python3_14t"
+PYTHON_TARGETS="python3_12 -python3_13 -python3_13t -python3_14 -python3_14t"
+BOOTSTRAP_USE="unicode pkg-config split-usr xml python_targets_python3_12 python_single_target_python3_12"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.mask
index c9a806f6755..07565802d62 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.mask
@@ -3,4 +3,8 @@
 
 # Andreas K. Hüttel <dilfridge@gentoo.org>
 # Requires 32bit alignment, so we mask it for the moment
+# Possibly more is broken in qemu
 dev-lang/python:3.13
+dev-lang/python:3.14
+dev-lang/python:3.13t
+dev-lang/python:3.14t
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
index 120f9403a7d..c6cd8d6e99a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
@@ -161,3 +161,6 @@ xemacs
 # Andreas K. Hüttel <dilfridge@gentoo.org>
 # Requires 32bit alignment, so we mask it for the moment
 python_targets_python3_13
+python_targets_python3_13t
+python_targets_python3_14
+python_targets_python3_14t
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index 6548bfae8d0..9517963618e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Hans de Graaff <graaff@gentoo.org> (2025-05-31)
+# Requires large parts of dev-ruby/rails to be keyworded.
+dev-ruby/minitest-hooks test
+
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index 09c69375f80..b449f5b19f1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # PPN-SD <nicolas.parlant@parhuet.fr> (2025-04-08)
 # media-libs/libsidplayfp is not keyworded
 media-sound/mpd sid
@@ -382,10 +386,6 @@ x11-misc/colord argyllcms extra-print-profiles
 # to do so.
 dev-ruby/rack-test test
 
-# Anthony G. Basile <blueness@gentoo.org> (2012-08-21)
-# Does not work on ppc/ppc64
-net-vpn/tor tor-hardening
-
 # Pacho Ramos <pacho@gentoo.org> (2012-05-07)
 # libhid is not keyworded
 app-misc/lcdproc lcd_devices_mdm166a
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/make.defaults
index ef55cded6db..54349204969 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # All extra USE/etc should be specified in sub-profiles.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 11ab2ec13a7..786c07e7f0d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Hans de Graaff <graaff@gentoo.org> (2025-05-31)
+# Requires large parts of dev-ruby/rails to be keyworded.
+dev-ruby/minitest-hooks test
+
+# Sam James <sam@gentoo.org> (2025-05-16)
+# gpio: dev-libs/libgpiod not keyworded here
+# modbus: dev-libs/libmodbus not keyworded here
+# monitor: dev-python/pyqt5 not keyworded here
+sys-power/nut gpio modbus monitor
+
 # Sam James <sam@gentoo.org> (2025-02-21)
 # media-video/rav1e is not yet keyworded here
 media-video/ffmpeg rav1e
@@ -97,6 +107,7 @@ sci-mathematics/maxima vtk
 # Broken bundled Eigen, fails to compile. See bug #865191.
 sci-geosciences/grass pdal
 sci-libs/vtk pdal
+media-gfx/openvdb pdal
 
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not keyworded
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/make.defaults
index f981d6d1627..ecba322484a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # All extra USE/etc should be specified in sub-profiles.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index 479b422cd4f..77304afe5ac 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2025-05-16)
+# gpio: dev-libs/libgpiod not keyworded here
+sys-power/nut gpio
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-06)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-geosciences/grass pdal
+sci-libs/vtk pdal
+media-gfx/openvdb pdal
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-05-03)
 # dependencies not yet keyworded
 sci-ml/caffe2 distributed gloo fbgemm nnpack onednn qnnpack rocm xnnpack
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
index 7261f063576..3bce1ce9b4f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 2023-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
+# Alfred Wingate (2025-05-13)
+# Need dev-libs/libdispatch which is not keyworded here
+gnustep-base/gnustep-base libdispatch
+
+# Viorel Munteanu (2025-05-06)
+# Needs dev-lang/go which is not keyworded here
+net-dialup/picocom man
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
index bd8a4a2e46a..2df4599271a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use
@@ -1,6 +1,10 @@
 # Copyright 2023-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrey Grozin <grozin@gentoo.org> (2025-05-15)
+# use ecl as the default lisp for maxima
+sci-mathematics/maxima ecl
+
 # James Le Cuirot <chewi@gentoo.org> (2023-12-16)
 # Apply additional FFmpeg patches for efficient playback on some SoCs.
 media-tv/kodi soc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
index a36ce5a37c9..e5cb1c3335e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
@@ -1,6 +1,10 @@
 # Copyright 2021-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrey Grozin <grozin@gentoo.org> (2025-05-15)
+# binary sbcl for bootstrap is not available
+dev-lisp/sbcl system-bootstrap
+
 # Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
 # MPV currently[1] has no plans to support >=lua5-3 making luajit
 # the only choice for maintained lua. Apply mask/force to override
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index cbc0ac23631..9a41debc65e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,12 +1,18 @@
 # Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-geosciences/grass pdal
+sci-libs/vtk pdal
+media-gfx/openvdb pdal
+
 # PPN-SD <nicolas.parlant@parhuet.fr> (2025-04-26)
 # dev-python/sphinx-panels is not keyworded
 net-dns/knot doc
 
 # Alfredo Tupone <tupone@gentoo.org> (2025-04-15)
-# drop dev-ml test 
+# drop dev-ml test
 dev-ml/duration test
 dev-ml/luv test
 dev-ml/ocaml-base64 test
@@ -36,13 +42,6 @@ media-libs/assimp collada
 # and I don't want to deal with it right now.
 sci-mathematics/maxima vtk
 
-# Michael Orlitzky <mjo@gentoo.org> (2024-08-26)
-# There's an unexplained test failure in sci-libs/qd that I've emailed
-# the authors about. Until we know what's up with that, USE=qd should
-# remain masked for consumers.
-sci-libs/fplll qd
-sci-mathematics/lcalc double-double quad-double
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-06-15)
 # Requires unkeyworded dev-qt/qtwebengine (and revdeps)
 kde-plasma/plasma-nm openconnect
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
index 4e7eed0bff7..35a8afe6179 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32/make.defaults
@@ -16,6 +16,8 @@ CXXFLAGS="${CFLAGS}"
 FFLAGS="${CFLAGS}"
 FCFLAGS="${CFLAGS}"
 
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs -Wl,--no-keep-memory"
+
 ## Mike Gilbert <floppym@gentoo.org> (2021-12-17)
 ## Prevent automagic use of 64-bit time_t.
 ## https://bugs.gentoo.org/828001
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
index 2464269fd8e..54469cc4090 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/rv32imac/ilp32d/make.defaults
@@ -16,6 +16,8 @@ CXXFLAGS="${CFLAGS}"
 FFLAGS="${CFLAGS}"
 FCFLAGS="${CFLAGS}"
 
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs -Wl,--no-keep-memory"
+
 ## Mike Gilbert <floppym@gentoo.org> (2021-12-17)
 ## Prevent automagic use of 64-bit time_t.
 ## https://bugs.gentoo.org/828001
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
index 2743d42cd44..0fb28d38e6a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
@@ -49,6 +49,9 @@ mono
 # No proper support for this arch yet
 java
 
+
+-video_cards_imagination
+
 # not supported / tested cards
 
 video_cards_ast
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index d90c82d39c4..0e30b676e2e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Hans de Graaff <graaff@gentoo.org> (2025-05-31)
+# Requires large parts of dev-ruby/rails to be keyworded.
+dev-ruby/minitest-hooks test
+
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
 # NRK <nrk@disroot.org> (2025-04-07)
 # media-libs/libyuv is not keyworded
 media-libs/imlib2 y4m
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force
new file mode 100644
index 00000000000..ed34cbf37b9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/32ul/package.use.force
@@ -0,0 +1,6 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-05-10)
+# Fails to build without, bug #955704
+dev-libs/libgcrypt asm
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index c15c38aff38..3b6d5d558d7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,22 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# NRK <nrk@disroot.org> (2025-05-18)
+# app-arch/plzip is not keyworded
+app-alternatives/lzip plzip
+
+# Alfred Wingate (2025-05-13)
+# Need dev-libs/libdispatch which is not keyworded here
+gnustep-base/gnustep-base libdispatch
+
+# Eray Aslan <eras@gentoo.org> (2025-05-08)
+# dev-db/tinycdb is not keyworded here
+net-mail/dovecot cdb
+
+# Viorel Munteanu (2025-05-06)
+# Needs dev-lang/go which is not keyworded here
+net-dialup/picocom man
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
 # dev-qt/qtbase:6 is not keyworded here
 media-libs/openal gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/make.defaults
index 16f6fbe98d0..00f4441eb5c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # All extra USE/etc should be specified in sub-profiles.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 71d140aac62..e8c794f0990 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# dev-python/nanobind is not keyworded here
+media-gfx/openvdb python
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-04-21)
 # ocamlopt is not available on 32 bits arch
 >=dev-lang/ocaml-5 ocamlopt
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
index ec64a3897af..047400302b6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
@@ -94,9 +94,9 @@ XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fu
 LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text"
 
 # Manuel Rüger <mrueg@gentoo.org> (2015-09-09)
-# Hans de Graaff <graaff@gentoo.org> (2024-10-08)
+# Hans de Graaff <graaff@gentoo.org> (2025-05-31)
 # Default Ruby build target(s)
-RUBY_TARGETS="ruby32"
+RUBY_TARGETS="ruby32 ruby33"
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2022-10-22)
 # These USE flags are what is common between the various sub-profiles. Stages 2
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
index 9678dc930ef..d8801de4188 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-18)
+# Requires systemd, so specifically unmasked only in targets/systemd.
+>=kde-plasma/drkonqi-6.3.90
+
 # Sam James <sam@gentoo.org> (2024-11-10)
 # Breaks suspend on elogind systems (bug #934314, bug #923614)
 # https://github.com/polkit-org/polkit/issues/451
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 8748fa6a267..ba471f4ab91 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-13)
+# Force both "old" KWallet backend (now ksecretd service via IUSE keyring)
+# and the legacy KWalletAPI (via IUSE legacy-kwallet) until a (stable)
+# migration path with instructions was laid out. See also:
+# https://invent.kde.org/plasma/plasma-desktop/-/issues/138
+# https://invent.kde.org/frameworks/kwallet/-/merge_requests/97
+# https://invent.kde.org/frameworks/kwallet/-/blob/master/README.md
+# https://notmart.org/blog/2025/04/towards-a-transition-from-kwallet-to-secret-service/
+kde-frameworks/kwallet-runtime keyring legacy-kwallet
+
 # Sam James <sam@gentoo.org> (2025-04-22)
 # qemu[X] still has automagic on some parts of gtk[X]. Workaround that
 # for now for bug #954152.
@@ -45,6 +55,8 @@ llvm-runtimes/libcxxabi clang
 #    echo "dev-lang/rust:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 #    echo "dev-lang/rust-bin:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 # done
+dev-lang/rust:1.87.0 llvm_slot_20
+dev-lang/rust-bin:1.87.0 llvm_slot_20
 dev-lang/rust:1.86.0 llvm_slot_19
 dev-lang/rust-bin:1.86.0 llvm_slot_19
 dev-lang/rust:1.85.1 llvm_slot_19
@@ -309,10 +321,6 @@ net-fs/autofs libtirpc
 net-misc/netkit-bootparamd libtirpc
 sys-cluster/glusterfs libtirpc
 
-# Maciej Mrozowski <reavertm@gentoo.org> (2016-09-01)
-# Workaround until resolved upstream (bug #586840)
->=dev-games/simgear-2016.2.1 dns
-
 # Justin Lecher <jlec@gentoo.org> (2014-08-10)
 # Doesn't work without acl support
 # No patch yet, #516626
@@ -330,14 +338,15 @@ dev-lang/python-exec python_targets_python3_11
 dev-lang/python-exec python_targets_python3_12
 dev-lang/python-exec python_targets_python3_13
 dev-lang/python-exec python_targets_python3_13t
+dev-lang/python-exec python_targets_python3_14
+dev-lang/python-exec python_targets_python3_14t
 dev-lang/python-exec python_targets_pypy3_11
 
 # Zac Medico <zmedico@gentoo.org> (2010-10-20)
 # Force ipc USE flag since it should remain enabled unless
 # it is found to be incompatible with a specific profile
 # or environment. When enabled, it fixes bug #278895,
-# bug #315615, and makes subshell die support more robust
-# (so that repoman's ebuild.nesteddie check is irrelevant).
+# bug #315615, and makes subshell die support more robust.
 sys-apps/portage ipc
 
 # Peter Alfredsen <loki_val@gentoo.org> (2009-04-11)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 47637157358..5e119c6dad5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,32 @@
 
 # New entries go on top.
 
+# Alfred Wingate <parona@protonmail.com> <2025-05-24)
+# Doesn't work well at runtime.
+dev-games/ogre wayland
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-23)
+# media-sound/hydrogen[lash] build is broken, and dropped upstream in next
+# version. Bug #946125
+media-sound/hydrogen lash
+
+# Maciej Mrozowski <reavertm@gentoo.org> (2025-05-22)
+# Does not compile as of 2024.1.1, requires buildsystem fixes.
+dev-games/simgear gdal
+games-simulation/flightgear gdal
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-14)
+# dev-qt/qtwebchannel:5 is masked, last revdep was dev-python/pyqtwebengine
+dev-python/pyqt5 webchannel
+
+# Joonas Niilola <juippis@gentoo.org> (2025-05-14)
+# Experimental, no official upstream support.
+www-client/firefox jpegxl
+
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-01)
+# Requires llvm-15
+media-gfx/openvdb ax
+
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-30)
 # Valve has modified Wine's ffmpeg code with a new pcm_byte_order_reverse_bsf.c
 # that seems riddled with issues (missing identifiers, incompatible pointer
@@ -46,10 +72,6 @@ sys-apps/usbutils usbreset
 # sys-cluster/pacemaker is being removed.
 sys-cluster/drbd-utils pacemaker
 
-# Michał Górny <mgorny@gentoo.org> (2025-03-05)
-# Mask until we have keyworded dev-util/spirv-llvm-translator:20 release.
-llvm-core/libclc llvm_slot_20
-
 # Michał Górny <mgorny@gentoo.org> (2025-03-05)
 # Mask until we have keyworded dev-lang/rust{,-bin} / slot 20 release.
 www-client/chromium llvm_slot_20
@@ -278,7 +300,6 @@ net-analyzer/nagios-plugin-check_raid hpa
 # Michał Górny <mgorny@gentoo.org> (2023-12-22)
 # Requires LLVM 14 that is being removed.
 <dev-lang/ghc-9.4 llvm
-<media-gfx/openvdb-11 ax
 sys-devel/sparse llvm
 
 # Takuya Wakazono <pastalian46@gmail.com> (2023-11-21)
@@ -565,12 +586,6 @@ sys-devel/gcc custom-cflags
 # situation is resolved.
 dev-util/rizin test
 
-# Sam James <sam@gentoo.org> (2021-12-27)
-# Doc building is broken and no new releases in a long time.
-# bug #830013
-# fixed in sci-libs/flann-1.9.2-20221027
-<=sci-libs/flann-1.9.2 doc
-
 # Joonas Niilola <juippis@gentoo.org> (2021-12-20)
 # Broken, upstream issue/PR open since 2021-05 without reply.
 # Gentoo bug #821253
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index 16f1277362b..a04c5a5a146 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -4,6 +4,10 @@
 # New entries go on top.
 # Please use the same syntax as in package.use.mask.
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-06)
+# USE=experimental is not stable by definition
+media-libs/zxing-cpp experimental
+
 # Michał Górny <mgorny@gentoo.org> (2024-04-12)
 # dev-python/mpi4py has no stable keywords.
 media-gfx/netgen mpi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
index 7fdb45177a2..75dbbe81dcc 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
@@ -16,10 +16,13 @@ llvm_slot_20
 # Hans de Graaff <graaff@gentoo.org> (2024-12-26)
 # Currently in testing and not ready to go stable yet.
 ruby_targets_ruby34
-ruby_targets_ruby33
 
 # Michał Górny <mgorny@gentoo.org> (2024-05-08)
 # Python implementations without stable keywords.
+python_targets_python3_14t
+python_single_target_python3_14t
+python_targets_python3_14
+python_single_target_python3_14
 python_targets_python3_13t
 python_single_target_python3_13t
 python_targets_pypy3_11
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/gnome/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/plasma/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/desktop/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/no-multilib/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/amd64/23.0/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/gnome/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/plasma/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/desktop/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults
new file mode 100644
index 00000000000..8fe4a1e300f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/make.defaults
@@ -0,0 +1 @@
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.mask
index ccb9479b103..a0ca2047e2c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.mask
@@ -5,3 +5,4 @@
 # Generic images are built with systemd and only available on arm64 and amd64
 sys-kernel/gentoo-kernel -generic-uki
 sys-kernel/gentoo-kernel-bin -generic-uki
+sys-kernel/vanilla-kernel -generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.stable.mask
index 2dc3c3ed2a8..3800841b7bb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm64/23.0/systemd/package.use.stable.mask
@@ -5,3 +5,4 @@
 # This is still experimental, prebuilt images may not boot on all systems.
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults
new file mode 100644
index 00000000000..8fe4a1e300f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/make.defaults
@@ -0,0 +1 @@
+LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/make.defaults
new file mode 100644
index 00000000000..9188aed8a58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/make.defaults
@@ -0,0 +1,10 @@
+# Copyright 2024-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="m68k-aligned-linux-gnut64"
+
+# Let's take care of a decent celestial alignment
+CFLAGS="${CFLAGS} -malign-int"
+CXXFLAGS="${CXXFLAGS} -malign-int"
+FCFLAGS="${FCFLAGS} -malign-int"
+FFLAGS="${FFLAGS} -malign-int"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/package.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/package.mask
new file mode 100644
index 00000000000..702337e06c0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/package.mask
@@ -0,0 +1,7 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-06-02)
+# Since we are using -maligned-int by default here, we also need the
+# corresponding fixed / patched toolchain versions...
+<sys-libs/glibc-2.41-r2
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/parent
new file mode 100644
index 00000000000..320c1b2c0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/parent
@@ -0,0 +1,2 @@
+..
+../../../../../features/time64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/parent
new file mode 100644
index 00000000000..25281026829
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/split-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../features/split-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/parent
new file mode 100644
index 00000000000..7e061533c15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/m68k/23.0/time64/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/packages b/sdk_container/src/third_party/portage-stable/profiles/default/linux/packages
index 6d35bf72e20..9bc63f1b7e1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/packages
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/packages
@@ -1,4 +1,4 @@
-# Copyright 2004-2021 Gentoo Authors.
+# Copyright 2004-2025 Gentoo Authors.
 # Distributed under the terms of the GNU General Public License v2
 
 # This file extends the base packages file for the default profile that all
@@ -6,6 +6,7 @@
 # will have.  Some will have an selinux profile (see ${PORTDIR}/profiles/selinux).
 # The idea is to only create a new family of profiles when absolutely necessary.
 
+*net-mail/mailbase
 *sys-apps/iproute2
 *sys-apps/man-pages
 *sys-apps/net-tools
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
index f557f4279de..2370787710d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
@@ -1,4 +1,4 @@
-# Copyright 2007-2023 Gentoo Authors
+# Copyright 2007-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # This file contains descriptions of APACHE2_MODULES USE_EXPAND flags.
@@ -81,6 +81,7 @@ proxy_wstunnel - Provides support for the tunnelling of web socket connections t
 ratelimit - Bandwidth Rate Limiting for Clients
 remoteip - Replaces the original client IP address for the connection with the useragent IP address list presented by a proxies or a load balancer via the request headers
 reqtimeout - Set timeout and minimum data rate for receiving requests
+request - Filters to handle and make available HTTP request bodies
 rewrite - Provides a rule-based rewriting engine to rewrite requested URLs on the fly
 session - Provides support for a server wide per user session interface
 session_crypto - Provides support for the encryption of user sessions before being written to a local database, or written to a remote browser via an HTTP cookie
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_x86.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_x86.desc
index 6324e4a540e..fd8f2e749ba 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_x86.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/cpu_flags_x86.desc
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Whenever the flag name does not correspond to /proc/cpuinfo flags,
@@ -8,7 +8,11 @@
 3dnow - Use the 3DNow! instruction set
 3dnowext - Use the Enhanced 3DNow! instruction set
 aes - Enable support for Intel's AES instruction set (AES-NI)
+amx_bf16 - Use Advanced Matrix Extensions tile computational operations on bfloat16 numbers
+amx_tile - Use Advanced Matrix Extensions tile architecture support
+amx_int8 - Use Advanced Matrix Extensions tile computational operations on 8-bit integers
 avx - Adds support for Advanced Vector Extensions instructions
+avx_vnni - Use AVX (VEX-encoded) versions of the Vector Neural Network Instructions
 avx2 - Adds support for Advanced Vector Extensions 2 instructions
 avx512_4fmaps - Use AVX-512 Fused Multiply-Accumulate Packed Single Precision instruction set
 avx512_4vnniw - Use AVX-512 Vector Neural Network Instructions Word Variable Precision
@@ -28,6 +32,8 @@ avx512ifma - Use AVX-512 Integer Fused Multiply-Add instruction set
 avx512pf - Use AVX-512 prefetch instructions
 avx512vbmi - Use AVX-512 vector byte manipulation instructions
 avx512vl - Use AVX-512 vector-length instructions
+bmi1 - Enable the first group of advanced bit manipulation extensions (ANDN, BEXTR, BLSI, BLSMSK, BLSR, TZCNT)
+bmi2 - Enable the second group of advanced bit manipulation extensions (BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX)
 f16c - Adds support for F16C instruction set for converting between half-precision and single-precision floats
 fma3 - Use the Fused Multiply Add 3 instruction set ([fma] in cpuinfo)
 fma4 - Use the Fused Multiply Add 4 instruction set
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
index 8e38ae89b7a..2b074a3ceaa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
@@ -7,4 +7,6 @@ python3_11 - Build for Python 3.11 only
 python3_12 - Build for Python 3.12 only
 python3_13 - Build for Python 3.13 only
 python3_13t - Build for Python 3.13 freethreading only
+python3_14 - Build for Python 3.14 only
+python3_14t - Build for Python 3.14 freethreading only
 pypy3_11 - Build for PyPy3.11 only
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
index 7b3fedd5245..ea191dccdac 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
@@ -7,4 +7,6 @@ python3_11 - Build with Python 3.11
 python3_12 - Build with Python 3.12
 python3_13 - Build with Python 3.13
 python3_13t - Build with Python 3.13 freethreading
+python3_14 - Build with Python 3.14
+python3_14t - Build with Python 3.14 freethreading
 pypy3_11 - Build with PyPy3.11
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
index da5843660cd..ff6013e04ac 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
@@ -16,6 +16,7 @@ fbdev - VIDEO_CARDS setting to build driver for fbdev video cards
 geode - VIDEO_CARDS setting to build driver for AMD Geode GX and LX video cards
 i915 - VIDEO_CARDS setting to build driver for Intel i915 video cards
 i965 - VIDEO_CARDS setting to build driver for Intel i965 video cards
+imagination - VIDEO_CARDS setting to build driver for Imagination video cards
 intel - VIDEO_CARDS setting to build driver for Intel video cards
 lavapipe - VIDEO_CARDS setting to build Vulkan software rasterizer using LLVMpipe
 lima - VIDEO_CARDS setting to build driver for Mali 200/400 video cards
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
index e73e7f48e57..85627bbd102 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
@@ -25,6 +25,7 @@ net-libs/quiche
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-17)
 # media-libs/libvpx casualties (#700902)
+media-gfx/blender
 media-plugins/gst-plugins-vpx
 dev-qt/qtwebengine
 www-client/falkon
@@ -40,7 +41,6 @@ kde-apps/grantlee-editor
 kde-apps/akregator
 dev-util/kdevelop
 dev-qt/qtwebview
-dev-python/pyqtwebengine
 app-text/kchmviewer
 app-office/merkuro
 app-editors/ghostwriter
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
index cdb1f2f138e..75e4ea63ba8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
@@ -16,6 +16,7 @@ media-libs/gexiv2 test
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-16)
 # media-libs/libvpx casualties (#700902)
+media-libs/opencv test
 media-video/ffmpeg vpx
 media-video/ffmpeg-compat vpx
 www-client/firefox system-libvpx
@@ -31,6 +32,7 @@ kde-apps/kalarm pim
 gnome-base/gnome extras
 games-engines/scummvm vpx
 net-libs/pjproject vpx
+dev-util/nvidia-cuda-toolkit nsight
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-16)
 # media-libs/libaom casualties
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
index 792562b3f91..5056e649fe3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
@@ -1,6 +1,10 @@
 # Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
+# media-gfx/alembic is masked (#884295)
+alembic
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-30)
 # media-libs/libjxl casualties
 # https://github.com/libjxl/libjxl/issues/2433
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/hardened/package.use b/sdk_container/src/third_party/portage-stable/profiles/features/hardened/package.use
index 13317366951..2f9a49f826e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/hardened/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/hardened/package.use
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 dev-lang/python gdbm
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index f7e7e704309..543598b0d56 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -448,6 +448,7 @@ dev-libs/optix
 media-libs/nvidia-vaapi-driver
 x11-drivers/nvidia-drivers
 x11-misc/primus
+dev-libs/cusparselt
 
 # Ulrich Müller (2020-03-31)
 # Not ported to musl, bug #715642.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index cf95fd5209e..781a9be8b80 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-05-17)
+# Tests cannot be built on musl due to libc specific ifdefs (bug #836710)
+net-mail/cyrus-imapd test
+
 # Ionen Wolkens <ionen@gentoo.org> (2025-03-10)
 # Been failing to build for a long time for musl with modern compilers,
 # so mask until there is a proper fix. Note that this does not disable
@@ -125,6 +129,7 @@ dev-lang/ispc gpu
 # Requires systemd
 sys-kernel/gentoo-kernel generic-uki
 sys-kernel/gentoo-kernel-bin generic-uki
+sys-kernel/vanilla-kernel generic-uki
 
 # Guillaume Seren <guillaumeseren@gmail.com> (2023-11-29)
 # execinfo.h required for server.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.use.mask
new file mode 100644
index 00000000000..686cb944a86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.use.mask
@@ -0,0 +1,8 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Nowa Ammerlaan <nowa@gentoo.org> (2023-12-07)
+# Does not support split-usr filesystem geometry. Please migrate to
+# a merged-usr profile.
+sys-kernel/installkernel systemd
+sys-kernel/installkernel systemd-boot
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/time64/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/time64/package.mask
index 77064182bb8..c4b9df1a1e7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/time64/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/time64/package.mask
@@ -4,4 +4,6 @@
 # Michał Górny <mgorny@gentoo.org> (2024-11-06)
 # Old versions of GCC do not support USE=time64, and as such do not
 # enforce 64-bit time_t as required by this profile.
-<sys-devel/gcc-14.2.1_p20241026
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-05-29)
+# Version updated
+<sys-devel/gcc-13.3.1_p20250522-r1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 0a3b4219a52..b4abfdcf15e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,25 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Holger Hoffstätte <holger@applied-asynchrony.com> (2025-05-18)
+# >=bpftrace-0.23 needs Rust-based blazesym_c
+>=dev-debug/bpftrace-0.23.2
+>=dev-libs/blazesym_c-0.1.1
+
+# Victor Kustov <ktrace@yandex.ru> (2025-05-08)
+# LibrePCB start ported to Rust
+>=sci-electronics/librepcb-1.3.0
+
+# Michał Górny <mgorny@gentoo.org> (2024-05-08)
+# The sigstore bundle.
+dev-python/betterproto
+dev-python/securesystemslib
+dev-python/sigstore
+dev-python/sigstore-protobuf-specs
+dev-python/sigstore-rekor-types
+dev-python/rfc3161-client
+dev-python/tuf
+
 # Michał Górny <mgorny@gentoo.org> (2024-04-20)
 # The mitmproxy bundle.
 dev-python/mitmproxy-wireguard
@@ -223,6 +242,7 @@ app-crypt/certbot-nginx
 app-crypt/rpm-sequoia
 app-emulation/virtiofsd
 app-eselect/eselect-rust
+app-misc/gramps
 app-misc/khal
 app-text/mdbook
 dev-embedded/esptool
@@ -355,6 +375,7 @@ media-gfx/gimp
 media-plugins/gimp-lqr
 media-video/rav1e
 net-analyzer/wtfis
+net-dns/dnsviz
 net-dns/pdns-recursor
 net-im/gajim
 >=net-irc/polari-3.37
diff --git a/sdk_container/src/third_party/portage-stable/profiles/info_pkgs b/sdk_container/src/third_party/portage-stable/profiles/info_pkgs
index abc517fa451..c7cf0ae8562 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/info_pkgs
+++ b/sdk_container/src/third_party/portage-stable/profiles/info_pkgs
@@ -1,4 +1,4 @@
-# Copyright 2004-2024 Gentoo Authors
+# Copyright 2004-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 ##
@@ -15,6 +15,7 @@ sys-devel/binutils
 sys-devel/binutils-config
 dev-build/libtool
 dev-build/make
+dev-lang/erlang
 dev-lang/python
 dev-lang/perl
 dev-lang/rust
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 0f36cdbdf27..81edd2f880a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -15,7 +15,7 @@
 # https://www.gnu.org/licenses/license-list.html
 # GPL or LGPL with various exceptions are also included here, because
 # they are more permissive than the licenses they are based on.
-GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2+-with-eCos-exception-2 GPL-2-with-classpath-exception GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3+-with-openssl-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception Unicode-DFS-2016 Unlicense UoI-NCSA UPL-1.0 UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
+GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2+-with-eCos-exception-2 GPL-2-with-classpath-exception GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3+-with-openssl-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception Unicode-DFS-2015 Unicode-DFS-2016 Unlicense UoI-NCSA UPL-1.0 UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
 
 # Free software licenses approved by the FSF
 FSF-APPROVED @GPL-COMPATIBLE AFL-2.1 AFL-3.0 Apache-1.0 Apache-1.1 APSL-2 BSD-4 CDDL CeCILL-B CeCILL-C CNRI CPAL-1.0 CPL-1.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 FraunhoferFDK gnuplot IBM LPL-1.02 LPPL-1.2 LPPL-1.3a MPL-1.0 MPL-1.1 Ms-PL Ms-RL NPL-1.1 openssl OSL-1.1 OSL-2.0 OSL-2.1 PHP-3.01 QPL-1.0 Zend-2.0
@@ -25,7 +25,7 @@ FSF-APPROVED @GPL-COMPATIBLE AFL-2.1 AFL-3.0 Apache-1.0 Apache-1.1 APSL-2 BSD-4
 # Note that the FSF lists these as nonfree: Artistic NOSA Watcom-1.0
 # We exclude NOSA and Watcom-1.0, but we keep Artistic because Debian
 # considers it DFSG-free.
-OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL-2 Artistic Artistic-2 BlueOak-1.0.0 Boost-1.0 BSD BSD-2 CDDL CNRI CPAL-1.0 CPL-1.0 ECL-2.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-3 GPL-3+ HPND IBM IPAfont ISC LBNLBSD LGPL-2 LGPL-2+ LGPL-2.1 LGPL-2.1+ LGPL-3 LGPL-3+ LPL-1.02 LPPL-1.3c MirOS MIT MIT-0 MPL-1.0 MPL-1.1 MPL-2.0 Ms-PL Ms-RL nethack OFL-1.1 OSL-2.1 PHP-3 PHP-3.01 POSTGRESQL PSF-2 QPL-1.0 Sleepycat Unicode-3.0 Unicode-DFS-2016 Unlicense UPL-1.0 UoI-NCSA W3C wxWinLL-3 ZLIB ZPL
+OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL-2 Artistic Artistic-2 BlueOak-1.0.0 Boost-1.0 BSD BSD-2 CDDL CNRI CPAL-1.0 CPL-1.0 ECL-2.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-3 GPL-3+ HPND IBM IPAfont ISC LBNLBSD LGPL-2 LGPL-2+ LGPL-2.1 LGPL-2.1+ LGPL-3 LGPL-3+ LPL-1.02 LPPL-1.3c MirOS MIT MIT-0 MPL-1.0 MPL-1.1 MPL-2.0 Ms-PL Ms-RL nethack OFL-1.1 OSL-2.1 PHP-3 PHP-3.01 POSTGRESQL PSF-2 QPL-1.0 Sleepycat Unicode-3.0 Unicode-DFS-2015 Unicode-DFS-2016 Unlicense UPL-1.0 UoI-NCSA W3C wxWinLL-3 ZLIB ZPL
 
 # Misc licenses that are probably free software, i.e. follow the
 # Free Software Definition at https://www.gnu.org/philosophy/free-sw.html
@@ -34,7 +34,7 @@ OSI-APPROVED-FREE 0BSD AFL-3.0 AGPL-3 AGPL-3+ Apache-1.1 Apache-2.0 APL-1.0 APSL
 # Licenses in this list should NOT appear directly or indirectly in
 # @FSF-APPROVED or @OSI-APPROVED.
 # Note: Licenses for fonts should be included in @MISC-FREE-DOCS.
-MISC-FREE AIFFWriter.m Allegro alternate AMPAS BEER-WARE boehm-gc BSD-1 BSD-2-with-patent BSD-with-attribution BSD-with-disclosure buddy bufexplorer.vim BZIP2 CAOSL CDDL-1.1 CDDL-Schily coldspringharbor CPL-0.5 Crypt-IDEA curl DES docbook dom4j DUMB-0.9.3 ElementTree Emacs ErlPL-1.1 FastCGI feh File-MMagic Flashpix FLEX flexmock FLTK freetts FVWM gd gsm HTML-Tidy iASL icu IDPL imagemagick Info-ZIP inner-net ipadic Ispell JasPer2.0 JDOM JOVE Khronos-CLHPP LambdaMOO LIBGLOSS libmng libpng libpng2 libtiff LLGPL-2.1 LPPL-1.0 LPPL-1.3 lsof matplotlib Mini-XML minpack MIT-with-advertising mm mpich2 NCSA-AMD NCSA-HDF netcat NEWLIB ngrep NPSL-0.95 Old-MIT openafs-krb5-a Openwall otter par PCRE perforce photopc PHP-2.02 pngcrush pngnq Princeton psutils rc rdisc regexp-UofT repoze RSA RtMidi rwpng sash scanlogd sdlsasteroids Sendmail Sendmail-Open-Source SMAIL Snd Spencer-99 SSLeay symlinks Sympow-BSD tablelist tcltk tcp_wrappers_license TeX TeX-other-free TextMate-bundle the-Click-license Time-Format Time-modules tm-align torque-2.5 Toyoda trio UCAR-Unidata unicode URT VTK w3m wm2 xbatt xboing XC Xdebug xtrs ZSH
+MISC-FREE AIFFWriter.m Allegro alternate AMPAS Base64 BEER-WARE boehm-gc BSD-1 BSD-2-with-patent BSD-with-attribution BSD-with-disclosure buddy bufexplorer.vim BZIP2 CAOSL CDDL-1.1 CDDL-Schily coldspringharbor CPL-0.5 Crypt-IDEA curl DES docbook dom4j DUMB-0.9.3 ElementTree Emacs ErlPL-1.1 FastCGI feh FFT2D File-MMagic Flashpix FLEX flexmock FLTK freetts FVWM gd gsm HTML-Tidy iASL icu IDPL imagemagick Info-ZIP inner-net ipadic Ispell JasPer2.0 JDOM JOVE Khronos-CLHPP LambdaMOO LIBGLOSS libmng libpng libpng2 libtiff LLGPL-2.1 LPPL-1.0 LPPL-1.3 lsof matplotlib Mini-XML minpack MIT-with-advertising mm mpich2 NCSA-AMD NCSA-HDF netcat NEWLIB ngrep NPSL-0.95 Old-MIT openafs-krb5-a Openwall otter par PCRE perforce photopc PHP-2.02 pngcrush pngnq Princeton psutils rc rdisc regexp-UofT repoze RSA RtMidi rwpng sash scanlogd sdlsasteroids Sendmail Sendmail-Open-Source SMAIL Snd Spencer-99 SSLeay SunSoft symlinks Sympow-BSD tablelist tcltk tcp_wrappers_license TeX TeX-other-free TextMate-bundle the-Click-license Time-Format Time-modules tm-align torque-2.5 Toyoda trio UCAR-Unidata unicode URT VTK w3m wm2 X11-Lucent xbatt xboing XC Xdebug xtrs ZSH
 
 # Metaset for all free software
 FREE-SOFTWARE @FSF-APPROVED @OSI-APPROVED-FREE @MISC-FREE
@@ -81,9 +81,9 @@ OSI-APPROVED @OSI-APPROVED-FREE @OSI-APPROVED-NONFREE
 
 # License agreements that try to take away your rights. These are more
 # restrictive than "all-rights-reserved" or require explicit approval.
-EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode MikroTik Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 PUEL-12 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
+EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode MikroTik Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK NVIDIA-SDK-v2017.06.13 NVIDIA-SDK-v2020.10.12 NVIDIA-cuSPARSELt-v2020.10.12 Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 PUEL-12 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
 
-# Deprecated license labels, used by repoman and pkgcheck
+# Deprecated license labels, used by pkgcheck
 #DEPRECATED (currently none)
 
 # Local Variables:
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 826d8063863..358546e726d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -36,12 +36,189 @@
 
 #--- END OF EXAMPLES ---
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-04)
-# Several open bugs, pending bump since 2020, fails to fetch since 2022.
-# If anyone is here to fix these things, then please make upstream port
-# the gui to Qt6 or drop it. Removal on 2025-05-31.
-# Bugs #715918, #717528, #734242, #854750, #882655
-app-misc/flirc
+# Michael Orlitzky <mjo@gentoo.org> (2025-05-28)
+# I added this for SageMath, but in hindsight do not think anyone is
+# using it. It has code issues and upstream is not terribly interested
+# in fixing it. (They are active and helpful, just not in love with this
+# particular codebase.) Bug 940232. Removal after 30 days.
+dev-gap/cohomolo
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-27)
+# Dead upstream with no release for over 10 years, Qt5-based even only by
+# means of a snapshot. Bugs #951875, #953016. Removal on 2025-06-26.
+x11-misc/qxkb
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-27)
+# Upstream repository+author, web pages and documentation gone after long
+# period of inactivity, based on Qt5. Bugs #949021, #940094
+# Removal on 2025-06-26.
+media-gfx/engauge
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-27)
+# sci-electronics/gazebo depends on x11-libs/qwt:6[qt5] and Qt5, lots of
+# open bugs. Most packages perpetually stuck at EAPI-7 and several major
+# version bumps out of date. Bugs #937608, #947390; removal on 2025-06-26.
+sci-electronics/gazebo
+dev-libs/sdformat
+net-libs/ignition-msgs
+net-libs/ignition-transport
+sci-libs/ignition-common
+sci-libs/ignition-fuel-tools
+sci-libs/ignition-math
+dev-build/ignition-cmake
+dev-libs/console_bridge
+dev-libs/urdfdom
+dev-libs/urdfdom_headers
+
+# Sam James <sam@gentoo.org> (2025-05-26)
+# Breaks some reverse dependencies and is abandoned upstream (bug #956630).
+=dev-cpp/glog-0.7.1
+
+# Nowa Ammerlaan <nowa@gentoo.org> (2025-05-25)
+# Archived upstream and no longer builds with modern compilers.
+# Bugs #956601, #930253
+# Removal on 2025-06-24
+media-libs/oneVPL-cpu
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-24)
+# Dead upstream, fails to build with GCC-14, depends on media-libs/dumb.
+# A rescue mission would ideally package dsda-doom. Bugs #939219, #908973
+# Removal on 2025-06-23.
+games-fps/prboom-plus
+
+# Sam James <sam@gentoo.org> (2025-05-23)
+# Severe memory leak (bug #953874)
+=app-i18n/ibus-anthy-1.5.17
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-23)
+# Package destabilisation mask. There is simply no need for this without
+# any stable consumers, and it is freeing up resources.
+# 5.2.10.1 is available in ~arch.
+~media-libs/allegro-5.2.7.0
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-22)
+# Even if Qt5 is optional here, it is dead upstream for close to 10 years
+# and without Gentoo package maintainer almost as long. Bug #926074.
+# Removal on 2025-06-21.
+net-firewall/pglinux
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-22)
+# Package destabilisation mask. 0.4.4_p20250125 is in ~arch but as snapshot
+# with currently no Gentoo maintainer it will not be stabilised.
+# 0.4.4 release was more than 3 years old already. Bug #955653
+~media-video/simplescreenrecorder-0.4.4
+
+# Matt Turner <mattst88@gentoo.org> (2025-05-22)
+# Old slot depending on libsoup:2.4. All reverse dependencies migrated to a
+# newer slot supporting libsoup:3.0.
+# Removal on 2025-06-21.  Bug #893668.
+net-libs/webkit-gtk:4
+
+# Pacho Ramos <pacho@gentoo.org> (2025-05-22)
+# Needs porting to libsoup 3.0, relies on webkit-gtk:4
+# Removal on 2025-06-21.  Bug #893720.
+x11-misc/meteo
+
+# Sam James <sam@gentoo.org> (2025-05-22)
+# Introduces REQUIRED_USE that needs more discussion (bug #956402)
+=media-gfx/gimp-3.0.2-r2
+=media-gfx/gimp-3.0.4
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-20)
+# Unaddressed pending version bumps for almost 2 years, stuck on EAPI-7.
+# Bugs #908094, #908095, #908096, #908097, #908427, #908428
+# Removal on 2025-06-19.
+dev-libs/aws-c-cal
+dev-libs/aws-checksums
+dev-libs/aws-c-common
+dev-libs/aws-c-event-stream
+dev-libs/aws-c-io
+dev-libs/s2n
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-19)
+# Dead upstream (last commit >4 years ago), not ported to Qt6 and broken w/
+# CMake 4. Bugs #955134, #955135. Removal on 2025-06-18.
+sci-libs/libgeodecomp
+
+# Ulrich Müller <ulm@gentoo.org> (2025-05-18)
+# Pretest versions, masked for testing.
+<app-editors/emacs-30.1.9999:30-vcs
+
+# Hans de Graaff <graaff@gentoo.org> (2025-05-18)
+# Obsolete slot depending on an old cucumber version. Use the newer slot
+# instead. Masked for removal on 2025-06-18.
+dev-util/cucumber-rails:2
+
+# David Seifert <soap@gentoo.org> (2025-05-17)
+# Historically split from dev-libs/icu, disabled by default upstream and not
+# recommended anymore. If need be, we can make it optional in icu itself.
+# Removal on 2025-06-16. Bug #956106.
+dev-libs/icu-layoutex
+dev-libs/icu-le-hb
+
+# Alfred Wingate <parona@protonmail.com> (2025-05-17)
+# Masked for testing
+dev-db/mysql:8.4
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-15)
+# Very dead upstream, very many open bugs for years without anyone fixing.
+# Bugs #314835, #632432, #827131, #874429, #908830, #925513, #934808.
+# Removal on 2025-06-14.
+www-misc/htdig
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-13)
+# Depends on Qt5 and is unmaintained for a very long time - currently
+# packaged release is from 2021. Alternatives are gui-apps/deskflow or
+# gui-apps/input-leap - see also bugs #953262, #907118
+# Removal on 2025-06-12.
+x11-misc/synergy
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-13)
+# No more revdeps, depends on Qt5. Bug #955654; removal on 2025-06-12.
+dev-games/openscenegraph-qt
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-13)
+# Last release from 2021, last commit >1 year ago and depends on Qt5.
+# Upstream shows no signs of activity let alone Qt6 porting work.
+# Unmaintained in Gentoo. Bug #950302; removal on 2025-06-12.
+x11-misc/qtfm
+
+# Matt Turner <mattst88@gentoo.org> (2025-05-13)
+# Package is replaced by dev-util/mesa_clc.
+# Removal on 2025-06-12.  Bug #955925.
+dev-util/intel_clc
+
+# Petr Vaněk <arkamar@gentoo.org> (2025-05-12)
+# A serious performance regression has been found in 10.11.12 and 11.4.6
+# releases, distributions are advised to not publish them, see
+# https://lists.mariadb.org/hyperkitty/list/packagers@lists.mariadb.org/thread/TP74ZU2ARZOQBLUNPT63I2A6LNB54XLJ/
+# and related bug reports:
+# https://jira.mariadb.org/browse/MDEV-36759
+# https://jira.mariadb.org/browse/MDEV-36765
+# https://jira.mariadb.org/browse/MDEV-36766
+#
+# Affected packages were removed from the tree, but this message shall be kept
+# untill 2025-06-23.
+~dev-db/mariadb-10.11.12
+~dev-db/mariadb-11.4.6
+
+# Petr Vaněk <arkamar@gentoo.org> (2025-05-10)
+# Unmaintained upstream, incompatible with py3.12+, no revdeps, see
+# https://github.com/torproject/stem/issues/154 and
+# https://github.com/torproject/nyx/issues/68
+# Removal on 2025-06-09.
+net-libs/stem
+net-misc/nyx
+
+# Michał Górny <mgorny@gentoo.org> (2025-05-08)
+# Vulnerable, EOL branch of dev-python/django.  Bug #955606.
+# Pleas upgrade to 5.1, 5.2 LTS, or downgrade to 4.2 LTS.
+=dev-python/django-5.0*
+
+# Alfred Wingate <parona@protonmail.com> (2025-05-05)
+# Masked for testing
+>=dev-libs/libxml2-2.14
+dev-libs/libxml2-compat
 
 # Michał Górny <mgorny@gentoo.org> (2025-05-04)
 # New wave of breakage from random removals.
@@ -56,21 +233,6 @@ app-misc/flirc
 # Removal on 2025-06-02.  Bug #950475, #952653.
 sci-chemistry/modeller
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
-# Dead upstream since 2014, depends on Qt5. Bug #949079
-# Removal  on 2025-05-31
-media-video/ffdiaporama
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-03)
-# Dead upstream since 2011, relies on downstream patching even for Qt5.
-# No one else packages this. Bugs #644482, #953769; removal on 2025-05-31
-sci-electronics/osqoop
-
-# Matt Turner <mattst88@gentoo.org> (2024-05-02)
-# Masked for testing
-=dev-util/mesa_clc-25.1*
-=media-libs/mesa-25.1*
-
 # Marc Schiffbauer <mschiff@gentoo.org> (2025-05-02)
 # Ancient version in tree, upstream discontinued to develop
 # a server for taskwarrior a long time ago
@@ -79,39 +241,6 @@ acct-group/taskd
 acct-user/taskd
 app-misc/taskd
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-01)
-# Unmaintained in Gentoo for almost 3 years, no commit upstream in 5 years
-# and depends on Qt5. Whoever wants to keep this in ::gentoo must sort out
-# the upstream/new-upstream situation and become a permanent maintainer.
-# Bugs #951484, #954360, #752198; removal on 2025-05-31
-x11-apps/radeon-profile
-x11-apps/radeon-profile-daemon
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-01)
-# Dead upstream for many years, depends on Qt5 and FTB w/ boost-1.87 among
-# other bugs. Bugs #946991, #949076, #943002; removal on 2025-05-31
-games-board/pokerth
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-01)
-# Dead upstream for many years, depends on Qt5 and app-text/poppler[qt5].
-# Bug #949025; removal on 2025-05-31
-x11-misc/qcomicbook
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-01)
-# Package destabilisation mask. 1.0_p20241107 is in ~arch but as snapshot
-# with long-term pending Qt6 patches on top it will not be stabilised.
-# 1.0 release was almost 8 years old already.
-~media-gfx/fotowall-1.0
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-01)
-# No maintainer in Gentoo since 2016, current package is still Qt5 based;
-# upstream does not even bother making tags let alone releases; anyone who
-# wants to deal with that shall step up as permanent maintainer and cut
-# some kind of Qt6 based package.
-# See also: https://github.com/fritzing/fritzing-app/issues/4086
-# Bug #947619; removal on 2025-05-31
-sci-electronics/fritzing
-
 # Matt Jolly <kangie@gentoo.org> (2025-04-28)
 # Unmaintained in Gentoo, depends on masked x11-wm/fvwm,
 # SRC_URI uses mirror://gentoo and the files don't exist on mirrors.
@@ -129,44 +258,6 @@ x11-themes/fvwm-themes
 x11-themes/fvwm-themes-extra
 =x11-themes/fvwm-crystal-3.7.5
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-28)
-# Package destabilisation mask for potential runtime errors and lack of
-# Qt6-compatible plugins. Bug #955031
-~sci-geosciences/qgis-3.38.3
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-26)
-# Dead upstream, stuck on Qt5, blocking x11-libs/qscintilla[qt5] cleanup
-# Bug #947297; removal on 2025-05-26
-dev-db/sqliteman
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-26)
-# Dead upstream, last revdep on x11-libs/qwtplot3d and x11-libs/qwt:5
-# Bugs #948047, #942455; removal on 2025-05-26
-sci-visualization/scidavis
-x11-libs/qwtplot3d
-x11-libs/qwt:5
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-24)
-# Requires Qt5WebEngine; bug #925722
-# Removal on 2025-05-24 - with a good chance to be kept if ported by then.
-www-client/otter
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-24)
-# Requires Qt5WebEngine; no more revdeps. Bug #926684
-# Removal on 2025-05-24.
-dev-python/pyqtwebengine
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-24)
-# Dead upstream, Qt5 based, no more revdeps. Bug #949019
-# Removal on 2025-05-24.
-dev-python/python-poppler-qt5
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-22)
-# Dead upstream, depends on downstream patching even for Qt5 support.
-# Almost no one else keeps packaging this. Bug #947622
-# Removal on 2025-05-22.
-sci-visualization/zhu3d
-
 # Michał Górny <mgorny@gentoo.org> (2025-04-22)
 # Metapackage used for pypy3 target in the past.
 # Removal on 2025-05-22.
@@ -178,59 +269,16 @@ dev-python/pypy3
 # Removal on 2025-05-22.  Bug #954213.
 dev-python/unittest-or-fail
 
-# Hans de Graaff <graaff@gentoo.org> (2025-04-21)
-# ruby32-only slot. Use the newer slot instead.
-# Masked for removal on 2025-05-21.
-dev-ruby/highline:2
-
-# Hans de Graaff <graaff@gentoo.org> (2025-04-20)
-# ruby32-only slot. Use the newer slot instead.
-# Masked for removal on 2025-05-20.
-dev-ruby/activeldap:6
-
 # Michał Górny <mgorny@gentoo.org> (2025-04-19)
 # This package will no longer feature stable keywords, due to unresolved
 # test failures blocking the stabilization request for months.
 <dev-python/mpi4py-4
 
-# Hans de Graaff <graaff@gentoo.org> (2025-04-19)
-# Ruby 3.1 is no longer supported upstream and will no longer
-# receive security updates. This mask also includes any
-# remaining ruby31-only packages.
-dev-lang/ruby:3.1
-dev-ruby/async:1
-dev-ruby/pathutil
-=app-admin/puppet-7*
-
 # Conrad Kostecki <conikost@gentoo.org> (2025-04-18)
 # Package not needed anymore by the only consumer net-dns/hash-slinger.
 # Masked for removal on 2025-05-18. Bug #952341
 dev-python/ipaddr
 
-# Hans de Graaff <graaff@gentoo.org> (2025-04-14)
-# Obsolete slot that fails tests, bug 933189. EAPI 7.  Use the newer
-# slot instead. Masked for removal on 2025-05-14.
-dev-ruby/childprocess:2
-
-# Michał Górny <mgorny@gentoo.org> (2025-04-09)
-# Still uses legacy distutils-r1 mode, and lacks Python 3.13 target.
-# No reply from the maintainer for a year now.
-# Removal on 2025-05-09.  Bug #909900.
-app-text/nfoview
-
-# Matt Turner <mattst88@gentoo.org> (2025-04-04)
-# Package is dead (last release in 1999).
-# Not relevant today: purpose is to not overload a very slow system with
-# multiple X11 clients starting at the same time. SRC_URI is long dead.
-# Removal on 2025-05-04.  Bug #953120.
-x11-misc/xtoolwait
-
-# Matt Turner <mattst88@gentoo.org> (2025-04-04)
-# Package is dead and has a pile of patches to make it compile.
-# SRC_URI is long gone. Many alternative image viewers.
-# Removal on 2025-05-04.  Bug #953119.
-media-gfx/xloadimage
-
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-02)
 # Masked for testing the new .0 version and leave time for packages
 # to catch up on support if needed. May or may keep masked until 6.9.1
@@ -297,6 +345,7 @@ net-im/yowsup
 >=xfce-base/thunar-4.21
 >=xfce-base/tumbler-4.21
 >=xfce-base/xfce4-appfinder-4.21
+>=xfce-base/xfce4-dev-tools-4.21
 >=xfce-base/xfce4-panel-4.21
 >=xfce-base/xfce4-power-manager-4.21
 >=xfce-base/xfce4-session-4.21
@@ -325,13 +374,6 @@ net-im/yowsup
 =dev-libs/libixion-0.20.0
 =dev-util/mdds-3.0.0
 
-# Nowa Ammerlaan <nowa@gentoo.org> (2025-02-21)
-# Shiboken and Pyside-tools have been merged into dev-python/pyside
-# as of version 6.8.2. Pyside-tools are useable when the "tools" USE
-# flag is enabled.
-dev-python/shiboken6
-dev-python/pyside6-tools
-
 # Maciej Barć <xgqt@gentoo.org> (2025-02-12)
 # Masked for testing. Fails to update from previous version. See bug #949626.
 >=x11-themes/fluent-icon-theme-2025.02.10
@@ -372,7 +414,7 @@ dev-python/pyside6-tools
 =dev-cpp/cpp-httplib-0.18.6
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-01-23)
-# Qt5 packages without any revdeps.
+# Qt5 tools without any revdeps.
 dev-qt/assistant
 dev-qt/linguist
 dev-qt/pixeltool
@@ -381,16 +423,20 @@ dev-qt/qdbusviewer
 dev-qt/qdoc
 dev-qt/qtdiag
 dev-qt/qtpaths
+dev-qt/qtplugininfo
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-23)
+# Qt5 packages without any revdeps. Removal on 2025-06-01.
 dev-qt/qt3d:5
 dev-qt/qtdatavis3d:5
 dev-qt/qtgamepad:5
 dev-qt/qtlocation:5
 dev-qt/qtnetworkauth:5
-dev-qt/qtplugininfo
 dev-qt/qtquicktimeline:5
 dev-qt/qtsensors:5
 dev-qt/qtserialbus:5
 dev-qt/qtvirtualkeyboard:5
+dev-qt/qtwebchannel:5
 dev-qt/qtwebview:5
 
 # Michał Górny <mgorny@gentoo.org> (2024-12-05)
@@ -466,9 +512,11 @@ app-emulation/virtualbox-kvm
 ~sys-boot/plymouth-24.004.60
 
 # Sam James <sam@gentoo.org> (2024-09-30)
-# GCC 10 and older no longer receive upstream support or fixes for
+# GCC 11 and older no longer receive upstream support or fixes for
 # bugs. Please switch to a newer GCC version using gcc-config.
-# The lowest supported version of GCC is GCC 11.
+#
+# The earliest supported version of GCC is GCC 12, but 11 remains unmasked
+# for now to ease sys-devel/gcc[d] bootstrapping.
 <sys-devel/gcc-11
 <sys-devel/kgcc64-11
 
@@ -631,7 +679,10 @@ media-plugins/kodi-game-libretro-dosbox
 # Masked for more testing especially of reverse-deps.
 # ogre 1.11/1.12 breakage: bug #834468
 # ogre 2.x breakage: bug #740424
->=dev-games/ogre-1.11.2
+dev-games/ogre:0/1.12
+dev-games/ogre:0/2.1
+dev-games/ogre:0/13.6
+dev-games/ogre:0/14.3
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2018-09-11)
 # Mask transition ebuilds that were needed only for <glibc-2.26
@@ -662,10 +713,10 @@ media-plugins/kodi-game-libretro-dosbox
 # If you still use one of these old toolchain packages, please upgrade (and
 # switch the compiler / the binutils) ASAP. If you need them for a specific
 # (isolated) use case, feel free to unmask them on your system.
-<sys-libs/glibc-2.38-r10
-<sys-libs/binutils-libs-2.42
-<sys-devel/binutils-2.42
-<sys-devel/binutils-hppa64-2.42
+<sys-libs/glibc-2.40-r8
+<sys-libs/binutils-libs-2.44
+<sys-devel/binutils-2.44
+<sys-devel/binutils-hppa64-2.44
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-01-07)
 # This package has some dangerous quality and security issues, but
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index 164932d0c7a..b45af14ef46 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -3,8 +3,8 @@
 
 #############################################
 # This is a list of valid profiles for each architecture.  This file is used by
-# repoman when doing a repoman scan or repoman full.
-# DO NOT ADD PROFILES WITH A "die" or "exit" IN THEM OR IT KILLS REPOMAN
+# pkgcheck when running pkgcheck scan.
+# DO NOT ADD PROFILES WITH A "die" or "exit" IN THEM OR IT KILLS PKGCHECK
 #
 #layout:
 #arch		profile_directory						status
@@ -67,8 +67,8 @@ amd64		default/linux/amd64/23.0/no-multilib/prefix			exp
 amd64		default/linux/amd64/23.0/no-multilib/prefix/kernel-2.6.32+	exp
 amd64		default/linux/amd64/23.0/no-multilib/prefix/kernel-2.6.16+	exp
 amd64		default/linux/amd64/23.0/no-multilib/prefix/kernel-3.2+		exp
-amd64		default/linux/amd64/23.0/llvm					dev
-amd64		default/linux/amd64/23.0/llvm/systemd				dev
+amd64		default/linux/amd64/23.0/llvm					exp
+amd64		default/linux/amd64/23.0/llvm/systemd				exp
 amd64		default/linux/amd64/23.0/hardened				stable
 amd64		default/linux/amd64/23.0/hardened/systemd			stable
 amd64		default/linux/amd64/23.0/hardened/selinux			stable
@@ -85,7 +85,7 @@ amd64		default/linux/amd64/23.0/split-usr/no-multilib/prefix		exp
 amd64		default/linux/amd64/23.0/split-usr/no-multilib/prefix/kernel-2.6.32+	exp
 amd64		default/linux/amd64/23.0/split-usr/no-multilib/prefix/kernel-2.6.16+	exp
 amd64		default/linux/amd64/23.0/split-usr/no-multilib/prefix/kernel-3.2+	exp
-amd64		default/linux/amd64/23.0/split-usr/llvm				dev
+amd64		default/linux/amd64/23.0/split-usr/llvm				exp
 amd64		default/linux/amd64/23.0/split-usr/hardened			stable
 amd64		default/linux/amd64/23.0/split-usr/hardened/selinux		stable
 
@@ -236,15 +236,15 @@ arm64		default/linux/arm64/23.0/desktop/plasma				stable
 arm64		default/linux/arm64/23.0/desktop/plasma/systemd			stable
 arm64		default/linux/arm64/23.0/desktop/systemd			stable
 arm64		default/linux/arm64/23.0/systemd				stable
-arm64		default/linux/arm64/23.0/llvm					dev
-arm64		default/linux/arm64/23.0/llvm/systemd				dev
+arm64		default/linux/arm64/23.0/llvm					exp
+arm64		default/linux/arm64/23.0/llvm/systemd				exp
 arm64		default/linux/arm64/23.0/split-usr				stable
 arm64		default/linux/arm64/23.0/split-usr/hardened			dev
 arm64		default/linux/arm64/23.0/split-usr/hardened/selinux		dev
 arm64		default/linux/arm64/23.0/split-usr/desktop			stable
 arm64		default/linux/arm64/23.0/split-usr/desktop/gnome		stable
 arm64		default/linux/arm64/23.0/split-usr/desktop/plasma		stable
-arm64		default/linux/arm64/23.0/split-usr/llvm				dev
+arm64		default/linux/arm64/23.0/split-usr/llvm				exp
 
 
 # ARM64 Profiles (big-endian)
@@ -294,8 +294,8 @@ loong		default/linux/loong/22.0/la64v100/lp64d/developer				exp
 loong		default/linux/loong/22.0/la64v100/lp64d/systemd					exp
 loong		default/linux/loong/22.0/la64v100/lp64d/systemd/merged-usr			exp
 loong		default/linux/loong/23.0/la64v100/lp64d						stable
-loong		default/linux/loong/23.0/la64v100/lp64d/llvm					dev
-loong		default/linux/loong/23.0/la64v100/lp64d/llvm/systemd				dev
+loong		default/linux/loong/23.0/la64v100/lp64d/llvm					exp
+loong		default/linux/loong/23.0/la64v100/lp64d/llvm/systemd				exp
 loong		default/linux/loong/23.0/la64v100/lp64d/desktop					stable
 loong		default/linux/loong/23.0/la64v100/lp64d/desktop/gnome				dev
 loong		default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd			dev
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
index b96230069e6..5df31320ad8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Marek Szuba <marecki@gentoo.org> (2023-11-12)
@@ -53,6 +53,7 @@ kde-apps/marble phonon
 
 # Required by kde-plasma/plasma-meta
 kde-plasma/kwin lock
+kde-plasma/kwin-x11 lock
 
 # plasma profile never enabled pulseaudio. We're skipping to pipewire.
 media-video/pipewire sound-server
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask b/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
index 532b8d38fd3..4698f2e442b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-18)
+# Requires systemd, so specifically unmasked only in targets/systemd.
+->=kde-plasma/drkonqi-6.3.90
+
 # Sam James <sam@gentoo.org> (2024-11-10)
 # Breaks suspend on elogind systems (bug #934314, bug #923614) but
 # works fine on systemd machines.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
index bb539889697..8a255a61f38 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
+++ b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
@@ -10,7 +10,7 @@ gnupg		https://www.mirrorservice.org/sites/ftp.gnupg.org/gcrypt/ https://mirrors
 goproxy https://proxy.golang.org/ https://goproxy.io/
 idsoftware	ftp://ftp.fu-berlin.de/pc/games/idgames/idstuff ftp://ftp.gamers.org/pub/idgames/idstuff
 imagemagick	https://imagemagick.org/archive/releases/ https://mirror.checkdomain.de/imagemagick/releases/ https://ftp.acc.umu.se/mirror/imagemagick.org/ftp/releases/ ftp://ftp.fifi.org/pub/ImageMagick/releases/
-kde		https://download.kde.org https://mirror.csclub.uwaterloo.ca/kde ftp://mirrors.dotsrc.org/kde http://kde.mirror.anlx.net
+kde		https://download.kde.org https://mirror.csclub.uwaterloo.ca/kde ftp://mirrors.dotsrc.org/kde https://ftp.gwdg.de/pub/linux/kde https://ftp.mirrorservice.org/sites/ftp.kde.org/pub/kde
 lokigames	http://updates.lokigames.com
 mariadb		https://archive.mariadb.org/ http://ftp.bme.hu/pub/mirrors/mariadb/ https://ftp.nluug.nl/db/mariadb/ https://mirrors.up.pt/pub/mariadb/ https://rsync.osuosl.org/pub/mariadb/ https://mirror.netcologne.de/mariadb/
 mplayer		https://www1.mplayerhq.hu/MPlayer http://www2.mplayerhq.hu/MPlayer http://www7.mplayerhq.hu/MPlayer http://www8.mplayerhq.hu/MPlayer ftp://ftp1.mplayerhq.hu/MPlayer/ ftp://ftp6.mplayerhq.hu/MPlayer/ ftp://ftp7.mplayerhq.hu/MPlayer/ ftp://ftp8.mplayerhq.hu/MPlayer/
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024
index 078900007e3..19d989a7125 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/4Q-2024
@@ -55,7 +55,6 @@ move dev-python/QtPy dev-python/qtpy
 move dev-python/PyQt-builder dev-python/pyqt-builder
 move dev-python/PyQt6-WebEngine dev-python/pyqt6-webengine
 move dev-python/PyQt6-sip dev-python/pyqt6-sip
-move dev-python/PyQtWebEngine dev-python/pyqtwebengine
 move dev-python/PyQt5-sip dev-python/pyqt5-sip
 move dev-python/PyQt5 dev-python/pyqt5
 move dev-python/PyQt6 dev-python/pyqt6
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
index def062065c8..de1e262bd94 100644
--- a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
@@ -1,3 +1,2 @@
 DIST gentoo-release-test-sigs-20190224.tar.gz 3235 BLAKE2B 924c69a62d5321716f536144f0607bd3ec4a65d76be492adc729864fd9bef82df0086541ae13034a83152ea0c8dc3cbd168be6cff111a3484128a22cbc8ef1d4 SHA512 f8cc2e84bedbdf14ace6abe4aacf8f0c9810c77ff6ae0fac301829d9d4d5cf0c128a76516c773ac993879215bcdb0aab097e1e7e747d8e1a7c4cfc815bd4d3e6
-DIST gentoo-release.asc.20230329.gz 16462 BLAKE2B 3ee5a2b9442731ff4498b448c5defe07b6fb299196f31445ba934360fff295150c0bcac037be01a1e5db97f00de1ccbfdb3a7abbf4ad0ff069d95ab42e28e680 SHA512 6e0720b0894dd80b19b769731aaa1862266371ad45c7d9e0fc9df173454b7d8b0f345dd16a47e3034d8ab34c50c3818a305f863af83edaaf7421f25bb03f4ad4
 DIST gentoo-release.asc.20240703.gz 18710 BLAKE2B 2436319e0fc05432ea08e7828a337551de0b37783c4376e3249ed132c29d394376fb2e5f36281299cb251473ecb2b2240f75e2b7bdefa02ff35cc1ca4250c515 SHA512 1e17dfb0c626044a50ffc410fc515ea64d9ed53c53c70c046a6ebaf59a8991885c1f7dadb3366334fa840b91882f825a0878988a43a43adec0f10b1a22b4f7ee
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild
deleted file mode 100644
index 301d4878cd5..00000000000
--- a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-DESCRIPTION="OpenPGP keys used for Gentoo releases (snapshots, stages)"
-HOMEPAGE="https://www.gentoo.org/downloads/signatures/"
-SRC_URI="https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release.asc.${PV}.gz
-	test? ( https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release-test-sigs-20190224.tar.gz )"
-
-LICENSE="public-domain"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-DEPEND="test? ( app-crypt/gnupg )"
-
-S=${WORKDIR}
-
-# Keys included:
-# DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
-# D99EAC7379A850BCE47DA5F29E6438C817072058
-# 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910
-# EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
-
-src_test() {
-	local old_umask=$(umask)
-	umask 077
-
-	local -x GNUPGHOME=${T}/.gnupg
-	mkdir "${GNUPGHOME}" || die
-	einfo "Importing keys ..."
-	gpg --import "gentoo-release.asc.${PV}" || die "Key import failed"
-
-	local f
-	for f in gentoo-release-test-sigs*/*.asc; do
-		einfo "Testing ${f##*/} ..."
-		gpg -q --trust-model always --verify "${f}" || die "Verification failed on ${f}"
-	done
-
-	umask "${old_umask}"
-}
-
-src_install() {
-	insinto /usr/share/openpgp-keys
-	newins "gentoo-release.asc.${PV}" gentoo-release.asc
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
index a055cb13a55..dfe43b9e635 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal
+inherit dot-a multilib-minimal
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/${PN}.git"
@@ -42,6 +42,8 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	use static-libs && lto-guarantee-fat
+
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/bin
 		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
@@ -68,5 +70,6 @@ multilib_src_install_all() {
 		find "${ED}" -name '*.la' -delete || die
 	fi
 
+	strip-lto-bytecode
 	einstalldocs
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
index 35f3c75e822..6973625cc4e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal
+inherit dot-a multilib-minimal
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/${PN}.git"
@@ -42,6 +42,8 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	use static-libs && lto-guarantee-fat
+
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/bin
 		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
@@ -68,5 +70,6 @@ multilib_src_install_all() {
 		find "${ED}" -name '*.la' -delete || die
 	fi
 
+	strip-lto-bytecode
 	einstalldocs
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
index b5524796510..22a24ddad25 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]] ; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild
index e5e3c773c37..0e2e2be8295 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild
@@ -33,7 +33,7 @@ else
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+	KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
 fi
 
 SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
index 54d4be116e3..675a517e46d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == *_p* ]] ; then
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
index 964f035d268..7b50b6fbaec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.2-r2.ebuild
@@ -3,8 +3,8 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
-inherit meson python-single-r1
+PYTHON_COMPAT=( python3_{11..13} )
+inherit dot-a meson python-single-r1
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/dtc/dtc.git"
@@ -61,6 +61,7 @@ pkg_setup() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	local emesonargs=(
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
@@ -69,14 +70,16 @@ src_configure() {
 		$(meson_feature yaml)
 	)
 
-	# bug #909366
-	use static-libs && emesonargs+=( -Dstatic-build=true )
-
 	meson_src_configure
 }
 
 src_install() {
 	meson_src_install
+	if use !static-libs; then
+		# bug #907940
+		rm "${ED}/usr/$(get_libdir)"/*.a || die
+	fi
+	strip-lto-bytecode
 
 	use python && python_optimize "${ED}"
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
index 3f84b5746fa..3095155f0e3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
@@ -3,8 +3,8 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
-inherit meson python-single-r1
+PYTHON_COMPAT=( python3_{11..13} )
+inherit dot-a meson python-single-r1
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/dtc/dtc.git"
@@ -56,7 +56,9 @@ pkg_setup() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	local emesonargs=(
+		-Ddefault_library=$(usex static-libs both shared)
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
 		$(meson_feature python)
@@ -64,14 +66,12 @@ src_configure() {
 		$(meson_feature yaml)
 	)
 
-	# bug #909366
-	use static-libs && emesonargs+=( -Dstatic-build=true )
-
 	meson_src_configure
 }
 
 src_install() {
 	meson_src_install
+	strip-lto-bytecode
 
 	use python && python_optimize "${ED}"
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
index bf8ef8f09f9..8897d27709a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_OPTIONAL=1
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit distutils-r1 toolchain-funcs multilib-minimal
 
@@ -18,7 +18,7 @@ else
 	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
index 12182441c5e..6a5896a7e01 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_OPTIONAL=1
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit distutils-r1 toolchain-funcs multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
index 9972bde7f7d..9925c2a4518 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
@@ -29,7 +29,7 @@ else
 	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild
index 38c64f263a1..31885bee97d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == *_p* ]] ; then
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 502a96844e4..15c6bdad484 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -2,3 +2,4 @@ DIST iproute2-6.11.0.tar.xz 923736 BLAKE2B 1a360d7cb9a70f5cde184abe934f2d08e9c0d
 DIST iproute2-6.12.0.tar.xz 925392 BLAKE2B 95aee769662e21c8c6223d09ee0ec365fcdeb7a10d01e89e33aa3039a6dfac11401cbdca4bf436544fc05ed709ad90871ac91eaf17dc553d7ca157b98577a7b7 SHA512 dbd6afb8162a6086e4be9045b8dc53aa563bd4b7abaf43ee13cd7d493730ff0b90e6985f68c6f42d64f4af6a692d0589e0cefd2f24045ec1c10418cfb73940b2
 DIST iproute2-6.13.0.tar.xz 927416 BLAKE2B bbebc44d1a7e35c410869a2a5884df09698ea3950acd126e5736a938718d40e57d539ff88ecd7827cbdf2f9481c3d728fff3948a61c2ba3e1483c5b7a7616577 SHA512 2e392a8ddc3d7662c3a72bba1c845587df85b7afc6efabf7df0ec2830bb1d4b16cac5bfb7a43dc3ac73adf0ea3fe3670824674d4f32209c6d1aa638a7cb7cd6c
 DIST iproute2-6.14.0.tar.xz 929092 BLAKE2B 18bd180c608b657694f4713bf915d45006c97a7206a3260ac52149d4c976422e1949ada425d4989c5a7e327e3d8eb45ea990de25f3645bb1308ac2531bf834d2 SHA512 e79049bdca0e0381f0a93a40e4d597ce59fb509dabc6e8b04a510ff9953f091c67577d6faa62967bd197bf62ab6e56d928558270a1390621431acb237b77fa46
+DIST iproute2-6.15.0.tar.xz 930908 BLAKE2B 50247f293e194601bd138418e55e2dc63421d2a5da863973e9ff78f2c76ba051350523559f2b7b7983af05a827f292135353adbf6c857ea32b7071f69940f73f SHA512 1a438941cd939e1c8e32cfe8c40e6fd826c89185f1bb0c623eaad7380a66afd9fa9e0d7cdc5e5b193d2761b7dbdc78fd0811537eecc500be633730c32ff55ad4
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
index dc463bb807c..1a434fec50e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit edo toolchain-funcs flag-o-matic
+inherit dot-a edo toolchain-funcs flag-o-matic
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
@@ -86,6 +86,7 @@ src_prepare() {
 
 src_configure() {
 	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
 
 	# This sure is ugly. Should probably move into toolchain-funcs at some point.
 	local setns
@@ -210,4 +211,5 @@ src_install() {
 	elif [[ -d "${ED}"/var/lib/arpd ]]; then
 		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
 	fi
+	strip-lto-bytecode
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.15.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.15.0.ebuild
new file mode 100644
index 00000000000..dfc30230bd4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.15.0.ebuild
@@ -0,0 +1,215 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+	strip-lto-bytecode
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index dcaf60620fa..dfc30230bd4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit edo toolchain-funcs flag-o-matic
+inherit dot-a edo toolchain-funcs flag-o-matic
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
@@ -86,6 +86,7 @@ src_prepare() {
 
 src_configure() {
 	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
 
 	# This sure is ugly. Should probably move into toolchain-funcs at some point.
 	local setns
@@ -210,4 +211,5 @@ src_install() {
 	elif [[ -d "${ED}"/var/lib/arpd ]]; then
 		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
 	fi
+	strip-lto-bytecode
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
index 3ec0553a753..b6fe3db885c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
@@ -1,3 +1,2 @@
-DIST kbd-2.5.1.tar.xz 1491952 BLAKE2B aab4c3d78c28709bf562b54fe94c0533d5c33185e183bf3eb944f89147b250d9df9b30b64a06eb4742feafe8c05a6aa491a7f007b4d6d9077bc19a4628ba05ae SHA512 74855f486aff5fc2f93a6cb29460a590c94eac653b001574e1b4eb1300ea99dfed9222f9e5d1d3a05a112a6880591d5c44ed6e76b8a64edf744ecb0892f562d0
-DIST kbd-2.6.4.tar.xz 1504584 BLAKE2B 25e55be0210c206c1f5eb0d85045bb1cbb2442cf88fb7eb28f7bbb8dd0d86473f48444fd9d80dfc624ce7ba8b39bfe1152ee6cf1877fab444e09600e93dae0ee SHA512 a4149cb0f85fd79b333a6c137d70896a30ebceb1cf9d4b5eef3abb2e1866d83b46cee651e4f3e512bf7e0ccd232d955c14f693e57020a3626e4943c4695fc8ab
 DIST kbd-2.7.1.tar.xz 1471648 BLAKE2B c817f78a0a377df5fcf2a6ba1608504fa875762db5bda1f061493e68ee6f6ef1fa085c0e440d74daeb6ad990ac48956caf7ab7f2a523b0d3b2480e69a9d810f5 SHA512 9c541fdbb77e5b1a757848fb4c6f8bb5a61791220938cbfe899aa16b412a87e98fc97fc06ba39d0f983e4cc808d0dcd983560e12c7f36e4df683a3002c51af09
+DIST kbd-2.8.0.tar.xz 1482152 BLAKE2B 3b1917e37bbb4f2a975cf1f6bbfeba6a6ee486378d770c3b0232c62c40fe758181a15799f9119e3e4eedbb356a0677b3fba4b0afef135d346801693a6ef432cc SHA512 66b532e782b6be3f53521a8d1c96f2ce895201dae48f8797c563be895dfdf4e9c03b9ccf39708d1b7dd1ffb13d526e499874e8e4ba74d22b507c1d32e4b410a3
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.5.1.ebuild
deleted file mode 100644
index b935995b48d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.5.1.ebuild
+++ /dev/null
@@ -1,83 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-if [[ ${PV} == 9999 ]] ; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://github.com/legionus/kbd.git https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git"
-	EGIT_BRANCH="master"
-else
-	if [[ $(ver_cut 3) -lt 90 ]] ; then
-		SRC_URI="https://www.kernel.org/pub/linux/utils/kbd/${P}.tar.xz"
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-	else
-		inherit autotools
-		SRC_URI="https://github.com/legionus/kbd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	fi
-fi
-
-DESCRIPTION="Keyboard and console utilities"
-HOMEPAGE="https://kbd-project.org/"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="nls pam test"
-RESTRICT="!test? ( test )"
-
-# Testsuite's Makefile.am calls missing(!)
-# ... but this seems to be consistent with the autoconf docs?
-# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html
-QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
-
-RDEPEND="
-	app-alternatives/gzip
-	pam? (
-		!app-misc/vlock
-		sys-libs/pam
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	test? ( dev-libs/check )
-"
-
-src_prepare() {
-	default
-
-	# Rename conflicting keymaps to have unique names, bug #293228
-	# See also https://github.com/legionus/kbd/issues/76.
-	pushd "${S}"/data/keymaps/i386 &> /dev/null || die
-	mv fgGIod/trf.map fgGIod/trf-fgGIod.map || die
-	mv olpc/es.map olpc/es-olpc.map || die
-	mv olpc/pt.map olpc/pt-olpc.map || die
-	mv qwerty/cz.map qwerty/cz-qwerty.map || die
-	popd &> /dev/null || die
-
-	if [[ ${PV} == 9999 ]] || [[ $(ver_cut 3) -ge 90 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	local myeconfargs=(
-		--disable-werror
-
-		$(use_enable nls)
-		$(use_enable pam vlock)
-		$(use_enable test tests)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	docinto html
-	dodoc docs/doc/*.html
-
-	# USE="test" installs .la files
-	find "${ED}" -type f -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
similarity index 70%
rename from sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
index ebceb5c788b..d7923299f9e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -12,7 +12,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	if [[ $(ver_cut 3) -lt 90 ]] ; then
 		SRC_URI="https://www.kernel.org/pub/linux/utils/kbd/${P}.tar.xz"
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	else
 		inherit autotools
 		SRC_URI="https://github.com/legionus/kbd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
@@ -27,11 +27,6 @@ SLOT="0"
 IUSE="nls selinux pam test"
 RESTRICT="!test? ( test )"
 
-# Testsuite's Makefile.am calls missing(!)
-# ... but this seems to be consistent with the autoconf docs?
-# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html
-QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
-
 DEPEND="
 	app-alternatives/gzip
 	pam? (
@@ -44,6 +39,7 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-loadkeys )
 "
 BDEPEND="
+	sys-devel/flex
 	virtual/pkgconfig
 	test? ( dev-libs/check )
 "
@@ -66,6 +62,9 @@ src_prepare() {
 }
 
 src_configure() {
+	# https://github.com/legionus/kbd/issues/121
+	unset LEX
+
 	local myeconfargs=(
 		--disable-werror
 
@@ -78,15 +77,28 @@ src_configure() {
 }
 
 src_test() {
+	# These tests want a tty and the check passes when it shouldn't
+	# when running via the ebuild.
+	sed -i -e "s:tty 2>/dev/null:false:" tests/testsuite || die
+
+	# Workaround Valgrind being mandatory for tests
+	# https://github.com/legionus/kbd/issues/133 (bug #956964)
+	#
+	# XXX: Drop this on next release (>2.8.0) and replace with
+	# --disable-memcheck in configure.
+	cat <<-EOF > tests/valgrind.sh || die
+	#!/bin/sh
+	shift
+	exec "\$@" 1>stdout 2>stderr
+	EOF
+	chmod +x tests/valgrind.sh || die
+
 	emake -Onone check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
 }
 
 src_install() {
 	default
 
-	docinto html
-	dodoc docs/doc/*.html
-
 	# USE="test" installs .la files
 	find "${ED}" -type f -name "*.la" -delete || die
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-9999.ebuild
index 8031a429399..538d6285889 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -39,6 +39,7 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-loadkeys )
 "
 BDEPEND="
+	sys-devel/flex
 	virtual/pkgconfig
 	test? ( dev-libs/check )
 "
@@ -61,8 +62,13 @@ src_prepare() {
 }
 
 src_configure() {
+	# https://github.com/legionus/kbd/issues/121
+	unset LEX
+
 	local myeconfargs=(
 		--disable-werror
+		# No Valgrind for the testsuite
+		--disable-memcheck
 
 		$(use_enable nls)
 		$(use_enable pam vlock)
@@ -73,6 +79,10 @@ src_configure() {
 }
 
 src_test() {
+	# These tests want a tty and the check passes when it shouldn't
+	# when running via the ebuild.
+	sed -i -e "s:tty 2>/dev/null:false:" tests/testsuite || die
+
 	emake -Onone check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.31.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.31.ebuild
index 66a6a76a66f..f313a673624 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.31.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.31.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == "9999" ]] ; then
 else
 	SRC_URI="https://www.kernel.org/pub/linux/utils/kernel/kexec/${P/_/-}.tar.xz"
 	[[ "${PV}" == *_rc* ]] || \
-	KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+	KEYWORDS="~amd64 arm64 ~ppc64 x86"
 fi
 
 DESCRIPTION="Load another kernel from the currently executing Linux kernel"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
index 184ec9c018e..0bc9c871e56 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
@@ -1,2 +1,3 @@
 DIST less-643.tar.gz 592291 BLAKE2B 6dc60dc2e8db05afdae466877a1d26a3008ff5378bbbf2fbdf9efc4f87c0fcfde5703d44a24d4355c98d3a5f438bdb51173150f2a69f801d9c8e4a7401d71b53 SHA512 6a324ac54e22429ac652dc303bc1fe48933555d1cbf8ad7ecf345940910c014fef9551a3219743cfb7115e356b5841ae97d6ce62e7a1ba1e3300d243efca34d9
 DIST less-668.tar.gz 649770 BLAKE2B 0f6a85a1c66577dd2a28682a6f8399e42fdbe9fc1498b2e89c6bb7c47109e8d3ab934abe5dd998b2c8dfacfb174ad9daeb79b3d4c13df22fa035ea792b2eaf5e SHA512 6527741a609849ec27b6ab35de46f2c5c2b2771391e3efe263207bee28915946f44331a42f832a7cb42231a19b135cbadc15ae02cd997b83a13cdfbc7213fc27
+DIST less-678.tar.gz 876971 BLAKE2B 5e6644a8c66f35f1b3ab72a0727c76922b7d3cf299d5d1cf1c94882e8b0d3ec0461cd351e6b2db554b331d993760db8eb17209f41f271f5704fee0caf8d6540e SHA512 ad1983229bfb5a30c6139db60012d3a12b613011f044acb4c0ec5c0fc809b8dc9be40255bf420f65d51425152c4cfc943076ccd2ee63b196165d6ab1426ea187
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-668.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-668.ebuild
index 899b82ee180..be837676e6c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-668.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-668.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-678.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-678.ebuild
new file mode 100644
index 00000000000..d0f19d686a2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-678.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Releases are usually first a beta then promoted to stable if no
+# issues were found. Upstream explicitly ask "to not generally distribute"
+# the beta versions. It's okay to keyword beta versions if they fix
+# a serious bug, but otherwise try to avoid it.
+
+WANT_AUTOMAKE=none
+WANT_LIBTOOL=none
+inherit autotools flag-o-matic optfeature toolchain-funcs
+
+DESCRIPTION="Excellent text file viewer"
+HOMEPAGE="https://www.greenwoodsoftware.com/less/"
+
+MY_PV=${PV/_beta/-beta}
+MY_P=${PN}-${MY_PV}
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/gwsw/less"
+	inherit git-r3
+else
+	SRC_URI="https://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
+
+	if [[ ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+S="${WORKDIR}"/${MY_P/?beta}
+
+LICENSE="|| ( GPL-3 BSD-2 )"
+SLOT="0"
+IUSE="pcre test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	>=app-misc/editor-wrapper-3
+	>=sys-libs/ncurses-5.2:=
+	pcre? ( dev-libs/libpcre2 )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="test? ( virtual/pkgconfig )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-643-lesstest-pkg-config.patch
+)
+
+src_prepare() {
+	default
+	# Per upstream README to prepare live build
+	[[ ${PV} == 9999 ]] && emake -f Makefile.aut distfiles
+	# Upstream uses unpatched autoconf-2.69, which breaks with clang-16.
+	# https://bugs.gentoo.org/870412
+	eautoreconf
+}
+
+src_configure() {
+	append-lfs-flags # bug #896316
+
+	local myeconfargs=(
+		--with-regex=$(usex pcre pcre2 posix)
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check VERBOSE=1 CC="$(tc-getCC)" PKG_CONFIG="$(tc-getPKG_CONFIG)"
+}
+
+src_install() {
+	default
+
+	keepdir /usr/lib/lessfilter.d
+	keepdir /etc/lessfilter.d
+
+	newbin "${FILESDIR}"/lesspipe-r4.sh lesspipe
+	newenvd "${FILESDIR}"/less.envd 70less
+}
+
+pkg_preinst() {
+	optfeature "Colorized output support" dev-python/pygments
+
+	if has_version "<${CATEGORY}/${PN}-483-r1" ; then
+		elog "The lesspipe.sh symlink has been dropped.  If you are still setting"
+		elog "LESSOPEN to that, you will need to update it to '|lesspipe %s'."
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-643" ; then
+		elog "less now colorizes by default. To disable this, set LESSCOLOR=no."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
index 57c09fbfd9a..be837676e6c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -25,7 +25,7 @@ else
 	SRC_URI="https://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
 
 	if [[ ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
index 26626e73331..3d12c0ea2a7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
@@ -1,3 +1,4 @@
 DIST nvme-cli-2.11.gh.tar.gz 1023249 BLAKE2B c60765aaf8343adb29b2b042223accdd1ac4b132eaab77eec777c7aaf8f135d03b227ca915ef49ef9c67bec1dc89d43b782c38683c0d5e8fde8c997d17bd7347 SHA512 33de20ad990a3b87fef46fa486832edde41907223aa6b8a47606e605b360745fd7e2054226bf93a59b2a09c6bc04d0b684e4b3bb27c3fc0e6110c64a558cadc0
 DIST nvme-cli-2.12.gh.tar.gz 1079884 BLAKE2B ad08ce7c477cebdbb68efd707de851e9b7187cc6bd4ce4980f9a6f33a02c65d0ae6702e4f38f135db22acadf10bc26b87064ac2c9e09c820837c47ca32b0f093 SHA512 569a60302e4ce71713906417f34a8922b4788d77220a01f2f11dd12fc787ac6590c00588353cbbba292640688995fcefee4ab28c274bedcc02a2e3439c258938
 DIST nvme-cli-2.13.gh.tar.gz 1122216 BLAKE2B 45b181607f22d332fcf9e8d14c0dfba5c5a49e7e95bcf479efaf8eae3a60222af10c2f6699aab2c53ec91ede6e3e262101bbde81248facf25d40c87c0b07fa22 SHA512 71ade7b97354bf70e4909d85265db157715c1afe52fba6d1e2aa614900a8059830e85029f71680884966476363e8846d6cfbc1dcfe57330c749775acc39df6e7
+DIST nvme-cli-2.14.gh.tar.gz 1142108 BLAKE2B 7d482f065de704d9da8c54ea435c3ca8e81f08f683a9679300d8d02fd9bec6ee2c068d77ddbd2e390bd1d761b8b4b4a70a790cc290127968800df361b7a767a7 SHA512 7f600ee719f06283e136427a0f9eb0b22412f7f4549c774768caff54150207ba87e2a431ea1569e5ed86a554aecd23c00c4e8c351aa0168a81807c86a0cb2edc
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.14.ebuild
new file mode 100644
index 00000000000..6ef94fc3276
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.14.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson systemd udev
+
+DESCRIPTION="NVM-Express user space tooling for Linux"
+HOMEPAGE="https://github.com/linux-nvme/nvme-cli"
+SRC_URI="https://github.com/linux-nvme/nvme-cli/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="GPL-2 GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc ~x86"
+IUSE="+json pdc"
+
+RDEPEND="
+	>=sys-libs/libnvme-1.14:=[json?]
+	json? ( dev-libs/json-c:= )
+	sys-libs/zlib:=
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+"
+BDEPEND="
+	virtual/pkgconfig
+"
+
+src_configure() {
+	local emesonargs=(
+		-Dversion-tag="${PV}"
+		-Ddocs=all
+		-Dhtmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+		-Dsystemddir="$(systemd_get_systemunitdir)"
+		-Dudevrulesdir="${EPREFIX}$(get_udevdir)/rules.d"
+		$(meson_feature json json-c)
+		$(meson_use pdc pdc-enabled)
+	)
+	meson_src_configure
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.3.ebuild
index dd302252b77..c7892459b4a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.3.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://pcsclite.apdu.fr/files/${P}.tar.xz"
 # upstream.
 LICENSE="BSD GPL-3+ BSD-2 ISC GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 # This is called libusb so that it doesn't fool people in thinking that
 # it is _required_ for USB support. Otherwise they'll disable udev and
 # that's going to be worse.
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest
index ad478ab458b..205d6daa2ea 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/Manifest
@@ -1 +1,2 @@
 DIST pkgcore-0.12.29.tar.gz 642382 BLAKE2B c080cb63db3163c9581eb9ae047dcf00212664234767e6e581664167d3e98c74ccee8abb78b2e4d268634443a3c6e6e583568080a1631b6d8ca3a567d047aa83 SHA512 a72ce837add96f2e6fc2f6612dff5e9a7b6bd9c18c382b46584754a0d87b6e582760028cb9538515e4b7177d0130a879b3e88f36c4d55dd19fd873438865b60b
+DIST pkgcore-0.12.30.tar.gz 647478 BLAKE2B 9fb76d0fed926a701326c58e096e039348e43ed3b594365207cb3410a6fcda287630452dfb9699af5230d6cd757dc5a1cdbd0802bef0d23646af19390f039f1a SHA512 09bf25c13835e4afa3f3839a8b1a043ed4284a760f5fb8c2313f618340c45a6992d29415595b4d63e6e3db21afc5fbf9368aadc801091b2ba35bf21c823fa630
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.30.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.30.ebuild
new file mode 100644
index 00000000000..915105f6e04
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-0.12.30.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} )
+inherit distutils-r1
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/pkgcore.git
+		https://github.com/pkgcore/pkgcore.git"
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	inherit pypi
+fi
+
+DESCRIPTION="a framework for package management"
+HOMEPAGE="https://github.com/pkgcore/pkgcore"
+
+LICENSE="BSD MIT"
+SLOT="0"
+
+if [[ ${PV} == *9999 ]]; then
+	COMMON_DEPEND="~dev-python/snakeoil-9999[${PYTHON_USEDEP}]"
+else
+	COMMON_DEPEND=">=dev-python/snakeoil-0.10.11[${PYTHON_USEDEP}]"
+fi
+
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-shells/bash-5.2[readline]
+	dev-python/lxml[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${COMMON_DEPEND}
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
+	test? (
+		dev-vcs/git
+	)
+"
+
+distutils_enable_tests pytest
+
+python_install_all() {
+	local DOCS=( NEWS.rst )
+	[[ ${PV} == *9999 ]] || doman build/sphinx/man/*
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-9999.ebuild
index aafbb6c3dbf..915105f6e04 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pkgcore/pkgcore-9999.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 inherit distutils-r1
 
 if [[ ${PV} == *9999 ]] ; then
@@ -25,12 +25,12 @@ SLOT="0"
 if [[ ${PV} == *9999 ]]; then
 	COMMON_DEPEND="~dev-python/snakeoil-9999[${PYTHON_USEDEP}]"
 else
-	COMMON_DEPEND=">=dev-python/snakeoil-0.10.7[${PYTHON_USEDEP}]"
+	COMMON_DEPEND=">=dev-python/snakeoil-0.10.11[${PYTHON_USEDEP}]"
 fi
 
 RDEPEND="
 	${COMMON_DEPEND}
-	>=app-shells/bash-5.1[readline]
+	>=app-shells/bash-5.2[readline]
 	dev-python/lxml[${PYTHON_USEDEP}]
 "
 BDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
index 42636c70dce..a688d365d57 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.46.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == *9999 ]]; then
 		https://github.com/gentoo/sandbox.git"
 else
 	SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="sandbox'd LD_PRELOAD hack"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
index 184020a21d9..090a025102f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == *9999 ]] ; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.5.ebuild
index 97147f10cbd..3615c2cac52 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.5.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit autotools subversion
 else
 	SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+	KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
 fi
 
 DESCRIPTION="Tools to monitor storage systems to provide advanced warning of disk degradation"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
index 51327c186fc..fab8ace23ef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.2.ebuild
@@ -27,7 +27,7 @@ elif [[ $(ver_cut 3) -ge 90 || $(ver_cut 4) -ge 90 ]] ; then
 	REGEN_BDEPEND=""
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	REGEN_BDEPEND=""
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
index 2f00ea1e981..82616c1f0d7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/usbutils/usbutils-018-r1.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://www.kernel.org/pub/linux/utils/usb/${PN}/${P}.tar.xz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="python usbreset"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
index e8d02fbc6a1..cd398debbd3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.4.ebuild
@@ -23,7 +23,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
index 718d96f9850..15a60893fc0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
@@ -1,2 +1,3 @@
 DIST sssd-2.10.2.tar.gz 9200497 BLAKE2B 76b6e4ab26c326d1075ae2811445e7c4196450af4b9791e3854c087bb82f229cc48a39027248d694943ec6fb9270d915a00d55eec7cd76c38700d4d1f3775360 SHA512 14ad222802e5426b0959ee32602e04ce24b3eb8d3bdd5e188cf29e3c7d32e0631b41c386fdbd129acf281317538460015d35410a688ea48dd546f9ae28522eac
 DIST sssd-2.9.6.tar.gz 9136447 BLAKE2B 9ba4faa66d56150de58e86588bd0dedb02ff2f155fa118a35cd981885fed6cab5fdf13373f575a41691c87b4d18c586cba717b399e3826675eee1b0f8da967b7 SHA512 d9a35fc12022f0a2aa73be373b396411fc69b2fe5489ab93d17813a4c75b3ec30e598d5748ab202f7588039b465e11d616ce546cd5fe5439fa8edd9ac8cda69a
+DIST sssd-2.9.7.tar.gz 9161891 BLAKE2B 1658f3a6447c58665fccf144292deda759a72e1dbe0913e49f510fa8342e0fa09569319a40293a63c360c17ede0e8051c93b81e488549ed8e3bbeff37ce86389 SHA512 ba2bcab28491971e420b8bb8769574e88af4059cad5cec5320668cabf31c11314fce6dcab45b097d7b0876dfebe1cad22a0104c0856c80cdc07c21b19a95a3f2
diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.7.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.6-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.7.ebuild
index 7ae6c777604..860a880b4b2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.6-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.7.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 PLOCALES="ca de es fr ja ko pt_BR ru sv tr uk"
 PLOCALES_BIN="${PLOCALES} bg cs eu fi hu id it ka nb nl pl pt tg zh_TW zh_CN"
 PLOCALE_BACKUP="sv"
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit autotools linux-info multilib-minimal optfeature plocale \
 	python-single-r1 pam systemd toolchain-funcs
@@ -15,7 +15,7 @@ DESCRIPTION="System Security Services Daemon provides access to identity and aut
 HOMEPAGE="https://github.com/SSSD/sssd"
 if [[ ${PV} != 9999 ]]; then
 	SRC_URI="https://github.com/SSSD/sssd/releases/download/${PV}/${P}.tar.gz"
-	KEYWORDS="amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 else
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/SSSD/sssd.git"
@@ -38,7 +38,7 @@ DEPEND="
 	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
 	>=dev-libs/popt-1.16
 	>=dev-libs/openssl-1.0.2:=
-	>=net-dns/bind-tools-9.9[gssapi]
+	>=net-dns/bind-9.9[gssapi]
 	>=net-dns/c-ares-1.10.0-r1:=[${MULTILIB_USEDEP}]
 	>=net-nds/openldap-2.4.30:=[sasl,experimental]
 	>=sys-apps/dbus-1.6
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/Manifest b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/Manifest
index 2947d3d6699..94b023d7b39 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/Manifest
@@ -3,3 +3,4 @@ DIST gnu-efi-3.0.17.tar.bz2 165568 BLAKE2B 27f8171b411a6a8a138d44d91c7e4e4291aa3
 DIST gnu-efi-3.0.18.tar.bz2 167567 BLAKE2B e080fa4c57a281452a6473304871304d1b5c30d42ee728b4c0c084258ed2f6f2099c068ec5841cee81ecf664dd658dee3b94d68324ebaa498cb49cec4f7f7df9 SHA512 39f9fa14b880441a94a04400ff8850efdd9474929e5501dfd05af06e7747b4d0f7cb742ac811c7026cf52d00508efb73018be4d61d63a1211de0cd931cbc473d
 DIST gnu-efi-3.0.19.tar.gz 218588 BLAKE2B 78db87904e644406ce2eb1a0ef0f325e7ad0f004dd56199e319985c5d035b4755d545c1a6bcf749da08c7670132de28a3e53ba059956b841034c6b059e39042b SHA512 78a79f51bd271043edbf534427d8fbba3d8099e831a9643019899453e8363ebd4d43f6e5448cdde31d43a6bdb94ec32e73425138bfb614617b8886df90fc1665
 DIST gnu-efi-4.0.0.tar.gz 228852 BLAKE2B 30a22785b43b586596e9b4cfd281815715529185fbfdb800947ee08a94b3dac80ee13e9f2a8f5cf4acc46b7844cef9e92de97e97801d085249dce3afb2b0fcf0 SHA512 737fda41a45a63ab652f3e8dd5c035bc40dd66e839218c33478fe2ce81346f004b1bed79a5ec29cc282f0d699ad21256e0915482a3fa04b880dea21cae9e2b7f
+DIST gnu-efi-4.0.1.tar.gz 243543 BLAKE2B 83afa6f8dcabc814a2009947d16e8e0ec23a84006d94fb7f01a1f9a80d981519947dc444d7cb449770188d8ad4cd6445826433d3e4e046ece7098481304b1d1b SHA512 0b5270fca81fcf8889b0423c0f390852077201739f9d8ca55f24156c5405ce355f8e1c5597764cec52f1e8f0c83316aa6b5adbeea1bb014da559118085d75ee9
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.1.ebuild
new file mode 100644
index 00000000000..746849679db
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.1.ebuild
@@ -0,0 +1,151 @@
+# Copyright 2004-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="Library for build EFI Applications"
+HOMEPAGE="https://sourceforge.net/projects/gnu-efi/"
+SRC_URI="https://github.com/ncroxon/gnu-efi/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+# inc/, lib/ dirs (README.efilib)
+# - BSD-2
+# gnuefi dir:
+# - BSD (3-cluase): crt0-efi-ia32.S
+# - GPL-2+ : setjmp_ia32.S
+LICENSE="GPL-2+ BSD BSD-2"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
+IUSE="abi_x86_32 abi_x86_64 custom-cflags"
+REQUIRED_USE="
+	amd64? ( || ( abi_x86_32 abi_x86_64 ) )
+	x86? ( || ( abi_x86_32 abi_x86_64 ) )
+"
+
+# for ld.bfd and objcopy
+BDEPEND="sys-devel/binutils"
+
+# These objects get run early boot (i.e. not inside of Linux),
+# so doing these QA checks on them doesn't make sense.
+QA_EXECSTACK="usr/*/lib*efi.a:* usr/*/crt*.o"
+RESTRICT="strip"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.0.0-remove-linux-headers.patch
+)
+
+DOCS="README* SECURITY* docs/*"
+
+check_and_set_objcopy() {
+	if [[ ${MERGE_TYPE} != "binary" ]]; then
+
+		if use arm || use riscv; then
+			# bug #939338
+			# objcopy does not understand PE/COFF on these arches: arm32, riscv64 and mips64le
+			# gnu-efi containes a workaround
+			return 0
+		fi
+
+		# bug #931792
+		# llvm-objcopy does not support EFI target, try to use binutils objcopy or fail
+		tc-export OBJCOPY
+		# Test OBJCOPY to see if it supports EFI targets, and return if it does
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' && return 0
+
+		# If OBJCOPY does not support EFI targets, it is possible that the 'objcopy' on our path is
+		# still LLVM if the 'binutils-plugin' USE flag is set. In this case, we check to see if the
+		# '(prefix)/usr/bin/objcopy' binary is available (it should be, it's a dependency), and if
+		# so, we use the absolute path explicitly.
+		local binutils_objcopy="${EPREFIX}"/usr/bin/objcopy
+		if [[ -e "${binutils_objcopy}" ]]; then
+			OBJCOPY="${binutils_objcopy}"
+			einfo "Forcing OBJCOPY=${OBJCOPY}"
+		fi
+
+		# Test OBJCOPY again to see if it supports EFI targets, and fail if it doesn't
+		LC_ALL=C "${OBJCOPY}" --help | grep -q '\<pei-' || die "${OBJCOPY} (objcopy) does not support EFI target"
+	fi
+}
+
+check_compiler() {
+	if [[ ${MERGE_TYPE} != "binary" ]]; then
+		tc-is-gcc || tc-is-clang || die "Unsupported compiler"
+	fi
+}
+
+pkg_pretend() {
+	check_compiler
+}
+
+pkg_setup() {
+	check_compiler
+	check_and_set_objcopy
+}
+
+src_prepare() {
+	default
+	sed -i -e "s/-Werror//" Make.defaults || die
+}
+
+efimake() {
+	local arch=
+	case ${CHOST} in
+		arm*) arch=arm ;;
+		aarch64*) arch=aarch64 ;;
+		ia64*) arch=ia64 ;;
+		i?86*) arch=ia32 ;;
+		loongarch64*) arch=loongarch64 ;;
+		riscv64*) arch=riscv64;;
+		x86_64*) arch=x86_64 ;;
+		*) die "Unknown CHOST" ;;
+	esac
+
+	local args=(
+		ARCH="${arch}"
+		HOSTCC="${BUILD_CC}"
+		CC="${CC}"
+		AS="${AS}"
+		LD="${LD}"
+		AR="${AR}"
+		OBJCOPY="${OBJCOPY}"
+		PREFIX="${EPREFIX}/usr"
+		LIBDIR='$(PREFIX)'/$(get_libdir)
+	)
+	emake -j1 "${args[@]}" "$@"
+}
+
+src_compile() {
+	tc-export BUILD_CC AR AS CC LD OBJCOPY
+
+	if ! use custom-cflags; then
+		unset CFLAGS CPPFLAGS LDFLAGS
+	fi
+
+	# work around musl: include first the compiler include dir, then the system one
+	# bug #933080, #938012
+	local CPPINCLUDEDIR
+	if tc-is-gcc; then
+		CPPINCLUDEDIR=$(LC_ALL=C ${CC} -print-search-dirs 2> /dev/null | grep ^install: | cut -f2 -d' ')/include
+	elif tc-is-clang; then
+		CPPINCLUDEDIR=$(LC_ALL=C ${CC} -print-resource-dir 2> /dev/null)/include
+	fi
+	append-cflags "-nostdinc -isystem ${CPPINCLUDEDIR} -isystem ${ESYSROOT}/usr/include"
+
+	if use amd64 || use x86; then
+		use abi_x86_32 && CHOST=i686 ABI=x86 efimake
+		use abi_x86_64 && CHOST=x86_64 ABI=amd64 efimake
+	else
+		efimake
+	fi
+}
+
+src_install() {
+	if use amd64 || use x86; then
+		use abi_x86_32 && CHOST=i686 ABI=x86 efimake INSTALLROOT="${D}" install
+		use abi_x86_64 && CHOST=x86_64 ABI=amd64 efimake INSTALLROOT="${D}" install
+	else
+		efimake INSTALLROOT="${D}" install
+	fi
+	einstalldocs
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-zfs-zstd-compression-support.patch b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-zfs-zstd-compression-support.patch
new file mode 100644
index 00000000000..63862e7ab8f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.12-zfs-zstd-compression-support.patch
@@ -0,0 +1,101 @@
+Patch fixes ZFS root filesystem dataset identification issues.
+
+This patch was mostly extracted from gub upstream commit f96df6fe9f6faa328c82820af88f14af07b2c9b9.
+See Gentoo Bugzilla https://bugs.gentoo.org/956414 for further details.
+
+diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
+index 7fa9446bd..705d73fab 100644
+--- a/grub-core/Makefile.core.def
++++ b/grub-core/Makefile.core.def
+@@ -1601,6 +1601,7 @@ module = {
+   common = fs/zfs/zfs_lz4.c;
+   common = fs/zfs/zfs_sha256.c;
+   common = fs/zfs/zfs_fletcher.c;
++  cppflags = '-I$(srcdir)/lib/posix_wrap -I$(srcdir)/lib/zstd';
+ };
+ 
+ module = {
+diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
+index b5453e006..3fdf9bda8 100644
+--- a/grub-core/fs/zfs/zfs.c
++++ b/grub-core/fs/zfs/zfs.c
+@@ -57,6 +57,8 @@
+ #include <grub/i18n.h>
+ #include <grub/safemath.h>
+ 
++#include <zstd.h>
++
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+ #define	ZPOOL_PROP_BOOTFS		"bootfs"
+@@ -291,6 +293,9 @@ static const char *spa_feature_names[] = {
+   "com.delphix:embedded_data",
+   "com.delphix:extensible_dataset",
+   "org.open-zfs:large_blocks",
++  "com.klarasystems:vdev_zaps_v2",
++  "com.delphix:head_errlog",
++  "org.freebsd:zstd_compress",
+   NULL
+ };
+ 
+@@ -312,6 +317,40 @@ zlib_decompress (void *s, void *d,
+   return grub_errno;
+ }
+ 
++static grub_err_t
++zstd_decompress (void *ibuf, void *obuf, grub_size_t isize,
++		 grub_size_t osize)
++{
++  grub_size_t zstd_ret;
++  grub_uint32_t c_len;
++  grub_uint8_t *byte_buf = (grub_uint8_t *) ibuf;
++
++  if (isize < 8)
++      return grub_error (GRUB_ERR_BAD_COMPRESSED_DATA, "zstd data too short");
++
++  c_len = grub_be_to_cpu32 (grub_get_unaligned32 (byte_buf));
++
++  if (c_len > isize - 8)
++      return grub_error (GRUB_ERR_BAD_COMPRESSED_DATA,
++			 "zstd data announced size overflow");
++
++  /*
++   * ZFS uses non-stadard magic for zstd streams. Rather than adjusting
++   * library functions, replace non-standard magic with standard one.
++   */
++  byte_buf[4] = 0x28;
++  byte_buf[5] = 0xb5;
++  byte_buf[6] = 0x2f;
++  byte_buf[7] = 0xfd;
++  zstd_ret = ZSTD_decompress (obuf, osize, byte_buf + 4, c_len + 4);
++
++  if (ZSTD_isError (zstd_ret))
++    return grub_error (GRUB_ERR_BAD_COMPRESSED_DATA,
++		       "zstd data corrupted (error %d)", (int) zstd_ret);
++
++  return GRUB_ERR_NONE;
++}
++
+ static grub_err_t
+ zle_decompress (void *s, void *d,
+ 		grub_size_t slen, grub_size_t dlen)
+@@ -362,6 +401,7 @@ static decomp_entry_t decomp_table[ZIO_COMPRESS_FUNCTIONS] = {
+   {"gzip-9", zlib_decompress},  /* ZIO_COMPRESS_GZIP9 */
+   {"zle", zle_decompress},      /* ZIO_COMPRESS_ZLE   */
+   {"lz4", lz4_decompress},      /* ZIO_COMPRESS_LZ4   */
++  {"zstd", zstd_decompress},    /* ZIO_COMPRESS_ZSTD   */
+ };
+ 
+ static grub_err_t zio_read_data (blkptr_t * bp, grub_zfs_endian_t endian,
+diff --git a/include/grub/zfs/zio.h b/include/grub/zfs/zio.h
+index 19ce136bb..997b0c4d4 100644
+--- a/include/grub/zfs/zio.h
++++ b/include/grub/zfs/zio.h
+@@ -89,6 +89,7 @@ enum zio_compress {
+ 	ZIO_COMPRESS_GZIP9,
+ 	ZIO_COMPRESS_ZLE,
+ 	ZIO_COMPRESS_LZ4,
++	ZIO_COMPRESS_ZSTD,
+ 	ZIO_COMPRESS_FUNCTIONS
+ };
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r6.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r6.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild
index 8931d754a9a..3371fc9eee8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r7.ebuild
@@ -16,6 +16,7 @@ EAPI=7
 # If any of the above applies to a user patch, the user should set the
 # corresponding variable in make.conf or the environment.
 
+GRUB_AUTOGEN=1
 GRUB_AUTORECONF=1
 PYTHON_COMPAT=( python3_{10..13} )
 WANT_LIBTOOL=none
@@ -64,6 +65,7 @@ PATCHES=(
 	"${FILESDIR}"/grub-2.06-test-words.patch
 	"${FILESDIR}"/grub-2.12-fwsetup.patch
 	"${WORKDIR}"/grub-2.12-bash-completion.patch
+	"${FILESDIR}"/grub-2.12-zfs-zstd-compression-support.patch
 )
 
 DEJAVU=dejavu-sans-ttf-2.37
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/bc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/bc/Manifest
index 89a797708e3..cc051230559 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/bc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/bc/Manifest
@@ -1,3 +1,4 @@
 DIST bc-1.07.1.tar.gz 419850 BLAKE2B dcedc193be5521aa0fa3a19746233ed65bc1fe8ef12e15155341706de6fbeecb6dd7ee4ab11e2d4b3aca2ae7097cce89e389b3573493bbc893e00b4ed3239594 SHA512 02126d0db6b6ed06d56cfc292d6f5475ff1e574779d7e69c7809bbb1e13f946f57ea07da2a7666baa092507a951a822044b0970075f75eefe65a5c1999b75d34
 DIST bc-1.08.0.tar.gz 452231 BLAKE2B f42af858507e72171caf0786ca7b72506d79c93a73aa1816a6471798f63d831c14f66cab6fd5af624a21a09b9930772ebf2e791c06f043b45e8b5893134481c7 SHA512 6ce5b510ad7aa8b489d0c3f060c34cf738da33fde4dda8398d9f75fabadef16d9b423ae8752881eff395b10088cd9d9fb16868c578b0950008f1ee08d12be197
 DIST bc-1.08.1.tar.gz 458434 BLAKE2B 51d1bac17f31bb7dbb044c28752cccfe59dd5bcb78a2c3bfa66a345577ea3aee37fef8d7efae83a57e41ae77d7317008f3682dfbc3165c76888770636deead01 SHA512 256c94833ead8029122d3ba6475cf4ff030c208a5bd3e2e9c5c8888467215e0fa9ab34e4226791bbd6e47498c0c61f0dc6399eecb0c8cf6a43453e84911c1847
+DIST bc-1.08.2.tar.gz 457557 BLAKE2B 6ff6d5083aa67d4075116c691b1f975127ab5079e1a1b63d916fbd3e6d5e95c7f4bc7fe196cac0e2a51a7f4c56d91da60495f3ce60f08bee8f2ba4278a791834 SHA512 0876a4c5bfc23da79479519c6a8e03ac9f59ae54077eb71ffdcc6ddaccb76c4b7595b088e89e6ad82d833c072eeff5b378178084276584813c00eedace4c6f8c
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.2.ebuild
new file mode 100644
index 00000000000..0a08fa03bab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.2.ebuild
@@ -0,0 +1,77 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="Handy console-based calculator utility"
+HOMEPAGE="https://www.gnu.org/software/bc/bc.html"
+SRC_URI="mirror://gnu/bc/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="libedit readline static"
+
+RDEPEND="
+	!readline? ( libedit? ( dev-libs/libedit:= ) )
+	readline? (
+		sys-libs/readline:=
+		sys-libs/ncurses:=
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	sys-devel/flex
+	app-alternatives/yacc
+"
+PDEPEND="app-alternatives/bc"
+
+src_configure() {
+	local myconf=(
+		$(use_with readline)
+		--program-suffix=-reference
+	)
+
+	if use readline ; then
+		myconf+=( --without-libedit )
+	else
+		myconf+=( $(use_with libedit) )
+	fi
+
+	use static && append-ldflags -static
+
+	# The libedit code isn't compatible currently. #830101
+	use libedit && append-flags -fcommon
+
+	# AC_SYS_LARGEFILE in configure.ac would handle this, but we don't patch
+	# autotools otherwise currently.  This change has been sent upstream, but
+	# who knows when they'll make another release.
+	append-lfs-flags
+
+	# configure dies with other lexes:
+	# "configure: error: readline works only with flex."
+	export LEX=flex
+
+	econf "${myconf[@]}"
+
+	# Do not regen docs -- configure produces a small fragment that includes
+	# the version info which causes all pages to regen (newer file). Bug #554774
+	touch -r doc doc/* || die
+}
+
+src_compile() {
+	emake AR="$(tc-getAR)"
+}
+
+pkg_postinst() {
+	# ensure to preserve the symlinks before app-alternatives/bc
+	# is installed
+	local x
+	for x in bc dc ; do
+		if [[ ! -h ${EROOT}/usr/bin/${x} ]] ; then
+			ln -s "${x}-reference" "${EROOT}/usr/bin/${x}" || die
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index c048e8822a4..bae05b1ad2e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -23,4 +23,5 @@ DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
 DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
+DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
index 074cb1c9bb1..2203fe5beec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+inherit dot-a libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
 
 DESCRIPTION="Tools necessary to build programs"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -194,6 +194,7 @@ src_configure() {
 	strip-flags
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+	lto-guarantee-fat
 
 	local x
 	echo
@@ -357,6 +358,9 @@ src_configure() {
 			# with the testsuite.
 			filter-lto
 
+			# bug #637066
+			filter-flags -Wall -Wreturn-type
+
 			export BUILD_CFLAGS="${CFLAGS}"
 		fi
 	fi
@@ -433,6 +437,8 @@ src_install() {
 	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
 	rm -rf "${ED}"/${LIBPATH}/bin || die
 	use static-libs || find "${ED}" -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
 
 	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
 	cd "${ED}"/${LIBPATH} || die
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
new file mode 100644
index 00000000000..dda92e423ed
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
@@ -0,0 +1,584 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla xxhash zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=4
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	SLOT=${PV}
+elif [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SLOT=$(ver_cut 1-2)
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	xxhash? ( dev-libs/xxhash )
+"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	pgo? (
+		dev-util/dejagnu
+		app-alternatives/bc
+	)
+	test? (
+		dev-util/dejagnu
+		app-alternatives/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	app-alternatives/lex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
+			https://github.com/gentoo/binutils-patches
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		if [[ ${PV} != 9999 ]] ; then
+			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
+		fi
+		EGIT_REPO_URI="
+			https://sourceware.org/git/binutils-gdb.git
+			https://git.sr.ht/~sourceware/binutils-gdb
+			https://gitlab.com/x86-binutils/binutils-gdb.git
+		"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999 ]] ; then
+		patchsetname="from git master"
+	elif [[ ${PV} == *9999 ]] ; then
+		patchsetname="from git branch ${EGIT_BRANCH}"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			if is_cross || use prefix; then
+				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
+					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+			fi
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+	lto-guarantee-fat
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		--enable-relro
+		--enable-install-libiberty
+		--enable-textrel-check=$(usex hardened error warning)
+		# Things to think about
+		#--enable-deterministic-archives
+		--enable-new-dtags
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with xxhash)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
+		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+
+		# Enables colored disassembly by default (equivalent to passing
+		# --disassembler-color=terminal to all objdump invocations).
+		--enable-colored-disassembly
+	)
+
+	case ${CTARGET} in
+		x86_64-*|aarch64*|arm64*|i[3456]*)
+			# These hardening options are available from 2.39+ but
+			# they unconditionally enable the behaviour even on arches
+			# where e.g. execstacks can't be avoided.
+			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			#
+			# TODO: Get the logic for this fixed upstream so it doesn't
+			# create impossible broken combinations on some arches, like mips.
+			#
+			# TODO: Get the logic for this fixed upstream so --disable-* works
+			# as expected.
+			myconf+=(
+				--enable-warn-execstack=yes
+				--enable-warn-rwx-segments=yes
+			)
+
+			if use hardened ; then
+				myconf+=(
+					# TODO: breaks glibc test suite
+					#--enable-error-execstack=yes
+					#--enable-error-rwx-segments=yes
+					--enable-default-execstack=no
+				)
+			fi
+			;;
+		*)
+			;;
+	esac
+
+	if use elibc_musl ; then
+		# Override our earlier setting for musl, as textrels don't
+		# work there at all. See bug #707660.
+		myconf+=(
+			--enable-textrel-check=error
+		)
+	fi
+
+	if use test || { use pgo && tc-is-lto ; } ; then
+		# -Wa,* needs to be consistent everywhere or lto-wrapper will complain
+		filter-flags '-Wa,*'
+	fi
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build $(tc-is-lto && echo "lto" || echo "yes")) )
+
+		if use pgo ; then
+			# We let configure handle it for us because it has to run
+			# the testsuite later on for profiling, and LTO isn't compatible
+			# with the testsuite.
+			filter-lto
+
+			# bug #637066
+			filter-flags -Wall -Wreturn-type
+
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	# see linker prefix patch
+	emake \
+		tooldir="${EPREFIX}${TOOLPATH}" \
+		gentoo_prefix=$(usex prefix-guest "${EPREFIX}"/usr /usr) \
+		all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	(
+		# Tests don't expect LTO
+		filter-lto
+
+		# If we have e.g. -mfpmath=sse -march=pentium4 in CFLAGS,
+		# we'll get lto1 warnings for some tests which cause
+		# spurious failures because -mfpmath isn't passed at
+		# link-time. Filter accordingly.
+		#
+		# Alternatively, we could pass C{C,XX}_FOR_TARGET with
+		# some (ideally not all, surely would break some tests)
+		# stuffed in.
+		filter-flags '-mfpmath=*'
+
+		# lto-wrapper warnings which confuse tests
+		filter-flags '-Wa,*'
+
+		# bug #637066
+		filter-flags -Wall -Wreturn-type
+
+		emake -k check \
+			CFLAGS_FOR_TARGET="${CFLAGS_FOR_TARGET:-${CFLAGS}}" \
+			CXXFLAGS_FOR_TARGET="${CXXFLAGS_FOR_TARGET:-${CXXFLAGS}}" \
+			LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}" \
+			CFLAGS="${CFLAGS}" \
+			CXXFLAGS="${CXXFLAGS}" \
+			LDFLAGS="${LDFLAGS}"
+	)
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	docompress "${DATAPATH}"/{info,man}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET} || eerror binutils-config returned an error
+		else
+			binutils-config ${choice} || eerror binutils-config returned an error
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
index 3c840be5f3e..ec413eb353d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+inherit dot-a libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
 
 DESCRIPTION="Tools necessary to build programs"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -194,6 +194,7 @@ src_configure() {
 	strip-flags
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+	lto-guarantee-fat
 
 	local x
 	echo
@@ -357,6 +358,9 @@ src_configure() {
 			# with the testsuite.
 			filter-lto
 
+			# bug #637066
+			filter-flags -Wall -Wreturn-type
+
 			export BUILD_CFLAGS="${CFLAGS}"
 		fi
 	fi
@@ -433,6 +437,8 @@ src_install() {
 	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
 	rm -rf "${ED}"/${LIBPATH}/bin || die
 	use static-libs || find "${ED}" -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
 
 	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
 	cd "${ED}"/${LIBPATH} || die
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 65d9f15ce0f..56005f5b75e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+inherit dot-a libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
 
 DESCRIPTION="Tools necessary to build programs"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -194,6 +194,7 @@ src_configure() {
 	strip-flags
 	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+	lto-guarantee-fat
 
 	local x
 	echo
@@ -357,6 +358,9 @@ src_configure() {
 			# with the testsuite.
 			filter-lto
 
+			# bug #637066
+			filter-flags -Wall -Wreturn-type
+
 			export BUILD_CFLAGS="${CFLAGS}"
 		fi
 	fi
@@ -433,6 +437,8 @@ src_install() {
 	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
 	rm -rf "${ED}"/${LIBPATH}/bin || die
 	use static-libs || find "${ED}" -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
 
 	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
 	cd "${ED}"/${LIBPATH} || die
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
index 82b2f724c5f..b0bc483b655 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250106.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
index 6ba1801e842..084660d0c36 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
index 7c9eb35f4b8..5494e3601b7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
@@ -3,6 +3,8 @@
 
 EAPI="8"
 
+inherit toolchain-funcs
+
 if [[ ${PV} == "99999999" ]] ; then
 	inherit git-r3
 	EGIT_REPO_URI="
@@ -29,6 +31,8 @@ RDEPEND="
 BDEPEND="app-arch/xz-utils"
 
 src_install() {
+	tc-export PKG_CONFIG # Bug 955822
+
 	default
 
 	if [[ ${PV} == "99999999" ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/flex/files/flex-2.6.4-fix-malloc-prototype.patch b/sdk_container/src/third_party/portage-stable/sys-devel/flex/files/flex-2.6.4-fix-malloc-prototype.patch
new file mode 100644
index 00000000000..9ded7cd40ea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/flex/files/flex-2.6.4-fix-malloc-prototype.patch
@@ -0,0 +1,26 @@
+Bug: https://bugs.gentoo.org/956581
+https://github.com/westes/flex/pull/674
+https://github.com/westes/flex/commit/4b142954b54a57a9b0af0a9661056a9c39a8fa95
+
+From bf254c75b1e0d2641ebbd7fc85fb183f36a62ea7 Mon Sep 17 00:00:00 2001
+From: Richard Barnes <rbarnes@umn.edu>
+Date: Wed, 2 Oct 2024 10:35:09 -0700
+Subject: [PATCH] Match `malloc` signature to its use
+
+---
+ lib/malloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/malloc.c b/lib/malloc.c
+index 75e8ef97c..701b9b39d 100755
+--- a/lib/malloc.c
++++ b/lib/malloc.c
+@@ -3,7 +3,7 @@
+      
+      #include <sys/types.h>
+      
+-     void *malloc ();
++     void *malloc (size_t n);
+      
+      /* Allocate an N-byte block of memory from the heap.
+         If N is zero, allocate a 1-byte block.  */
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
index 41845f105a3..3a5e1b6a645 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/flex/flex-2.6.4-r6.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit flag-o-matic libtool multilib-minimal toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib-minimal toolchain-funcs
 
 DESCRIPTION="The Fast Lexical Analyzer"
 HOMEPAGE="https://github.com/westes/flex"
@@ -29,6 +29,7 @@ PATCHES=(
 	"${FILESDIR}"/${P}-libobjdir.patch
 	"${FILESDIR}"/${P}-fix-build-with-glibc2.26.patch
 	"${FILESDIR}"/${P}-fix-apple-m1-crash-by-explicit-pointer-cast.patch
+	"${FILESDIR}"/${P}-fix-malloc-prototype.patch
 
 	"${WORKDIR}"/${P}-autotools-regenerate.patch
 )
@@ -53,7 +54,7 @@ src_prepare() {
 
 src_configure() {
 	use static && append-ldflags -static
-
+	lto-guarantee-fat
 	multilib-minimal_src_configure
 }
 
@@ -86,6 +87,7 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
 	einstalldocs
 	dodoc ONEWS
 	find "${ED}" -name '*.la' -type f -delete || die
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index e7b10290412..5042a812734 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -7,38 +7,40 @@ DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e
 DIST gcc-12-20241219.tar.xz 79920016 BLAKE2B 71044352515f33eaf0bcc64cc6eacdecb8b7b1dbca6d8836b629f76e60320f5090178ff37b6804fbda0913c0f55afca37588647974fd72e9961edd338ccf6ffb SHA512 e0c08366f392083feb1ae242242e9bd335681234808ed44d4e75afe157be2814bef321d2327186d217f38bbb6176706e1258228904d31fdb3bb37c8e245dacb0
 DIST gcc-12-20250227.tar.xz 79915940 BLAKE2B 0adb19847cb3f317316549f657434654b9923806366a4b95e496effea9c07995b7d3de65c40cc2f62ba1e87cfb0f8cd8a1a833284042fdc5e6fce2bd7e7e9543 SHA512 d01cad1771762f5b56c783d6a3b39415be1c7619229b5ff056fe40ef0bf821c67a2d1a2272c2227a44f92825582579625352d19e2342d11f76a079556dae0ae8
 DIST gcc-12-20250417.tar.xz 79924416 BLAKE2B 4f6542d016693e2392a433c1931a33112fc959e194cdfbe01f76c9f4103d0ba3b899bd4d1993031340d90d5512a2075f8aaf0a73013eaad0afe9708fcefd47dc SHA512 82ee092685d988eb184926f4bd306540d43c7da94a0f76a5b1aaaf134235ee882b07f34e4c9a55cddba11988aafafa8ff0be1fe12330a61c2ee927d63597e7a6
-DIST gcc-12-20250430.tar.xz 79927628 BLAKE2B c57d83bfa68765807c7fb0f6b8834232a3296f8c3cb944c5338c6334d69017b0132e82fe579ac8ac3efc5deaa039c6ae180c9d1515659b13d70a2109a48a7949 SHA512 61f35a337ff034c5872103fed5645c954bb833f4155e0ce78d3478c62448f0648b947217b4ed6e801367a649749f332eeb09ba44a4dc2c941e1e1c921cca4242
+DIST gcc-12-20250528.tar.xz 79942548 BLAKE2B 3c500796a34ccd863da451de4084cc90d404c9b8d41caccde11a840bc25cf949669ea9b4d4ae58899962aeb37e14ec947068238787a0019bbf22e62135a001ca SHA512 aa4e0583b308b8ada43c209edee54f97606683e1e7dad8e0250a6c77591e8cb2520258973822a91f3a45261a46a0b2e3783214ae6e004eed90cdf3a2faec479c
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0-patches-2.tar.xz 14876 BLAKE2B 6bf5abbb2abba4b9fe9fa153ac4112fe5f563e97cd4e1b885ccd0d88abf1124fa91f20d6be972e2242410447be73bca60014785f8551b8087ed0d4cc3e868225 SHA512 dfd5f02d4c1076fad4ee998b2f620171dd3eb65a1160312def9dae89b18327a06db853f569e0e3c049e5ab06c61488bb6faecec52bafe737fddeb43628c54a1f
 DIST gcc-12.4.0-patches-3.tar.xz 14140 BLAKE2B cc73805b2c1f9f6a8d96b2a31d79ce0034ebc3ef1976e78e8ec4f2649c33cef48acee943773de5e03b891128f37e4d72c07d7f4c0bd6d473e484a4b6a9df9f25 SHA512 a93c6bc7d2bd1d7b80bfc6b16c042ac6d3cb6e15cada16041baa48b8023d857b4a1557f4620c46646136daece6566655523010366411aa9fad671398efb03b6f
 DIST gcc-12.4.0.tar.xz 83377372 BLAKE2B 0d5aa9995bf53fa2dc976a846240cfb8fafd125ad6c54f45dc9d770215eae3e9ea0db82a9a4f79c51b4d5f8461a1d730c17db6841bc31bd96dba11d9ed7544ae SHA512 5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853
 DIST gcc-13-20241220.tar.xz 84504500 BLAKE2B 60d6dcdcafa36399a0c0de7fef3a4eb4ca8e0b6780cd31c9eace2965c53115205bf64e8247b833a4375c1e3ad2d94820b5bdc97a4689be95d8ab55a676afa689 SHA512 10fe009dc3b8872b24350e4fb999f71b848bd5a03e48e8292f76e6eca3dbdef8383a3b13b813aada983ebdbe3ecab1642961b3210cd1e0063a86655a44493017
-DIST gcc-13-20250301.tar.xz 84525780 BLAKE2B c366f4de63b7956abb1bf2d1039acdf90c7a801adbb2793e4c199b0f743d143327aac9c2b078991f802da758ed4326dd913d9f60aec4fc471eff9af72f781a8e SHA512 075bfb3c5aeaf1c9bf7ab69ef117fcc1fd3ce1042edc9442d95df717e622c2ea9cfabbabf8be5eda32b3cf115d7d3e73907fd577a69f0beb6895f7ec2c5fc813
 DIST gcc-13-20250418.tar.xz 84528940 BLAKE2B 566cc9570d9a2e41e67416cd3bb3609fad38a37cc648422988182652010ba2f2eb459c29fce32f8f97ea33c23eac3b43098af6fb333ce250a7e9eac4ca0abeb7 SHA512 185179a591d6ecc3a6477379fd877241a18b25bec0eacd0819e6e0ee38abbbebe7fee9027d36a60087f487c65a8afd17228e8dc0b803f4cf5ae6b8ce9cdadcbc
-DIST gcc-13-20250424.tar.xz 84551016 BLAKE2B 0c70b70bb741567e8b9689a484852d7b689193b0752b062f7d6639f59c6d404a3a91e91a674b64aa3d189bd8f28cc8f678d89027e659d0213b1e9e735af45e14 SHA512 7558b829c1e51ccb203ce182620528f5dd599f86f039074e575fcd50cf7ec38c23f4dee0bff0fa9dea77af416d934a1b2fabdd82e47a053ac93d486bc7af9823
-DIST gcc-13-20250501.tar.xz 84577616 BLAKE2B bb389c8bed1055febed51dd85a332ab903db758aca5403a5cee1bd3c5af0a821ffbc82ad97b020734e5dbe5693bdfb0789b1749ab7d75a2e79d4dad74e371ed1 SHA512 4ddc9306b86b72982847ea6915c92ba6e4956b835cdc0b55426e7120018b2bb85c7c2a69d727c79e48a1114e8321277ca16a6f441131c67e3d9f50ebd1409c48
+DIST gcc-13-20250522.tar.xz 84560600 BLAKE2B 418d5f6eb25542519317aa18f16d347940549b4bdbcd5a75279d784e310758e870d8814c4ff631195d44a05d57da95f8bef3a1ba5931f1a085f9e88912ddf993 SHA512 4c16bd9d3e0aa38772ae5a347f99f2d3fbf5587d5fbf7fe9e8c2f8cda203221a424e161719ddc42cb945ec3a75c5956da61ccccf4ff7b3a9eb377962b28e506c
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
 DIST gcc-13.3.0-patches-2.tar.xz 44440 BLAKE2B ebde73f6c3cd1a5fdc5bbce36414a59dda0925cba9d422d3689fc9c14fece44ee2391982a674411aa99bf47ffd49200f3ce51cc908beb8298adfff78e709a84c SHA512 eb56e0d7e69b5c3cca21f4cbff21c1204cf64ede7e66d689f45cf5ff37de8a59f24eb1f4b30d9c4222fd4126654fe4ffc146851f504761014995553c1202e8fd
 DIST gcc-13.3.0-patches-3.tar.xz 51904 BLAKE2B f93896e6cd6fbbe8d996781ba4c4cf48d70063d0af79a595ca30686e3452e4a5a5517cdd1b91bf1502a9402bb0ad1f8c26b105d147f1e79ef6810bdf90ad13c2 SHA512 179e3b99350752ca3c672fe97b3168f27030aba8505b95c1ebc18592270a82f00175ccaf24f68eb90a9282bc1eda2794b3fd69bf5815af960a64356f36421937
-DIST gcc-13.3.0-patches-4.tar.xz 51768 BLAKE2B 54bcd1875af5ef50bb67c0152e1f8e7c2b8da98b17a97186e47da82f19ccf14393c62b40b26a8736e63858f59a56f1d9352f5b01480925192b766e319711db21 SHA512 33bd289b370be512604a1f8f1798c43ceac4c4eebbd0c409b9ddefc6716844bd9d5fa15b41845fc1e93c40e4e93ec9ccaab730ac768fad98f47033782400ab17
+DIST gcc-13.3.0-patches-5.tar.xz 52820 BLAKE2B 73759dc576aab9e5f66dc7f9a1e8eb1b79a98bdb85bfdac9d611baa82c85a5f433d5031876c6e0ee2f02dd1d874da1661b0dd0f05906b118502f17bfaf16eb1a SHA512 4e6b626a562657f2d928324b412d5033464c09d283ad3a2ebfebbb5245bffb09c2532318325c4c16f4206df5cede6758fe1031c55e64dfb9b9ea08ef2c1e90af
+DIST gcc-13.4.0-RC-20250529.tar.xz 88510400 BLAKE2B b1da2b270b0bd51361732cef8c81fda56ccfb3bdcb2fbcfb0f5bab929066b464a2ff39277c2a4408a63dc8617af99d580336727b11e7f71c0869fa4359da9db9 SHA512 bcbe0580368abf36048f78f048ee4e9d89e4af6ece731a6d6f7a6d38c223ef1f6a5c6738f2a3bc6a3728648f28a1df4bce7f5ea4556d2a380ae9c7a5e8441f28
+DIST gcc-13.4.0-RC-20250530.tar.xz 88502788 BLAKE2B 0737082c4dfd3706918e646f3ef04d1fc63157908b2fbdf98d88a82a89468a371753c4958e3cde3bade1cd51ed76220345d33d072bbe5a190d68073aa63b4e92 SHA512 6ba9d9325e3b7f325ce52741cc0e6832d6989c60e647e052cb116bbd775c6a9e660a6cb9706b14b4f1abd3794b8f6fdef041237b450a5b71351179cedc407569
 DIST gcc-14-20241221.tar.xz 88198252 BLAKE2B 7491c2e1c8885e201859143bdf5cae95af4c0db77709ec7d761ad535df30042f5deb8488ba7c508de3673e4b0f2af1de8d17476f39cd47b745ddccec6a9e4470 SHA512 91fe1e1d1f8e8fad64930a2eadf942a542bd42f841fceb49f475bccac00f04692b8cd38821ea9ee05f78b5c51001d8bd39df5f71f3a3d89aab8980019cea9be8
-DIST gcc-14-20250301.tar.xz 88230928 BLAKE2B 2b65e7cccbf431a74df73adac53995873e78240d7abd97e9c9c576806c389b3c1abb6d47710a25a26f2ee399de750a07c3fb7916a580875d08a3a83354d89c1c SHA512 6b2afe19ce95a595307ae10b89054927116d33b499f1ef8233936d719271c04cb8f66890068ef2252c59ab0276dd0e6210990cb88abdfb4965818c25949f431e
 DIST gcc-14-20250419.tar.xz 88251960 BLAKE2B b9d8312ac8dd9dd82128ff872e379f3426b4464e940ebd7748e53d6cd41e5a0f936f01ffdd3beb308a693ce98d3c323206ec67006de0735a430534b21899ae6d SHA512 44cd816dc61d4cf9925be47b75c5ddfc791dbfb43cc56a82e3a46673e8a2753d69f8b9230d68399c4b232c2daab85622168998f2dab767bb78c2292613dd6643
-DIST gcc-14-20250425.tar.xz 88293272 BLAKE2B 13e27faa2db627a97dcd34b866a036ecf4593468c88b061a24e5c7fc09c0d525019f714842cbb2a6081ac16cccd823ea104915f41d0840c6e3eef7db51650414 SHA512 6afdb41289f37c00bec0629a068c2907af87bf6e78d44b6f41c5de23dae31294c6d06e30ed6c48460f1efe0b314df3afd1be2022d66f3b7826b5c8491554be69
-DIST gcc-14-20250502.tar.xz 88287888 BLAKE2B c7d8daa57bdd68fada6f51d4db66c69b094e72feef12e866163f96e2b2d8a4bc699cfe6885aed31e507c08e660167fdd2edc18b92d0b7f53560d4107e2f04989 SHA512 7fe989f8bb0b0b0bbc48f6ec237e8802b2d1a7f184e4179917d93fe40c2774927d4579943571c6f70bbc8f1c8475c633dcc77f847bee6bb8810909cb3afc9ee6
+DIST gcc-14-20250530.tar.xz 88301156 BLAKE2B 48e2fd31659bb170b13442a731ebd8d386657515c496e4e987ca3536cb8fd68982c91421c109f7fdb3729481afdeb310e7ba0820270adcac60984aebdbf1562d SHA512 93ddd0e7c3b724f2af8bac9ef5d367366a09ee1b1bc9c4da31bf31b40899565e2491faf2570e784db0ff41ac18d1cf32d2120594181d0c635749209a8a144768
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-7.tar.xz 14244 BLAKE2B 11236e91e1fe83fec8ffaa40ec0cdd4b52a00a951e9aa9a7a0a932b234b8f1a9603333a7ccf55859f4ef53dd4d8ad1fd5c1d2514b6e45fce5b86bb58622a0ecc SHA512 5a4d86d943e31fa068b5a784c0132bd83c23243dcb3cf972557a42e004469a415e1b3185f31b1bb36f916594d475f266a2fda031a414e4a15e0bbfe471269eee
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
-DIST gcc-15-20250426.tar.xz 92081764 BLAKE2B 1aded22dbac3458140744c85409da569c3fb8db0b0798a1a7bdea2d9d77b0375f68a240721bda5c8e97e363c3e06e63489ced6987dd6a517b7c4f185e0468f86 SHA512 2278176ed9b7a19e81dc7a174d587523ae01d5a2e49710ac36381b30463c84ed3184c1f1e9c96116e9387b9ff58bc7d389b8dfda7b755c4a0d8470c14f1872c5
-DIST gcc-15-20250503.tar.xz 92076804 BLAKE2B 9c32f2c354df41ae0d340d15aacfe0724f1e75666b3c31a98b2bfc68e0446cb4b38f38b08580fd6dd3ac109544710649d735846c742ebc950c6843e1805907c2 SHA512 30d10cde478800d44fae444ed1cd45b566f449143bc50df95a1a8c8cd80bab0d0cb09255e50fd134bb128c4b49f60a37a21c34924cd1b1143f8f7a4a4709bf31
-DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
-DIST gcc-15.0.0-patches-55.tar.xz 19028 BLAKE2B f01935ebcf814b34c0319e6b92cb3fc83a562990743d906fe171583ae583e4e6a8c31abba893b0a9b2e1665c3af62271e5ffdad0626a8585dd92e085c886c82e SHA512 1c46d0fb96dadf51a3aa48db97210eb4d9b92f6b9f4ac08af41009a385ef9ed064432a92b5e3163d9ca8bd9065cd5934b2792359ec8c09203e950e21d29119b4
+DIST gcc-14.3.0.tar.xz 95212220 BLAKE2B 11c0e549b2e9b4bbbe4cd64782032d2ec783b3db8d4aa538ebd0a0c9760d8e521c32007891a608b081bc6dd353d4eb23030c5e2b9fe9a20c4894a8455dde47b6 SHA512 cb4e3259640721bbd275c723fe4df53d12f9b1673afb3db274c22c6aa457865dccf2d6ea20b4fd4c591f6152e6d4b87516c402015900f06ce9d43af66d3b7a93
+DIST gcc-15-20250524.tar.xz 92091956 BLAKE2B 17889467a8f7376e2ab3e665f4d7d144695d1697fea4d5e13bb291b3702a394c5b49d88f92d2084f47f09d3f101a72a30afb7a72cc9c227ab5636ea2ba7c83ee SHA512 c8e23bdbe3c9d68f338c613728488e23b77f555655f8fe7dfbb12e53db0b1e70e86b4cd6d73792ab22e60f1563656078d9acd1146611d3159ad388c1d84a8153
+DIST gcc-15-20250531.tar.xz 92132452 BLAKE2B eab81cce973324497662c8586af7794afb6f0f48c0ef1976b46928a4a10e00b40d3770d7e621957de087842310ec17c89d9167784f520ef9c137203119926149 SHA512 1ff8eecc4a1301450a06cbb3e6430e196639d4a30634527bf83595bcc1b96db32638473091ff93ba158f0ac2bf7ec78ac82cb05e39e3e3483b54e85837d1a244
+DIST gcc-15.1.0-musl-patches-1.tar.xz 3036 BLAKE2B f7e8b794feb3c30252dd3e35b990c8a134d337e285a2778ad5575b04667cf01040bf4187252151cd57097cd6d440851843156c9631736f4f065ca8b7ce2f0678 SHA512 4d3f1660d89484f63ad6c238884415673cdfdabb8833cce2fe114193b52f11b3518b034881024527f6553de93936d15ed707d4d2b1e8221908a08ec67810464b
+DIST gcc-15.1.0-patches-1.tar.xz 18628 BLAKE2B ee5fc9d6a06374ccc8d85cd1e269514fde8fed9b1810867a199ac747c09fc166e11e54ba531d42ee2ffbab3ca80277f9ad3c873fbaa3530ff60e5f2bc25c41ba SHA512 72992f0698f632c98abd6d8c7a7a38a109b2f064775a0c5029e44dc29cd88ae061cddd603d47eabced5af5f8571e0b73c9778080873c69dd4dc4766c60339b28
 DIST gcc-15.1.0.tar.xz 98268344 BLAKE2B a902ce99db4e93615879e435bcd0b96d5a16ea0af42598ca0e6d12913b2ce3651a98574c3264b2717b848e6b5a823b403ccca0adde463938d5b41aa3f1da0d34 SHA512 ddd35ca6c653dffa88f7c7ef9ee4cd806e156e0f3b30f4d63e75a8363361285cd566ee73127734cde6a934611de815bee3e32e24bfd2e0ab9f7ff35c929821c1
-DIST gcc-16-20250427.tar.xz 92158556 BLAKE2B a993e398989cd1548e4bcd399faccf381a82e5648e4638b1a8144637794d4f188232fecc658b3f2a5be58e085931c3abbb9033984c3cab54adac144abb9817f6 SHA512 a64224705eae17147cd2944cf2b24c6542ef77ab6c3d4dfe598b6abcee5c178a3e2cfdbde729b23c22ed4803ddab49d636652f452f382d8cfee0d2be43a227b1
-DIST gcc-16-20250504.tar.xz 92144212 BLAKE2B 6b9390e5cbc44332926f79fdcbb46678b46cded8502a493ba950ced72b74ba47f5ad40de30c2e86e06d3e41b6e51b15ed16802b05b3ad4ed9a93e6987848a299 SHA512 b47468969129288408b09cf5dee79cac0243e6a83321b2622d6681f1cd67e93b9211d6033f307404cf7ecf72b8f2c2e67537ceab9fbc9a13e34d800a42ba677c
+DIST gcc-16-20250525.tar.xz 93827336 BLAKE2B b79645f522e50a72166b3ea7860d4a27f3b19e0ac4be85f4944479e44d95221bb01bbaea630b43b7e2ba79de5531fb1b591b5eabc67bdc3d04106735813f8400 SHA512 92c0b5a431caeb57ab9665a9431f586b78c68fd050e319a3b0cab2fe1c66c6bda6da0145c621d78464a5e39e20b24428419f15b97aca608e2b1cfbcfa09181c3
+DIST gcc-16-20250601.tar.xz 93928944 BLAKE2B 4630f24175cde84cc36244b65336d3de2e09e010157410cc1bf29b7cff27431eb43d13455ca9734567262b5a61c28a7d544cceee3d6116506eec8a05fa75dd96 SHA512 27146f8961c77c06ce76235880e633548c186657f48b3a80e3b11450bcb096eee3bd48250a7c3931378f70ae90fe4a5d6e5031589d5cede316dbadb46a27b3ff
+DIST gcc-16.0.0-musl-patches-1.tar.xz 3040 BLAKE2B 18b16357699780eb470cf44a10710281955140103198e0bd55b75e1efe3dbec233689edb11e1b9a62f782f3d97293af4906c18c2c41613b422eda085ee819467 SHA512 5ba580c7c7bb9e62935a5162d44d357cc31185a113acff7498ed7b1ac43fd0a35de7c3de0c87f02fe0be46b5e55b49bb35d1f5cd470058d21a9ea4096a37e13d
+DIST gcc-16.0.0-patches-2.tar.xz 17524 BLAKE2B 6e5f07e01ec4981cccb6286151e7948b9ceaadb61afb11307174fcd855440db84d233857c07e311b099130913a26d13201a3b62e2f52ceb959055e190e776efb SHA512 3e6c7fd3e819dff461e54d2a0d568d2d68e01bda845ab44e026231f187c43a9ffa266e7dab981f3b36a55b9654cefb197f5fff7158538526512ce05be0948992
+DIST gcc-16.0.0-patches-3.tar.xz 17832 BLAKE2B 8ca77441e3909b650f1894144eefa57ec8c9591adaedccf738d37c7d28626d08927794053d3d2e5a0d10a9d8727584183042e2607e56f09ee6401ef5a002477d SHA512 1b21a7cc71f3c927eaff6d50fafd3c4f9fb206870dbdc4742cee6dcb31b8469ac1baff49b458152324daef5a5e867b376642f25ed2a6c6126d11c2878deace0e
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 886019dca3e..35a344c26f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="10.5.0"
 PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 477eb3fd96a..1e35f778baf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="11.5.0"
 PATCH_VER="1"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
index 8198fc49dbb..cbd9d60b416 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="1"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
index bc4c233455e..6adf0ff80bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="2"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
index abbfb04944b..830a3c31071 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="2"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
index a300c328e74..f4974702aeb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250417.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="3"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250528.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250528.ebuild
index fb618179942..37640af01a4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250430.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250528.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="12.4.0"
 PATCH_VER="3"
 MUSL_VER="1"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
index 8e7542f313a..476367feff6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
 MUSL_GCC_VER="12.4.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
index 51f50a6419e..44ee9ff5c0b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 # Maintenance notes and explanations of GCC handling are on the wiki:
 # https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
index 716039677f5..0231b6eb4cc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="2"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
index 209e0b1fcad..b8d2cb59046 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250418.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
 PATCH_VER="3"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250522-r1.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250522-r1.ebuild
index a439cd30a1b..926f8808b7b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250501.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250522-r1.ebuild
@@ -10,9 +10,9 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="4"
+PATCH_VER="5"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -43,6 +43,7 @@ if tc_is_live ; then
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~m68k"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250529.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250529.ebuild
index a439cd30a1b..085c60f01ff 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250424.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250529.ebuild
@@ -8,11 +8,12 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
+TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="4"
+PATCH_VER="5"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250530.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250530.ebuild
index 7969b89177c..085c60f01ff 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250530.ebuild
@@ -8,11 +8,12 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
+TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="2"
+PATCH_VER="5"
 MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -42,7 +43,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
index 1de90381b63..962be9a61a6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.3.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
index 4e0e4421fa0..9e1ce5ddf6d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="7"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
index a2ede76ffc5..f7475a6a2bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250419.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.0.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.0.ebuild
index a2ede76ffc5..f7475a6a2bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.0.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250530.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250530.ebuild
index d405a1386bd..999d16e0cd7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250425.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250530.ebuild
@@ -12,7 +12,7 @@ PATCH_GCC_VER="14.2.0"
 PATCH_VER="8"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.9999.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.9999.ebuild
index 0465a3f8e64..892196f71e8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.4.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
 MUSL_GCC_VER="14.2.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
index 780f510704b..c372ae2863c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.0.ebuild
@@ -8,11 +8,11 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
@@ -30,7 +30,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=master
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild
deleted file mode 100644
index 3c858925143..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250426.ebuild
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild
deleted file mode 100644
index 3c858925143..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250503.ebuild
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="55"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250524.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250524.ebuild
index d405a1386bd..60e2fc36363 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250502.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250524.ebuild
@@ -8,11 +8,11 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="14.2.0"
-PATCH_VER="8"
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
 MUSL_VER="1"
-MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..13} )
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
@@ -27,9 +27,9 @@ inherit toolchain
 
 if tc_is_live ; then
 	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+	EGIT_BRANCH=master
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# m68k doesnt build (ICE, bug 932733)
+	# Don't keyword live ebuilds
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
@@ -51,7 +51,6 @@ src_prepare() {
 	done
 
 	toolchain_src_prepare
-
 	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
 	eapply_user
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250531.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250531.ebuild
new file mode 100644
index 00000000000..60e2fc36363
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250531.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.1.0"
+PATCH_VER="1"
+MUSL_VER="1"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
index 65883e2a1dd..f1a982bdcf2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
@@ -8,9 +8,9 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PATCH_GCC_VER="15.1.0"
+MUSL_GCC_VER="15.1.0"
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
@@ -28,7 +28,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250525.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250525.ebuild
index 2338e2a3938..031efdb451b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250504.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250525.ebuild
@@ -9,8 +9,10 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
+PATCH_VER="2"
+MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250601.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250601.ebuild
index 2338e2a3938..0e25c3f620e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250427.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250601.ebuild
@@ -9,8 +9,10 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
+PATCH_VER="3"
+MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
index 2338e2a3938..42e1def5b40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.9999.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
 MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
index 650d49559b8..125c8cf1e39 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_VER="4"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 inherit toolchain
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index a38688e620b..fa67a8543c4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
 PATCH_VER="2"
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{10..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r1.ebuild
index a170dc80646..c9ee1016f9f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r1.ebuild
@@ -79,14 +79,6 @@ PATCHES=(
 
 QA_SONAME_NO_SYMLINK=".*/preloadable_libintl.so"
 
-QA_CONFIG_IMPL_DECL_SKIP=(
-	# bug #898570
-	unreachable
-	MIN
-	alignof
-	static_assert
-)
-
 pkg_pretend() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r2.ebuild
index 6be735b1cf1..9fffec587cb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5-r2.ebuild
@@ -74,14 +74,6 @@ PATCHES=(
 
 QA_SONAME_NO_SYMLINK=".*/preloadable_libintl.so"
 
-QA_CONFIG_IMPL_DECL_SKIP=(
-	# bug #898570
-	unreachable
-	MIN
-	alignof
-	static_assert
-)
-
 pkg_pretend() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
index 88afc730dd6..826a4441d39 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Note: Keep version bumps in sync with dev-libs/libintl.
@@ -79,14 +79,6 @@ PATCHES=(
 
 QA_SONAME_NO_SYMLINK=".*/preloadable_libintl.so"
 
-QA_CONFIG_IMPL_DECL_SKIP=(
-	# bug #898570
-	unreachable
-	MIN
-	alignof
-	static_assert
-)
-
 pkg_pretend() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.23.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.23.1-r1.ebuild
index 19e8f01b1a1..76ef3f745c7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.23.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.23.1-r1.ebuild
@@ -74,14 +74,6 @@ PATCHES=(
 
 QA_SONAME_NO_SYMLINK=".*/preloadable_libintl.so"
 
-QA_CONFIG_IMPL_DECL_SKIP=(
-	# bug #898570
-	unreachable
-	MIN
-	alignof
-	static_assert
-)
-
 pkg_pretend() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
index 97747795b01..ea6b0f02f75 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
@@ -1,7 +1,5 @@
 DIST m4-1.4.19-test-198-sysval-r1.patch.gz 6292 BLAKE2B 62f52c8bb75e7b8f11e487906f1ce47069ea6d3095fd6532aa6b47bcd8109b7cd733fde26915d449a1cfc326f27f5ed83ba29a5a80687b8b9bdb73c8d87e96b8 SHA512 c3e7d4c1631e401c6b5477c22fd5de837188acf9d72551b116c665a927d1799b1fb249e90c9fb4f6f2f328ee84b2e4dd0bf54f684139997c19ee5b69a3e9284d
-DIST m4-1.4.19.60-6ebfc.tar.xz 2031984 BLAKE2B d6001b14a4f4bb5bb163463331b9e24469b6b48f690c88796b4d2ca57dc3c31046eb7ece0c2593941aa1b5a0e90e2aa0d85b000e135742286bf90cc7f5d09b57 SHA512 bcb801404ff8f4146e59e8baadae02f5dfac1ce3f860118122430e4facae098628e915d8ee9386abb3c133a0cc2b7c98170a57687c9d85aaa6f130b061b7810f
-DIST m4-1.4.19.60-6ebfc.tar.xz.sig 488 BLAKE2B 71f9c4aec3e981816eda83032474b4d9acccc628c79a5dd9a5e2a077e4f3f30fa6f59fb29ed7e0c1ae7148a4605584b65653eacaee7d06ba006fa2dcb7e425c1 SHA512 5e89d23c7879eb4970f05a6e8fb37eb1b17ece4204bb86cc16bcbb4f4705263725ac70b286c2454249a8a33728784a2434e498deccbbd367424ceef91a36b164
-DIST m4-1.4.19.65-bdd9.tar.xz 2038192 BLAKE2B 47a719ce90486ffa819b05173225ce3d7e6669be238bd8df5bb37f81dc30e95fc7a3c717940b97543f87b547b3db58607d9fe35c967609c04174f5204da93994 SHA512 f74ea0305e3ccde89633a7f6e4acd05ec4f68defc3d4aedea635f93f99555ceea1fed2bf3cca6386bcf7994e879e67f6f4c9a64b59636047b26e282e42e735c3
-DIST m4-1.4.19.65-bdd9.tar.xz.sig 488 BLAKE2B 281e3300b02fc92dd03bd38faa082f5394536dcebf7c87ec33b0b2bb5a94ebff1a2233c8aaeb23b17f436e2b40c90ee1d68e5a59d208306242688710f797c6d5 SHA512 c33bd351b73616fc3e7cd7292403af9f0001fedbd005a7cd115180005f3fffd0a58b37422b70c638302cf5c3a65bb723c3b916bc237be0f687b2a190b4162fe7
 DIST m4-1.4.19.tar.xz 1654908 BLAKE2B 08694485a49c542761fa9a7db4d7609f4dfb08a5c6b785b57f2e14cf1f696c2a1c788bb5eb934e8159a632b63ff071dfe42511d0109d7b1828f46d33c8bf416a SHA512 47f595845c89709727bda0b3fc78e3188ef78ec818965b395532e7041cabe9e49677ee4aca3d042930095a7f8df81de3da1026b23b6897be471f6cf13ddd512b
 DIST m4-1.4.19.tar.xz.sig 488 BLAKE2B 99e89b1ed0bf158d29a652392fb122e23227e895c75a8c63057ebe33f11b433ab205ae99a991578a89df8c3e723fc00669d8cdb290fbc86eaa6c704b112e4370 SHA512 d6ac9c6a54c57e9b53fb3e34a60d49df2f46a6e494da0a0c9ae8246b984e68a853b5d8c42677c1a0485c3f36b0bce10a481d3775c0edc1dbdfb27b43545bc31e
+DIST m4-1.4.20.tar.xz 2044756 BLAKE2B d8e6716dd4f35e17b866917f0697f980d7b6fbfa9aa92feb1234fdb49fb62107dc48405036a8ca97db73889d7638b90b69ea005352992b7bf45e8605127b318f SHA512 dc7b4f61452e564b095010029bf6ce4246e5a03959989cd76b09eb8012db7424c52819143020fab21a3471ff57ab026d3eccbd00dd3969819208980565a9fec0
+DIST m4-1.4.20.tar.xz.sig 488 BLAKE2B a202c6d8f7d65bf8f4936ec5d18bce768fe80ab485905cce051339fffdecbdd191f73b25675770648536ee24c2b161416e924b6acd30c1d8d00a425174f0a439 SHA512 bc75a64e47a87fe4073f26850a8344e82d15f156ac5b52cde1af701a0ba4e0d18f414323f86c868f114c4867b00c31ce205a9505343e588ad97825b05136c5eb
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
deleted file mode 100644
index 6fb2e2de7ee..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/m4.asc
-inherit verify-sig
-
-DESCRIPTION="GNU macro processor"
-HOMEPAGE="https://www.gnu.org/software/m4/m4.html"
-if [[ ${PV} == *_p* ]] ; then
-	# Note: could put this in devspace, but if it's gone, we don't want
-	# it in tree anyway. It's just for testing.
-	MY_SNAPSHOT="$(ver_cut 1-3).60-6ebfc"
-	SRC_URI="
-		https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
-		https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
-		verify-sig? (
-			https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
-			https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
-		)
-	"
-	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-IUSE="examples nls"
-
-RDEPEND="
-	virtual/libiconv
-	nls? (
-		sys-devel/gettext
-		virtual/libintl
-	)
-"
-DEPEND="${RDEPEND}"
-# Remember: cannot dep on autoconf since it needs us
-BDEPEND="
-	app-arch/xz-utils
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-m4 )
-"
-
-src_prepare() {
-	default
-
-	# touch generated files after patching m4, to avoid activating maintainer
-	# mode
-	# remove when loong-fix-build.patch is no longer necessary
-	#touch ./aclocal.m4 ./lib/config.hin ./configure ./doc/stamp-vti || die
-	#find . -name Makefile.in -exec touch {} + || die
-}
-
-src_configure() {
-	local -a myeconfargs=(
-		--enable-changeword
-
-		--with-packager="Gentoo Linux"
-		--with-packager-version="${PVR}"
-		--with-packager-bug-reports="https://bugs.gentoo.org/"
-
-		$(usex nls '' '--disable-nls')
-
-		# Disable automagic dependency over libsigsegv; see bug #278026
-		ac_cv_libsigsegv=no
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	[[ -d /none ]] && die "m4 tests will fail with /none/" # bug #244396
-	emake check
-}
-
-src_install() {
-	default
-
-	# autoconf-2.60 for instance, first checks gm4, then m4.  If we don't have
-	# gm4, it might find gm4 from outside the prefix on for instance Darwin
-	use prefix && dosym m4 /usr/bin/gm4
-
-	if use examples ; then
-		dodoc -r examples
-		rm -f "${ED}"/usr/share/doc/${PF}/examples/Makefile*
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.20.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250419.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.20.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
index 8f8d1b87aa0..2eceb5f4735 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.8.ebuild
@@ -22,7 +22,7 @@ else
 	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/patch/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
index 085da8a437d..3a5ada833fd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
@@ -1,7 +1,7 @@
-DIST intel-microcode-collection-20240915.tar.xz 15384092 BLAKE2B 8f7caf4e7e96544037f25f335a1fd24a04e9613cd397dcd4a299f385647335771bd2218b64b7fd047405e88ac3907f662b4a2d35c5600d488a197152514d0de8 SHA512 975867f7a817e4086c6901329de3c6bff2b6d8ed4719af41b349e87297c8b213a31708804d7216a44358fbe4effc227e96999fb7f9f4599dd83d033eee849a4d
 DIST intel-microcode-collection-20241103.tar.xz 17703860 BLAKE2B dd2e88e4b06a54ad5f07b12a842eea0a66f2b8d5bf5fb311bd5d9d955faf6f08d1b025cdf5ba04a6b43b3fb153dca50c2fba1cb40454e9b195c7fe03563c8685 SHA512 f57fc0ba0deced6d852354556429afea0995f1864a73594e92c5900bbec3816ff8d960860f853c788ebeb3ae0f1a44ca3dc9ddc091bdc2753a2f181993eb601d
 DIST intel-microcode-collection-20250211.tar.xz 20347768 BLAKE2B 3d06117d036731654052ed82000b303f66b5f279f64c9c7e7d1027fc79f5a01b36808bcfd71d522d4903bb8c637cc9fd5ac4e33f7597b5e07cce6038870e88f0 SHA512 cd7bd7a7cbcf37fe7aea98d10ed1369fcd75fa3778ff85eec474fab8ef80fe5c26fea8f3a89918af58aa250f544d0950591a793669507c7c5f3f9702ef442424
+DIST intel-microcode-collection-20250513.tar.xz 19778084 BLAKE2B 163360f399def56e9b4d05d31f3d20cdfa416f4673351a5d66cb320e7751abb3bc6e983bfd7fec53ccda8feff242d9e5e896a1137454876ea9df1ba36232191d SHA512 fe06dbcf2880c3b8857973a13fa2f25bc7eb8943bfc82b39ea7b2446becd82ea7c574df91989a2b66f897092db08e51cca671bc2297df30f266890751f02a7ce
 DIST intel-ucode-sig_0x406e3-rev_0xd6.bin 101376 BLAKE2B 66d55867954d69dda1425febd93bb8c89f7aa836d504f8b5fee127f8505bcf2246f4fcc55cc245bc5e532528d60cca2eee278de7ab5174dc2862db7982a2b36f SHA512 248066b521bf512b5d8e4a8c7e921464ce52169c954d6e4ca580d8c172cd789519e22b4cf56c212e452b4191741f0202019f7061d322c9433b5af9ce5413b567
-DIST microcode-20240910.tar.gz 12879730 BLAKE2B b4c353dd340ef8004e5be2e596de0ebaf8366684a3371207e14d3d8c0e4bbdc5a9c75d8279d280d1029452368556a0c2e7bf85f3fe75f1b1560e16c953f223b7 SHA512 d996de4f045df33f4eb1a1dabfb2f55bd8941e8dc16241d7a6c361216f4b87b88c34ba57c88ee4d4b7b3cf2b3fac937c43806191681df031fa3d5cdd677a86fe
 DIST microcode-20241112.tar.gz 12923653 BLAKE2B 223721ac561b137513653e1b10dc2afabcc4fc9e304f3fc71c252f1ada9554bf1df812c766831ec4b5f66f57f66c3e1cf563d7d24d17e553a4e26adc659f8d76 SHA512 de4ddb0a77e17a4a5b6789537cf71db9ab884c795ef5c77b17d3392fda0fbb4d860cc27bcdbd7512d9412d6f934e6771e889be262b20e77433e0f72d3b6cf1f0
 DIST microcode-20250211.tar.gz 11844354 BLAKE2B 628d4e1664639d688fded764add9a0e2df38c8aae7a63b0bf93430befcf9938f0b9bec535016bfb2d6ff0538fd09f8eec7b2d721f727406a0ec50c6f809ad698 SHA512 493216fb14097c7c9bda3117fbcae8ad4300fb8646918338119ef303000aad6f73ca04acc59c9a890b0b2b58e097798f673954f15e3142948267bbeeacc842cf
+DIST microcode-20250512.tar.gz 14985022 BLAKE2B 1a080ef059cfb50846460b53f245ba7c241a5d2126df9a9842641066341971d1e9889499349be29fd90cf55f80d2fe230052cb34e718cbbdb8894138a647f34c SHA512 7c22448eaec64a09562fc05da59e8b77bd828ff7a8c2973a012eb5e2cf92a6cfff6e770e379f5db4a8d633de610be6f02ddd033351505a2b8180e3982d63a49e
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20250512_p20250513.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240910_p20240915.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20250512_p20250513.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
index f7ae4d73b02..626430641f7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.2-r10.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="archive cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.4.ebuild
index dd903105a61..689cbffefb5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/lxcfs-6.0.4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit cmake meson python-any-r1 systemd verify-sig
 
@@ -14,7 +14,7 @@ SRC_URI="https://linuxcontainers.org/downloads/lxcfs/${P}.tar.gz
 
 LICENSE="Apache-2.0 LGPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm64 ~riscv ~x86"
 IUSE="doc test"
 
 DEPEND="sys-fs/fuse:3="
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/metadata.xml
index 358bde78668..e20f7ed7f1a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/lxcfs/metadata.xml
@@ -16,7 +16,7 @@
 		their /proc originals to provide cgroup-aware values.
 	</longdescription>
 	<upstream>
-		<remote-id type="github">lxc/lxfs</remote-id>
+		<remote-id type="github">lxc/lxcfs</remote-id>
 		<remote-id type="cpe">cpe:/a:canonical:lxcfs</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8-r1.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8-r1.ebuild
index e85965ca2f8..db3d55366b3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.8-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -53,6 +53,11 @@ myemake() {
 		V=1
 	)
 
+	if ! use systemd; then
+		# Bug 956025
+		myemakeargs+=( SYSTEMD= )
+	fi
+
 	emake "${myemakeargs[@]}" "$@"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.10.ebuild
index 326b49b0d01..9bf86611069 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/quota/quota-4.10.ebuild
@@ -9,7 +9,7 @@ SRC_URI="https://downloads.sourceforge.net/linuxquota/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
 IUSE="ldap netlink nls rpc selinux tcpd"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
index d8111034d34..0bca2786677 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
@@ -1,2 +1 @@
-DIST squashfs-tools-ng-1.3.1.tar.xz 585916 BLAKE2B 697131ddb9959bed388534f90c93e2e7495ef5aec9facf97e7d17475cff64d7a4badb709a16ae5e6da3ee89b1a1e3a49833bd15b9a0b4b364e15a565bd18e480 SHA512 0a433f7c3633cd5d8646d990744e31ed59c7012d5f8bb4fdb7892b892631f22a8fd0969f7d81de68f53e44670e71cb8e29729cd925a93b98ab3b6942bbc30662
 DIST squashfs-tools-ng-1.3.2.tar.xz 585380 BLAKE2B 43e8e7c189a9e3a23964a9ae17666eba7ff362d7ed011ee09e342d9ef777de2ce8e326cd38fa0932ace33929cf75bab81786ca56411053c08041300459262076 SHA512 6f14d90875ef3f3d36d3cd38932ade6b0da7284922c914bd655e3f0a4abb17ba75d4bc052a1d4244c1b4ff96b3798d83d5a7b3263b8e1b96c112f4cdf967400f
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild
deleted file mode 100644
index 9342b6bd684..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.1.ebuild
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 2019-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="A new set of tools for working with SquashFS images"
-HOMEPAGE="https://github.com/AgentD/squashfs-tools-ng"
-if [[ ${PV} = 9999* ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://github.com/AgentD/${PN}.git"
-else
-	inherit libtool
-	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	SRC_URI="https://infraroot.at/pub/squashfs/${P}.tar.xz"
-fi
-
-LICENSE="LGPL-3+ BSD-2 MIT tools? ( GPL-3+ )"
-SLOT="0"
-IUSE="lz4 +lzma lzo selinux +tools zstd"
-
-DEPEND="
-	app-arch/bzip2:=
-	sys-libs/zlib:=
-	lz4?     ( app-arch/lz4:= )
-	lzma?    ( app-arch/xz-utils )
-	lzo?     ( dev-libs/lzo:2 )
-	selinux? ( sys-libs/libselinux:= )
-	zstd?    ( app-arch/zstd:= )
-"
-RDEPEND="${DEPEND}"
-
-src_prepare() {
-	default
-	if [[ ${PV} = "9999" ]]; then
-		eautoreconf
-	else
-		elibtoolize
-	fi
-}
-
-src_configure() {
-	local myconf=(
-		--disable-static
-		$(use_with lz4)
-		$(use_with lzo)
-		$(use_with selinux)
-		$(use_with tools)
-		$(use_with lzma xz)
-		$(use_with zstd)
-	)
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	default
-	find "${D}" -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
index 98d07222123..7dd806e761c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/Manifest
@@ -2,8 +2,6 @@ DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0
 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317
 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271
 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e
-DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b
-DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0
 DIST zfs-2.3.1.tar.gz 34048716 BLAKE2B 7f22826c3359a015a87aafd119d882d8196dca59dadd85674a48c42ed502937f2880e98a387e9986be2c14fc48f46a288aed5fd8635f13db2585e3fc95e57726 SHA512 235023dbe97b3f7c5273e2a6fa34957cc37967256845d4ed9faa2e2a6da29ea6fdcba4167658cf03129afbb0aa11311a760d3d0b5ea5aecc64a4c7ee22ad2d31
 DIST zfs-2.3.1.tar.gz.asc 836 BLAKE2B 5d1f84f5803f1b0553ad75b12020a57537f6a6e3c3781ab8a21f0d7de9ad6be0be7618bb42e51bbddd5fc48cabb05f6d79ea2f5eebc63d67383b29c44d69f7f6 SHA512 619aac22d80b8100f28ca3e4a984b2e0387b272131d2a8c104a278955a811e2280ecf3bfa3b7d54ed73572ed7cd45121cd724b52afd3503c30c1e41400d27674
 DIST zfs-2.3.2.tar.gz 34344259 BLAKE2B 8a89c62cbbeaf410db4011821cdd9959abef1782be7427b81ac47565407384fa3a381bef041dae73e97c2b2cefca62933180851901b3b1b86974ed33ad178a61 SHA512 94311f2eca1488be83aa0cb802b4a4541bbbd061a3e8e5cbda62cabbb0c8f9a705372ad192cb77703b3d7642c43be7f604f3c363b243cf03a6aceae2d7e5db81
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild
deleted file mode 100644
index 435d8a40d27..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.0.ebuild
+++ /dev/null
@@ -1,207 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_INITRAMFS_IUSE=+initramfs
-inherit autotools flag-o-matic linux-mod-r1 multiprocessing
-
-DESCRIPTION="Linux ZFS kernel module for sys-fs/zfs"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-MODULES_KERNEL_MAX=6.12
-MODULES_KERNEL_MIN=4.18
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-	inherit git-r3
-	unset MODULES_KERNEL_MAX
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_PV=${PV/_rc/-rc}
-	SRC_URI="https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/zfs/releases/download/zfs-${MY_PV}/zfs-${MY_PV}.tar.gz.asc )"
-	S="${WORKDIR}/zfs-${MY_PV}"
-
-	ZFS_KERNEL_COMPAT="${MODULES_KERNEL_MAX}"
-	# Increments minor eg 5.14 -> 5.15, and still supports override.
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="CDDL MIT debug? ( GPL-2+ )"
-SLOT="0/${PVR}"
-IUSE="custom-cflags debug +rootfs"
-RESTRICT="test"
-
-BDEPEND="
-	app-alternatives/awk
-	dev-lang/perl
-"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-
-	IUSE+=" +dist-kernel-cap"
-	RDEPEND="
-		dist-kernel-cap? ( dist-kernel? (
-			<virtual/dist-kernel-${ZFS_KERNEL_DEP}
-		) )
-	"
-fi
-
-# Used to suggest matching USE, but without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-${PV}[dist-kernel] )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.11-gentoo.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-}
-
-pkg_setup() {
-	local CONFIG_CHECK="
-		EFI_PARTITION
-		ZLIB_DEFLATE
-		ZLIB_INFLATE
-		!DEBUG_LOCK_ALLOC
-		!PAX_KERNEXEC_PLUGIN_METHOD_OR
-	"
-	use debug && CONFIG_CHECK+="
-		DEBUG_INFO
-		FRAME_POINTER
-		!DEBUG_INFO_REDUCED
-	"
-	use rootfs && CONFIG_CHECK+="
-		BLK_DEV_INITRD
-		DEVTMPFS
-	"
-
-	kernel_is -lt 5 && CONFIG_CHECK+=" IOSCHED_NOOP"
-
-	if [[ ${PV} != 9999 ]] ; then
-		local kv_major_max kv_minor_max zcompat
-		zcompat="${ZFS_KERNEL_COMPAT_OVERRIDE:-${ZFS_KERNEL_COMPAT}}"
-		kv_major_max="${zcompat%%.*}"
-		zcompat="${zcompat#*.}"
-		kv_minor_max="${zcompat%%.*}"
-		kernel_is -le "${kv_major_max}" "${kv_minor_max}" || die \
-			"Linux ${kv_major_max}.${kv_minor_max} is the latest supported version"
-	fi
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != 9999 ]] ; then
-		# Set module revision number
-		sed -Ei "s/(Release:.*)1/\1${PR}-gentoo/" META || die
-	fi
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	filter-ldflags -Wl,*
-
-	local myconf=(
-		--bindir="${EPREFIX}"/bin
-		--sbindir="${EPREFIX}"/sbin
-		--with-config=kernel
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		$(use_enable debug)
-
-		# See gentoo.patch
-		GENTOO_MAKEARGS_EVAL="${MODULES_MAKEARGS[*]@Q}"
-		TEST_JOBS="$(makeopts_jobs)"
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake "${MODULES_MAKEARGS[@]}"
-}
-
-src_install() {
-	emake "${MODULES_MAKEARGS[@]}" DESTDIR="${ED}" install
-	modules_post_process
-
-	dodoc AUTHORS COPYRIGHT META README.md
-}
-
-_old_layout_cleanup() {
-	# new files are just extra/{spl,zfs}.ko with no subdirs.
-	local olddir=(
-		avl/zavl
-		icp/icp
-		lua/zlua
-		nvpair/znvpair
-		spl/spl
-		unicode/zunicode
-		zcommon/zcommon
-		zfs/zfs
-		zstd/zzstd
-	)
-
-	# kernel/module/Kconfig contains possible compressed extentions.
-	local kext kextfiles
-		for kext in .ko{,.{gz,xz,zst}}; do
-		kextfiles+=( "${olddir[@]/%/${kext}}" )
-	done
-
-	local oldfile oldpath
-	for oldfile in "${kextfiles[@]}"; do
-		oldpath="${EROOT}/lib/modules/${KV_FULL}/extra/${oldfile}"
-		if [[ -f "${oldpath}" ]]; then
-			ewarn "Found obsolete zfs module ${oldfile} for current kernel ${KV_FULL}, removing."
-			rm -rv "${oldpath}" || die
-			# we do not remove non-empty directories just for safety in case there's something else.
-			# also it may fail if there are both compressed and uncompressed modules installed.
-			rmdir -v --ignore-fail-on-non-empty "${oldpath%/*.*}" || die
-		fi
-	done
-}
-
-pkg_postinst() {
-	# Check for old module layout before doing anything else.
-	# only attempt layout cleanup if new .ko location is used.
-	local newko=( "${EROOT}/lib/modules/${KV_FULL}/extra"/{zfs,spl}.ko* )
-	# We check first array member, if glob above did not exand, it will be "zfs.ko*" and -f will return false.
-	# if glob expanded -f will do correct file precense check.
-	[[ -f ${newko[0]} ]] && _old_layout_cleanup
-
-	linux-mod-r1_pkg_postinst
-
-	if use x86 || use arm ; then
-		ewarn "32-bit kernels will likely require increasing vmalloc to"
-		ewarn "at least 256M and decreasing zfs_arc_max to some value less than that."
-	fi
-
-	if has_version sys-boot/grub ; then
-		ewarn "This version of OpenZFS includes support for new feature flags"
-		ewarn "that are incompatible with previous versions. GRUB2 support for"
-		ewarn "/boot with the new feature flags is not yet available."
-		ewarn "Do *NOT* upgrade root pools to use the new feature flags."
-		ewarn "Any new pools will be created with the new feature flags by default"
-		ewarn "and will not be compatible with older versions of OpenZFS. To"
-		ewarn "create a new pool that is backward compatible wih GRUB2, use "
-		ewarn
-		ewarn "zpool create -o compatibility=grub2 ..."
-		ewarn
-		ewarn "Refer to /usr/share/zfs/compatibility.d/grub2 for list of features."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
index 2b1d047a34c..e8da986b29c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs-kmod/zfs-kmod-2.3.2.ebuild
@@ -31,7 +31,7 @@ else
 	ZFS_KERNEL_DEP="${ZFS_KERNEL_DEP%%.*}.$(( ${ZFS_KERNEL_DEP##*.} + 1))"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
+		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
index 98d07222123..7dd806e761c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/Manifest
@@ -2,8 +2,6 @@ DIST zfs-2.1.16.tar.gz 35187215 BLAKE2B 8bb90903f3747589fff94a810584de54d7f598b0
 DIST zfs-2.1.16.tar.gz.asc 836 BLAKE2B b46614399ca63d9c88216c55bb2177cc0c28f4da2cb6be3ee361efca994309abff46fdf6ad6b0bad448c44e9e84ee40e2183d1b482e04844317f14744bab5c1f SHA512 d2d94a4e3ffe182e86fa3319cb9661688125f378ffa1e5768ee89033f796a1f52f877c382588fb1f434686e30bc4e65e3f08ceac0dd3dd7f8f751ba6182c3317
 DIST zfs-2.2.7.tar.gz 33852602 BLAKE2B 31a066d5d543e3328d1afd065a8da4f9b4c52433d585cdbb41936900fd1453431585c6bc4b6e6d9a497a03e79969bae883e17cf4677099686feb3e32577d2777 SHA512 6493faa8e31d9c042c4e8f748d32cb9243212fdf4e0341c19568b47bcf302e60beb89940b80374610b71e1dca1ca5813f3efaddbf1a2453ceabb38381165b271
 DIST zfs-2.2.7.tar.gz.asc 836 BLAKE2B e8fc5e04f5b37a22c741bda46b4573e0cebe85da051c73cf3c5fc267de3c313399b235fc346ca06f4c22d37d2500044a26adb3ea241a65fbcf8760d0ef880039 SHA512 8d22a64c920c2a983429688a340f4ae281decdd30e465591e6b40af9f3016b8f168f4e8ea460600c832a2f46b383ff307986649a645585fb25c34fdfda75ad6e
-DIST zfs-2.3.0.tar.gz 34029599 BLAKE2B b9fb7913f95dd0c8aec703961ecc0413aa51df889f15b1541ff8fcd7146ba485947fab83deb062bdffcdeab17a2465b7551c7eba3ec55c62c21aba58846c0da5 SHA512 f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b
-DIST zfs-2.3.0.tar.gz.asc 836 BLAKE2B 9d1bd03dc6e5699236bca4c2b20a0a8b46e88d90ea58f7171d087c555da85d6af88acc5990f828ba455f9fbe24c90800c1edf74cd3f865b528730ffef8a931b8 SHA512 ba9a8e8b248de7383c8d33b84b0d70de026b8f3e6a1c82557b74ac274b28e559435541fbdfe816f6b80ce5098b3cac34af69cd53877f1f50fa6a846fa92a5dd0
 DIST zfs-2.3.1.tar.gz 34048716 BLAKE2B 7f22826c3359a015a87aafd119d882d8196dca59dadd85674a48c42ed502937f2880e98a387e9986be2c14fc48f46a288aed5fd8635f13db2585e3fc95e57726 SHA512 235023dbe97b3f7c5273e2a6fa34957cc37967256845d4ed9faa2e2a6da29ea6fdcba4167658cf03129afbb0aa11311a760d3d0b5ea5aecc64a4c7ee22ad2d31
 DIST zfs-2.3.1.tar.gz.asc 836 BLAKE2B 5d1f84f5803f1b0553ad75b12020a57537f6a6e3c3781ab8a21f0d7de9ad6be0be7618bb42e51bbddd5fc48cabb05f6d79ea2f5eebc63d67383b29c44d69f7f6 SHA512 619aac22d80b8100f28ca3e4a984b2e0387b272131d2a8c104a278955a811e2280ecf3bfa3b7d54ed73572ed7cd45121cd724b52afd3503c30c1e41400d27674
 DIST zfs-2.3.2.tar.gz 34344259 BLAKE2B 8a89c62cbbeaf410db4011821cdd9959abef1782be7427b81ac47565407384fa3a381bef041dae73e97c2b2cefca62933180851901b3b1b86974ed33ad178a61 SHA512 94311f2eca1488be83aa0cb802b4a4541bbbd061a3e8e5cbda62cabbb0c8f9a705372ad192cb77703b3d7642c43be7f604f3c363b243cf03a6aceae2d7e5db81
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/files/2.3.2-musl_S_IFMT.patch b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/files/2.3.2-musl_S_IFMT.patch
new file mode 100644
index 00000000000..d356b818eda
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/files/2.3.2-musl_S_IFMT.patch
@@ -0,0 +1,40 @@
+https://github.com/openzfs/zfs/pull/17294 (merged)
+
+From 634c172ee89f5303493a75dc7ff55e0a355b503a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Luis=20Salvador=20Rufo?=
+ <salvador.joseluis@gmail.com>
+Date: Fri, 2 May 2025 23:49:25 +0200
+Subject: [PATCH] tests: fix `S_IFMT` undeclared at `statx.c`
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+`S_IFMT` is declared in `sys/stat.h`, but we cannot include this header
+because it redeclares the `statx` function with different argument
+types. Therefore, we define `S_IFMT` ourselves, in the same way as the
+other definitions.
+
+Reviewed-by: Rob Norris <robn@despairlabs.com>
+Reviewed-by: George Melikov <mail@gmelikov.ru>
+Reviewed-by: Alexander Motin <mav@FreeBSD.org>
+Signed-off-by: José Luis Salvador Rufo <salvador.joseluis@gmail.com>
+Closes #17293
+Closes #17294
+---
+ tests/zfs-tests/cmd/statx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/zfs-tests/cmd/statx.c b/tests/zfs-tests/cmd/statx.c
+index 89939f6efb40..1acc7e58c5ce 100644
+--- a/tests/zfs-tests/cmd/statx.c
++++ b/tests/zfs-tests/cmd/statx.c
+@@ -109,6 +109,9 @@ _statx(int fd, const char *path, int flags, unsigned int mask, void *stx)
+ #ifndef STATX_DIOALIGN
+ #define	STATX_DIOALIGN	(1<<13)
+ #endif
++#ifndef S_IFMT
++#define	S_IFMT 0170000
++#endif
+ 
+ typedef struct {
+ 	int64_t		tv_sec;
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild
deleted file mode 100644
index 1f1fcfb8f87..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.0.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
-
-inherit autotools bash-completion-r1 dist-kernel-utils distutils-r1 flag-o-matic linux-info pam systemd udev usr-ldscript
-
-DESCRIPTION="Userland utilities for ZFS Linux kernel module"
-HOMEPAGE="https://github.com/openzfs/zfs"
-
-if [[ ${PV} == "9999" ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/openzfs/zfs.git"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openzfs.asc
-	inherit verify-sig
-
-	MY_P="${P/_rc/-rc}"
-	SRC_URI="https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( https://github.com/openzfs/${PN}/releases/download/${MY_P}/${MY_P}.tar.gz.asc )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
-	fi
-fi
-
-LICENSE="BSD-2 CDDL MIT"
-# just libzfs soname major for now.
-# possible candidates: libuutil, libzpool, libnvpair. Those do not provide stable abi, but are considered.
-# see libsoversion_check() below as well
-SLOT="0/6"
-IUSE="custom-cflags debug dist-kernel kernel-builtin minimal nls pam python +rootfs selinux test-suite unwind"
-
-DEPEND="
-	dev-libs/openssl:=
-	net-libs/libtirpc:=
-	sys-apps/util-linux
-	sys-libs/zlib
-	virtual/libudev:=
-	!minimal? ( ${PYTHON_DEPS} )
-	pam? ( sys-libs/pam )
-	python? (
-		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
-	)
-	unwind? ( sys-libs/libunwind:= )
-"
-
-BDEPEND="
-	app-alternatives/awk
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	python? (
-		${DISTUTILS_DEPS}
-		|| (
-			dev-python/packaging[${PYTHON_USEDEP}]
-			dev-python/distlib[${PYTHON_USEDEP}]
-		)
-	)
-"
-
-if [[ ${PV} != "9999" ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-openzfs )"
-fi
-
-# awk is used for some scripts, completions, and the Dracut module
-RDEPEND="
-	${DEPEND}
-	!kernel-builtin? ( ~sys-fs/zfs-kmod-${PV}:= )
-	!prefix? ( virtual/udev )
-	app-alternatives/awk
-	sys-fs/udev-init-scripts
-	dist-kernel? ( virtual/dist-kernel:= )
-	rootfs? (
-		app-alternatives/cpio
-		app-misc/pax-utils
-	)
-	selinux? ( sec-policy/selinux-zfs )
-	test-suite? (
-		app-shells/ksh
-		sys-apps/kmod[tools]
-		sys-apps/util-linux
-		app-alternatives/bc
-		sys-block/parted
-		sys-fs/lsscsi
-		sys-fs/mdadm
-		sys-process/procps
-	)
-"
-
-# PDEPEND in this form is needed to trick portage suggest
-# enabling dist-kernel if only 1 package have it set, without suggesting to disable
-PDEPEND="dist-kernel? ( ~sys-fs/zfs-kmod-${PV}[dist-kernel] )"
-
-REQUIRED_USE="
-	!minimal? ( ${PYTHON_REQUIRED_USE} )
-	python? ( !minimal )
-	test-suite? ( !minimal )
-"
-
-RESTRICT="test"
-
-PATCHES=(
-	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
-)
-
-pkg_pretend() {
-	use rootfs || return 0
-
-	if has_version virtual/dist-kernel && ! use dist-kernel; then
-		ewarn "You have virtual/dist-kernel installed, but"
-		ewarn "USE=\"dist-kernel\" is not enabled for ${CATEGORY}/${PN}"
-		ewarn "It's recommended to globally enable dist-kernel USE flag"
-		ewarn "to auto-trigger initrd rebuilds with kernel updates"
-	fi
-}
-
-pkg_setup() {
-	if use kernel_linux; then
-		linux-info_pkg_setup
-
-		if ! linux_config_exists; then
-			ewarn "Cannot check the linux kernel configuration."
-		else
-			if use test-suite; then
-				if linux_chkconfig_present BLK_DEV_LOOP; then
-					eerror "The ZFS test suite requires loop device support enabled."
-					eerror "Please enable it:"
-					eerror "    CONFIG_BLK_DEV_LOOP=y"
-					eerror "in /usr/src/linux/.config or"
-					eerror "    Device Drivers --->"
-					eerror "        Block devices --->"
-					eerror "            [X] Loopback device support"
-				fi
-			fi
-		fi
-	fi
-}
-
-libsoversion_check() {
-	local bugurl libzfs_sover
-	bugurl="https://bugs.gentoo.org/enter_bug.cgi?form_name=enter_bug&product=Gentoo+Linux&component=Current+packages"
-
-	libzfs_sover="$(grep 'libzfs_la_LDFLAGS += -version-info' lib/libzfs/Makefile.am \
-		| grep -Eo '[0-9]+:[0-9]+:[0-9]+')"
-	libzfs_sover="${libzfs_sover%%:*}"
-
-	if [[ ${libzfs_sover} -ne $(ver_cut 2 ${SLOT}) ]]; then
-		echo
-		eerror "BUG BUG BUG BUG BUG BUG BUG BUG"
-		eerror "ebuild subslot does not match libzfs soversion!"
-		eerror "libzfs soversion: ${libzfs_sover}"
-		eerror "ebuild value: $(ver_cut 2 ${SLOT})"
-		eerror "This is a bug in the ebuild, please use the following URL to report it"
-		eerror "${bugurl}&short_desc=${CATEGORY}%2F${P}+update+subslot"
-		echo
-		# we want to abort for releases, but just print a warning for live ebuild
-		# to keep package installable
-		[[  ${PV} == "9999" ]] || die
-	fi
-}
-
-src_prepare() {
-	default
-	libsoversion_check
-
-	# Run unconditionally (bug #792627)
-	eautoreconf
-
-	if [[ ${PV} != "9999" ]]; then
-		# Set revision number
-		sed -i "s/\(Release:\)\(.*\)1/\1\2${PR}-gentoo/" META || die "Could not set Gentoo release"
-	fi
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-
-	# Tries to use /etc/conf.d which we reserve for OpenRC
-	sed -i -e '/EnvironmentFile/d' etc/systemd/system/zfs*.in || die
-
-	# prevent errors showing up on zfs-mount stop, #647688
-	# openrc will unmount all filesystems anyway.
-	sed -i "/^ZFS_UNMOUNT=/ s/yes/no/" "etc/default/zfs.in" || die
-}
-
-src_configure() {
-	use custom-cflags || strip-flags
-	use minimal || python_setup
-
-	local myconf=(
-		--bindir="${EPREFIX}/bin"
-		--enable-shared
-		--enable-sysvinit
-		--localstatedir="${EPREFIX}/var"
-		--sbindir="${EPREFIX}/sbin"
-		--with-config=user
-		--with-dracutdir="${EPREFIX}/usr/lib/dracut"
-		--with-linux="${KV_DIR}"
-		--with-linux-obj="${KV_OUT_DIR}"
-		--with-udevdir="$(get_udevdir)"
-		--with-pamconfigsdir="${EPREFIX}/unwanted_files"
-		--with-pammoduledir="$(getpam_mod_dir)"
-		--with-systemdunitdir="$(systemd_get_systemunitdir)"
-		--with-systemdpresetdir="$(systemd_get_systempresetdir)"
-		--with-vendor=gentoo
-		# Building zfs-mount-generator.c on musl breaks as strndupa
-		# isn't available. But systemd doesn't support musl anyway, so
-		# just disable building it.
-		# UPDATE: it has been fixed since,
-		# https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a
-		# but we still leave it as this for now.
-		$(use_enable !elibc_musl systemd)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable pam)
-		$(use_enable python pyzfs)
-		$(use_with unwind libunwind)
-		--disable-static
-		$(usex minimal --without-python --with-python="${EPYTHON}")
-	)
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	default
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_install() {
-	default
-
-	gen_usr_ldscript -a nvpair uutil zfsbootenv zfs zfs_core zpool
-
-	use pam && { rm -rv "${ED}/unwanted_files" || die ; }
-
-	use test-suite || { rm -r "${ED}"/usr/share/zfs/{test-runner,zfs-tests,runfiles,*sh} || die ; }
-
-	find "${ED}" -name '*.la' -delete || die
-
-	dobashcomp contrib/bash_completion.d/zfs
-	bashcomp_alias zfs zpool
-
-	# strip executable bit from conf.d file
-	fperms 0644 /etc/conf.d/zfs
-
-	if use python; then
-		pushd contrib/pyzfs >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	# enforce best available python implementation
-	use minimal || python_fix_shebang "${ED}/bin"
-}
-
-pkg_postinst() {
-	udev_reload
-
-	# we always need userspace utils in sync with zfs-kmod
-	# so force initrd update for userspace as well, to avoid
-	# situation when zfs-kmod trigger initrd rebuild before
-	# userspace component is rebuilt
-	# KV_* variables are provided by linux-info.eclass
-	if [[ -z ${ROOT} ]] && use dist-kernel; then
-		dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
-	fi
-
-	if use rootfs; then
-		if ! has_version sys-kernel/genkernel && ! has_version sys-kernel/dracut; then
-			elog "Root on zfs requires an initramfs to boot"
-			elog "The following packages provide one and are tested on a regular basis:"
-			elog "  sys-kernel/dracut ( preferred, module maintained by zfs developers )"
-			elog "  sys-kernel/genkernel"
-		fi
-	fi
-
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		einfo "Please refer to ${EROOT}/$(systemd_get_systempresetdir)/50-zfs.preset"
-		einfo "for default zfs systemd service configuration"
-	else
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-import" ]] || \
-			einfo "You should add zfs-import to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-load-key" ]] || \
-			einfo "You should add zfs-load-key to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/boot/zfs-mount" ]]|| \
-			einfo "You should add zfs-mount to the boot runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-share" ]] || \
-			einfo "You should add zfs-share to the default runlevel."
-		[[ -e "${EROOT}/etc/runlevels/default/zfs-zed" ]] || \
-			einfo "You should add zfs-zed to the default runlevel."
-	fi
-}
-
-pkg_postrm() {
-	udev_reload
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
index ed54eda9d89..197191fa3a9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-2.3.2.ebuild
@@ -3,6 +3,11 @@
 
 EAPI=8
 
+# Maintainers should consider lurking in the ZFS IRC channels (there's several)
+# and regularly checking ZFS GitHub issues and PRs. Look out for the 'zfs-*'
+# stable backport PRs when they're opened and subscribe to them for any important
+# cherry-picks that may be needed in advance.
+
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{10..13} )
@@ -25,7 +30,7 @@ else
 	S="${WORKDIR}/${MY_P}"
 
 	if [[ ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc"
+		KEYWORDS="amd64 arm64 ~loong ppc64 ~riscv ~sparc"
 	fi
 fi
 
@@ -106,6 +111,7 @@ RESTRICT="test"
 
 PATCHES=(
 	"${FILESDIR}"/2.1.5-dracut-zfs-missing.patch
+	"${FILESDIR}"/2.3.2-musl_S_IFMT.patch
 )
 
 pkg_pretend() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
index ed54eda9d89..0f03de4f371 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/zfs/zfs-9999.ebuild
@@ -3,6 +3,11 @@
 
 EAPI=8
 
+# Maintainers should consider lurking in the ZFS IRC channels (there's several)
+# and regularly checking ZFS GitHub issues and PRs. Look out for the 'zfs-*'
+# stable backport PRs when they're opened and subscribe to them for any important
+# cherry-picks that may be needed in advance.
+
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{10..13} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
index 1befd67dbee..41f1fa12637 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
@@ -1,3 +1,4 @@
 DIST dracut-060_pre20240104.tar.gz 499965 BLAKE2B 935e0e5da348426d69c6dab6b91078f126cadd9ffc6a32378e79cd93b1dbadff35899efc3786fc12bf5a6741843d3637b0c98cc71fe4a96a8caf053ae887bac3 SHA512 f7818265f082e9c05ebb81a91b67fb9b1d3bf8b2433b7e6ea9be6bee43d28cd1ee48577648e1d9b3729c17608b028d294c13bf5d4db4cc5a18e3b007eb2cd67e
 DIST dracut-103.tar.gz 567713 BLAKE2B 7781c0b7fc83a2c0c461f6398687e053226b489fb5405b3132b30d8e7a4f3cea2bb73aa0fe6e4c4b27187d6270ba623f403916ec38025a912930ae347a7e25ce SHA512 ba0dbefbcbecb09c44ce240664bc4f4ee25dfb8be7bc060028ae3b1ccf7d70410491c105e64fcef3d6f44d2794cb6162bcea9404125906be46bf3dff098e0277
 DIST dracut-106.tar.gz 527743 BLAKE2B 837621da329500b88b0c81a724990702a9f4e816a4818c26622b2bc5e3885c908f0bbba682a262f967d9a08a912cfd63a33270143560a30e3d067dc4217c5262 SHA512 ab17f9440129e2db7c2902115459309132ce7f7b29bbb3172002b7a8ea8ab54799d62d89fbf3f84581a5c14196f6754d33669b583b9d758ab4686a3443a3c4ad
+DIST dracut-107.tar.gz 536435 BLAKE2B 8ff85073853f874b31b659b73abfafe27bb0da59c8e77039bd1739d266dffe26616f6c96eceb2cb36319801d0fb3df53ea4153bf426f081e7e5b73c11522018b SHA512 3f8e79fbfd40c0d384e856cbabe9257c5cbafbb4a3fe4b56da27832c36844dbbf9c59f12155d165d9343bc7341eda2b90c215148eb46ae873c219fbc93992944
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-103-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-103-r4.ebuild
index 82e81230a5b..d829ca7c48c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-103-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-103-r4.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/dracut-ng/dracut-ng"
 else
 	if [[ "${PV}" != *_rc* ]]; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv sparc x86"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv sparc x86"
 	fi
 	SRC_URI="https://github.com/dracut-ng/dracut-ng/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${PN}-ng-${PV}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-106-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-106-r2.ebuild
index 88d06b6e368..5095b443222 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-106-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-106-r2.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/dracut-ng/dracut-ng"
 else
 	if [[ "${PV}" != *_rc* ]]; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ~ppc ppc64 ~riscv ~sparc x86"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~sparc x86"
 	fi
 	SRC_URI="https://github.com/dracut-ng/dracut-ng/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${PN}-ng-${PV}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild
new file mode 100644
index 00000000000..415b8f5798a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-107.ebuild
@@ -0,0 +1,234 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+CARGO_OPTIONAL=1
+
+inherit cargo flag-o-matic bash-completion-r1 edo optfeature systemd toolchain-funcs
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/dracut-ng/dracut-ng"
+else
+	if [[ "${PV}" != *_rc* ]]; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+	SRC_URI="https://github.com/dracut-ng/dracut-ng/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${PN}-ng-${PV}"
+fi
+
+DESCRIPTION="Generic initramfs generation tool"
+HOMEPAGE="https://github.com/dracut-ng/dracut-ng/wiki"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+dracut-cpio selinux test"
+RESTRICT="test"
+PROPERTIES="test? ( test_privileged test_network )"
+
+RDEPEND="
+	app-alternatives/cpio
+	>=app-shells/bash-4.0:0
+	sys-apps/coreutils[xattr(-)]
+	>=sys-apps/kmod-23[tools]
+	|| (
+		>=sys-apps/sysvinit-2.87-r3
+		sys-apps/openrc[sysv-utils(-),selinux?]
+		sys-apps/systemd[sysv-utils]
+		sys-apps/s6-linux-init[sysv-utils(-)]
+	)
+	>=sys-apps/util-linux-2.21
+	virtual/pkgconfig[native-symlinks(+)]
+	virtual/udev
+
+	elibc_musl? ( sys-libs/fts-standalone )
+	selinux? (
+		sec-policy/selinux-dracut
+		sys-libs/libselinux
+		sys-libs/libsepol
+	)
+"
+DEPEND="
+	>=sys-apps/kmod-23
+	elibc_musl? ( sys-libs/fts-standalone )
+"
+
+BDEPEND="
+	app-text/asciidoc
+	app-text/docbook-xml-dtd:4.5
+	>=app-text/docbook-xsl-stylesheets-1.75.2
+	>=dev-libs/libxslt-1.1.26
+	virtual/pkgconfig
+	dracut-cpio? ( ${RUST_DEPEND} )
+	test? (
+		net-nds/rpcbind
+		net-fs/nfs-utils
+		sys-block/open-iscsi
+		sys-fs/btrfs-progs
+		sys-fs/dmraid
+		sys-fs/lvm2[lvm,thin]
+		sys-fs/mdadm
+		sys-fs/multipath-tools
+		alpha? ( app-emulation/qemu[qemu_softmmu_targets_alpha] )
+		amd64? ( app-emulation/qemu[qemu_softmmu_targets_x86_64] )
+		arm? ( app-emulation/qemu[qemu_softmmu_targets_arm] )
+		arm64? ( app-emulation/qemu[qemu_softmmu_targets_aarch64] )
+		hppa? ( app-emulation/qemu[qemu_softmmu_targets_hppa] )
+		loong? ( app-emulation/qemu[qemu_softmmu_targets_loongarch64] )
+		mips? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_mips]
+			app-emulation/qemu[qemu_softmmu_targets_mips64]
+			app-emulation/qemu[qemu_softmmu_targets_mips64el]
+		) )
+		ppc? ( app-emulation/qemu[qemu_softmmu_targets_ppc] )
+		ppc64? ( app-emulation/qemu[qemu_softmmu_targets_ppc64] )
+		riscv? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_riscv32]
+			app-emulation/qemu[qemu_softmmu_targets_riscv64]
+		) )
+		sparc? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_sparc]
+			app-emulation/qemu[qemu_softmmu_targets_sparc64]
+		) )
+		x86? ( app-emulation/qemu[qemu_softmmu_targets_i386] )
+	)
+"
+
+QA_MULTILIB_PATHS="usr/lib/dracut/.*"
+
+PATCHES=(
+	"${FILESDIR}"/gentoo-ldconfig-paths-r1.patch
+	# Gentoo specific acct-user and acct-group conf adjustments
+	"${FILESDIR}"/${PN}-106-acct-user-group-gentoo.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1322
+	"${FILESDIR}"/${PN}-107-hostonly-regression-fix-1322.patch
+)
+
+pkg_setup() {
+	use dracut-cpio && rust_pkg_setup
+}
+
+src_configure() {
+	local myconf=(
+		--prefix="${EPREFIX}/usr"
+		--sysconfdir="${EPREFIX}/etc"
+		--bashcompletiondir="$(get_bashcompdir)"
+		--systemdsystemunitdir="$(systemd_get_systemunitdir)"
+		--disable-dracut-cpio
+	)
+
+	# this emulates what the build system would be doing without us
+	append-cflags -D_FILE_OFFSET_BITS=64
+
+	tc-export CC PKG_CONFIG
+
+	edo ./configure "${myconf[@]}"
+	if use dracut-cpio; then
+		cargo_gen_config
+		cargo_src_configure
+	fi
+}
+
+src_compile() {
+	default
+	if use dracut-cpio; then
+		pushd src/dracut-cpio >/dev/null || die
+		cargo_src_compile
+		popd >/dev/null || die
+	fi
+}
+
+src_test() {
+	addwrite /dev/kvm
+	# Translate ARCH so run-qemu can find the correct qemu-system-ARCH
+	local qemu_arch
+	if use amd64; then
+		qemu_arch=x86_64
+	elif use arm64; then
+		qemu_arch=aarch64
+	elif use loong; then
+		qemu_arch=loongarch64
+	elif use x86; then
+		qemu_arch=i386
+	else
+		qemu_arch=$(tc-arch)
+	fi
+	ARCH=${qemu_arch} emake -C test check
+}
+
+src_install() {
+	local DOCS=(
+		AUTHORS
+		NEWS.md
+		README.md
+	)
+	default
+	if use dracut-cpio; then
+		exeinto /usr/lib/dracut
+		doexe "src/dracut-cpio/$(cargo_target_dir)/dracut-cpio"
+	fi
+}
+
+pkg_preinst() {
+	# Remove directory/symlink conflicts
+	# https://bugs.gentoo.org/943007
+	local save_nullglob=$(shopt -p nullglob)
+	shopt -s nullglob
+	local module
+	for module in "${EROOT}"/usr/lib/dracut/modules.d/{80test,80test-makeroot,80test-root}; do
+		if [[ ! -L ${module} && -d ${module} ]]; then
+			rm -rv "${module}" || die
+		fi
+		local backups=( "${module}".backup.* )
+		if [[ ${#backups[@]} -gt 0 ]]; then
+			rm -v "${backups[@]}" || die
+		fi
+	done
+	eval "${save_nullglob}"
+}
+
+pkg_postinst() {
+	optfeature "Networking support" net-misc/networkmanager
+	optfeature "Legacy networking support" net-misc/curl "net-misc/dhcp[client]" \
+		sys-apps/iproute2 "net-misc/iputils[arping]"
+	optfeature "Scan for Btrfs on block devices"  sys-fs/btrfs-progs
+	optfeature "Load kernel modules and drop this privilege for real init" \
+		sys-libs/libcap
+	optfeature "Support CIFS" net-fs/cifs-utils
+	optfeature "Decrypt devices encrypted with cryptsetup/LUKS" \
+		"sys-fs/cryptsetup[-static-libs]"
+	optfeature "Support for GPG-encrypted keys for crypt module" \
+		app-crypt/gnupg
+	optfeature \
+		"Allows use of dash instead of default bash (on your own risk)" \
+		app-shells/dash
+	optfeature \
+		"Allows use of busybox instead of default bash (on your own risk)" \
+		sys-apps/busybox
+	optfeature "Support iSCSI" sys-block/open-iscsi
+	optfeature "Support Logical Volume Manager" sys-fs/lvm2[lvm]
+	optfeature "Support MD devices, also known as software RAID devices" \
+		sys-fs/mdadm sys-fs/dmraid
+	optfeature "Support Device Mapper multipathing" sys-fs/multipath-tools
+	optfeature "Plymouth boot splash"  '>=sys-boot/plymouth-0.8.5-r5'
+	optfeature "Support network block devices" sys-block/nbd
+	optfeature "Support NFS" net-fs/nfs-utils net-nds/rpcbind
+	optfeature \
+		"Install ssh and scp along with config files and specified keys" \
+		virtual/openssh
+	optfeature "Enable logging with rsyslog" app-admin/rsyslog
+	optfeature "Support Squashfs" sys-fs/squashfs-tools
+	optfeature "Support TPM 2.0 TSS" app-crypt/tpm2-tools
+	optfeature "Support Bluetooth (experimental)" net-wireless/bluez
+	optfeature "Support BIOS-given device names" sys-apps/biosdevname
+	optfeature "Support network NVMe" sys-apps/nvme-cli app-misc/jq
+	optfeature \
+		"Enable rngd service to help generating entropy early during boot" \
+		sys-apps/rng-tools
+	optfeature "building Unified Kernel Images with dracut (--uefi)" \
+		"sys-apps/systemd[boot]" "sys-apps/systemd-utils[boot]"
+	optfeature "automatically generating an initramfs on each kernel installation" \
+		"sys-kernel/installkernel[dracut]"
+	optfeature "automatically generating an UKI on each kernel installation" \
+		"sys-kernel/installkernel[dracut,uki]"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
index a9a2d38f294..624115e9cc8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/dracut-ng/dracut-ng"
 else
 	if [[ "${PV}" != *_rc* ]]; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 	fi
 	SRC_URI="https://github.com/dracut-ng/dracut-ng/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${PN}-ng-${PV}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-107-hostonly-regression-fix-1322.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-107-hostonly-regression-fix-1322.patch
new file mode 100644
index 00000000000..a8134df240d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-107-hostonly-regression-fix-1322.patch
@@ -0,0 +1,22 @@
+https://github.com/dracut-ng/dracut-ng/pull/1322
+diff --git a/modules.d/90kernel-modules/module-setup.sh b/modules.d/90kernel-modules/module-setup.sh
+index 840c4fd8a..df362ceff 100755
+--- a/modules.d/90kernel-modules/module-setup.sh
++++ b/modules.d/90kernel-modules/module-setup.sh
+@@ -122,11 +122,11 @@ installkernel() {
+ 
+         # if not on strict hostonly mode, install all known filesystems,
+         # if the required list is not set via the filesystems variable
+-        if [[ $hostonly_mode != "strict" ]]; then
+-            if [[ -z $filesystems ]]; then
+-                dracut_instmods -o -P ".*/(kernel/fs/nfs|kernel/fs/nfsd|kernel/fs/lockd)/.*" '=fs'
+-            fi
+-        elif [[ "${host_fs_types[*]}" ]]; then
++        if [[ $hostonly_mode != "strict" ]] && [[ -z $filesystems ]]; then
++            dracut_instmods -o -P ".*/(kernel/fs/nfs|kernel/fs/nfsd|kernel/fs/lockd)/.*" '=fs'
++        fi
++
++        if [[ $hostonly ]] && [[ "${host_fs_types[*]}" ]]; then
+             hostonly='' instmods "${host_fs_types[@]}"
+         fi
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
index 5f7d3dbdec9..d28c78db2d1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
@@ -19,4 +19,5 @@ DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
 DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
+DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.34-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.34-r2.ebuild
index 952c057bfa8..882117b11ce 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.34-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.34-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -56,7 +56,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.35.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.35.2.ebuild
index c4443d6f5e5..709f40573fa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.35.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.35.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -58,7 +58,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.36.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.36.1-r2.ebuild
index ed7215c3e33..8d04ed6e444 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.36.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.36.1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -56,7 +56,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.37_p1-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.37_p1-r2.ebuild
index 2434f02290e..cd7c5ac7f0c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.37_p1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.37_p1-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -57,7 +57,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.38-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.38-r2.ebuild
index 95b5e398f89..acfc709fe29 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.38-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.38-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -71,7 +71,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
index 143416d9fb8..dde84de0b04 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -71,7 +71,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild
index 9fd6d71b339..02fd1fa9821 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -75,7 +75,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r5.ebuild
index a7571995914..c44eb14ba43 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -77,7 +77,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
index a24ffb52464..4d50f718ec4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.42-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -77,7 +77,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	# Workaround for lld-17 (bug #914640)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.43-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.43-r3.ebuild
index b2251c25ecd..e18eb20b6be 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.43-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.43-r3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -82,7 +82,7 @@ pkgversion() {
 multilib_src_configure() {
 	# https://sourceware.org/PR32372
 	append-cflags -std=gnu17
-
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
new file mode 100644
index 00000000000..6d25065050a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
@@ -0,0 +1,232 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a libtool toolchain-funcs multilib-minimal
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=1
+PATCH_DEV=dilfridge
+
+MY_PN=binutils
+MY_P=${MY_PN}-${PV}
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	SLOT="0/${PV}"
+elif [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SLOT="0/$(ver_cut 1-2)"
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT="0/${PV}"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+fi
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+RESTRICT="!test? ( test )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
+			https://github.com/gentoo/binutils-patches
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		if [[ ${PV} != 9999 ]] ; then
+			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
+		fi
+		EGIT_REPO_URI="
+			https://sourceware.org/git/binutils-gdb.git
+			https://git.sr.ht/~sourceware/binutils-gdb
+			https://gitlab.com/x86-binutils/binutils-gdb.git
+		"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${MY_P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${MY_P}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+}
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# Avoid automagic dependency on (currently prefix) systems
+		# with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_test() {
+	# Without this, the default `src_test` check for the 'check' target
+	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+	emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Provided by dev-debug/gdb instead
+	if [[ ${PV} != 9999 ]] ; then
+		rm "${ED}"/usr/share/info/sframe-spec.info || die
+	fi
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r2.ebuild
new file mode 100644
index 00000000000..68778c83c83
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r2.ebuild
@@ -0,0 +1,232 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a libtool toolchain-funcs multilib-minimal
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=4
+PATCH_DEV=dilfridge
+
+MY_PN=binutils
+MY_P=${MY_PN}-${PV}
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	SLOT="0/${PV}"
+elif [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SLOT="0/$(ver_cut 1-2)"
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT="0/${PV}"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+fi
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+RESTRICT="!test? ( test )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
+			https://github.com/gentoo/binutils-patches
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		if [[ ${PV} != 9999 ]] ; then
+			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
+		fi
+		EGIT_REPO_URI="
+			https://sourceware.org/git/binutils-gdb.git
+			https://git.sr.ht/~sourceware/binutils-gdb
+			https://gitlab.com/x86-binutils/binutils-gdb.git
+		"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${MY_P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${MY_P}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+}
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# Avoid automagic dependency on (currently prefix) systems
+		# with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_test() {
+	# Without this, the default `src_test` check for the 'check' target
+	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+	emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Provided by dev-debug/gdb instead
+	if [[ ${PV} != 9999 ]] ; then
+		rm "${ED}"/usr/share/info/sframe-spec.info || die
+	fi
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
index 1f0481a9ef4..3265100b04c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
@@ -129,6 +129,7 @@ pkgversion() {
 }
 
 multilib_src_configure() {
+	# bug #814326
 	filter-lto
 
 	local myconf=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
index 6b4dbbfd697..bf7a24d748c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-9999.ebuild
@@ -1,9 +1,9 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit flag-o-matic libtool toolchain-funcs multilib-minimal
+inherit dot-a libtool toolchain-funcs multilib-minimal
 
 DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -53,8 +53,6 @@ RDEPEND="${DEPEND}
 
 RESTRICT="!test? ( test )"
 
-MY_BUILDDIR=${WORKDIR}/build
-
 MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/bfd.h
 )
@@ -94,7 +92,6 @@ src_unpack() {
 	fi
 
 	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
 }
 
 src_prepare() {
@@ -128,9 +125,12 @@ pkgversion() {
 	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
 }
 
-multilib_src_configure() {
-	filter-lto
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
 
+multilib_src_configure() {
 	local myconf=(
 		# portage's econf() does not detect presence of --d-d-t
 		# because it greps only top-level ./configure. But not
@@ -168,8 +168,8 @@ multilib_src_configure() {
 		# USE=64-bit-bfd changes data structures of exported API
 		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
 
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
+		# Avoid automagic dependency on (currently prefix) systems
+		# with debuginfod library, bug #754753
 		--without-debuginfod
 
 		# Revisit if it's useful, we do have binutils[zstd] though
@@ -207,6 +207,12 @@ multilib_src_configure() {
 		Makefile || die
 }
 
+multilib_src_test() {
+	# Without this, the default `src_test` check for the 'check' target
+	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+	emake check
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 
@@ -221,4 +227,6 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	use static-libs || find "${ED}"/usr -name '*.la' -delete
+	# Explicit "${ED}" as we need it to do things even w/ USE=-static-libs
+	strip-lto-bytecode "${ED}"
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
index 2c4d0280032..a991431ac21 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
@@ -15,7 +15,7 @@ SRC_URI="
 
 LICENSE="GPL-3"
 SLOT="0/6" # libgdbm.so version
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
index 89f9e828911..2466e38ddde 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
@@ -28,6 +28,7 @@ DIST glibc-2.40-patches-9.tar.xz 187952 BLAKE2B 48aecbdcc9ddc0b1139de1934c26952d
 DIST glibc-2.40.tar.xz 18752204 BLAKE2B 8593cab5b2549b77159b6866fbb40b917e491fd5bc0814f7f85b6529166d78d4583436450c479b86cdfe468304fc4d2a9ba8294230a55dbc4c15e89c3ab6c000 SHA512 33caf91dbfddde6480b7cdf7a68b36aff8c522bfee56160af26af297f1b768668edb08bc4e1a7ff61c64721e3c1d49c347a5dd01c5edd3b914ee6479c8b27885
 DIST glibc-2.41-patches-1.tar.xz 17560 BLAKE2B dc4e39cb5605867b44c2308a8d6d6c0a662656b80a0aa2734f488e2cc22e26c948177eeb80ff6c79d82925b4dbd146a4d78646879c6e32fd60f817fb0d9ae092 SHA512 94da2092e49ee827d7558bcbfa8ebcbb9f81ed68848221d139039ea788cef57375ccfa61498bc73c6e83050681990d3968791a5f90514de12e45c10baef31d1e
 DIST glibc-2.41-patches-2.tar.xz 54320 BLAKE2B cd0779c452159c90adf165da18e61699dc5e53dcfecb44f8e7ddc5bcbb00050705a423a298a57054ddce5daaee728ac03d1e25c71ad5070edf5907ac6eac0783 SHA512 4c74a657faa1cffedc083d061258508f483d25e5f3989d98e61608e245a6e75e5c389fefd0c31e5ccde6926c5173364852957b8d8b83a474842c635d1f7fc1c3
+DIST glibc-2.41-patches-3.tar.xz 71180 BLAKE2B 4e871573c6f223ab8eb48a6f4589d511ea2e7b13b45c2317ba6309c3453b3bcaa9c1d07ebcb6c3ac81a7f2650330b5c4c575a0ea6a1526724cacf6a6aaef9d62 SHA512 89ccc4f382eedb83e0b69d39b7e40f32737eb6ea07351ac599849effb7591d43e266ef43f12afb430a15e3c4df98e512e4b3b5c4c3db2fc34be97f5b309edede
 DIST glibc-2.41.tar.xz 19344868 BLAKE2B 4da62f489ba7a95bb069c2cfea8cf78e4d37e3a5f7e1736239670ba1dca12b69aa77bd00ced078c27d91b1e622c58cbd70258161a9d18c5b3bcc95863b8d744d SHA512 894a3e5a796bc13df30c26a5bfbe4d60b5dbdaac54e7763432235124b547070c7dda88c50584536870cab79183d8cad73a3ac6ed09bfe54fa8482aad07253169
 DIST glibc-systemd-20210729.tar.gz 1480 BLAKE2B 37722c7579df782d890e44dbab99c3de52ab466eb9de80d82405e9bb5620bf39ffc8c5f466a435bdb86ef6d36dd7019c0736573916bda6c67d02a2581e0ec979 SHA512 efd75af58b50522c28cdac7abd1fc56555bc1bb042512c90d8340c1ec09c5791b3872a305bf83723252bbde5855b75d958c041083457765c4cfd170732d09238
 DIST glibc-systemd-20210814.tar.gz 1469 BLAKE2B 10fa7bcb46d4fdce9c0ab353cbd30871e9b09a347a13a9c9a3b5777f931aa3c826c158d2e49532c604d4a834f2fab4089b67495fb88d0398945dc50d45ad9ef1 SHA512 5346a9ea459a1e6ccf665389f2a294de1e16f1e3e05cdf07e3dd99ed0e4f6f8b52cc333d4bff3c75ac90ab6ce70cd4ab2b3e126f920ce7979abd6dda56315efc
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.41-m68k-malign.patch b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.41-m68k-malign.patch
new file mode 100644
index 00000000000..4db3ccd0716
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/files/glibc-2.41-m68k-malign.patch
@@ -0,0 +1,14 @@
+
+Found by Adrian Glaubitz (cbmuser)
+
+diff --git a/sysdeps/m68k/utmp-size.h b/sysdeps/m68k/utmp-size.h
+index 5946685819..8f21ebe1b6 100644
+--- a/sysdeps/m68k/utmp-size.h
++++ b/sysdeps/m68k/utmp-size.h
+@@ -1,3 +1,2 @@
+-/* m68k has 2-byte alignment.  */
+-#define UTMP_SIZE 382
++#define UTMP_SIZE 384
+ #define LASTLOG_SIZE 292
+
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild
new file mode 100644
index 00000000000..25bdeed5154
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r2.ebuild
@@ -0,0 +1,1768 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Bumping notes: https://wiki.gentoo.org/wiki/Project:Toolchain/sys-libs/glibc
+# Please read & adapt the page as necessary if obsolete.
+
+PYTHON_COMPAT=( python3_{10..13} )
+TMPFILES_OPTIONAL=1
+
+EMULTILIB_PKG="true"
+
+# Gentoo patchset (ignored for live ebuilds)
+PATCH_VER=3
+PATCH_DEV=dilfridge
+
+# gcc mulitilib bootstrap files version
+GCC_BOOTSTRAP_VER=20201208
+
+# systemd integration version
+GLIBC_SYSTEMD_VER=20210729
+
+# Minimum kernel version that glibc requires
+MIN_KERN_VER="3.2.0"
+
+# Minimum pax-utils version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_PAX_UTILS_VER="1.3.3"
+
+# Minimum systemd version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_SYSTEMD_VER="254.9-r1"
+
+inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfig \
+	multilib systemd multiprocessing tmpfiles eapi9-ver
+
+DESCRIPTION="GNU libc C library"
+HOMEPAGE="https://www.gnu.org/software/libc/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="mirror://gnu/glibc/${P}.tar.xz"
+	SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz"
+fi
+
+SRC_URI+=" multilib-bootstrap? ( https://dev.gentoo.org/~dilfridge/distfiles/gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz )"
+SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git/snapshot/glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz )"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+SLOT="2.2"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+#
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+# Note [Disable automatic stripping]
+# Disabling automatic stripping for a few reasons:
+# - portage's attempt to strip breaks non-native binaries at least on
+#   arm: bug #697428
+# - portage's attempt to strip libpthread.so.0 breaks gdb thread
+#   enumeration: bug #697910. This is quite subtle:
+#   * gdb uses glibc's libthread_db-1.0.so to enumerate threads.
+#   * libthread_db-1.0.so needs access to libpthread.so.0 local symbols
+#     via 'ps_pglobal_lookup' symbol defined in gdb.
+#   * 'ps_pglobal_lookup' uses '.symtab' section table to resolve all
+#     known symbols in 'libpthread.so.0'. Specifically 'nptl_version'
+#     (unexported) is used to sanity check compatibility before enabling
+#     debugging.
+#     Also see https://sourceware.org/gdb/wiki/FAQ#GDB_does_not_see_any_threads_besides_the_one_in_which_crash_occurred.3B_or_SIGTRAP_kills_my_program_when_I_set_a_breakpoint
+#   * normal 'strip' command trims '.symtab'
+#   Thus our main goal here is to prevent 'libpthread.so.0' from
+#   losing it's '.symtab' entries.
+# - similarly, valgrind requires knowledge about symbols in ld.so:
+#	bug #920753
+# As Gentoo's strip does not allow us to pass less aggressive stripping
+# options and does not check the machine target we strip selectively.
+
+# We need a new-enough binutils/gcc to match upstream baseline.
+# Also we need to make sure our binutils/gcc supports TLS,
+# and that gcc already contains the hardened patches.
+# Lastly, let's avoid some openssh nastiness, bug 708224, as
+# convenience to our users.
+
+IDEPEND="
+	!compile-locales? ( sys-apps/locale-gen )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	sys-devel/bison
+	compile-locales? ( sys-apps/locale-gen )
+	doc? (
+		dev-lang/perl
+		sys-apps/texinfo
+	)
+	test? (
+		dev-lang/perl
+		>=net-dns/libidn2-2.3.0
+		sys-apps/gawk[mpfr]
+	)
+"
+COMMON_DEPEND="
+	gd? ( media-libs/gd:2= )
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-debug/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+"
+RDEPEND="${COMMON_DEPEND}
+	!<app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	!<sys-apps/systemd-${MIN_SYSTEMD_VER}
+	perl? ( dev-lang/perl )
+"
+
+RESTRICT="!test? ( test )"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	BDEPEND+=" !headers-only? (
+		>=${CATEGORY}/binutils-2.27
+		>=${CATEGORY}/gcc-6.2
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	BDEPEND+="
+		>=sys-devel/binutils-2.27
+		>=sys-devel/gcc-6.2
+	"
+	DEPEND+=" virtual/os-headers "
+	RDEPEND+="
+		>=net-dns/libidn2-2.3.0
+		vanilla? ( !sys-libs/timezone-data )
+	"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+# Ignore tests whitelisted below
+GENTOO_GLIBC_XFAIL_TESTS="${GENTOO_GLIBC_XFAIL_TESTS:-yes}"
+
+# The following tests fail due to the Gentoo build system and are thus
+# executed but ignored:
+XFAIL_TEST_LIST=(
+	# buggy test, assumes /dev/ and /dev/null on a single filesystem
+	# 'mount --bind /dev/null /chroot/dev/null' breaks it.
+	# https://sourceware.org/PR25909
+	tst-support_descriptors
+
+	# The following tests fail only inside portage
+	# https://bugs.gentoo.org/831267
+	tst-system
+	tst-strerror
+	tst-strsignal
+
+	# Fails with certain PORTAGE_NICENESS/PORTAGE_SCHEDULING_POLICY
+	tst-sched1
+	tst-sched_setattr
+
+	# Fails regularly, unreliable
+	tst-valgrind-smoke
+
+	# https://sourceware.org/bugzilla/show_bug.cgi?id=31877 (bug #927973)
+	tst-shstk-legacy-1g
+)
+
+XFAIL_NSPAWN_TEST_LIST=(
+	# These tests need to be adapted to handle EPERM/ENOSYS(?) properly
+	# upstream, as systemd-nspawn's default seccomp whitelist is too strict.
+	# https://sourceware.org/PR30603
+	test-errno-linux
+	tst-aarch64-pkey
+	tst-bz21269
+	tst-mlock2
+	tst-ntp_gettime
+	tst-ntp_gettime-time64
+	tst-ntp_gettimex
+	tst-ntp_gettimex-time64
+	tst-pkey
+	tst-process_mrelease
+	tst-adjtime
+	tst-adjtime-time64
+	tst-clock2
+	tst-clock2-time64
+
+	# These fail if --suppress-sync and/or low priority is set
+	tst-sync_file_range
+	test-errno
+)
+
+#
+# Small helper functions
+#
+
+dump_build_environment() {
+	einfo ==== glibc build environment ========================================================
+	local v
+	for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX CPP LD \
+		{AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM AR AS STRIP RANLIB OBJCOPY \
+		STRINGS OBJDUMP READELF; do
+		einfo " $(printf '%15s' ${v}:)   ${!v}"
+	done
+	einfo =====================================================================================
+}
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+just_headers() {
+	is_crosscompile && use headers-only
+}
+
+alt_prefix() {
+	is_crosscompile && echo /usr/${CTARGET}
+}
+
+# This prefix is applicable to CHOST when building against this
+# glibc. It is baked into the library at configure time.
+host_eprefix() {
+	is_crosscompile || echo "${EPREFIX}"
+}
+
+# This prefix is applicable to CBUILD when building against this
+# glibc. It determines the destination path at install time.
+build_eprefix() {
+	is_crosscompile && echo "${EPREFIX}"
+}
+
+alt_headers() {
+	echo $(alt_prefix)/usr/include
+}
+alt_libdir() {
+	echo $(alt_prefix)/$(get_libdir)
+}
+alt_usrlibdir() {
+	echo $(alt_prefix)/usr/$(get_libdir)
+}
+
+builddir() {
+	echo "${WORKDIR}/build-${ABI}-${CTARGET}-$1"
+}
+
+do_compile_test() {
+	local ret save_cflags=${CFLAGS}
+	CFLAGS+=" $1"
+	shift
+
+	pushd "${T}" >/dev/null
+
+	rm -f glibc-test*
+	printf '%b' "$*" > glibc-test.c
+
+	# We assume CC is already set up.
+	nonfatal emake glibc-test
+	ret=$?
+
+	popd >/dev/null
+
+	CFLAGS=${save_cflags}
+	return ${ret}
+}
+
+do_run_test() {
+	local ret
+
+	if [[ ${MERGE_TYPE} == "binary" ]] ; then
+		# ignore build failures when installing a binary package #324685
+		do_compile_test "" "$@" 2>/dev/null || return 0
+	else
+		ebegin "Performing simple compile test for ABI=${ABI}"
+		if ! do_compile_test "" "$@" ; then
+			ewarn "Simple build failed ... assuming this is desired #324685"
+			eend 1
+			return 0
+		else
+			eend 0
+		fi
+	fi
+
+	pushd "${T}" >/dev/null
+
+	./glibc-test
+	ret=$?
+	rm -f glibc-test*
+
+	popd >/dev/null
+
+	return ${ret}
+}
+
+setup_target_flags() {
+	# This largely mucks with compiler flags.  None of which should matter
+	# when building up just the headers.
+	just_headers && return 0
+
+	case $(tc-arch) in
+		x86)
+			# -march needed for #185404 #199334
+			# TODO: When creating the first glibc cross-compile, this test will
+			# always fail as it does a full link which in turn requires glibc.
+			# Probably also applies when changing multilib profile settings (e.g.
+			# enabling x86 when the profile was amd64-only previously).
+			# We could change main to _start and pass -nostdlib here so that we
+			# only test the gcc code compilation.  Or we could do a compile and
+			# then look for the symbol via scanelf.
+			if ! do_compile_test "" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+				local t=${CTARGET_OPT:-${CTARGET}}
+				t=${t%%-*}
+				filter-flags '-march=*'
+				export CFLAGS="-march=${t} ${CFLAGS}"
+				einfo "Auto adding -march=${t} to CFLAGS #185404"
+			fi
+			# For compatibility with older binaries at slight performance cost.
+			use stack-realign && export CFLAGS+=" -mstackrealign"
+		;;
+		amd64)
+			# -march needed for #185404 #199334
+			# TODO: See cross-compile issues listed above for x86.
+			if [[ ${ABI} == x86 ]]; then
+				if ! do_compile_test "${CFLAGS_x86}" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+					local t=${CTARGET_OPT:-${CTARGET}}
+					t=${t%%-*}
+					# Normally the target is x86_64-xxx, so turn that into the -march that
+					# gcc actually accepts. #528708
+					[[ ${t} == "x86_64" ]] && t="x86-64"
+					filter-flags '-march=*'
+					# ugly, ugly, ugly.  ugly.
+					CFLAGS_x86=$(CFLAGS=${CFLAGS_x86} filter-flags '-march=*'; echo "${CFLAGS}")
+					export CFLAGS_x86="${CFLAGS_x86} -march=${t}"
+					einfo "Auto adding -march=${t} to CFLAGS_x86 #185404 (ABI=${ABI})"
+				fi
+				# For compatibility with older binaries at slight performance cost.
+				use stack-realign && export CFLAGS_x86+=" -mstackrealign"
+			fi
+		;;
+		mips)
+			# The mips abi cannot support the GNU style hashes. #233233
+			filter-ldflags -Wl,--hash-style=gnu -Wl,--hash-style=both
+		;;
+		ppc|ppc64)
+			# Many arch-specific implementations do not work on ppc with
+			# cache-block not equal to 128 bytes. This breaks memset:
+			#   https://sourceware.org/PR26522
+			#   https://bugs.gentoo.org/737996
+			# Use default -mcpu=. For ppc it means non-multiarch setup.
+			filter-flags '-mcpu=*'
+		;;
+		sparc)
+			# Both sparc and sparc64 can use -fcall-used-g6.  -g7 is bad, though.
+			filter-flags "-fcall-used-g7"
+			append-flags "-fcall-used-g6"
+
+			local cpu
+			case ${CTARGET} in
+			sparc64-*)
+				cpu="sparc64"
+				case $(get-flag mcpu) in
+				v9)
+					# We need to force at least v9a because the base build doesn't
+					# work with just v9.
+					# https://sourceware.org/bugzilla/show_bug.cgi?id=19477
+					append-flags "-Wa,-xarch=v9a"
+					;;
+				esac
+				;;
+			sparc-*)
+				case $(get-flag mcpu) in
+				v8|supersparc|hypersparc|leon|leon3)
+					cpu="sparcv8"
+					;;
+				*)
+					cpu="sparcv9"
+					;;
+				esac
+			;;
+			esac
+			[[ -n ${cpu} ]] && CTARGET_OPT="${cpu}-${CTARGET#*-}"
+		;;
+	esac
+}
+
+setup_flags() {
+	# Make sure host make.conf doesn't pollute us
+	if is_crosscompile || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+
+	# Store our CFLAGS because it's changed depending on which CTARGET
+	# we are building when pulling glibc on a multilib profile
+	CFLAGS_BASE=${CFLAGS_BASE-${CFLAGS}}
+	CFLAGS=${CFLAGS_BASE}
+	CXXFLAGS_BASE=${CXXFLAGS_BASE-${CXXFLAGS}}
+	CXXFLAGS=${CXXFLAGS_BASE}
+	ASFLAGS_BASE=${ASFLAGS_BASE-${ASFLAGS}}
+	ASFLAGS=${ASFLAGS_BASE}
+
+	# Allow users to explicitly avoid flag sanitization via
+	# USE=custom-cflags.
+	if ! use custom-cflags; then
+		# Over-zealous CFLAGS can often cause problems.  What may work for one
+		# person may not work for another.  To avoid a large influx of bugs
+		# relating to failed builds, we strip most CFLAGS out to ensure as few
+		# problems as possible.
+		strip-flags
+
+		# Allow -O2 and -O3, but nothing else for now.
+		# TODO: Test -Os, -Oz.
+		if ! is-flagq '-O@(2|3)' ; then
+			# Lock glibc at -O2. We want to be conservative here.
+			filter-flags '-O?'
+			append-flags -O2
+		fi
+	fi
+
+	strip-unsupported-flags
+	filter-lto
+	filter-flags -m32 -m64 '-mabi=*'
+
+	# glibc aborts if rpath is set by LDFLAGS
+	filter-ldflags '-Wl,-rpath=*'
+
+	# ld can't use -r & --relax at the same time, bug #788901
+	# https://sourceware.org/PR27837
+	filter-ldflags '-Wl,--relax'
+
+	# Flag added for cross-prefix, but causes ldconfig to segfault. Not needed
+	# anyway because glibc already handles this by itself.
+	filter-ldflags '-Wl,--dynamic-linker=*'
+
+	# Fails to link (bug #940709) in some cases but even if it manages to,
+	# subtle runtime breakage will occur because the linker scripts need
+	# adaptation. Mentioned in PR21557#c0.
+	filter-ldflags '-Wl,--gc-sections'
+
+	# some weird software relies on sysv hashes in glibc, bug 863863, bug 864100
+	# we have to do that here already so mips can filter it out again :P
+	if use hash-sysv-compat ; then
+		append-ldflags '-Wl,--hash-style=both'
+	fi
+
+	# #492892
+	filter-flags -frecord-gcc-switches
+
+	# #898098
+	filter-flags -fno-builtin
+
+	# #798774
+	filter-flags -fno-semantic-interposition
+
+	# #829583
+	filter-lfs-flags
+
+	unset CBUILD_OPT CTARGET_OPT
+	if use multilib ; then
+		CTARGET_OPT=$(get_abi_CTARGET)
+		[[ -z ${CTARGET_OPT} ]] && CTARGET_OPT=$(get_abi_CHOST)
+	fi
+
+	setup_target_flags
+
+	if [[ -n ${CTARGET_OPT} && ${CBUILD} == ${CHOST} ]] && ! is_crosscompile; then
+		CBUILD_OPT=${CTARGET_OPT}
+	fi
+
+	# glibc's headers disallow -O0 and fail at build time:
+	#  include/libc-symbols.h:75:3: #error "glibc cannot be compiled without optimization"
+	# https://sourceware.org/glibc/wiki/FAQ#Why_do_I_get:.60.23error_.22glibc_cannot_be_compiled_without_optimization.22.27.2C_when_trying_to_compile_GNU_libc_with_GNU_CC.3F
+	replace-flags -O0 -O1
+
+	# Similar issues as with SSP. Can't inject yourself that early.
+	filter-flags '-fsanitize=*'
+
+	# See end of bug #830454; we handle this via USE=cet
+	filter-flags '-fcf-protection=*'
+
+	# When bootstrapping, we may have a situation where
+	# CET-enabled gcc from seed is used to build CET-disabled
+	# glibc. As such, gcc implicitly enables CET if no
+	# -fcf-protection flag is passed. For a typical package it
+	# should not be a problem, but for glibc it matters as it is
+	# dealing with CET in ld.so. So if CET is supposed to be
+	# disabled for glibc, be explicit about it.
+	if ! use cet; then
+		case ${ABI}-${CTARGET} in
+			amd64-x86_64-*|x32-x86_64-*-*-gnux32)
+				append-flags '-fcf-protection=none'
+				;;
+			arm64-aarch64*)
+				append-flags '-mbranch-protection=none'
+				;;
+		esac
+	fi
+}
+
+use_multiarch() {
+	# Allow user to disable runtime arch detection in multilib.
+	use multiarch || return 1
+	# Make sure binutils is new enough to support indirect functions,
+	# #336792. This funky sed supports gold and bfd linkers.
+	local bver nver
+	bver=$($(tc-getLD ${CTARGET}) -v | sed -n -r '1{s:[^0-9]*::;s:^([0-9.]*).*:\1:;p}')
+	case $(tc-arch ${CTARGET}) in
+	amd64|x86) nver="2.20" ;;
+	arm)       nver="2.22" ;;
+	hppa)      nver="2.23" ;;
+	ppc|ppc64) nver="2.20" ;;
+	# ifunc support was added in 2.23, but glibc also needs
+	# machinemode which is in 2.24.
+	s390)      nver="2.24" ;;
+	sparc)     nver="2.21" ;;
+	*)         return 1 ;;
+	esac
+	ver_test ${bver} -ge ${nver}
+}
+
+# Setup toolchain variables that had historically been defined in the
+# profiles for these archs.
+setup_env() {
+	# silly users
+	unset LD_RUN_PATH
+	unset LD_ASSUME_KERNEL
+
+	if is_crosscompile || tc-is-cross-compiler ; then
+		multilib_env ${CTARGET_OPT:-${CTARGET}}
+
+		if ! use multilib ; then
+			MULTILIB_ABIS=${DEFAULT_ABI}
+		else
+			MULTILIB_ABIS=${MULTILIB_ABIS:-${DEFAULT_ABI}}
+		fi
+
+		# If the user has CFLAGS_<CTARGET> in their make.conf, use that,
+		# and fall back on CFLAGS.
+		local VAR=CFLAGS_${CTARGET//[-.]/_}
+		CFLAGS=${!VAR-${CFLAGS}}
+		einfo " $(printf '%15s' 'Manual CFLAGS:')   ${CFLAGS}"
+	fi
+
+	setup_flags
+
+	export ABI=${ABI:-${DEFAULT_ABI:-default}}
+
+	if just_headers ; then
+		# Avoid mixing host's CC and target's CFLAGS_${ABI}:
+		# At this bootstrap stage we have only binutils for
+		# target but not compiler yet.
+		einfo "Skip CC ABI injection. We can't use (cross-)compiler yet."
+		return 0
+	fi
+
+	# glibc does not work with non-bfd (for various reasons):
+	# * gold (bug #269274)
+	# * mold (bug #860900)
+	tc-ld-force-bfd
+
+	if use doc ; then
+		export MAKEINFO=makeinfo
+	else
+		export MAKEINFO=/dev/null
+	fi
+
+	# Reset CC and CXX to the value at start of emerge
+	export CC=${glibc__ORIG_CC:-${CC:-$(tc-getCC ${CTARGET})}}
+	export CXX=${glibc__ORIG_CXX:-${CXX:-$(tc-getCXX ${CTARGET})}}
+	export CPP=${glibc__ORIG_CPP:-${CPP:-$(tc-getCPP ${CTARGET})}}
+
+	# and make sure glibc__ORIG_CC and glibc__ORIG_CXX is defined now.
+	export glibc__ORIG_CC=${CC}
+	export glibc__ORIG_CXX=${CXX}
+	export glibc__ORIG_CPP=${CPP}
+
+	if tc-is-clang && ! use custom-cflags && ! is_crosscompile ; then
+		export glibc__force_gcc=yes
+		# once this is toggled on, it needs to stay on, since with CPP manipulated
+		# tc-is-clang does not work correctly anymore...
+	fi
+
+	if [[ ${glibc__force_gcc} == "yes" ]] ; then
+		# If we are running in an otherwise clang/llvm environment, we need to
+		# recover the proper gcc and binutils settings here, at least until glibc
+		# is finally building with clang. So let's override everything that is
+		# set in the clang profiles.
+		# Want to shoot yourself into the foot? Set USE=custom-cflags, that's always
+		# a good start into that direction.
+		# Also, if you're crosscompiling, let's assume you know what you are doing.
+		# Hopefully.
+		# Last, we need the settings of the *build* environment, not of the
+		# target environment...
+
+		local current_binutils_path=$(env CHOST="${CBUILD}" ROOT="${BROOT}" binutils-config -B "${CTARGET}")
+		local current_gcc_path=$(env ROOT="${BROOT}" gcc-config -B)
+		einfo "Overriding clang configuration, since it won't work here"
+
+		export CC="${current_gcc_path}/${CTARGET}-gcc"
+		export CPP="${current_gcc_path}/${CTARGET}-cpp"
+		export CXX="${current_gcc_path}/${CTARGET}-g++"
+		export LD="${current_binutils_path}/ld.bfd"
+		export AR="${current_binutils_path}/ar"
+		export AS="${current_binutils_path}/as"
+		export NM="${current_binutils_path}/nm"
+		export STRIP="${current_binutils_path}/strip"
+		export RANLIB="${current_binutils_path}/ranlib"
+		export OBJCOPY="${current_binutils_path}/objcopy"
+		export STRINGS="${current_binutils_path}/strings"
+		export OBJDUMP="${current_binutils_path}/objdump"
+		export READELF="${current_binutils_path}/readelf"
+		export ADDR2LINE="${current_binutils_path}/addr2line"
+
+		# do we need to also do flags munging here? yes! at least...
+		filter-flags '-fuse-ld=*'
+		filter-flags '-D_FORTIFY_SOURCE=*'
+
+	else
+
+		# this is the "normal" case
+
+		export CC="$(tc-getCC ${CTARGET})"
+		export CXX="$(tc-getCXX ${CTARGET})"
+		export CPP="$(tc-getCPP ${CTARGET})"
+
+		# Always use tuple-prefixed toolchain. For non-native ABI glibc's configure
+		# can't detect them automatically due to ${CHOST} mismatch and fallbacks
+		# to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup().
+		export NM="$(tc-getNM ${CTARGET})"
+		export READELF="$(tc-getREADELF ${CTARGET})"
+
+	fi
+
+	# We need to export CFLAGS with abi information in them because glibc's
+	# configure script checks CFLAGS for some targets (like mips).  Keep
+	# around the original clean value to avoid appending multiple ABIs on
+	# top of each other. (Why does the comment talk about CFLAGS if the code
+	# acts on CC?)
+	export glibc__GLIBC_CC=${CC}
+	export glibc__GLIBC_CXX=${CXX}
+	export glibc__GLIBC_CPP=${CPP}
+
+	export glibc__abi_CFLAGS="$(get_abi_CFLAGS)"
+
+	# CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760
+	# To build .S (assembly) files with the same ABI-specific flags
+	# upstream currently recommends adding CFLAGS to CC/CXX:
+	#    https://sourceware.org/PR23273
+	# Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS
+	# and breaks multiarch support. See 659030#c3 for an example.
+	# The glibc configure script doesn't properly use LDFLAGS all the time.
+	export CC="${glibc__GLIBC_CC} ${glibc__abi_CFLAGS} ${CFLAGS} ${LDFLAGS}"
+
+	# Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548
+	export CXX="${glibc__GLIBC_CXX} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	export CPP="${glibc__GLIBC_CPP} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	if is_crosscompile; then
+		# Assume worst-case bootstrap: glibc is built for the first time
+		# with ${CTARGET}-g++ not available yet. We avoid
+		# building auxiliary programs that require C++: bug #683074
+		# It should not affect final result.
+		export libc_cv_cxx_link_ok=no
+		# The line above has the same effect. We set CXX explicitly
+		# to make build logs less confusing.
+		export CXX=
+	fi
+}
+
+foreach_abi() {
+	setup_env
+
+	local ret=0
+	local abilist=""
+	if use multilib ; then
+		abilist=$(get_install_abis)
+	else
+		abilist=${DEFAULT_ABI}
+	fi
+	local -x ABI
+	for ABI in ${abilist:-default} ; do
+		setup_env
+		einfo "Running $1 for ABI ${ABI}"
+		$1
+		: $(( ret |= $? ))
+	done
+	return ${ret}
+}
+
+glibc_banner() {
+	local b="Gentoo ${PVR}"
+	[[ -n ${PATCH_VER} ]] && ! use vanilla && b+=" (patchset ${PATCH_VER})"
+	echo "${b}"
+}
+
+# The following Kernel version handling functions are mostly copied from portage
+# source. It's better not to use linux-info.eclass here since a) it adds too
+# much magic, see bug 326693 for some of the arguments, and b) some of the
+# functions are just not provided.
+
+g_get_running_KV() {
+	uname -r
+	return $?
+}
+
+g_KV_major() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	echo "${KV%%.*}"
+}
+
+g_KV_minor() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.}
+	echo "${KV%%.*}"
+}
+
+g_KV_micro() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.*.}
+	echo "${KV%%[^[:digit:]]*}"
+}
+
+g_KV_to_int() {
+	[[ -z $1 ]] && return 1
+	local KV_MAJOR=$(g_KV_major "$1")
+	local KV_MINOR=$(g_KV_minor "$1")
+	local KV_MICRO=$(g_KV_micro "$1")
+	local KV_int=$(( KV_MAJOR * 65536 + KV_MINOR * 256 + KV_MICRO ))
+
+	# We make version 2.2.0 the minimum version we will handle as
+	# a sanity check ... if its less, we fail ...
+	if [[ ${KV_int} -ge 131584 ]] ; then
+		echo "${KV_int}"
+		return 0
+	fi
+	return 1
+}
+
+g_int_to_KV() {
+	local version=$1 major minor micro
+	major=$((version / 65536))
+	minor=$(((version % 65536) / 256))
+	micro=$((version % 256))
+	echo ${major}.${minor}.${micro}
+}
+
+eend_KV() {
+	[[ $(g_KV_to_int $1) -ge $(g_KV_to_int $2) ]]
+	eend $?
+}
+
+get_kheader_version() {
+	printf '#include <linux/version.h>\nLINUX_VERSION_CODE\n' | \
+	$(tc-getCPP ${CTARGET}) -I "${ESYSROOT}$(alt_headers)" - | \
+	tail -n 1
+}
+
+# We collect all sanity checks here. Consistency is not guranteed between
+# pkg_ and src_ phases, so we call this function both in pkg_pretend and in
+# src_unpack.
+sanity_prechecks() {
+	# Prevent native builds from downgrading
+	if [[ ${MERGE_TYPE} != "buildonly" ]] && \
+	   [[ -z ${ROOT} ]] && \
+	   [[ ${CBUILD} == ${CHOST} ]] && \
+	   [[ ${CHOST} == ${CTARGET} ]] ; then
+
+		# The high rev # is to allow people to downgrade between -r#
+		# versions. We want to block 2.20->2.19, but 2.20-r3->2.20-r2
+		# should be fine. Hopefully we never actually use a r# this
+		# high.
+		if has_version ">${CATEGORY}/${P}-r10000" ; then
+			eerror "Sanity check to keep you from breaking your system:"
+			eerror " Downgrading glibc is not supported and a sure way to destruction."
+			[[ ${I_ALLOW_TO_BREAK_MY_SYSTEM} = yes ]] || die "Aborting to save your system."
+		fi
+
+		if ! do_run_test '#include <unistd.h>\n#include <sys/syscall.h>\nint main(){return syscall(1000)!=-1;}\n' ; then
+			eerror "Your old kernel is broken. You need to update it to a newer"
+			eerror "version as syscall(<bignum>) will break. See bug 279260."
+			die "Old and broken kernel."
+		fi
+	fi
+
+	if [[ ${CTARGET} == i386-* ]] ; then
+		eerror "i386 CHOSTs are no longer supported."
+		eerror "Chances are you don't actually want/need i386."
+		eerror "Please read https://www.gentoo.org/doc/en/change-chost.xml"
+		die "Please fix your CHOST"
+	fi
+
+	if [[ -e /proc/xen ]] && [[ $(tc-arch) == "x86" ]] && ! is-flag -mno-tls-direct-seg-refs ; then
+		ewarn "You are using Xen but don't have -mno-tls-direct-seg-refs in your CFLAGS."
+		ewarn "This will result in a 50% performance penalty when running with a 32bit"
+		ewarn "hypervisor, which is probably not what you want."
+	fi
+
+	# ABI-specific checks follow here. Hey, we have a lot more specific conditions that
+	# we test for...
+	if ! is_crosscompile ; then
+		if use amd64 && use multilib && [[ ${MERGE_TYPE} != "binary" ]] ; then
+			ebegin "Checking if the system can execute 32-bit binaries"
+			echo 'int main(){return 0;}' > "${T}/check-ia32-emulation.c"
+			local STAT
+			if ${CC-${CHOST}-gcc} ${CFLAGS_x86} "${T}/check-ia32-emulation.c" -o "${T}/check-ia32-emulation.elf32"; then
+				"${T}/check-ia32-emulation.elf32"
+				STAT=$?
+			else
+				# Don't fail here to allow single->multi ABI switch
+				# or recover from breakage like bug #646424
+				ewarn "Failed to compile the ABI test. Broken host glibc?"
+				STAT=0
+			fi
+			rm -f "${T}/check-ia32-emulation.elf32"
+			eend $STAT
+			if [[ $STAT -ne 0 ]]; then
+				eerror "Ensure that CONFIG_IA32_EMULATION is enabled in the kernel."
+				eerror "Seek support otherwise."
+				die "Unable to execute 32-bit binaries"
+			fi
+		fi
+
+	fi
+
+	# When we actually have to compile something...
+	if ! just_headers && [[ ${MERGE_TYPE} != "binary" ]] ; then
+		if [[ -d "${ESYSROOT}"/usr/lib/include ]] ; then
+			# bug #833620, bug #643302
+			eerror "Found ${ESYSROOT}/usr/lib/include directory!"
+			eerror "This is known to break glibc's build."
+			eerror "Please backup its contents then remove the directory."
+			die "Found directory (${ESYSROOT}/usr/lib/include) which will break build (bug #833620)!"
+		fi
+
+		if [[ ${CTARGET} == *-linux* ]] ; then
+			local run_kv build_kv want_kv
+
+			run_kv=$(g_get_running_KV)
+			build_kv=$(g_int_to_KV $(get_kheader_version))
+			want_kv=${MIN_KERN_VER}
+
+			if ! is_crosscompile && ! tc-is-cross-compiler ; then
+				# Building fails on an non-supporting kernel
+				ebegin "Checking running kernel version (${run_kv} >= ${want_kv})"
+				if ! eend_KV ${run_kv} ${want_kv} ; then
+					echo
+					eerror "You need a kernel of at least ${want_kv}!"
+					die "Kernel version too low!"
+				fi
+			fi
+
+			# Do not run this check for pkg_pretend, just pkg_setup and friends (if we ever get used there).
+			# It's plausible (seen it in the wild) that Portage will (correctly) schedule a linux-headers
+			# upgrade before glibc, but because pkg_pretend gets run before any packages are merged at all (not
+			# just glibc), the whole emerge gets aborted without a good reason. We probably don't
+			# need to run this check at all given we have a dependency on the right headers,
+			# but let's leave it as-is for now.
+			if [[ ${EBUILD_PHASE_FUNC} != pkg_pretend ]] ; then
+				ebegin "Checking linux-headers version (${build_kv} >= ${want_kv})"
+				if ! eend_KV ${build_kv} ${want_kv} ; then
+					echo
+					eerror "You need linux-headers of at least ${want_kv}!"
+					die "linux-headers version too low!"
+				fi
+			fi
+		fi
+	fi
+}
+
+upgrade_warning() {
+	is_crosscompile && return
+
+	if [[ ${MERGE_TYPE} != buildonly && -n ${REPLACING_VERSIONS} && -z ${ROOT} ]]; then
+		if ver_replacing -lt $(ver_cut 1-2 ${PV}); then
+			ewarn "After upgrading glibc, please restart all running processes."
+			ewarn "Be sure to include init (telinit u) or systemd (systemctl daemon-reexec)."
+			ewarn "Alternatively, reboot your system."
+			ewarn "(See bug #660556, bug #741116, bug #823756, etc)"
+		fi
+	fi
+}
+
+#
+# the phases
+#
+
+# pkg_pretend
+
+pkg_pretend() {
+	upgrade_warning
+}
+
+# pkg_setup
+
+pkg_setup() {
+	# see bug 682570
+	[[ -z ${BOOTSTRAP_RAP} ]] && python-any-r1_pkg_setup
+}
+
+# src_unpack
+
+src_unpack() {
+	setup_env
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
+
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
+			https://github.com/gentoo/glibc-patches.git
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patches || die
+		EGIT_REPO_URI="
+			https://sourceware.org/git/glibc.git
+			https://git.sr.ht/~sourceware/glibc
+			https://gitlab.com/x86-glibc/glibc.git
+		"
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack glibc-${PV}-patches-${PATCH_VER}.tar.xz
+	fi
+
+	cd "${WORKDIR}" || die
+	use systemd && unpack glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz
+}
+
+# src_prepare
+
+src_prepare() {
+	local patchsetname
+	if ! use vanilla ; then
+		if [[ ${PV} == 9999* ]] ; then
+			patchsetname="from git master"
+		else
+			patchsetname="${PV}-${PATCH_VER}"
+		fi
+		einfo "Applying Gentoo Glibc patchset ${patchsetname}"
+		eapply "${WORKDIR}"/patches
+		einfo "Done."
+	fi
+
+        case ${CTARGET} in
+                m68*-aligned-*)
+			einfo "Applying utmp format fix for m68k with -maligned-int"
+			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
+			;;
+                *)
+			;;
+        esac
+
+	default
+
+	gnuconfig_update
+
+	cd "${WORKDIR}" || die
+	find . -name configure -exec touch {} +
+
+	# Fix permissions on some of the scripts.
+	chmod u+x "${S}"/scripts/*.sh
+
+	cd "${S}" || die
+}
+
+# src_configure
+
+glibc_do_configure() {
+	dump_build_environment
+
+	local myconf=()
+
+	# Use '=strong' instead of '=all' to protect only functions
+	# worth protecting from stack smashes.
+	myconf+=( --enable-stack-protector=$(usex ssp strong no) )
+
+	# Keep a whitelist of targets supporting IFUNC. glibc's ./configure
+	# is not robust enough to detect proper support:
+	#    https://bugs.gentoo.org/641216
+	#    https://sourceware.org/PR22634#c0
+	case $(tc-arch ${CTARGET}) in
+		# Keep whitelist of targets where autodetection mostly works.
+		amd64|x86|sparc|ppc|ppc64|arm|arm64|s390|riscv|loong) ;;
+		# Blacklist everywhere else
+		*) myconf+=( libc_cv_ld_gnu_indirect_function=no ) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|x32-x86_64-*-*-gnux32) myconf+=( $(use_enable cet) ) ;;
+		*) ;;
+	esac
+
+	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
+
+	myconf+=( --enable-kernel=${MIN_KERN_VER} )
+
+	# Since SELinux support is only required for nscd, only enable it if:
+	# 1. USE selinux
+	# 2. only for the primary ABI on multilib systems
+	# 3. Not a crosscompile
+	if ! is_crosscompile && use selinux ; then
+		if use multilib ; then
+			if is_final_abi ; then
+				myconf+=( --with-selinux )
+			else
+				myconf+=( --without-selinux )
+			fi
+		else
+			myconf+=( --with-selinux )
+		fi
+	else
+		myconf+=( --without-selinux )
+	fi
+
+	# Force a few tests where we always know the answer but
+	# configure is incapable of finding it.
+	if is_crosscompile ; then
+		export \
+			libc_cv_c_cleanup=yes \
+			libc_cv_forced_unwind=yes
+	fi
+
+	myconf+=(
+		--disable-werror
+		--enable-bind-now
+		--enable-fortify-source
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		$(use_enable profile)
+		$(use_with gd)
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		--sysconfdir="$(host_eprefix)/etc"
+		--localstatedir="$(host_eprefix)/var"
+		--libdir='$(prefix)'/$(get_libdir)
+		--mandir='$(prefix)'/share/man
+		--infodir='$(prefix)'/share/info
+		--libexecdir='$(libdir)'/misc/glibc
+		--with-bugurl=https://bugs.gentoo.org/
+		--with-pkgversion="$(glibc_banner)"
+		$(use_multiarch || echo --disable-multi-arch)
+		$(use_enable systemtap)
+		$(use_enable nscd)
+
+		# /usr/bin/mtrace has a Perl shebang. Gentoo Prefix QA checks fail if
+		# Perl hasn't been installed inside the prefix yet and configure picks
+		# up a Perl from outside the prefix instead. configure will fail to
+		# execute Perl during configure if we're cross-compiling a prefix, but
+		# it will just disable mtrace in that case.
+		# Note: mtrace is needed by the test suite.
+		ac_cv_path_PERL="$(usex perl "${EPREFIX}"/usr/bin/perl $(usex test "${EPREFIX}"/usr/bin/perl $(usex doc "${EPREFIX}"/usr/bin/perl no)))"
+
+		# locale data is arch-independent
+		# https://bugs.gentoo.org/753740
+		libc_cv_complocaledir='${exec_prefix}/lib/locale'
+
+		# On aarch64 there is no way to override -mcpu=native, and if
+		# the current cpu does not support SVE configure fails.
+		# Let's boldly assume our toolchain can always build SVE instructions.
+		libc_cv_aarch64_sve_asm=yes
+
+		${EXTRA_ECONF}
+	)
+
+	# We rely on sys-libs/timezone-data for timezone tools normally.
+	myconf+=( $(use_enable vanilla timezone-tools) )
+
+	# These libs don't have configure flags.
+	ac_cv_lib_audit_audit_log_user_avc_message=$(usex audit || echo no)
+	ac_cv_lib_cap_cap_init=$(usex caps || echo no)
+
+	# There is no configure option for this and we need to export it
+	# since the glibc build will re-run configure on itself
+	export libc_cv_rootsbindir="$(host_eprefix)/sbin"
+	export libc_cv_slibdir="$(host_eprefix)/$(get_libdir)"
+
+	local builddir=$(builddir nptl)
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+	set -- "${S}"/configure "${myconf[@]}"
+	echo "$@"
+	"$@" || die "failed to configure glibc"
+
+	# If we're trying to migrate between ABI sets, we need
+	# to lie and use a local copy of gcc.  Like if the system
+	# is built with MULTILIB_ABIS="amd64 x86" but we want to
+	# add x32 to it, gcc/glibc don't yet support x32.
+	#
+	if [[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib-bootstrap ; then
+		echo 'int main(void){}' > "${T}"/test.c || die
+		if ! $(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS} "${T}"/test.c -Wl,-emain -lgcc 2>/dev/null ; then
+			sed -i -e '/^CC = /s:$: -B$(objdir)/../'"gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}/${ABI}:" config.make || die
+		fi
+	fi
+}
+
+glibc_headers_configure() {
+	export ABI=default
+
+	local builddir=$(builddir "headers")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+
+	# if we don't have a compiler yet, we can't really test it now ...
+	# hopefully they don't affect header generation, so let's hope for
+	# the best here ...
+	local v vars=(
+		ac_cv_header_cpuid_h=yes
+		libc_cv_{386,390,alpha,arm,hppa,mips,{powerpc,sparc}{,32,64},sh,x86_64}_tls=yes
+		libc_cv_asm_cfi_directives=yes
+		libc_cv_broken_visibility_attribute=no
+		libc_cv_c_cleanup=yes
+		libc_cv_compiler_powerpc64le_binary128_ok=yes
+		libc_cv_forced_unwind=yes
+		libc_cv_gcc___thread=yes
+		libc_cv_mlong_double_128=yes
+		libc_cv_mlong_double_128ibm=yes
+		libc_cv_ppc_machine=yes
+		libc_cv_ppc_rel16=yes
+		libc_cv_predef_fortify_source=no
+		libc_cv_target_power8_ok=yes
+		libc_cv_visibility_attribute=yes
+		libc_cv_z_combreloc=yes
+		libc_cv_z_execstack=yes
+		libc_cv_z_initfirst=yes
+		libc_cv_z_nodelete=yes
+		libc_cv_z_nodlopen=yes
+		libc_cv_z_relro=yes
+		libc_mips_abi=${ABI}
+		libc_mips_float=$([[ $(tc-is-softfloat) == "yes" ]] && echo soft || echo hard)
+		# These libs don't have configure flags.
+		ac_cv_lib_audit_audit_log_user_avc_message=no
+		ac_cv_lib_cap_cap_init=no
+	)
+
+	einfo "Forcing cached settings:"
+	for v in "${vars[@]}" ; do
+		einfo " ${v}"
+		export ${v}
+	done
+
+	local headers_only_arch_CPPFLAGS=()
+
+	# Blow away some random CC settings that screw things up. #550192
+	if [[ -d ${S}/sysdeps/mips ]]; then
+		pushd "${S}"/sysdeps/mips >/dev/null
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=32:' mips32/Makefile mips64/n32/Makefile || die
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=64:' mips64/n64/Makefile || die
+
+		# Force the mips ABI to the default.  This is OK because the set of
+		# installed headers in this phase is the same between the 3 ABIs.
+		# If this ever changes, this hack will break, but that's unlikely
+		# as glibc discourages that behavior.
+		# https://crbug.com/647033
+		sed -i -e 's:abiflag=.*:abiflag=_ABIO32:' preconfigure || die
+
+		popd >/dev/null
+	fi
+
+	local myconf=()
+
+	case ${CTARGET} in
+	aarch64*)
+		# The configure checks fail during cross-build, so disable here
+		# for headers-only
+		myconf+=(
+			--disable-mathvec
+		) ;;
+	riscv*)
+		# RISC-V interrogates the compiler to determine which target to
+		# build.  If building the headers then we don't strictly need a
+		# RISC-V compiler, so the built-in definitions that are provided
+		# along with all RISC-V compiler might not exist.  This causes
+		# glibc's RISC-V preconfigure script to blow up.  Since we're just
+		# building the headers any value will actually work here, so just
+		# pick the standard one (rv64g/lp64d) to make the build scripts
+		# happy for now -- the headers are all the same anyway so it
+		# doesn't matter.
+		headers_only_arch_CPPFLAGS+=(
+			-D__riscv_xlen=64
+			-D__riscv_flen=64
+			-D__riscv_float_abi_double=1
+			-D__riscv_atomic=1
+		) ;;
+	esac
+
+	myconf+=(
+		--disable-sanity-checks
+		--enable-hacker-mode
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		${EXTRA_ECONF}
+	)
+
+	# Nothing is compiled here which would affect the headers for the target.
+	# So forcing CC/CFLAGS is sane.
+	local headers_only_CC=$(tc-getBUILD_CC)
+	local headers_only_CFLAGS="-O1 -pipe"
+	local headers_only_CPPFLAGS="-U_FORTIFY_SOURCE ${headers_only_arch_CPPFLAGS[*]}"
+	local headers_only_LDFLAGS=""
+	set -- "${S}"/configure "${myconf[@]}"
+	echo \
+		"CC=${headers_only_CC}" \
+		"CFLAGS=${headers_only_CFLAGS}" \
+		"CPPFLAGS=${headers_only_CPPFLAGS}" \
+		"LDFLAGS=${headers_only_LDFLAGS}" \
+		"$@"
+	CC=${headers_only_CC} \
+	CFLAGS=${headers_only_CFLAGS} \
+	CPPFLAGS=${headers_only_CPPFLAGS} \
+	LDFLAGS="" \
+	"$@" || die "failed to configure glibc"
+}
+
+do_src_configure() {
+	if just_headers ; then
+		glibc_headers_configure
+	else
+		glibc_do_configure nptl
+	fi
+}
+
+src_configure() {
+	foreach_abi do_src_configure
+}
+
+# src_compile
+
+do_src_compile() {
+	emake -C "$(builddir nptl)"
+}
+
+src_compile() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi do_src_compile
+}
+
+# src_test
+
+glibc_src_test() {
+	cd "$(builddir nptl)"
+
+	local myxfailparams=""
+	if [[ "${GENTOO_GLIBC_XFAIL_TESTS}" == "yes" ]] ; then
+		local virt=$(systemd-detect-virt 2>/dev/null)
+		if [[ ${virt} == systemd-nspawn ]] ; then
+			ewarn "Skipping extra tests because in systemd-nspawn container"
+			XFAIL_TEST_LIST+=( "${XFAIL_NSPAWN_TEST_LIST[@]}" )
+		fi
+		if [[ "$(nice)" == "19" ]] ; then
+			# Expects to be able to increase niceness, which it can't do if
+			# already at the highest nice value
+			XFAIL_TEST_LIST+=( "tst-nice" )
+		fi
+
+		for myt in ${XFAIL_TEST_LIST[@]} ; do
+			myxfailparams+="test-xfail-${myt}=yes "
+		done
+	fi
+
+	# sandbox does not understand unshare() and prevents
+	# writes to /proc/, which makes many tests fail
+
+	# we give the tests a bit more time to avoid spurious
+	# bug reports on slow arches
+
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 emake ${myxfailparams} check
+}
+
+src_test() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi glibc_src_test || die "tests failed"
+}
+
+# src_install
+
+run_locale_gen() {
+	# if the host locales.gen contains no entries, we'll install everything
+	local root="$1"
+	local inplace=""
+
+	if [[ "${root}" == "--inplace-glibc" ]] ; then
+		inplace="--inplace-glibc"
+		root="$2"
+	fi
+
+	local locale_list="${root%/}/etc/locale.gen"
+
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
+		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
+		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	fi
+
+	# bug 736794: we need to be careful with the parallelization... the number of
+	# processors saved in the environment of a binary package may differ strongly
+	# from the number of processes available during postinst
+	local mygenjobs="$(makeopts_jobs)"
+	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
+		mygenjobs="$(nproc)"
+	fi
+
+	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
+		--destdir "${root}"
+	echo "$@"
+	"$@"
+
+	popd >/dev/null
+}
+
+glibc_do_src_install() {
+	local builddir=$(builddir nptl)
+	cd "${builddir}"
+
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install
+
+	# This version (2.26) provides some compatibility libraries for the NIS/NIS+ support
+	# which come without headers etc. Only needed for binary packages since the
+	# external net-libs/libnsl has increased soversion. Keep only versioned libraries.
+	find "${D}" -name "libnsl.a" -delete
+	find "${D}" -name "libnsl.so" -delete
+
+	# Normally upstream_pv is ${PV}. Live ebuilds are exception, there we need
+	# to infer upstream version:
+	# '#define VERSION "2.26.90"' -> '2.26.90'
+	local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h)
+
+	# Avoid stripping binaries not targeted by ${CHOST}. Or else
+	# ${CHOST}-strip would break binaries build for ${CTARGET}.
+	is_crosscompile && dostrip -x /
+
+	# gdb thread introspection relies on local libpthreads symbols. stripping breaks it
+	# See Note [Disable automatic stripping]
+	dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so
+	# valgrind requires knowledge about ld.so symbols.
+	dostrip -x $(alt_libdir)/ld-*.so*
+
+	if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then
+		# Move versioned .a file out of libdir to evade portage QA checks
+		# instead of using gen_usr_ldscript(). We fix ldscript as:
+		# "GROUP ( /usr/lib64/libm-<pv>.a ..." -> "GROUP ( /usr/lib64/glibc-<pv>/libm-<pv>.a ..."
+		sed -i "s@\(libm-${upstream_pv}.a\)@${P}/\1@" \
+			"${ED}"/$(alt_usrlibdir)/libm.a || die
+		dodir $(alt_usrlibdir)/${P}
+		mv "${ED}"/$(alt_usrlibdir)/libm-${upstream_pv}.a \
+			"${ED}"/$(alt_usrlibdir)/${P}/libm-${upstream_pv}.a || die
+	fi
+
+	# We configure toolchains for standalone prefix systems with a sysroot,
+	# which is prepended to paths in ld scripts, so strip the prefix from these.
+	# Before: GROUP ( /foo/lib64/libc.so.6 /foo/usr/lib64/libc_nonshared.a  AS_NEEDED ( /foo/lib64/ld-linux-x86-64.so.2 ) )
+	# After: GROUP ( /lib64/libc.so.6 /usr/lib64/libc_nonshared.a  AS_NEEDED ( /lib64/ld-linux-x86-64.so.2 ) )
+	if [[ -n $(host_eprefix) ]] ; then
+		local file
+		grep -lZIF "ld script" "${ED}/$(alt_usrlibdir)"/lib*.{a,so} 2>/dev/null | while read -rd '' file ; do
+			sed -i "s|$(host_eprefix)/|/|g" "${file}" || die
+		done
+	fi
+
+	# We'll take care of the cache ourselves
+	rm -f "${ED}"/etc/ld.so.cache
+
+	# Everything past this point just needs to be done once ...
+	is_final_abi || return 0
+
+	# Make sure the non-native interp can be found on multilib systems even
+	# if the main library set isn't installed into the right place.  Maybe
+	# we should query the active gcc for info instead of hardcoding it ?
+	local i ldso_abi ldso_name
+	local ldso_abi_list=(
+		# x86
+		amd64   /lib64/ld-linux-x86-64.so.2
+		x32     /libx32/ld-linux-x32.so.2
+		x86     /lib/ld-linux.so.2
+		# mips
+		o32     /lib/ld.so.1
+		n32     /lib32/ld.so.1
+		n64     /lib64/ld.so.1
+		# powerpc
+		ppc     /lib/ld.so.1
+		# riscv
+		ilp32d  /lib/ld-linux-riscv32-ilp32d.so.1
+		ilp32   /lib/ld-linux-riscv32-ilp32.so.1
+		lp64d   /lib/ld-linux-riscv64-lp64d.so.1
+		lp64    /lib/ld-linux-riscv64-lp64.so.1
+		# s390
+		s390    /lib/ld.so.1
+		s390x   /lib/ld64.so.1
+		# sparc
+		sparc32 /lib/ld-linux.so.2
+		sparc64 /lib64/ld-linux.so.2
+	)
+	case $(tc-endian) in
+	little)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64.so.1
+			# ELFv2 (glibc does not support ELFv1 on LE)
+			ppc64   /lib64/ld64.so.2
+		)
+		;;
+	big)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64_be.so.1
+			# ELFv1 (glibc does not support ELFv2 on BE)
+			ppc64   /lib64/ld64.so.1
+		)
+		;;
+	esac
+	if [[ ${SYMLINK_LIB} == "yes" ]] && [[ ! -e ${ED}/$(alt_prefix)/lib ]] ; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) $(alt_prefix)/lib
+	fi
+	for (( i = 0; i < ${#ldso_abi_list[@]}; i += 2 )) ; do
+		ldso_abi=${ldso_abi_list[i]}
+		has ${ldso_abi} $(get_install_abis) || continue
+
+		ldso_name="$(alt_prefix)${ldso_abi_list[i+1]}"
+		if [[ ! -L ${ED}/${ldso_name} && ! -e ${ED}/${ldso_name} ]] ; then
+			dosym ../$(get_abi_LIBDIR ${ldso_abi})/${ldso_name##*/} ${ldso_name}
+		fi
+	done
+
+	# In the LSB 5.0 definition, someone had the excellent idea to "standardize"
+	# the runtime loader name, see also https://xkcd.com/927/
+	# Normally, in Gentoo one should never come across executables that require this.
+	# However, binary commercial packages are known to adhere to weird practices.
+	# https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-AMD64/LSB-Core-AMD64.html#BASELIB
+	local lsb_ldso_name native_ldso_name lsb_ldso_abi
+	local lsb_ldso_abi_list=(
+		# x86
+		amd64	ld-linux-x86-64.so.2	ld-lsb-x86-64.so.3
+	)
+	for (( i = 0; i < ${#lsb_ldso_abi_list[@]}; i += 3 )) ; do
+		lsb_ldso_abi=${lsb_ldso_abi_list[i]}
+		native_ldso_name=${lsb_ldso_abi_list[i+1]}
+		lsb_ldso_name=${lsb_ldso_abi_list[i+2]}
+		has ${lsb_ldso_abi} $(get_install_abis) || continue
+
+		if [[ ! -L ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} && ! -e ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} ]] ; then
+			dosym ${native_ldso_name} "$(alt_prefix)/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name}"
+		fi
+	done
+
+	# With devpts under Linux mounted properly, we do not need the pt_chown
+	# binary to be setuid.  This is because the default owners/perms will be
+	# exactly what we want.
+	if ! use suid ; then
+		find "${ED}" -name pt_chown -exec chmod -s {} +
+	fi
+
+	#################################################################
+	# EVERYTHING AFTER THIS POINT IS FOR NATIVE GLIBC INSTALLS ONLY #
+	#################################################################
+
+	# Make sure we install some symlink hacks so that when we build
+	# a 2nd stage cross-compiler, gcc finds the target system
+	# headers correctly.  See gcc/doc/gccinstall.info
+	if is_crosscompile ; then
+		# We need to make sure that /lib and /usr/lib always exists.
+		# gcc likes to use relative paths to get to its multilibs like
+		# /usr/lib/../lib64/.  So while we don't install any files into
+		# /usr/lib/, we do need it to exist.
+		keepdir $(alt_prefix)/lib
+		keepdir $(alt_prefix)/usr/lib
+
+		dosym usr/include $(alt_prefix)/sys-include
+		return 0
+	fi
+
+	# Files for Debian-style locale updating
+	dodir /usr/share/i18n
+	sed \
+		-e "/^#/d" \
+		-e "/SUPPORTED-LOCALES=/d" \
+		-e "s: \\\\::g" -e "s:/: :g" \
+		"${S}"/localedata/SUPPORTED > "${ED}"/usr/share/i18n/SUPPORTED \
+		|| die "generating /usr/share/i18n/SUPPORTED failed"
+
+	cd "${S}" || die
+
+	# Install misc network config files
+	insinto /etc
+	doins posix/gai.conf
+
+	if use systemd ; then
+		doins "${WORKDIR}/glibc-systemd-${GLIBC_SYSTEMD_VER}/gentoo-config/nsswitch.conf"
+	else
+		doins nss/nsswitch.conf
+	fi
+
+	# Gentoo-specific
+	newins "${FILESDIR}"/host.conf-1 host.conf
+
+	if use nscd ; then
+		doins nscd/nscd.conf
+
+		newinitd "$(prefixify_ro "${FILESDIR}"/nscd-1)" nscd
+
+		local nscd_args=(
+			-e "s:@PIDFILE@:$(strings "${ED}"/usr/sbin/nscd | grep nscd.pid):"
+		)
+
+		sed -i "${nscd_args[@]}" "${ED}"/etc/init.d/nscd
+
+		use systemd && systemd_dounit nscd/nscd.service
+		newtmpfiles nscd/nscd.tmpfiles nscd.conf
+	fi
+
+	echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00glibc
+	doenvd "${T}"/00glibc
+
+	for d in BUGS ChangeLog CONFORMANCE FAQ NEWS NOTES PROJECTS README* ; do
+		[[ -s ${d} ]] && dodoc ${d}
+	done
+	dodoc -r ChangeLog.old
+
+	# Prevent overwriting of the /etc/localtime symlink.  We'll handle the
+	# creation of the "factory" symlink in pkg_postinst().
+	rm -f "${ED}"/etc/localtime
+
+	# Generate all locales if this is a native build as locale generation
+	if use compile-locales && ! is_crosscompile ; then
+		run_locale_gen --inplace-glibc "${ED}/"
+	fi
+}
+
+glibc_headers_install() {
+	local builddir=$(builddir "headers")
+	cd "${builddir}"
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install-headers
+
+	insinto $(alt_headers)/gnu
+	doins "${S}"/include/gnu/stubs.h
+
+	# Make sure we install the sys-include symlink so that when
+	# we build a 2nd stage cross-compiler, gcc finds the target
+	# system headers correctly.  See gcc/doc/gccinstall.info
+	dosym usr/include $(alt_prefix)/sys-include
+}
+
+src_install() {
+	if just_headers ; then
+		export ABI=default
+		glibc_headers_install
+		return
+	fi
+
+	foreach_abi glibc_do_src_install
+
+	if ! use static-libs ; then
+		einfo "Not installing static glibc libraries"
+		find "${ED}" -name "*.a" -and -not -name "*_nonshared.a" -delete
+	fi
+}
+
+# Simple test to make sure our new glibc isn't completely broken.
+# Make sure we don't test with statically built binaries since
+# they will fail.  Also, skip if this glibc is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+glibc_sanity_check() {
+	cd / #228809
+
+	# We enter ${ED} so to avoid trouble if the path contains
+	# special characters; for instance if the path contains the
+	# colon character (:), then the linker will try to split it
+	# and look for the libraries in an unexpected place. This can
+	# lead to unsafe code execution if the generated prefix is
+	# within a world-writable directory.
+	# (e.g. /var/tmp/portage:${HOSTNAME})
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	# first let's find the actual dynamic linker here
+	# symlinks may point to the wrong abi
+	local newldso=$(find . -maxdepth 1 -name 'ld*so.?' -type f -print -quit)
+
+	einfo Last-minute run tests with ${newldso} in /$(get_libdir) ...
+
+	local x striptest
+	for x in cal date env free ls true uname uptime ; do
+		x=$(type -p ${x})
+		[[ -z ${x} || ${x} != ${EPREFIX}/* ]] && continue
+		striptest=$(LC_ALL="C" file -L ${x} 2>/dev/null) || continue
+		case ${striptest} in
+		*"statically linked"*) continue;;
+		*"ASCII text"*) continue;;
+		esac
+		# We need to clear the locale settings as the upgrade might want
+		# incompatible locale data.  This test is not for verifying that.
+		LC_ALL=C \
+		${newldso} --library-path . ${x} > /dev/null \
+			|| die "simple run test (${x}) failed"
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	# Default /etc/hosts.conf:multi to on for systems with small dbs.
+	if [[ $(wc -l < "${EROOT}"/etc/hosts) -lt 1000 ]] ; then
+		sed -i '/^multi off/s:off:on:' "${ED}"/etc/host.conf
+		einfo "Defaulting /etc/host.conf:multi to on"
+	fi
+
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}/$(get_libdir) ]] || return 0
+	[[ -z ${BOOTSTRAP_RAP} ]] && glibc_sanity_check
+
+	if [[ -L ${EROOT}/usr/lib/locale ]]; then
+		# Help portage migrate this to a directory
+		# https://bugs.gentoo.org/753740
+		rm "${EROOT}"/usr/lib/locale || die
+	fi
+
+	# Keep around libcrypt so that Perl doesn't break when merging libxcrypt
+	# (libxcrypt is the new provider for now of libcrypt.so.{1,2}).
+	# bug #802207
+	if has_version "${CATEGORY}/${PN}[crypt]" && ! has preserve-libs ${FEATURES}; then
+		PRESERVED_OLD_LIBCRYPT=1
+		cp -p "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" \
+			"${T}/libcrypt$(get_libname 1)" || die
+	else
+		PRESERVED_OLD_LIBCRYPT=0
+	fi
+}
+
+glibc_refresh_ldconfig() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+
+	# Version check could be added to avoid unnecessary work, but ldconfig
+	# should finish quickly enough to not matter.
+	ebegin "Refreshing ld.so.cache"
+	ldconfig -i
+	if ! eend $?; then
+		ewarn "Failed to refresh the ld.so.cache for you. Some programs may be broken"
+		ewarn "before you manually do so (ldconfig -i)."
+	fi
+}
+
+pkg_postinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	if ! tc-is-cross-compiler && [[ -x ${EROOT}/usr/sbin/iconvconfig ]] ; then
+		# Generate fastloading iconv module configuration file.
+		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
+	fi
+
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		# glibc-2.38+ on loong has ldconfig support added, but the ELF e_flags
+		# handling has changed as well, which means stale ldconfig auxiliary
+		# cache entries and failure to lookup libgcc_s / libstdc++ (breaking
+		# every C++ application) / libgomp etc., among other breakages.
+		#
+		# To fix this, simply refresh the ld.so.cache without using the
+		# auxiliary cache if we're natively installing on loong. This should
+		# be done relatively soon because we want to minimize the breakage
+		# window for the affected programs.
+		use loong && glibc_refresh_ldconfig
+
+		use compile-locales || run_locale_gen "${EROOT}/"
+
+		# If fixincludes was/is active for a particular GCC slot, we
+		# must refresh it. See bug #933282 and GCC's documentation:
+		# https://gcc.gnu.org/onlinedocs/gcc/Fixed-Headers.html
+		#
+		# TODO: Could this be done for cross? Some care would be needed
+		# to pass the right arguments.
+		while IFS= read -r -d $'\0' slot ; do
+			local mkheaders_path="${BROOT}"/usr/libexec/gcc/${CBUILD}/${slot##*/}/install-tools/mkheaders
+			local pthread_h="${BROOT}"/usr/lib/gcc/${CBUILD}/${slot##*/}/include-fixed/pthread.h
+			if [[ -x ${mkheaders_path} ]] ; then
+				ebegin "Refreshing fixincludes for ${CBUILD} with gcc-${slot##*/}"
+				${mkheaders_path} -v
+				eend $?
+			elif [[ -f ${pthread_h} ]] ; then
+				# fixincludes might have been enabled in the past for this
+				# GCC slot but not since we fixed toolchain.eclass to install
+				# mkheaders, so we need to manually delete pthread.h at least.
+				ebegin "Deleting stale fixincludes'd pthread.h for ${CBUILD} with gcc-${slot##*/}"
+				mv -v "${pthread_h}" "${pthread_h}.bak"
+				eend $?
+			fi
+		done < <(find "${BROOT}"/usr/libexec/gcc/${CBUILD}/ -mindepth 1 -maxdepth 1 -type d -print0)
+	fi
+
+	upgrade_warning
+
+	# Check for sanity of /etc/nsswitch.conf, take 2
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then
+		local entry
+		for entry in passwd group shadow; do
+			if grep -E -q "^[ \t]*${entry}:.*nis" "${EROOT}"/etc/nsswitch.conf; then
+				ewarn ""
+				ewarn "Your ${EROOT}/etc/nsswitch.conf uses NIS. Support for that has been"
+				ewarn "removed from glibc and is now provided by the package"
+				ewarn "  sys-auth/libnss-nis"
+				ewarn "Install it now to keep your NIS setup working."
+				ewarn ""
+			fi
+		done
+	fi
+
+	if [[ ${PRESERVED_OLD_LIBCRYPT} -eq 1 ]] ; then
+		cp -p "${T}/libcrypt$(get_libname 1)" "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" || die
+		preserve_old_lib_notify /$(get_libdir)/libcrypt$(get_libname 1)
+
+		elog "Please ignore a possible later error message about a file collision involving"
+		elog "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1). We need to preserve this file for the moment to keep"
+		elog "the upgrade working, but it also needs to be overwritten when"
+		elog "sys-libs/libxcrypt is installed. See bug 802210 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
index f1adca0c21c..e23e2568a76 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
@@ -972,6 +972,15 @@ src_prepare() {
 		einfo "Done."
 	fi
 
+        case ${CTARGET} in
+                m68*-aligned-*)
+			einfo "Applying utmp format fix for m68k with -maligned-int"
+			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
+			;;
+                *)
+			;;
+        esac
+
 	default
 
 	gnuconfig_update
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
index 6d3e584582b..a107cc54a12 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://download.samba.org/pub/${PN}/${P}.tar.gz"
 
 LICENSE="LGPL-3"
 SLOT="0/${PV}"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="doc ldap +lmdb python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
index 41edeea87f9..245a9e741b1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
@@ -1,3 +1,2 @@
-DIST libcap-2.69.tar.xz 189200 BLAKE2B 94d1fef7666a1c383a8b96f1f6092bd242164631532868b628d2f5de71b42a371d041a978ef7fbadfee3eeb433165444995d1078cd790275bc0433a7875a697e SHA512 647c307dc451517da9d089495ab959b4a6fbbe41c79f4e1e9bb663569dad630ead0c2e413dfb393319e3ea14dc9848c81b392107fe3382ce1813d278c3394a7f
-DIST libcap-2.70.tar.xz 191388 BLAKE2B 77b72acee53032117ea481e3380d1b497f9264b6193b9523542508c7c3e46070248ca4ed910d35809ce6e52caa60cbb31edb125c47221627eeda35c61bd0914b SHA512 4e0bf0efeccb654c409afe9727b2b53c1d4da8190d7a0a9848fc52550ff3e13502add3eacde04a68a5b7bec09e91df487f64c5746ba987f873236a9e53b3d4e8
 DIST libcap-2.71.tar.xz 193512 BLAKE2B a4bc55d8b58db5d75b4615f287a15614c075f8f7e690e7a833c453658c80d6f99e633132bc8a3b8cc7d1393e513763d924bf2cbe6bc29c7a40e2a5f19755e662 SHA512 59bb6781d96776595ad3df890f4e5188380634eabbb6128f3a5307946b01cf3bd19dee8a29d3e501de1d9e1c6ed0092c4cd5adc91da227a1260c1f4356cc0bf3
+DIST libcap-2.76.tar.xz 199200 BLAKE2B 301c74ceae00e915f70ff8f0a32c86a5ddf405a00522f4299390e4e0b6bc4270fc7e3c4ba5c53db2ddc5f7de6a97b43e310097a4ecc1d678f721f9dfa53cef53 SHA512 f9448628ce036a10ce71958b25e5dd31032c4d86d8d34d905d2dfa32890ad443804169d4c6b825fd4bfe260b5de20f046cee958e40268bcadbbe7f7731ae40ad
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.70.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.70.ebuild
deleted file mode 100644
index 735aed2e539..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.70.ebuild
+++ /dev/null
@@ -1,93 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal toolchain-funcs pam
-
-if [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/libs/libcap/libcap.git"
-else
-	SRC_URI="https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${P}.tar.xz"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-fi
-
-DESCRIPTION="POSIX 1003.1e capabilities"
-HOMEPAGE="https://sites.google.com/site/fullycapable/"
-
-LICENSE="|| ( GPL-2 BSD ) pam? ( || ( LGPL-2+ BSD ) )"
-SLOT="0"
-IUSE="pam static-libs tools"
-
-# While the build system optionally uses gperf, we don't DEPEND on it because
-# the build automatically falls back when it's unavailable.  #604802
-PDEPEND="pam? ( sys-libs/pam[${MULTILIB_USEDEP}] )"
-DEPEND="${PDEPEND}
-	sys-kernel/linux-headers"
-BDEPEND="
-	sys-apps/diffutils
-	tools? ( dev-lang/go )"
-
-QA_FLAGS_IGNORED="sbin/captree" # go binaries don't use LDFLAGS
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.62-ignore-RAISE_SETFCAP-install-failures.patch
-)
-
-src_prepare() {
-	default
-	multilib_copy_sources
-}
-
-run_emake() {
-	local args=(
-		AR="$(tc-getAR)"
-		CC="$(tc-getCC)"
-		OBJCOPY="$(tc-getOBJCOPY)"
-		RANLIB="$(tc-getRANLIB)"
-		exec_prefix="${EPREFIX}"
-		lib_prefix="${EPREFIX}/usr"
-		lib="$(get_libdir)"
-		prefix="${EPREFIX}/usr"
-		PAM_CAP="$(usex pam yes no)"
-		DYNAMIC=yes
-		GOLANG="$(multilib_native_usex tools yes no)"
-	)
-	emake "${args[@]}" "$@"
-}
-
-src_configure() {
-	tc-export_build_env BUILD_CC
-	multilib-minimal_src_configure
-}
-
-multilib_src_compile() {
-	run_emake
-}
-
-multilib_src_test() {
-	run_emake test
-}
-
-multilib_src_install() {
-	# no configure, needs explicit install line #444724#c3
-	run_emake DESTDIR="${D}" install
-
-	if ! use static-libs ; then
-		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
-	fi
-
-	# install pam plugins ourselves
-	rm -rf "${ED}"/usr/$(get_libdir)/security || die
-
-	if use pam ; then
-		dopammod pam_cap/pam_cap.so
-		dopamsecurity '' pam_cap/capability.conf
-	fi
-}
-
-multilib_src_install_all() {
-	dodoc CHANGELOG README doc/capability.md
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
index 4159643cac5..bdff2e8cbcc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ if [[ ${PV} == *9999 ]]; then
 else
 	SRC_URI="https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${P}.tar.xz"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 DESCRIPTION="POSIX 1003.1e capabilities"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
index 735aed2e539..7c2586bcc98 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ if [[ ${PV} == *9999 ]]; then
 else
 	SRC_URI="https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${P}.tar.xz"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 fi
 
 DESCRIPTION="POSIX 1003.1e capabilities"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
index 7831fcbaf78..d66e68308c8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
@@ -1,3 +1,4 @@
 DIST libnvme-1.11.1.gh.tar.gz 740327 BLAKE2B eb9a731ce4886e7a76170d4be916e850548710dbbc135bbe94c5ff0c2f3da5e2cb162a6c8ea857d6b9b609ffafba34487cd3419fc4981e9e549419c2bb757568 SHA512 8720f2907a3d13af44fb3deec883cd6eb247d5861c4459b5fe0e67ff9ecfb565462a5faf39d43e08b5284f3e8ca8e72d41b333984beaa45d3287b1a258f3e59d
 DIST libnvme-1.12.gh.tar.gz 775030 BLAKE2B b6c9da012c39ec0b5ce671f498fd55b904ea9f0c34f8358eed166e08f9ef12c760707aa693a0123267cfb256812650f0afb5d017f4c8a940b61e18f9998d8b9e SHA512 6681f476c36d077d1481336ca66327cfed9b910e75309334a1eb1fa8ccfba7982d96c7b3ae5d587f306923247a716c5d70f4b71c26716e6be6020b470f9c1077
 DIST libnvme-1.13.gh.tar.gz 776674 BLAKE2B a0b9190a2350e28ccbe4bed69eb23140bf6863688c977a023333309cdcca8398d6c024197429454c003ebbc642d492f88737d27cea368345768cf181fad8ce8d SHA512 7c56cb4a531c77e7024126c3dde4ffe629944be93a3102b09bc7a16031bdd64dac5cb19834c586609c5e3c186f805532d739f960abc4ba22114f36c6bc710264
+DIST libnvme-1.14.gh.tar.gz 805970 BLAKE2B a7d4acd4f28d2bca223fc788962fc62ab31e2f60010bd05254c44e3c59a60e42ecfe25c6aea13ac99341695340084d3c3034d8a3f822df7c51551c839d41fe95 SHA512 96a1bbd6cea1e77381254e242e781b023416abfbf44c82a0aa6eb0b316b30316d32d0b91f441089a317cbae5b511f6b3eaab570624cbda2178f9dce4cb5dd288
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.14-remove-glibc-include.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.14-remove-glibc-include.patch
new file mode 100644
index 00000000000..725bb8237e3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.14-remove-glibc-include.patch
@@ -0,0 +1,29 @@
+https://bugs.gentoo.org/956710
+https://github.com/linux-nvme/libnvme/pull/1016
+https://github.com/linux-nvme/libnvme/commit/9b3ab852075f6da64648145b2d2e56e34354bf45
+
+From 9b3ab852075f6da64648145b2d2e56e34354bf45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20N=C3=A9ri?= <dne+commits@rb67.eu>
+Date: Fri, 23 May 2025 12:36:44 +0200
+Subject: [PATCH] examples: remove unnecessary include of <bits/pthreadtypes.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The <bits/*.h> header files are GNU libc specific, and should not be
+used directly from application code. This one in particular is already
+included by <pthread.h> on glibc.
+
+Fixes build on musl.
+
+Signed-off-by: Daniel Néri <dne+commits@rb67.eu>
+--- a/examples/mi-mctp-csi-test.c
++++ b/examples/mi-mctp-csi-test.c
+@@ -21,7 +21,6 @@
+ 
+ #include <ccan/array_size/array_size.h>
+ #include <ccan/endian/endian.h>
+-#include <bits/pthreadtypes.h>
+ 
+ void fhexdump(FILE *fp, const unsigned char *buf, int len)
+ {
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.12-r1.ebuild
index a1110a40482..1692114985b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.12-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.12-r1.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -
 LICENSE="LGPL-2.1+"
 SLOT="0/1"
 KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
-IUSE="dbus +json keyutils python ssl test uring"
+IUSE="dbus io-uring +json keyutils python ssl test"
 RESTRICT="!test? ( test )"
 
 REQUIRED_USE="
@@ -26,7 +26,7 @@ DEPEND="
 	dbus? ( sys-apps/dbus:= )
 	python? ( ${PYTHON_DEPS} )
 	ssl? ( >=dev-libs/openssl-1.1:= )
-	uring? ( sys-libs/liburing:= )
+	io-uring? ( sys-libs/liburing:= )
 "
 RDEPEND="
 	${DEPEND}
@@ -43,7 +43,7 @@ src_configure() {
 		$(meson_feature dbus libdbus)
 		$(meson_feature keyutils)
 		$(meson_feature ssl openssl)
-		$(meson_feature uring liburing)
+		$(meson_feature io-uring liburing)
 	)
 	meson_src_configure
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.13-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.13-r1.ebuild
index 67d9327c433..74e5be635be 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.13-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.13-r1.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -
 LICENSE="LGPL-2.1+"
 SLOT="0/1"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
-IUSE="dbus +json keyutils python ssl test uring"
+IUSE="dbus io-uring +json keyutils python ssl test"
 RESTRICT="!test? ( test )"
 
 REQUIRED_USE="
@@ -26,7 +26,7 @@ DEPEND="
 	dbus? ( sys-apps/dbus:= )
 	python? ( ${PYTHON_DEPS} )
 	ssl? ( >=dev-libs/openssl-1.1:= )
-	uring? ( sys-libs/liburing:= )
+	io-uring? ( sys-libs/liburing:= )
 "
 RDEPEND="
 	${DEPEND}
@@ -43,7 +43,7 @@ src_configure() {
 		$(meson_feature dbus libdbus)
 		$(meson_feature keyutils)
 		$(meson_feature ssl openssl)
-		$(meson_feature uring liburing)
+		$(meson_feature io-uring liburing)
 	)
 	meson_src_configure
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.14.ebuild
new file mode 100644
index 00000000000..582ed5b198b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.14.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..14} )
+DISTUTILS_OPTIONAL=1
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=meson-python
+inherit distutils-r1 meson
+
+DESCRIPTION="C Library for NVM Express on Linux"
+HOMEPAGE="https://github.com/linux-nvme/libnvme"
+SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="dbus io-uring +json keyutils python ssl test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+DEPEND="
+	json? ( dev-libs/json-c:= )
+	keyutils? ( sys-apps/keyutils:= )
+	dbus? ( sys-apps/dbus:= )
+	python? ( ${PYTHON_DEPS} )
+	ssl? ( >=dev-libs/openssl-1.1:= )
+	io-uring? ( sys-libs/liburing:= )
+"
+RDEPEND="
+	${DEPEND}
+"
+BDEPEND="
+	python? (
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+		dev-python/meson-python[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+PATCHES=(
+	"${FILESDIR}"/libnvme-1.14-remove-glibc-include.patch
+)
+
+src_prepare() {
+	default
+	use python && distutils-r1_src_prepare
+}
+
+src_configure() {
+	local emesonargs=(
+		-Dpython=disabled
+		$(meson_use test tests)
+		$(meson_feature json json-c)
+		$(meson_feature dbus libdbus)
+		$(meson_feature keyutils)
+		$(meson_feature ssl openssl)
+		$(meson_feature io-uring liburing)
+	)
+	meson_src_configure
+	use python && distutils-r1_src_configure
+}
+
+python_compile() {
+	local emesonargs=(
+		-Dpython=enabled
+	)
+	meson_src_configure --reconfigure
+	distutils-r1_python_compile
+}
+
+src_compile() {
+	meson_src_compile
+
+	use python && distutils-r1_src_compile
+}
+
+src_test() {
+	meson_src_test
+	use python && distutils-r1_src_test
+}
+
+python_test() {
+	local -A test_args=(
+		["test-nbft.py"]="--filename=${S}/libnvme/tests/NBFT"
+	)
+	pushd "${BUILD_DIR}" >/dev/null || die
+	local testfile
+	for testfile in "${S}"/libnvme/tests/*.py; do
+		PYTHONPATH="${BUILD_DIR}" "${EPYTHON}" "${testfile}" \
+			${test_args[${testfile##*/}]} \
+			|| die "test ${testfile##*/} failed with ${EPYTHON}"
+	done
+	popd >/dev/null || die
+}
+
+src_install() {
+	meson_src_install
+	use python && distutils-r1_src_install
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/metadata.xml
index 5b2185449d5..b8882391c6f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/metadata.xml
@@ -9,7 +9,6 @@
 		<flag name="json">Support JSON output via <pkg>dev-libs/json-c</pkg></flag>
 		<flag name="keyutils">Add support for <pkg>sys-apps/keyutils</pkg></flag>
 		<flag name="uuid">UUID support via <pkg>sys-apps/util-linux</pkg></flag>
-		<flag name="uring">uring support via <pkg>sys-libs/liburing</pkg></flag>
 	</use>
 	<upstream>
 		<remote-id type="github">linux-nvme/libnvme</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
index 2902fd245a1..1fce91e47d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.8.1.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]]; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
index 041e040a37d..37c01b9d4b7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.8.1.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]]; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/Manifest
index 8e783073b4a..b35238f2b66 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/Manifest
@@ -1,2 +1,3 @@
 DIST libunwind-1.8.0-docs.tar.xz 29280 BLAKE2B 260c5011cf23422ec04449126259c9960b5549b94def8ffa3821ccc67809b5da06be22fb0b465fcee2f0ec89faebab71d2bf3316dc68315a27e0913856513b0a SHA512 6969c8426dc5d79a78a9dae366a9e7b6f1d9a7ce307357913d4f5b8867a540ab8225b5342ee0e06e77b832ef76336fba41dadf12effa5236a076e6bfe72ec548
 DIST libunwind-1.8.1.tar.gz 958468 BLAKE2B 936e70f2428d8f6ada3b4d58b3c9e3a9738eb2f7aee1ad5fb4e44dbb7400186d1bd1ead86a698e53d199d5944b102f8380d08b48104a138021286a79fb006ec3 SHA512 aba7b578c1b8cbe78f05b64e154f3530525f8a34668b2a9f1ee6acb4b22c857befe34ad4e9e8cca99dbb66689d41bc72060a8f191bd8be232725d342809431b3
+DIST libunwind-1.8.2.tar.gz 979922 BLAKE2B b198b186c616adf1302d153a12949ceab07608f8133e42454e6b10bdf9518a514ef15d5ba52ef75b11e5f73fa330205accd415cfc30e6fa3ddd9724cbb088737 SHA512 f1ff26763c1b2e68948413c4aec22303b6c886425a8264eb65fbd58fc202f79c7b04bd4784bd8499850d08933f0e363cfa3a7d177efdadc223ed0254bc381345
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/libunwind-1.8.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/libunwind-1.8.2.ebuild
new file mode 100644
index 00000000000..82797fa7612
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libunwind/libunwind-1.8.2.ebuild
@@ -0,0 +1,134 @@
+# Copyright 2005-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-libunwind-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${LIBUNWIND_DOCS_PREBUILT:=1}
+
+LIBUNWIND_DOCS_PREBUILT_DEV=sam
+LIBUNWIND_DOCS_VERSION=1.8.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+LIBUNWIND_DOCS_USEFLAG="+doc"
+
+inherit libtool multilib-minimal
+
+DESCRIPTION="Portable and efficient API to determine the call-chain of a program"
+HOMEPAGE="https://savannah.nongnu.org/projects/libunwind"
+
+if [[ ${PV} == 9999 ]] ; then
+	LIBUNWIND_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://github.com/libunwind/libunwind"
+	inherit autotools git-r3
+else
+	SRC_URI="https://github.com/libunwind/libunwind/releases/download/v${PV/_rc/-rc}/${P/_rc/-rc}.tar.gz"
+	if [[ ${LIBUNWIND_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${LIBUNWIND_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${LIBUNWIND_DOCS_VERSION}-docs.tar.xz )"
+	fi
+	S="${WORKDIR}"/${P/_rc/-rc}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 -sparc ~x86 ~amd64-linux ~x86-linux"
+	fi
+fi
+
+[[ ${LIBUNWIND_DOCS_PREBUILT} == 1 ]] && LIBUNWIND_DOCS_USEFLAG="doc"
+
+LICENSE="MIT"
+SLOT="0/8" # libunwind.so.8
+IUSE="debug debug-frame ${LIBUNWIND_DOCS_USEFLAG} libatomic lzma static-libs test zlib"
+# XXX: if enabling tests again, make sure to arrange for deleting them so they don't get installed
+# https://github.com/libunwind/libunwind/pull/722
+RESTRICT="test !test? ( test )" # some tests are broken (toolchain version dependent, rely on external binaries)
+
+BDEPEND="
+	doc? ( app-text/texlive-core )
+"
+RDEPEND="
+	lzma? ( app-arch/xz-utils[static-libs?,${MULTILIB_USEDEP}] )
+	zlib? ( sys-libs/zlib[static-libs?,${MULTILIB_USEDEP}] )
+"
+# We just use the header from libatomic.
+DEPEND="
+	${RDEPEND}
+	libatomic? ( dev-libs/libatomic_ops[${MULTILIB_USEDEP}] )
+"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/libunwind.h
+
+	# see libunwind.h for the full list of arch-specific headers
+	/usr/include/libunwind-aarch64.h
+	/usr/include/libunwind-arm.h
+	/usr/include/libunwind-hppa.h
+	/usr/include/libunwind-ia64.h
+	/usr/include/libunwind-mips.h
+	/usr/include/libunwind-ppc32.h
+	/usr/include/libunwind-ppc64.h
+	/usr/include/libunwind-riscv.h
+	/usr/include/libunwind-sh.h
+	/usr/include/libunwind-tilegx.h
+	/usr/include/libunwind-x86.h
+	/usr/include/libunwind-x86_64.h
+)
+
+src_prepare() {
+	default
+
+	chmod +x src/ia64/mk_cursor_i || die
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		# --enable-cxx-exceptions: always enable it, headers provide the interface
+		# and on some archs it is disabled by default causing a mismatch between the
+		# API and the ABI, bug #418253
+		--enable-cxx-exceptions
+		--enable-coredump
+		--enable-ptrace
+		--enable-setjmp
+		$(use_enable debug-frame)
+		$(multilib_native_use_enable doc documentation)
+		$(use_enable lzma minidebuginfo)
+		$(use_enable static-libs static)
+		$(use_enable zlib zlibdebuginfo)
+		# conservative-checks: validate memory addresses before use; as of 1.0.1,
+		# only x86_64 supports this, yet may be useful for debugging, couple it with
+		# debug useflag.
+		$(use_enable debug conservative_checks)
+		$(use_enable debug)
+		$(use_enable test tests)
+	)
+
+	export ac_cv_header_atomic_ops_h=$(usex libatomic)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	# bug #586208
+	CCACHE_NODIRECT=1 default
+}
+
+multilib_src_test() {
+	# Sandbox causes some tests to freak out.
+	SANDBOX_ON=0 emake check
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -type f -delete || die
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${LIBUNWIND_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${LIBUNWIND_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/Manifest
index 713ec40661e..e1579ae3589 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/Manifest
@@ -1,3 +1,3 @@
-DIST liburing-2.7.tar.bz2 252289 BLAKE2B dc04745d2eda04d7009a532fc77566804c34b77dcef512f17ef424e22bc1e1a31ba87c2a841bb5574b11c494641a3128005d6dfccf2b87d6c3888fe5cd887996 SHA512 ec6cf69cae2e7e448e9e338bcd616bf27522f6f0e4768bf80d246d6df8610df3accaddae1c135c31bca7814bc3b8214854c40b3f7137163c0950605c716793f1
-DIST liburing-2.8.tar.bz2 284202 BLAKE2B de1deaa8927b5f80a38195ef857fdb0d3dc5f7f57358fe319af42ec3d980bf4c20284d7726645e9c32bcb3e5d7d981540a52a35abb26394cbef03f88ab7c4248 SHA512 5822108aa771a34a4c3f008a0155e4f1fa9393499f24a1bce00aed7fab6e3b9e022b44f96479af0036295129db75d5062618fb4c48cef836e3155c604491e94d
+DIST liburing-2.10.tar.gz 428315 BLAKE2B f5477f7a1a30202feea3e97f236f6a8a2db59923a0ba9c13dda2cd8de0831bb0979dc6acdef4a2f1797ce2637125def54b9f3d50f14ef01affeed43b089228df SHA512 6fb6e7ce66917d9438095e05916f90d834034ac3f6d6d8b6ee1eadf48ab9e499efa4af489dc72f8acc4a0b018f917ffcb8af4af682b47512566205519dd1f5db
+DIST liburing-2.7.gh.tar.gz 347638 BLAKE2B 3e281cbf9be72cc8e04b04486df4dd9dd32c95ef9b84f7eae3253eb8e9a4afdaf8048ac359d6d250fecfb0a2bded51e46c1ab073d0e96c4d7d5d1d554d65c2b2 SHA512 c65146ee53defba4f9b752674be8489757f60be0855b361c6d1136119c74803351e5ccc8a1890c0777bfe61da4c0fd997230fc8817ff3929a7e2186b389cdc28
 DIST liburing-2.9.tar.gz 407191 BLAKE2B 7081f9430e9532cad659e24de7ba998ad40f15a3fc3bf08fbe2b30df2bb335d4b06affb98d5667d4f8e6c8bc6e7a98c25caddd57ec5c98940562eb0e7977e54d SHA512 f27233e6128444175b18cd1d45647acdd27b906a8cd561029508710e443b44416b916cad1b2c1217e23d9a5ffb5ba68b119e9c812eae406650fbd10bf26c2fa5
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.10.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.8.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.10.ebuild
index a469ca0ee19..51789caff4e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.10.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,10 +11,12 @@ if [[ "${PV}" == *9999 ]] ; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/axboe/liburing.git"
 else
-	SRC_URI="https://git.kernel.dk/cgit/${PN}/snapshot/${P}.tar.bz2"
+	SRC_URI="https://github.com/axboe/liburing/archive/refs/tags/${P}.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	QA_PKGCONFIG_VERSION=${PV}
 fi
+
+S="${WORKDIR}"/liburing-${P}
 LICENSE="MIT"
 SLOT="0/2" # liburing.so major version
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
index d309a7e8cfc..b155d151a70 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.7-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,10 +11,13 @@ if [[ "${PV}" == *9999 ]] ; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/axboe/liburing.git"
 else
-	SRC_URI="https://git.kernel.dk/cgit/${PN}/snapshot/${P}.tar.bz2"
+	SRC_URI="https://github.com/axboe/liburing/archive/refs/tags/${P}.tar.gz -> ${P}.gh.tar.gz"
 	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	QA_PKGCONFIG_VERSION=${PV}
+
+	S="${WORKDIR}"/liburing-${P}
 fi
+
 LICENSE="MIT"
 SLOT="0/2" # liburing.so major version
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.9.ebuild
index 51789caff4e..677f9993008 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-2.9.ebuild
@@ -12,7 +12,7 @@ if [[ "${PV}" == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/axboe/liburing.git"
 else
 	SRC_URI="https://github.com/axboe/liburing/archive/refs/tags/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	QA_PKGCONFIG_VERSION=${PV}
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-9999.ebuild
index 76c4d774efc..98c17b11a96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/liburing/liburing-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,10 +11,13 @@ if [[ "${PV}" == *9999 ]] ; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/axboe/liburing.git"
 else
-	SRC_URI="https://git.kernel.dk/cgit/${PN}/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="https://github.com/axboe/liburing/archive/refs/tags/${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	QA_PKGCONFIG_VERSION=${PV}
+
+	S="${WORKDIR}"/liburing-${P}
 fi
+
 LICENSE="MIT"
 SLOT="0/2" # liburing.so major version
 
@@ -47,6 +50,7 @@ multilib_src_configure() {
 		--mandir="${EPREFIX}/usr/share/man"
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
+		--use-libc
 	)
 	# No autotools configure! "econf" will fail.
 	TMPDIR="${T}" ./configure "${myconf[@]}" || die
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
index 18c4945f0d7..259a3cce265 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/Manifest
@@ -1,2 +1 @@
-DIST libxcrypt-4.4.36-autotools.tar.xz 624660 BLAKE2B 8dc3d0f354baf8c64dc011e95e7df10d48b0dfe428503936ffd55edf2745de04003c7efe231ed5d9a14cea7f682ba377b7e00f0463b4060c50c9c29f555b790f SHA512 fb8391ecb89622eb0d74d13c5fc1369718e83c47671449044ca0c2f78a236d7b06177a60bf8cda47694caa840c68eaaf0b23690e8975fa5d64b734c8eb246d10
 DIST libxcrypt-4.4.38-autotools.tar.xz 630696 BLAKE2B 471066e83495fbaf3ef8dee066b4a7bff36dbc36d6ae1c09f2510d79b041b8517d6cc345e678d92508f5d044dc25fd7b1d36e0243aa46314bbbe7e3201838a5c SHA512 9b1d53119e0d808f6bc30e39cbe85710e3abb774109df28e05b90adebb828f47db3f7126de4ffdea2e63073905648ad941985d1a2167ba7282c01e132ef4e2b2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
deleted file mode 100644
index ee2c2f74d18..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
+++ /dev/null
@@ -1,258 +0,0 @@
-# Copyright 2004-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} )
-# NEED_BOOTSTRAP is for developers to quickly generate a tarball
-# for publishing to the tree.
-NEED_BOOTSTRAP="no"
-inherit crossdev multibuild multilib python-any-r1 flag-o-matic toolchain-funcs multilib-minimal
-
-DESCRIPTION="Extended crypt library for descrypt, md5crypt, bcrypt, and others"
-HOMEPAGE="https://github.com/besser82/libxcrypt"
-if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-	inherit autotools
-	SRC_URI="https://github.com/besser82/libxcrypt/releases/download/v${PV}/${P}.tar.xz"
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-autotools.tar.xz"
-fi
-
-LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="+compat static-libs +system test headers-only"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	system? (
-		elibc_glibc? (
-			${CATEGORY}/glibc[-crypt(-)]
-			!${CATEGORY}/glibc[crypt(-)]
-		)
-		elibc_musl? (
-			${CATEGORY}/musl[-crypt(+)]
-			!${CATEGORY}/musl[crypt(+)]
-		)
-	)
-"
-RDEPEND="${DEPEND}"
-BDEPEND="
-	dev-lang/perl
-	test? ( $(python_gen_any_dep 'dev-python/passlib[${PYTHON_USEDEP}]') )
-"
-
-python_check_deps() {
-	python_has_version "dev-python/passlib[${PYTHON_USEDEP}]"
-}
-
-pkg_pretend() {
-	if has "distcc" ${FEATURES} ; then
-		ewarn "Please verify all distcc nodes are using the same versions of GCC (>= 10) and Binutils!"
-		ewarn "Older/mismatched versions of GCC may lead to a misbehaving library: bug #823179."
-
-		if [[ ${BUILD_TYPE} != "binary" ]] && tc-is-gcc && [[ $(gcc-major-version) -lt 10 ]] ; then
-			die "libxcrypt is known to fail to build or be broken at runtime with < GCC 10 (bug #823179)!"
-		fi
-	fi
-}
-
-pkg_setup() {
-	:
-}
-
-src_prepare() {
-	default
-
-	# WARNING: Please read on bumping or applying patches!
-	#
-	# There are two circular dependencies to be aware of:
-	# 1)
-	#	if we're bootstrapping configure and makefiles:
-	#		libxcrypt -> automake -> perl -> libxcrypt
-	#
-	#   mitigation:
-	#		toolchain@ manually runs `make dist` after running autoconf + `./configure`
-	#		and the ebuild uses that.
-	#		(Don't include the pre-generated Perl artefacts.)
-	#
-	#	solution for future:
-	#		Upstream are working on producing `make dist` tarballs.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# 2)
-	#	configure *unconditionally* needs Perl at build time to generate
-	#	a list of enabled algorithms based on the set passed to `configure`:
-	#		libxcrypt -> perl -> libxcrypt
-	#
-	#	mitigation:
-	#		None at the moment.
-	#
-	#	solution for future:
-	#		Not possible right now. Upstream intend on depending on Perl for further
-	#		configuration options.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# Therefore, on changes (inc. bumps):
-	#	* You must check whether upstream have started providing tarballs with bootstrapped
-	#	  auto{conf,make};
-	#
-	#	* diff the build system changes!
-	#
-	if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-		# Facilitate our split variant build for compat + non-compat
-		eapply "${FILESDIR}"/${PN}-4.4.19-multibuild.patch
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	MULTIBUILD_VARIANTS=(
-		$(usev compat 'xcrypt_compat')
-		xcrypt_nocompat
-	)
-
-	MYPREFIX=${EPREFIX}
-	MYSYSROOT=${ESYSROOT}
-
-	if target_is_not_host; then
-		# Hack to work around missing TARGET_CC support.
-		# See bug 949976.
-		if tc-is-clang; then
-			export CC="${CTARGET}-clang"
-		else
-			export CC="${CTARGET}-gcc"
-		fi
-
-		local CHOST=${CTARGET}
-
-		MYPREFIX=
-		MYSYSROOT=${ESYSROOT}/usr/${CTARGET}
-
-		# Ensure we get compatible libdir
-		unset DEFAULT_ABI MULTILIB_ABIS
-		multilib_env
-		ABI=${DEFAULT_ABI}
-
-		strip-unsupported-flags
-	fi
-
-	if use headers-only; then
-		# Nothing is compiled which would affect the headers, so we set
-		# CC and PKG_CONFIG to ensure configure passes without defaulting
-		# to the unprefixed host variants e.g. "pkg-config"
-		local -x CC="$(tc-getBUILD_CC)"
-		local -x PKG_CONFIG="false"
-	fi
-
-	# Avoid possible "illegal instruction" errors with gold
-	# bug #821496
-	tc-ld-disable-gold
-
-	# Doesn't work with LTO: bug #852917.
-	# https://github.com/besser82/libxcrypt/issues/24
-	filter-lto
-
-	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
-
-	if use test; then
-		python_setup
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myconf=(
-		--disable-werror
-		--prefix="${MYPREFIX}/usr"
-		--libdir="${MYPREFIX}/usr/$(get_libdir)$(usev !system /xcrypt)"
-		--includedir="${MYPREFIX}/usr/include$(usev !system /xcrypt)"
-		--with-pkgconfigdir="${MYPREFIX}/usr/$(get_libdir)/pkgconfig"
-		--with-sysroot="${MYSYSROOT}"
-	)
-
-	tc-export PKG_CONFIG
-
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			myconf+=(
-				--disable-static
-				--disable-xcrypt-compat-files
-				--enable-obsolete-api=yes
-			)
-			;;
-		xcrypt_nocompat-*)
-			myconf+=(
-				--enable-obsolete-api=no
-				$(use_enable static-libs static)
-			)
-			;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-src_compile() {
-	use headers-only && return
-
-	multibuild_foreach_variant multilib-minimal_src_compile
-}
-
-multilib_src_test() {
-	emake check
-}
-
-src_test() {
-	multibuild_foreach_variant multilib-minimal_src_test
-}
-
-src_install() {
-	local DESTDIR=${D}
-	if target_is_not_host; then
-		DESTDIR=${ED}/usr/${CTARGET}
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_install
-
-	find "${ED}" -name '*.la' -delete || die
-
-	if target_is_not_host; then
-		insinto /usr/${CTARGET}/usr/share
-		doins -r "${ED}/usr/share/doc"
-		rm -r "${ED}/usr/share/doc" || die
-		rmdir "${ED}/usr/share" || die
-	fi
-}
-
-multilib_src_install() {
-	if use headers-only; then
-		emake DESTDIR="${DESTDIR}" install-nodist_includeHEADERS
-	else
-		emake DESTDIR="${DESTDIR}" install
-		# Conflicts with sys-apps/man-pages
-		rm "${DESTDIR}${MYPREFIX}"/usr/share/man/man3/crypt{,_r}.3 || die
-	fi
-}
-
-pkg_preinst() {
-	# Verify we're not in a bad case like bug #843209 with broken symlinks.
-	# This can be dropped when, if ever, the split-usr && system && compat case
-	# is cleaned up in *_src_install.
-	local broken_symlinks=()
-	mapfile -d '' broken_symlinks < <(
-		find "${ED}" -xtype l -print0
-	)
-
-	if [[ ${#broken_symlinks[@]} -gt 0 ]]; then
-		eerror "Broken symlinks found before merging!"
-		local symlink target resolved
-		for symlink in "${broken_symlinks[@]}" ; do
-			target="$(readlink "${symlink}")"
-			resolved="$(readlink -f "${symlink}")"
-			eerror "  '${symlink}' -> '${target}' (${resolved})"
-		done
-		die "Broken symlinks found! Aborting to avoid damaging system. Please report a bug."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild
deleted file mode 100644
index 3380844c86d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36.ebuild
+++ /dev/null
@@ -1,340 +0,0 @@
-# Copyright 2004-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..11} )
-# NEED_BOOTSTRAP is for developers to quickly generate a tarball
-# for publishing to the tree.
-NEED_BOOTSTRAP="no"
-inherit multibuild multilib python-any-r1 flag-o-matic toolchain-funcs multilib-minimal
-
-DESCRIPTION="Extended crypt library for descrypt, md5crypt, bcrypt, and others"
-HOMEPAGE="https://github.com/besser82/libxcrypt"
-if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-	inherit autotools
-	SRC_URI="https://github.com/besser82/libxcrypt/releases/download/v${PV}/${P}.tar.xz"
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-autotools.tar.xz"
-fi
-
-LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="+compat split-usr static-libs +system test headers-only"
-REQUIRED_USE="split-usr? ( system )"
-RESTRICT="!test? ( test )"
-
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY/cross-} != ${CATEGORY} ]] ; then
-		export CTARGET=${CATEGORY/cross-}
-	fi
-fi
-
-is_cross() {
-	local enabled_abis=( $(multilib_get_enabled_abis) )
-	[[ "${#enabled_abis[@]}" -le 1 ]] && [[ ${CHOST} != ${CTARGET} ]]
-}
-
-DEPEND="
-	system? (
-		elibc_glibc? (
-			${CATEGORY}/glibc[-crypt(+)]
-			!${CATEGORY}/glibc[crypt(+)]
-		)
-		elibc_musl? (
-			${CATEGORY}/musl[-crypt(+)]
-			!${CATEGORY}/musl[crypt(+)]
-		)
-	)
-"
-RDEPEND="${DEPEND}"
-BDEPEND="
-	dev-lang/perl
-	test? ( $(python_gen_any_dep 'dev-python/passlib[${PYTHON_USEDEP}]') )
-"
-
-python_check_deps() {
-	python_has_version "dev-python/passlib[${PYTHON_USEDEP}]"
-}
-
-pkg_pretend() {
-	if has "distcc" ${FEATURES} ; then
-		ewarn "Please verify all distcc nodes are using the same versions of GCC (>= 10) and Binutils!"
-		ewarn "Older/mismatched versions of GCC may lead to a misbehaving library: bug #823179."
-
-		if [[ ${BUILD_TYPE} != "binary" ]] && tc-is-gcc && [[ $(gcc-major-version) -lt 10 ]] ; then
-			die "libxcrypt is known to fail to build or be broken at runtime with < GCC 10 (bug #823179)!"
-		fi
-	fi
-}
-
-pkg_setup() {
-	MULTIBUILD_VARIANTS=(
-		$(usev compat 'xcrypt_compat')
-		xcrypt_nocompat
-	)
-
-	use test && python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# WARNING: Please read on bumping or applying patches!
-	#
-	# There are two circular dependencies to be aware of:
-	# 1)
-	#	if we're bootstrapping configure and makefiles:
-	#		libxcrypt -> automake -> perl -> libxcrypt
-	#
-	#   mitigation:
-	#		toolchain@ manually runs `make dist` after running autoconf + `./configure`
-	#		and the ebuild uses that.
-	#		(Don't include the pre-generated Perl artefacts.)
-	#
-	#	solution for future:
-	#		Upstream are working on producing `make dist` tarballs.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# 2)
-	#	configure *unconditionally* needs Perl at build time to generate
-	#	a list of enabled algorithms based on the set passed to `configure`:
-	#		libxcrypt -> perl -> libxcrypt
-	#
-	#	mitigation:
-	#		None at the moment.
-	#
-	#	solution for future:
-	#		Not possible right now. Upstream intend on depending on Perl for further
-	#		configuration options.
-	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
-	#
-	# Therefore, on changes (inc. bumps):
-	#	* You must check whether upstream have started providing tarballs with bootstrapped
-	#	  auto{conf,make};
-	#
-	#	* diff the build system changes!
-	#
-	if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
-		# Facilitate our split variant build for compat + non-compat
-		eapply "${FILESDIR}"/${PN}-4.4.19-multibuild.patch
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	# Avoid possible "illegal instruction" errors with gold
-	# bug #821496
-	tc-ld-disable-gold
-
-	# Doesn't work with LTO: bug #852917.
-	# https://github.com/besser82/libxcrypt/issues/24
-	filter-lto
-
-	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
-	# https://github.com/gentoo/gentoo/pull/28355
-	# mold needs this too but right now tc-ld-is-mold is also not available
-	if tc-ld-is-lld; then
-		append-ldflags -Wl,--undefined-version
-	fi
-
-	multibuild_foreach_variant multilib-minimal_src_configure
-}
-
-get_xcprefix() {
-	if is_cross; then
-		echo "${EPREFIX}/usr/${CTARGET}"
-	else
-		echo "${EPREFIX}"
-	fi
-}
-
-get_xclibdir() {
-	printf -- "%s/%s/%s/%s\n" \
-		"$(get_xcprefix)" \
-		"$(usev !split-usr '/usr')" \
-		"$(get_libdir)" \
-		"$(usev !system 'xcrypt')"
-}
-
-get_xcincludedir() {
-	printf -- "%s/usr/include/%s\n" \
-		"$(get_xcprefix)" \
-		"$(usev !system 'xcrypt')"
-}
-
-get_xcmandir() {
-	printf -- "%s/usr/share/man\n" \
-		"$(get_xcprefix)"
-}
-
-get_xcpkgconfigdir() {
-	printf -- "%s/usr/%s/pkgconfig\n" \
-		"$(get_xcprefix)" \
-		"$(get_libdir)"
-}
-
-multilib_src_configure() {
-	local -a myconf=(
-		--host=${CTARGET}
-		--disable-werror
-		--libdir=$(get_xclibdir)
-		--with-pkgconfigdir=$(get_xcpkgconfigdir)
-		--includedir=$(get_xcincludedir)
-		--mandir="$(get_xcmandir)"
-	)
-
-	tc-export PKG_CONFIG
-
-	if is_cross; then
-		if tc-is-clang; then
-			export CC="${CTARGET}-clang"
-		else
-			export CC="${CTARGET}-gcc"
-		fi
-	fi
-
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			myconf+=(
-				--disable-static
-				--disable-xcrypt-compat-files
-				--enable-obsolete-api=yes
-			)
-			;;
-		xcrypt_nocompat-*)
-			myconf+=(
-				--enable-obsolete-api=no
-				$(use_enable static-libs static)
-			)
-		;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-
-	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
-		headers_only_flags="CC=$(tc-getBUILD_CC)"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}" "${headers_only_flags}"
-}
-
-src_compile() {
-	use headers-only && return
-
-	multibuild_foreach_variant multilib-minimal_src_compile
-}
-
-multilib_src_test() {
-	emake check
-}
-
-src_test() {
-	multibuild_foreach_variant multilib-minimal_src_test
-}
-
-src_install() {
-	multibuild_foreach_variant multilib-minimal_src_install
-
-	use headers-only || \
-	(
-		shopt -s failglob || die "failglob failed"
-
-		# Make sure our man pages do not collide with glibc or man-pages.
-		for manpage in "${D}$(get_xcmandir)"/man3/crypt{,_r}.?*; do
-			mv -n "${manpage}" "$(dirname "${manpage}")/xcrypt_$(basename "${manpage}")" \
-				|| die "mv failed"
-		done
-	) || die "failglob error"
-
-	# Remove useless stuff from installation
-	find "${ED}"/usr/share/doc/${PF} -type l -delete || die
-	find "${ED}" -name '*.la' -delete || die
-
-	# workaround broken upstream cross-* --docdir by installing files in proper locations
-	if is_cross; then
-		insinto "$(get_xcprefix)"/usr/share
-		doins -r "${ED}"/usr/share/doc
-		rm -r "${ED}"/usr/share/doc || die
-	fi
-}
-
-multilib_src_install() {
-	if use headers-only; then
-		emake DESTDIR="${D}" install-nodist_includeHEADERS
-		return
-	fi
-
-	emake DESTDIR="${D}" install
-
-	# Don't install the libcrypt.so symlink for the "compat" version
-	case "${MULTIBUILD_ID}" in
-		xcrypt_compat-*)
-			rm "${D}"$(get_xclibdir)/libcrypt$(get_libname) \
-				|| die "failed to remove extra compat libraries"
-		;;
-		xcrypt_nocompat-*)
-			if use split-usr; then
-				(
-					if use static-libs; then
-						# .a files are installed to /$(get_libdir) by default
-						# Move static libraries to /usr prefix or portage will abort
-						shopt -s nullglob || die "failglob failed"
-						static_libs=( "${D}"/$(get_xclibdir)/*.a )
-
-						if [[ -n ${static_libs[*]} ]]; then
-							dodir "/usr/$(get_xclibdir)"
-							mv "${static_libs[@]}" "${ED}/usr/$(get_xclibdir)" \
-								|| die "Moving static libs failed"
-						fi
-					fi
-
-					if use system; then
-						# Move versionless .so symlinks from /$(get_libdir) to /usr/$(get_libdir)
-						# to allow linker to correctly find shared libraries.
-						shopt -s failglob || die "failglob failed"
-
-						for lib_file in "${D}"$(get_xclibdir)/*$(get_libname); do
-							lib_file_basename="$(basename "${lib_file}")"
-							lib_file_target="$(basename "$(readlink -f "${lib_file}")")"
-
-							# We already know we're in split-usr (checked above)
-							# See bug #843209 (also worth keeping in mind bug #802222 too)
-							local libdir_no_prefix=$(get_xclibdir)
-							libdir_no_prefix=${libdir_no_prefix#${EPREFIX}}
-							libdir_no_prefix=${libdir_no_prefix%/usr}
-							dosym -r "/$(get_libdir)/${lib_file_target}" "/usr/${libdir_no_prefix}/${lib_file_basename}"
-						done
-
-						rm "${D}"$(get_xclibdir)/*$(get_libname) || die "Removing symlinks in incorrect location failed"
-					fi
-				)
-			fi
-		;;
-		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
-	esac
-}
-
-pkg_preinst() {
-	# Verify we're not in a bad case like bug #843209 with broken symlinks.
-	# This can be dropped when, if ever, the split-usr && system && compat case
-	# is cleaned up in *_src_install.
-	local broken_symlinks=()
-	mapfile -d '' broken_symlinks < <(
-		find "${ED}" -xtype l -print0
-	)
-
-	if [[ ${#broken_symlinks[@]} -gt 0 ]]; then
-		eerror "Broken symlinks found before merging!"
-		local symlink target resolved
-		for symlink in "${broken_symlinks[@]}" ; do
-			target="$(readlink "${symlink}")"
-			resolved="$(readlink -f "${symlink}")"
-			eerror "  '${symlink}' -> '${target}' (${resolved})"
-		done
-		die "Broken symlinks found! Aborting to avoid damaging system. Please report a bug."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
index 309bd48e295..69617761240 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 # NEED_BOOTSTRAP is for developers to quickly generate a tarball
 # for publishing to the tree.
 NEED_BOOTSTRAP="no"
@@ -20,7 +20,7 @@ fi
 
 LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
 SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="+compat static-libs +system test headers-only"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
index bb38abf7bab..84e1cb687ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
@@ -231,8 +231,27 @@ DIST ncurses-6.5-20250322.patch.gz 4987 BLAKE2B 708811bca043891e8c09ef137e0e2cff
 DIST ncurses-6.5-20250322.patch.gz.asc 729 BLAKE2B bd38bf5ed3c387f5b5726363e3ff58d7f0654a7fab6fa590a7965fd169ca0280832130a338d42692dee72da97afd63b5e738670df37a28f170339de6097e040c SHA512 649b46cbe129f48ac030e79d4f8ddeb3ee1da46af634022f4bf059e3ce31ce02a633f53eda776ac8c49d9ce0c4fdf8d8eabc1e1b22d9205c582d9b9485198e9a
 DIST ncurses-6.5-20250329.patch.gz 5288 BLAKE2B 2cb8cbff061fd22badf488db087855287f86fef50c79ca94bb81cf0152bbe266f2406ad62a1eba99ab7c090dd3b01df8964f2b5ae952c0c715da7947687ec00e SHA512 42e88dfe5c862ebb6effd6cf9e3bc79d5ad797b544a0f8891d165e97a4e1ab840efc3782e8fe78327cd030d3c1c9de3ba20a7c68b32ef9910b4530500f605694
 DIST ncurses-6.5-20250329.patch.gz.asc 729 BLAKE2B 96517ad803d2b91849119c890b6cf7e42f401c660e992f9b4564d5c6c4e2eab585c2dea85a41e4bd0d54b4434932cbd885d2a393063934e092712b043391c700 SHA512 24afa71c892737b4e0a557e6efa37f3ee65bd341c47ed2015322d8d0575efac0eaa9518e967a2c40e91a3f560d58ea553ed3d089d729dd53671db1abe271bd4d
+DIST ncurses-6.5-20250405.patch.gz 89875 BLAKE2B ef06de623a5940dc5648392765f280d6e8b47693cbc7c41df269ed3df62031675e5f0b53dcca005d00591fcad9ce46d162051a2c8397eb8b1909db3d9ac3fc2b SHA512 bc540cf6e6b58253900733c9362a1662c77369b79a0553a6a56edb2aa63b72815bd9e083944b6f8b84228c81f2ee0647c2d5cafba6cb12fb6486371320a60d87
+DIST ncurses-6.5-20250405.patch.gz.asc 729 BLAKE2B 1612dda4524e1764ad7d6d28399e3b968c1e6c00b1b49179ed560382bf97e8570011719bdcaba284dd7d3a4952badb64216a2bf6e7128ac78d3eb156de9bf445 SHA512 3634ea82cdd716ac59da52743af551ca0720bf0c07b2a237f7eec010628b5cff636cc96eff167402097e8eb5aac11bceeaecccf270ae44081b7c85982d82d895
+DIST ncurses-6.5-20250412.patch.gz 19036 BLAKE2B ab471f5d9f3a8d7cc05104ad0d40036b1e38440092787e79b7fb705d576a954d11bbd5acbc279d550ceb6e220f51ac2cde1075f31dfe71633e4c73ab8ae04697 SHA512 ae240b24977f78876f9fdfcecfccafd22d3561200fa4a751b870a0c467d693080c854b62750bfd63bd0809967f62b300aedb8ec7f6d24f0cbb299442e2ddd39e
+DIST ncurses-6.5-20250412.patch.gz.asc 729 BLAKE2B 36a5ec7490b3f25a2696052d59292bdf4588db3d73b73fdfb47f0f199844e6ece26a8fad0af499b9b53ac6fb9a37085d2146a0f490275aa27fa255912af6b5e2 SHA512 baf8c20988a620eee8eb4dc4399ae635523fe644578ecf73605f4c736fdfff281d0cc4a6d7df591bee5ef344d3ea2d0d3e0615962f0d78a6194a91f48ef7a7eb
+DIST ncurses-6.5-20250419.patch.gz 14283 BLAKE2B 395988f7f2f5622954d98296976e77889e3a9d5fe82d745c83afbf95b13618ba9fa07d1e28cb80ba51be00f28beb29f20ef4aab0f3f8d1c29627c1fa8853203a SHA512 59120b8a53277a134946aaf367935656ebe31c2cd955a0dc403b799cf9e56db692d76c66c6274d4a32fea567ef8ab3bdddf20667ba9a909d8d856597b24ae4dd
+DIST ncurses-6.5-20250419.patch.gz.asc 729 BLAKE2B 47043488c3595f8ac519c4ec71ab0054640f14d28b74a7bd335bc1af18d592ec92cedd4a2e18c88ed67f6d1bdb9b0aa8b0a842222de0533e1f0f01ada56bb93e SHA512 0ba92af7ded7ecccf49f7cb2ede7a49b964dea1df094a8c821f1b198fe09c23c4ef01002894a448aedc82baec4d3af3d020c7fbca9d108a31452430392400d2a
+DIST ncurses-6.5-20250426.patch.gz 9888 BLAKE2B 2442d328642ff0361d60468e726bdef62496be1d95ee715ced4c9ee5469b8ff1b0b092743a9487dae3e154c3d5a476d58af27853b7e7a0bc7db6685006a23dcc SHA512 ccb28a0e0003efa6acb7e678ecd6c8ffb35437db869ee0feb2d7f9ecdac0e89720ed09fe37d85bfc83ba4eeefe8db80765e80995f63420d789975adf4a2cf494
+DIST ncurses-6.5-20250426.patch.gz.asc 729 BLAKE2B 917622a82bba7a18af851d487b3d0969820e485bc2695b1a543d467ab899360e9502149ba32ff731b6a9c8050104f8024a9589ec29fe7d8be644d92e0ed8fe74 SHA512 00ea24c7564c594ea43b29b6ff9cb763b5bc69c1f3b4be60505150db8487533bbfe9b93cf702f0ea6bfba5a1fe203c91c8e0b1c93e22e1b973178377ef4cc970
+DIST ncurses-6.5-20250503.patch.gz 51443 BLAKE2B a45f007e24843b6c2a73c5f15652d38f992aa88a2543189e5c210977e2962be269637d89362acfd5b17d4e2da8342cd99a8695746cd3501cccc9c026c3318b6b SHA512 402075f35583917b2a2ec27a3a2f30052685cf4657b37b1032c970dbb929ef26318ec537d52cde8715c3dc937732a7c603a08c889e38c5cab46c9010e817d991
+DIST ncurses-6.5-20250503.patch.gz.asc 729 BLAKE2B c0efd97a3ca71396f3e33c263c3c0129c957f195fa8ac319924c860742e917dde17f88c27706ebf7481d6518cc1f86b086dfdf0b637a05357f9826d3a0cbd20e SHA512 b8a30ae8ece99fadc3beba610ea7f404070fcf59dc314029dc2bc6345bc79c9420ca3c631da7af7d60aa4d2dfcda2fb1b042acadcae1534add5befaa24fdec76
+DIST ncurses-6.5-20250510.patch.gz 5373 BLAKE2B 81cb9afe5b73c8daf7781891d3adbe4e3c0d52dc15f053f4a53faf3c7ced4f30c4a0d7351a6225fc7c9c3d0485534664523ee77ebe9ecdbb853cb1f33336ca1a SHA512 83ca80ae6f52f87956fcd9e87c21db923ced3251f81d781bfc9de25619546edda79c2324a9cb3ea1735c6fc993ba0aa67f1fe6f57c40f800ea810fda0eaa15b4
+DIST ncurses-6.5-20250510.patch.gz.asc 729 BLAKE2B 52ceb3917a9151cd3d1d02232e7a109697305627bac43ff0c548c6cbbf58b79268f13e85c55c47a8d7a6a889e2c63fe09596fd50b2fd7967eb28ccce0699b26b SHA512 65685481dbc730cdce750965cc9384c8390752d942855bee9e2536b50d0b14098836eb8290f3aa7f9f47b271bb756b250b399e36ab229da9148b14edd3d88dee
+DIST ncurses-6.5-20250517.patch.gz 98030 BLAKE2B 164ab687c773b184ae33e1970e11bfc895200311f85a3547d7ec501f9addcce0e064ece9a5d4d29db699c9c73c7c82e502e07275fc5962dc98bd07e69d183ac8 SHA512 fe111fa7e32100c953ba8e1c2ecda7a7cddae5b2e929793e2ed353696d5cf64a7ac69c170fb253f4f1666f47cec3003649e3c9fdc9460842994e35d82591360f
+DIST ncurses-6.5-20250517.patch.gz.asc 729 BLAKE2B a392c600c4fe676b092154082256c01147adf71c1789cab1d95bb886bd1b869ad9d163f4b3c12ae8382ed729269ea43f8112abfd4cf36ead2c930f1bf6623825 SHA512 695dfb27ffa68175113fac3ccde8cb456cb78b6797fe6fd3aa7a8e08ffc48bd273b68a35741ba356b935545314e3e9669fa02e3dc6caf11fa20960e6011e4b67
+DIST ncurses-6.5-20250524.patch.gz 3599 BLAKE2B 5e1da13964f10d846afb26f8759590fd8ac921b386cef77922a509b50ece7f35867d1dbfaaa37c67186cfb718be12eb782bc2dae8ea9ec1cf5291341b24af612 SHA512 b900f9b6f507130da2129d3399540a7c1462cbe64c8d44319b28768521269b0ac823b6b0ebb3a51d0ba68aafc7e05b9699ff7f08ec2213550e9d80a9b2c6bc2e
+DIST ncurses-6.5-20250524.patch.gz.asc 729 BLAKE2B ba0c26a977da6874fa9f005dd094527739357384626b86f40edb73f9e41b63f5f43953ef9ec67dcb0d82404f822f6599c38ef8b5d4bb0e3b20e6c8f04115cc27 SHA512 6fafad6288c3fd87efded4faed2f2a4de705bf207cdecb5759f13be9bc6e2f866a1eb7d47719388f974954e78ab8c70e9be8b558e8f2662a2c042d16662ea281
+DIST ncurses-6.5-20250531.patch.gz 3172 BLAKE2B 225875dcf8adaf785efc0137ee0cdd7affb378ad266aab0ec2dffd4197cd74daafcda5638f0e3c09720a41ba9506ce46ff7bbdfd51d13cda4096d6b7be1fadb5 SHA512 763a3ce3e26445f4b978a7305b135e2cf94f7973db22b7228ff1fe9eee93ffe82ed32aa0012c9b2916599ab3980e455140f5150af420d85b75f33a426542acf8
+DIST ncurses-6.5-20250531.patch.gz.asc 729 BLAKE2B 94e72ea10c99afecc97c39854522dab0e95d970e77c36b558003717cf4f8a9f32783a994c88f6e5f657310929c518a7b80e46fbaeaf51f48811b7980458b6621 SHA512 5b7e4b98e2127e914aa997b63b59b4e3e5281f7a453d456ea4a29e5ec84da8ab4c8c74a3723e61613e04e85a412f37488a5cd6f4ff5536a05e3d91033035ecc4
 DIST ncurses-6.5.tar.gz 3688489 BLAKE2B d0a05c218b5f320ba9abe2f322787baef1d15d764e503c81d49772b54b2927d28ecbeb500c8e514996226b41f69445b4de44ff423cec25b61847307fe61682ec SHA512 fc5a13409d2a530a1325776dcce3a99127ddc2c03999cfeb0065d0eee2d68456274fb1c7b3cc99c1937bc657d0e7fca97016e147f93c7821b5a4a6837db821e8
 DIST ncurses-6.5.tar.gz.sig 438 BLAKE2B 5789b47932ec97d3863c7a65306369f0a36cb5b1a35c1e009b5174f50941edceafc22e6f07db3843a096773663a0ca602c0ecb9465e6042d9a78d76ae5008215 SHA512 96ce61a3d529e48e249acecbf4bb9eae2d9f2f67506e92ffa3182f5e98040c38babf0c2c15d92fc5d96e1181e72be1b29fdbff7bee859dfe2ae387f9b8883092
 DIST ncurses-6.5_p20241109-patches.tar.xz 63676 BLAKE2B 9981b740fcec18cc794074ccc93ae1dbe175e52449af2bddfd10a6fb1d5dfe9b545bd19fce5e601d2d85008425fd5cd6fc33042d7bcc854363b0642b9c880efe SHA512 076d2d39c46cf9236e5e65472e10182da2dffffa936c7567b11e23323d64f9739bb3818d4fdbdd75a14fd3f5b202dcdb7aaa6813afb5e303f81c094339824162
 DIST ncurses-6.5_p20250118-patches.tar.xz 64188 BLAKE2B 46ac7c8bcfb0ec4fb032ccff4ba0c57d15f925910eb4d108c626aba8fdecefd21660a05cf54a88a4668b50e489ce0a08526f978a0084c66b2105fc4d929fdfe5 SHA512 12ff29d5ec76487f8b368d481fc19d841e8ce6bc216ff614b6d6d543a1fa36020b403432c802665d99b7fb4f08ae863d7ac331e6e2d95ff86c719fdca383c3e2
 DIST ncurses-6.5_p20250301-patches.tar.xz 65224 BLAKE2B 9db65c728cc6d79e21b7673bb7700069cbf09287acfb65b23a65d607c3172835a9bf7df9a705d3a05b6197684bc7935e1cbed91bf18343c4fb8ebacf17e61dc1 SHA512 f5808f0c2fc1f6027678d8980a0cf598a64c9e85e1d72459dd712090c2dd24eb45261f35b025fd543aed56e903c658942c163b8fe8bace24a56fb8e9238da29e
+DIST ncurses-6.5_p20250531-patches.tar.xz 65304 BLAKE2B b696a473c34df2aa1fe8b03fcbd6dd4bffdc8620917c0651994037bf902526a0c0b2be843beee2dec543677a0289aea35dd7e9ba7161eaef2c5663b4f1e356a8 SHA512 cb638cd2fd7128a7245b95a686df0725cbe133b42d26bdebabe62f070eacc25545845ea09c44d6d73183776a0ad094ae7857e2079b6561f05d94b86730f355db
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
new file mode 100644
index 00000000000..d32df669b86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
@@ -0,0 +1,490 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
+# provide a configure option for the ABI version.
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
+inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
+
+MY_PV="${PV:0:3}"
+MY_P="${PN}-${MY_PV}"
+DESCRIPTION="Console display library"
+HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
+# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
+SRC_URI="
+	mirror://gnu/ncurses/${MY_P}.tar.gz
+	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
+	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
+	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
+"
+
+GENTOO_PATCH_DEV=sam
+GENTOO_PATCH_PV=6.5_p20250531
+GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
+
+# Populated below in a loop. Do not add patches manually here.
+UPSTREAM_PATCHES=()
+
+if [[ ${PV} == *_p* ]] ; then
+	# Sometimes, after releases, there's no megapatch available yet.
+	#
+	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
+	#
+	#	"At times (generally to mark a relatively stable point), I create a rollup
+	#	patch, which consists of all changes from the release through the current date."
+	#
+	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
+	# the patches are considered to be acceptable to use after some testing. They
+	# are both for development but also bug fixes.
+	#
+	# This array should contain a list of all the snapshots since the last
+	# release if there's no megapatch available yet.
+	PATCH_DATES=(
+		20240504
+		20240511
+		20240518
+		20240519
+		20240525
+		20240601
+		20240608
+		20240615
+		20240622
+		20240629
+		20240706
+		20240713
+		20240720
+		20240727
+		20240810
+		20240817
+		20240824
+		20240831
+		20240914
+		20240922
+		20240928
+		20241006
+		20241019
+		20241026
+		20241102
+		20241109
+		20241123
+		20241130
+		20241207
+		20241214
+		20241221
+		20241228
+		20250104
+		20250111
+		20250118
+		20250125
+		20250201
+		20250208
+		20250215
+		20250216
+		20250222
+		20250301
+		20250308
+		20250315
+		20250322
+		20250329
+		20250405
+		20250412
+		20250419
+		20250426
+		20250503
+		20250510
+		20250517
+		20250524
+
+		# Latest patch is just _pN = $(ver_cut 4)
+		$(ver_cut 4)
+	)
+
+	if [[ -z ${PATCH_DATES[@]} ]] ; then
+		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
+		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
+
+		# If we have a rollup patch, use that instead of the individual ones.
+		UPSTREAM_PATCHES+=( patch.sh )
+	else
+		# We use a mirror as well because we've had reports of 403 forbidden for some users.
+		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+
+		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
+		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
+		# Suffix each with .patch.gz
+		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
+		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
+		# Repeat for .patch.gz.asc for verify-sig
+		SRC_URI+=" ${mangled_patches[@]}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
+
+		# For all of the URLs, chuck in invisible-island.net too:
+		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
+
+		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
+
+		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
+	fi
+fi
+
+SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="MIT"
+# The subslot reflects the SONAME.
+SLOT="0/6"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
+# In 6.5_p20250118, the C++ examples fail to link, but there's no automated
+# testsuite anyway. Controlling building examples isn't really what USE=test
+# is for. Just restrict them.
+RESTRICT="!test? ( test ) test"
+
+# TODO: ncurses allows (and we take advantage of this, even) passing
+# the SONAME for dlopen() use, so only the header is needed at build time.
+# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
+# which would be far nicer UX-wise.
+DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
+# Block the older ncurses that installed all files w/SLOT=5, bug #557472
+RDEPEND="
+	${DEPEND}
+	!<=sys-libs/ncurses-5.9-r4:5
+	!<sys-libs/slang-2.3.2_pre23
+	!<x11-terms/rxvt-unicode-9.06-r3
+	!<x11-terms/st-0.6-r1
+	!minimal? ( !<x11-terms/ghostty-1.1.0 )
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
+
+PATCHES=(
+	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
+
+	# When rebasing Gentoo's patchset, please use git from a clean
+	# src_prepare with upstream patches already applied. git am --reject
+	# the existing patchset and rebase as required. This makes it easier
+	# to manage future rebasing & adding new patches.
+	#
+	# For the same reasons, please include the original configure.in changes,
+	# NOT just the generated results!
+	"${WORKDIR}"/${GENTOO_PATCH_NAME}
+)
+
+src_unpack() {
+	# Avoid trying to verify our own patchset tarball, there's no point
+	if use verify-sig ; then
+		local file
+		for file in ${A} ; do
+			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
+			else
+				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
+
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
+			fi
+		done
+	fi
+
+	default
+}
+
+src_configure() {
+	# bug #115036
+	unset TERMINFO
+
+	tc-export_build_env BUILD_{CC,CXX,CPP}
+
+	# bug #214642
+	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
+
+	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
+	# Order matters here -- we want unicode/thread versions to come last so that the
+	# binaries in /usr/bin support both wide and narrow.
+	# The naming is also important as we use these directly with filenames and when
+	# checking configure flags.
+	NCURSES_TARGETS=(
+		ncurses
+		ncursesw
+		ncursest
+		ncursestw
+	)
+
+	# When installing ncurses, we have to use a compatible version of tic.
+	# This comes up when cross-compiling, doing multilib builds, upgrading,
+	# or installing for the first time.  Build a local copy of tic whenever
+	# the host version isn't available. bug #249363, bug #557598
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		local lbuildflags="-static"
+
+		# some toolchains don't quite support static linking
+		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
+		case ${CHOST} in
+			*-darwin*)  dbuildflags=     ;;
+			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
+		esac
+		echo "int main() {}" | \
+			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
+			|| lbuildflags="${dbuildflags}"
+
+		# We can't re-use the multilib BUILD_DIR because we run outside of it.
+		BUILD_DIR="${WORKDIR}" \
+		CC=${BUILD_CC} \
+		CXX=${BUILD_CXX} \
+		CPP=${BUILD_CPP} \
+		CHOST=${CBUILD} \
+		CFLAGS=${BUILD_CFLAGS} \
+		CXXFLAGS=${BUILD_CXXFLAGS} \
+		CPPFLAGS=${BUILD_CPPFLAGS} \
+		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
+		do_configure cross --without-shared --with-normal --with-progs --without-ada
+	fi
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${ABI} == x86 ]] ; then
+		# For compatibility with older binaries at slight performance cost.
+		# bug #616402
+		use stack-realign && append-flags -mstackrealign
+	fi
+
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_configure "${t}"
+	done
+}
+
+do_configure() {
+	local target=$1
+	shift
+
+	mkdir "${BUILD_DIR}/${target}" || die
+	cd "${BUILD_DIR}/${target}" || die
+
+	local conf=(
+		# We need the basic terminfo files in /etc, bug #37026.  We will
+		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
+		# src_install() ...
+		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
+
+		# Enable installation of .pc files.
+		--enable-pc-files
+		# This path is used to control where the .pc files are installed.
+		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
+
+		# Now the rest of the various standard flags.
+		--with-shared
+		--enable-fvisibility
+		# (Originally disabled until bug #245417 is sorted out, but now
+		# just keeping it off for good, given nobody needed it until now
+		# (2022) and we're trying to phase out bdb.)
+		--without-hashed-db
+		$(use_with ada)
+		$(use_with cxx)
+		$(use_with cxx cxx-binding)
+		--with-cxx-shared
+		$(use_with debug)
+		$(use_with profile)
+		# The configure script uses ldd to parse the linked output which
+		# is flaky for cross-compiling/multilib/ldd versions/etc...
+		$(use_with gpm gpm libgpm.so.1)
+
+		# bug #930806
+		--disable-setuid-environ
+		# TODO: Maybe do these for USE=hardened
+		#--disable-root-access
+		#--disable-root-environ
+
+		--disable-termcap
+		--enable-symlinks
+		--with-manpage-format=normal
+		--enable-const
+		--enable-colorfgbg
+		--enable-hard-tabs
+		--enable-echo
+		$(use_enable !ada warnings)
+		$(use_with debug assertions)
+		$(use_enable !debug leaks)
+		$(use_with debug expanded)
+		$(use_with !debug macros)
+		$(multilib_native_with progs)
+		$(use_with test tests)
+		$(use_with trace)
+		$(use_with tinfo termlib)
+		--disable-stripping
+		--disable-pkg-ldflags
+	)
+
+	case ${CHOST} in
+		*-mingw32*)
+			conf+=( --enable-term-driver )
+			;;
+		*)
+			conf+=( --disable-term-driver )
+			;;
+	esac
+
+	if [[ ${target} == ncurses*w ]] ; then
+		conf+=( --enable-widec )
+	else
+		conf+=( --disable-widec )
+	fi
+	if [[ ${target} == ncursest* ]] ; then
+		conf+=( --with-{pthread,reentrant} )
+	else
+		conf+=( --without-{pthread,reentrant} )
+	fi
+
+	# Make sure each variant goes in a unique location.
+	if [[ ${target} == "ncurses" ]] ; then
+		# "ncurses" variant goes into "${EPREFIX}"/usr/include
+		# It is needed on Prefix because the configure script appends
+		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
+		conf+=( --enable-overwrite )
+	else
+		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
+	fi
+	# See comments in src_configure.
+	if [[ ${target} != "cross" ]] ; then
+		local cross_path="${WORKDIR}/cross"
+		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
+	fi
+
+	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
+}
+
+src_compile() {
+	# See comments in src_configure.
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
+	fi
+
+	multilib-minimal_src_compile
+}
+
+multilib_src_compile() {
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_compile "${t}"
+	done
+}
+
+do_compile() {
+	local target=$1
+	shift
+
+	cd "${BUILD_DIR}/${target}" || die
+
+	# A little hack to fix parallel builds ... they break when
+	# generating sources so if we generate the sources first (in
+	# non-parallel), we can then build the rest of the package
+	# in parallel.  This is not really a perf hit since the source
+	# generation is quite small.
+	emake -j1 sources
+
+	# For some reason, sources depends on pc-files which depends on
+	# compiled libraries which depends on sources which ...
+	# Manually delete the pc-files file so the install step will
+	# create the .pc files we want.
+	rm -f misc/pc-files || die
+	emake "$@"
+}
+
+multilib_src_install() {
+	local target
+	for target in "${NCURSES_TARGETS[@]}" ; do
+		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
+	done
+
+	# Move main libraries into /.
+	if multilib_is_native_abi ; then
+		gen_usr_ldscript -a \
+			"${NCURSES_TARGETS[@]}" \
+			$(usex tinfo 'tinfow tinfo' '')
+	fi
+
+	# Don't delete '*.dll.a', needed for linking, bug #631468
+	if ! use static-libs; then
+		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
+	fi
+
+	# Build fails to create this ...
+	# -FIXME-
+	# Ugly hackaround for riscv having two parts libdir (bug #689240)
+	# Replace this hack with an official solution once we have one...
+	# -FIXME-
+	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
+		/usr/$(get_libdir)/terminfo
+
+	# Remove obsolete libcurses symlink that is created by the build
+	# system. Technically, this could be also achieved
+	# via --disable-overwrite but it also moves headers implicitly,
+	# and we do not want to do this yet.
+	# bug #836696
+	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
+}
+
+multilib_src_install_all() {
+	local terms=(
+		# Dumb/simple values that show up when using the in-kernel VT.
+		ansi console dumb linux
+		vt{52,100,102,200,220}
+		# [u]rxvt users used to be pretty common.  Probably should drop this
+		# since upstream is dead and people are moving away from it.
+		rxvt{,-unicode}{,-256color}
+		# xterm users are common, as is terminals re-using/spoofing it.
+		xterm xterm-{,256}color
+		# screen is common (and reused by tmux).
+		screen{,-256color}
+		screen.xterm-256color
+	)
+	if use split-usr ; then
+		local x
+		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
+		einfo "Installing basic terminfo files in /etc..."
+		for x in "${terms[@]}"; do
+			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
+			local basedir=$(basename "$(dirname "${termfile}")")
+
+			if [[ -n ${termfile} ]] ; then
+				dodir "/etc/terminfo/${basedir}"
+				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
+				dosym "../../../../etc/terminfo/${basedir}/${x}" \
+					"/usr/share/terminfo/${basedir}/${x}"
+			fi
+		done
+
+		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
+
+		use minimal && rm -r "${ED}"/usr/share/terminfo*
+		# Because ncurses5-config --terminfo returns the directory we keep it
+		# bug #245374
+		keepdir /usr/share/terminfo
+	elif use minimal ; then
+		# Keep only the basic terminfo files
+		find "${ED}"/usr/share/terminfo/ \
+			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
+			-type d -empty -delete || die
+	fi
+
+	cd "${S}" || die
+	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
+	if use doc ; then
+		docinto html
+		dodoc -r doc/html/
+	fi
+}
+
+pkg_preinst() {
+	preserve_old_lib /$(get_libdir)/libncurses.so.5
+	preserve_old_lib /$(get_libdir)/libncursesw.so.5
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
+	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
index 90a7c816523..8f4d8fc781c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
@@ -5,6 +5,7 @@ DIST readline-8.2.tar.gz 3043952 BLAKE2B 7974322b9c092a756a79e537df08e8532f8e0fc
 DIST readline-8.2.tar.gz.sig 95 BLAKE2B dc510459c0c47782ca87364a6677b4d8f0b68a984143122c08bd15aef08a71bff59ac92d3c3ada518dad09f189c144748e840175041eb619f679e2d8b95dc2aa SHA512 0effd273689e5f7fe7e049c8f2c5f3c97149f198a90d053231ee4de34901560a465ab0d4fd71fd07c7d7e233caed7f42e5b668bffaf1e23a7eb373c8f9e150fe
 DIST readline-8.3-rc1.tar.gz 3415130 BLAKE2B 08dd19a92b7561ab55bd8b8d6a939bf6c31f5545484133de060555e0fb6fbf17b49b2151918d91e537c9fe4d55a17959967684126fedfb26fececd7ff265c207 SHA512 dbaa0eeb2d8bbe8dc89b5ab6d3e47162fd9bad5cf950e33f8f1d3d9baaa9faa014c77ced46b9249c0e56e70b94665f1433ae2e4093dc20f937b19e07bb9fcc74
 DIST readline-8.3-rc1.tar.gz.sig 95 BLAKE2B 1c2b88ff2b2755e121bbe53b22bee75ce435c365ed513afdd7d9053be5860fab7ba15d51b9a2b9621b3b77674b4f46b60f5591b3ccb057e60f4fd9aa4c59872f SHA512 d8e4bfb03f903d696cf6982066ee2c513f5a8e5fd3426d39a39eed4c661a53cb315f156e7c00b3cdfe6dcb6728f5f849f1eea33e766641e971fc11d0b8e6d50c
+DIST readline-8.3_rc1_p20250530-7cf2d923617659d216db3210f6247740f7dde1d8.tar.gz 3477609 BLAKE2B ce694adf5b28982633fe83f062bfb16e3a65888a2926eff2705b9e690e9b4211a2ab2498074fa4b1d292d6ab229ea74ce30ed1e1cbee98191049d6ab7ed71f56 SHA512 14595684649a14926289db2b437bbca17c2211c73bed1fbc98cae192107a81e8e8e806cdd7a77b85b5a6be3a0c8376550a9170539fc6fb7dd515795ebdfe737e
 DIST readline81-001 2454 BLAKE2B 7ec4e5c39a224a70643b44b88bcfef5198e199c76f2a34f0b0ce24f1747dd46be49ddf93871c474cda64322b4358127fec4c2401d19422f84934546bbe1f3bf2 SHA512 cfbef10bdeb562a302ccf214878d02ebadf799343b3d2d7996a282f81bcfde83997ba6dcc9a8477af4dd7c73bca74105ca00a81e42ed13321672bd2930550e54
 DIST readline81-001.sig 95 BLAKE2B 7d523d0fc21772cb03aa4b5d66ea58c1a99a6c0e4a8625e89cad015cbff63cd68e08207ca5150819225300ac864806032888104bbbea64ca38ebf89e28c24b7e SHA512 7fa3747e388aecb26f2d4f8346b89b367710ea99a14618c625066b820901dc467bd156ec37340fde1f86f0fe0d6b33044c1ed5768cf8ed1a25386d32dc6419a6
 DIST readline81-002 1242 BLAKE2B 4ef0404561bd8fc5559e8e5f675ae3f12c467178a8954f54f3204c2d09b88ccec960e807c7af0ec3514b489b676e3be51f98351e377fb18e3d7a14d33d4da69d SHA512 e47c029b82cf3a4d44e85c4348f7e059c56726694c190d84186822e1c893e1c006e7ec75f33c36791112f81abd792a2e2fdae9a65cd128f3c89ff4ffd9a9a1ff
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_rc1_p20250530.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_rc1_p20250530.ebuild
new file mode 100644
index 00000000000..9e75fb4b342
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_rc1_p20250530.ebuild
@@ -0,0 +1,265 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# There's no standard way of versioning the point releases upstream
+# make anyway, so while this was added for RC versions, it's fine
+# in general.
+QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
+
+# Official patches
+# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+DESCRIPTION="Another cute console display library"
+HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	READLINE_COMMIT="7cf2d923617659d216db3210f6247740f7dde1d8"
+	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
+	S="${WORKDIR}/${MY_P}"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/readline"
+		mirror_url_base="ftp://ftp.cwru.edu/pub/readline"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			# Add in the mirror URL too.
+			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
+			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}}.sig )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
+	fi
+fi
+
+LICENSE="GPL-3+"
+SLOT="0/8"  # subslot matches SONAME major
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="static-libs +unicode utils"
+
+RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
+	"${FILESDIR}"/${PN}-7.0-headers.patch
+	"${FILESDIR}"/${PN}-8.0-headers.patch
+
+	# TODO: rebase
+	#"${FILESDIR}"/${PN}-8.0-darwin-shlib-versioning.patch
+)
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	default
+
+	#(( PLEVEL < 0 )) && eautoreconf
+
+	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
+		# If we're bootstrapping, make a guess. We don't have pkg-config
+		# around yet. bug #818103.
+		# Incorrectly populating this leads to underlinked libreadline.
+		local ncurses_libs
+		local ncurses_libs_suffix=$(usex unicode w '')
+
+		ncurses_libs="-lncurses${ncurses_libs_suffix}"
+
+		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
+			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
+		fi
+	else
+		# Force ncurses linking, bug #71420.
+		# Use pkg-config to get the right values, bug #457558.
+		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
+	fi
+
+	sed -i \
+		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
+		support/shobj-conf || die
+	sed -i \
+		-e "/^[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
+		examples/rlfe/configure || die
+
+	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
+	# objformat for years, so we don't want to rely on that.
+	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
+
+	# For local readline headers
+	ln -s ../.. examples/rlfe/readline || die
+}
+
+src_configure() {
+	# Fix implicit decls with widechar funcs
+	append-cppflags -D_GNU_SOURCE
+	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
+	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
+
+	# Make sure configure picks a better ar than `ar`, bug #484866
+	export ac_cv_prog_AR="$(tc-getAR)"
+
+	# Force the test since we used sed above to force it.
+	export bash_cv_termcap_lib=ncurses
+
+	# Control cross-compiling cases when we know the right answer.
+	# In cases where the C library doesn't support wide characters, readline
+	# itself won't work correctly, so forcing the answer below should be OK.
+	if tc-is-cross-compiler ; then
+		export bash_cv_func_sigsetjmp="present"
+		export bash_cv_func_ctype_nonascii="yes"
+		# bug #503312
+		export bash_cv_wcwidth_broken="no"
+	fi
+
+	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
+	# so we can re-use the config cache file between the two.
+	append-ldflags -L.
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--cache-file="${BUILD_DIR}"/config.cache
+		--with-curses
+		$(use_enable static-libs static)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		mkdir -p examples/rlfe || die
+		cd examples/rlfe || die
+
+		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
+	fi
+}
+
+multilib_src_compile() {
+	emake
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		cd examples/rlfe || die
+		local l
+		for l in readline history ; do
+			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
+			ln -s ../../lib${l}.a lib${l}.a || die
+		done
+		emake
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi ; then
+		if use utils && ! tc-is-cross-compiler; then
+			dobin examples/rlfe/rlfe
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
+
+	dodoc USAGE
+	docinto ps
+	dodoc doc/*.ps
+}
+pkg_preinst() {
+	# bug #29865
+	# Reappeared in bug #595324 with paludis so keeping this for now...
+	preserve_old_lib \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
index b32518a3794..a083802f828 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ SRC_URI="https://www.samba.org/ftp/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3 LGPL-3+ LGPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 IUSE="compat +python test valgrind"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
index d179aa7975e..f8936c01030 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.12.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://samba.org/ftp/tdb/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
index 037719db24f..4729fc57e83 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ SRC_URI="https://samba.org/ftp/tevent/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
 IUSE="python test"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
index 539afc06569..790df813137 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/timezone-data/timezone-data-2025b.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/tzdb-${PV}
 
 LICENSE="BSD public-domain"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="nls leaps-timezone zic-slim"
 
 DEPEND="nls? ( virtual/libintl )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
index f81cf5fac8d..e7318f89fd2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/zlib/zlib-1.3.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,7 +6,7 @@ EAPI=8
 # Worth keeping an eye on 'develop' branch upstream for possible backports.
 AUTOTOOLS_AUTO_DEPEND="no"
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/madler.asc
-inherit autotools edo multilib-minimal flag-o-matic verify-sig
+inherit autotools dot-a edo multilib-minimal flag-o-matic verify-sig
 
 DESCRIPTION="Standard (de)compression library"
 HOMEPAGE="https://zlib.net/"
@@ -68,6 +68,11 @@ src_prepare() {
 	esac
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	# We pass manually instead of relying on the configure script/makefile
 	# because it would pass it even for older binutils.
@@ -164,6 +169,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	dodoc FAQ README ChangeLog doc/*.txt
 
 	if use minizip ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r1.ebuild
deleted file mode 100644
index f55bbf7f30f..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r1.ebuild
+++ /dev/null
@@ -1,68 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit cmake flag-o-matic
-
-# guard against forgetfulness, https://bugs.gentoo.org/795936
-GIT_COMMIT_0190="de40ad007797e0dcd8b7126f27bb87401d224240"
-GIT_COMMIT="GIT_COMMIT_${PV//./}"
-GIT_COMMIT="${!GIT_COMMIT}"
-
-DESCRIPTION="A tiny but valid init for containers"
-HOMEPAGE="https://github.com/krallin/tini"
-SRC_URI="https://github.com/krallin/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 hppa ppc64 ~riscv ~x86"
-IUSE="+args +static"
-
-PATCHES=("${FILESDIR}/tini-0.19.0-musl-basename.patch")
-
-src_prepare() {
-
-	[[ -z ${GIT_COMMIT} ]] && die "forgetful maintainer! please define GIT_COMMIT_${PV//./} on bump"
-
-	cmake_src_prepare
-
-	local sed_args=(
-		# Do not strip binary
-		-e 's/-Wl,-s")$/")/'
-
-		# Remove -Werror and -pedantic-errors in order to allow macro
-		# redefinition, so that CFLAGS="-U_FORTIFY_SOURCE" does not
-		# trigger an error due to add_definitions(-D_FORTIFY_SOURCE=2)
-		# in CMakeLists.txt (bug 626438).
-		-e "s/ -Werror / /"
-		-e "s/ -pedantic-errors / /"
-	)
-
-	sed -i "${sed_args[@]}" \
-		-e "s/git.*status --porcelain.*/true/" \
-		-e "s/git.*log -n 1.*/true/" \
-		-e "s/git.\${tini_VERSION_GIT}/git.${GIT_COMMIT}/" \
-		CMakeLists.txt || die
-}
-
-src_configure() {
-	local mycmakeargs=()
-	use args || mycmakeargs+=(-DMINIMAL=ON)
-
-	cmake_src_configure
-}
-
-src_compile() {
-	append-cflags -DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37
-	cmake_src_compile
-}
-
-src_install() {
-	cmake_src_install
-	if use static; then
-		mv "${ED}"/usr/bin/{${PN}-static,${PN}} || die
-	else
-		rm "${ED}"/usr/bin/${PN}-static || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
index ac403b354fc..7cda7f7e38d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/tini/tini-0.19.0-r2.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://github.com/krallin/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ~hppa ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 hppa ppc64 ~riscv ~x86"
 IUSE="+args +static"
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.0.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.0.ebuild
index fa5ecac0c22..8cac0712d62 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.0.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} = 9999* ]]; then
 	GIT_ECLASS="git-r3"
 fi
 
-inherit ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
+inherit flag-o-matic ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
 
 DESCRIPTION="Low-level pixel manipulation routines"
 HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
@@ -32,6 +32,13 @@ pkg_setup() {
 }
 
 multilib_src_configure() {
+	# Temporary workaround for a build failure (known gcc issue):
+	#
+	#  * https://bugs.gentoo.org/956715
+	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
+	#
+	use riscv && filter-lto
+
 	local emesonargs=(
 		$(meson_feature cpu_flags_x86_mmxext mmx)
 		$(meson_feature cpu_flags_x86_sse2 sse2)
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-9999.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-9999.ebuild
index fa5ecac0c22..8cac0712d62 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-9999.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} = 9999* ]]; then
 	GIT_ECLASS="git-r3"
 fi
 
-inherit ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
+inherit flag-o-matic ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
 
 DESCRIPTION="Low-level pixel manipulation routines"
 HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
@@ -32,6 +32,13 @@ pkg_setup() {
 }
 
 multilib_src_configure() {
+	# Temporary workaround for a build failure (known gcc issue):
+	#
+	#  * https://bugs.gentoo.org/956715
+	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
+	#
+	use riscv && filter-lto
+
 	local emesonargs=(
 		$(meson_feature cpu_flags_x86_mmxext mmx)
 		$(meson_feature cpu_flags_x86_sse2 sse2)