diff --git a/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest b/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
index 67dd2c6a6c1..17da9698ff2 100644
--- a/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
@@ -1,2 +1,4 @@
 DIST sudo-1.9.17p1.tar.gz 5449076 BLAKE2B 21771348a8de392767c366bb938951327dcc64a4cedee716a802435899e5135c218468271833a9e3ab9d90bda29e36c0870e27dd333d3a5c64fb8e3a5ebbff58 SHA512 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
 DIST sudo-1.9.17p1.tar.gz.sig 566 BLAKE2B b6380c84b82740455a28388925d27bdf9296ddef943653c1883af3c7684ab53571053ef333ac9747ee11330b06fd23adf477856f70bd5fcaa6dbda1c9e432675 SHA512 714ce7c613683689e9d166171b04c03220e21d06f2e66d800f2d075927830014447611933d7293d9c763beeea66fc02255d8175c9ac8cba6d62166750aab50a6
+DIST sudo-1.9.17p2.tar.gz 5451682 BLAKE2B dd42ff4fd571ba8489cc59d71a09c7e0483d21daf9faf7e697beedc04d9f170b01e60446af179c949a3da115b616fbec07aff8fbf8b7d502161c24d1b35b7a69 SHA512 c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93
+DIST sudo-1.9.17p2.tar.gz.sig 566 BLAKE2B b778061533cd2778eec1093fc37e89f45ea4b2a5e97a71f85fc00fbfc1b550a194e4faa410bc072e3ecbd233a3834f004d7451e020d2be148a36336b35d462e5 SHA512 7ca1949a7ffe0481d7c0f9215fdeae54fff34f0156f06c72a090515b1a97d052e63ce94cffe5a92ca23a723ddd0b0186fabc957cdc22120482c6f9f87d65a5f6
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
new file mode 100644
index 00000000000..4bc530f28c2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
@@ -0,0 +1,292 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit pam tmpfiles toolchain-funcs
+
+MY_P="${P/_/}"
+MY_P="${MY_P/beta/b}"
+
+DESCRIPTION="Allows users or groups to run commands as other users"
+HOMEPAGE="https://www.sudo.ws/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://github.com/sudo-project/sudo
+		https://git.sudo.ws/sudo
+	"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc
+	inherit libtool verify-sig
+
+	uri_prefix=
+	case ${P} in
+		*_beta*|*_rc*) uri_prefix=beta/ ;;
+	esac
+
+	SRC_URI="
+		https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
+		verify-sig? (
+			https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig
+		)
+	"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	fi
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"
+fi
+
+S="${WORKDIR}/${MY_P}"
+
+# Basic license is ISC-style as-is, some files are released under
+# 3-clause BSD license
+LICENSE="ISC BSD"
+SLOT="0"
+IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd"
+
+DEPEND="
+	sys-libs/zlib:=
+	virtual/libcrypt:=
+	gcrypt? ( dev-libs/libgcrypt:= )
+	ldap? (
+		>=net-nds/openldap-2.1.30-r1:=
+		sasl? (
+			dev-libs/cyrus-sasl
+			net-nds/openldap:=[sasl]
+		)
+	)
+	pam? ( sys-libs/pam )
+	sasl? ( dev-libs/cyrus-sasl )
+	selinux? ( sys-libs/libselinux )
+	skey? ( >=sys-auth/skey-1.1.5-r1 )
+	ssl? ( dev-libs/openssl:= )
+	sssd? ( sys-auth/sssd[sudo(+)] )
+"
+RDEPEND="
+	${DEPEND}
+	>=app-misc/editor-wrapper-3
+	virtual/editor
+	ldap? ( dev-lang/perl )
+	pam? ( sys-auth/pambase )
+	selinux? ( sec-policy/selinux-sudo )
+	sendmail? ( virtual/mta )
+"
+BDEPEND+="
+	app-alternatives/yacc
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	?? ( pam skey )
+	?? ( gcrypt ssl )
+"
+
+MAKEOPTS+=" SAMPLES="
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+set_secure_path() {
+	# First extract the default ROOTPATH from build env
+	SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
+
+	case "${SECURE_PATH}" in
+		*/usr/sbin*)
+			;;
+		*)
+			SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}")
+			;;
+	esac
+
+	if [[ -z ${SECURE_PATH} ]] ; then
+		ewarn "	Failed to detect SECURE_PATH, please report this"
+	fi
+
+	# Then remove duplicate path entries
+	cleanpath() {
+		local newpath thisp IFS=:
+		for thisp in $1 ; do
+			if [[ :${newpath}: != *:${thisp}:* ]] ; then
+				newpath+=:${thisp}
+			else
+				einfo "   Duplicate entry ${thisp} removed..."
+			fi
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}}
+
+	# Finally, strip gcc paths, bug #136027
+	rmpath() {
+		local e newpath thisp IFS=:
+		for thisp in ${SECURE_PATH} ; do
+			for e ; do
+				[[ ${thisp} == ${e} ]] && continue 2 ;
+			done
+			newpath+=:${thisp}
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
+}
+
+src_configure() {
+	local SECURE_PATH
+
+	set_secure_path
+
+	# bug #767712
+	tc-export PKG_CONFIG
+
+	# - audit: somebody got to explain me how I can test this before I
+	# enable it.. - Diego
+	# - plugindir: autoconf code is crappy and does not delay evaluation
+	# until `make` time, so we have to use a full path here rather than
+	# basing off other values.
+	local myeconfargs=(
+		# We set all of the relevant options by ourselves (patched
+		# into the toolchain) and setting these in the build system
+		# actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3
+		# (it'll downgrade to =2). So, this has no functional effect on
+		# the hardening for users. It's safe.
+		--disable-hardening
+
+		# requires some python eclass
+		--disable-python
+		--enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d
+		--enable-zlib=system
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+		--with-env-editor
+		--with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
+		--with-rundir="${EPREFIX}"/run/sudo
+		--with-vardir="${EPREFIX}"/var/db/sudo
+		--without-linux-audit
+		--without-opie
+		$(use_enable gcrypt)
+		$(use_enable nls)
+		$(use_enable sasl)
+		$(use_enable ssl openssl)
+		$(use_with ldap)
+		$(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
+		$(use_with offensive insults)
+		$(use_with offensive all-insults)
+		$(use_with pam)
+		$(use_with pam pam-login)
+		$(use_with secure-path)
+		"$(use_with secure-path secure-path-value "${SECURE_PATH}")"
+		$(use_with selinux)
+		$(use_with sendmail)
+		$(use_with skey)
+		$(use_with sssd)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	if use ldap ; then
+		dodoc README.LDAP.md
+
+		cat <<-EOF > "${T}"/ldap.conf.sudo
+		# See ldap.conf(5) and README.LDAP.md for details
+		# This file should only be readable by root
+
+		# supported directives: host, port, ssl, ldap_version
+		# uri, binddn, bindpw, sudoers_base, sudoers_debug
+		# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
+		EOF
+
+		if use sasl ; then
+			cat <<-EOF >> "${T}"/ldap.conf.sudo
+
+			# SASL directives: use_sasl, sasl_mech, sasl_auth_id
+			# sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname
+			EOF
+		fi
+
+		insinto /etc
+		doins "${T}"/ldap.conf.sudo
+		fperms 0440 /etc/ldap.conf.sudo
+
+		insinto /etc/openldap/schema
+		newins docs/schema.OpenLDAP sudo.schema
+	fi
+
+	if use pam ; then
+		pamd_mimic system-auth sudo auth account session
+		pamd_mimic system-auth sudo-i auth account session
+	fi
+
+	keepdir /var/db/sudo/lectured
+	fperms 0700 /var/db/sudo/lectured
+	# bug #652958
+	fperms 0711 /var/db/sudo
+
+	# Don't install into /run as that is a tmpfs most of the time
+	# (bug #504854)
+	rm -rf "${ED}"/run || die
+
+	# bug #697812
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process sudo.conf
+
+	# bug #652958
+	local sudo_db="${EROOT}/var/db/sudo"
+	if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
+		chmod 711 "${sudo_db}" || die
+	fi
+
+	if use ldap ; then
+		ewarn
+		ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration."
+		ewarn
+		if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
+			ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
+			ewarn "configured in ${ROOT}/etc/nsswitch.conf."
+			ewarn
+			ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:"
+			ewarn "  sudoers: ldap files"
+			ewarn
+		fi
+	fi
+	if use prefix ; then
+		ewarn
+		ewarn "To use sudo on Prefix, you need to change file ownership and permissions"
+		ewarn "with root privileges, as follows:"
+		ewarn
+		ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
+		ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
+		ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
+		ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
+		ewarn
+	fi
+
+	elog "To use the -A (askpass) option, you need to install a compatible"
+	elog "password program from the following list. Starred packages will"
+	elog "automatically register for the use with sudo (but will not force"
+	elog "the -A option):"
+	elog ""
+	elog " [*] net-misc/ssh-askpass-fullscreen"
+	elog "     net-misc/x11-ssh-askpass"
+	elog ""
+	elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
+	elog "variable to the program you want to use."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
index 98528da0064..518b752ba8f 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -54,10 +54,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
index 5fc6a3e9f2a..cd99b755cc6 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
index f08eff27086..930b7abefbd 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
index c8bba3f996d..9eafb3a45d2 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}
 
 # update this on every bump
@@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
index 449e318ef1b..5d819509409 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
@@ -4,3 +4,5 @@ DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
 DIST incus-6.14.tar.xz 12509468 BLAKE2B ec3bb614088d82e07c13169a6b26d8c83214fddbdf30049d58f2cca2678a16ccb6acca7bba68d4e15a514dad71639a144a7b2f4b9f3efdf9c8ca8d750692e250 SHA512 186abb32dcfbe851f04131ea7a9256fafaa465d40379e825554275697e04f005920c09939a8cb199b499b60df667921900c4a2d5b9a7ab9bd20b3e473468dbf1
 DIST incus-6.14.tar.xz.asc 833 BLAKE2B c9cfa631bb316234a6958f2aa3e708e32ea2fca34357700e7d1e38723be539f5b6b1484597c18baca1f22d922c7aca148463dfc0b818f7809126e6873e4826b5 SHA512 6a2f4ceeab44462cca74799a1c135eeb17cbece3d270c5195c3eacda8ea24419fc34cab6d157dbfed803bb269df42a02abc417b98887cec5f10b0ec70b430644
+DIST incus-6.15.tar.xz 12716184 BLAKE2B bc821575f7f24b42054028ce628a29f38ef41b8a31a94f34381019306681f9279ae6c36cb00b7f84d62f5ddc89d27216d753e5c0f5ec1d327bbd283ab5fe1e15 SHA512 7561abce8eb9c01764aca9bb5477028439c05f6c1c20637f288028be93f4bc0d74a36af76f7ad0e35028dfe40e2a0bb2d7b4a363d1da35fe657072f5d847c78e
+DIST incus-6.15.tar.xz.asc 833 BLAKE2B ccab84a2fd3f9d6971ff0fd7cba9afc23dbe0fc0bcb8738656f9071db7c773840566009d5014dc15d37be26bff018e3faf8af59dd5d50b629aebd2e79cf3dc5e SHA512 b1bf43ffff719a3f1c6be7a8d32e44f418efb8e926914dea5479ba1175768910fa38b4e5b83c51e90ec34d2d345629597beb286215b9658a611cf568b8e43122
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
new file mode 100644
index 00000000000..29786771bf1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
@@ -0,0 +1,253 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
+		local bindir="_dist/bin/linux_${GOARCH}"
+	else
+		local bindir="_dist/bin"
+	fi
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
index 9b1df9b06a1..1725c921564 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
@@ -1,5 +1,3 @@
-DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
-DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855
 DIST gpgme-1.24.3.tar.bz2 1892862 BLAKE2B ace04d4fc803f6ce96f850a46b4b383ebdcbfe51d55fbe2a5ced10451310553c15ee5a603d1e6ffb78a8de75461fafacc296fec3e4f38d4908171a095cab185f SHA512 3b5fc22a2f83576058ac14e744333f46df362b39f742d6c9e54a5a66828194a1312f5f365bdc15683e148821f5d591fa92a2daad83fc116f65dccf14e817ca48
 DIST gpgme-1.24.3.tar.bz2.sig 238 BLAKE2B 5b8402b011899faae26bcba428e45a7bb7baf9b16e4c605cdae3d84dc1cbf52ccd524181ef0726e25075c42f9ccb72cd996707a2f96c04b7054cc9050270b586 SHA512 056b28b041dd83c86984e73c31403ea45d33db30c1b2b05e45b0cfb5bb723b25a0fa21ddee192c135cea5d93d934502085bc0fc94fa3c29858513e260c332948
 DIST gpgme-2.0.0.tar.bz2 1383911 BLAKE2B 7053955f80f9a69c62d8b4bb6cc80ea259e6854857b340577c4a68fac1d34c0f2aff1dbbf88b503dd2b021c48d9fff67709593817f3b0e74f72df913d7e3de0d SHA512 ee58dc2a4273c740d5b9ef13cc655d5e600ddddd137fb85a781c31e8854829283b4ce241d7810a963d9a125d603213600f37e7d0c1ce3b3cf1b935e62cf60777
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
deleted file mode 100644
index 32458e4c9b7..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
+++ /dev/null
@@ -1,178 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintainers should:
-# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
-# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
-# (find the one for the current release then subscribe to it +
-# any subsequent ones linked within so you're covered for a while.)
-
-DISTUTILS_EXT=1
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-
-# in-source builds are not supported:
-# * https://dev.gnupg.org/T6313#166339
-# * https://dev.gnupg.org/T6673#174545
-inherit distutils-r1 libtool flag-o-matic out-of-source qmake-utils toolchain-funcs verify-sig
-
-DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
-HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
-SRC_URI="
-	mirror://gnupg/gpgme/${P}.tar.bz2
-	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
-"
-
-LICENSE="GPL-2 LGPL-2.1"
-# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
-# Use e.g. app-portage/iwdevtools integration with dev-libs/libabigail's abidiff.
-# Subslot: SONAME of each: <libgpgme.libgpgmepp.libqgpgme.FUDGE>
-# Bump FUDGE if a release is made which breaks ABI without changing SONAME.
-# (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
-SLOT="1/11.6.15.2"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	qt5? ( cxx )
-	qt6? ( cxx )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-# - On each bump, update dep bounds on each version from configure.ac!
-RDEPEND="
-	>=app-crypt/gnupg-2
-	>=dev-libs/libassuan-2.5.3:=
-	>=dev-libs/libgpg-error-1.46-r1:=
-	python? ( ${PYTHON_DEPS} )
-	qt5? ( dev-qt/qtcore:5 )
-	qt6? ( dev-qt/qtbase:6 )
-"
-DEPEND="
-	${RDEPEND}
-	test? (
-		qt5? ( dev-qt/qttest:5 )
-	)
-"
-#doc? ( app-text/doxygen[dot] )
-BDEPEND="
-	python? (
-		${PYTHON_DEPS}
-		${DISTUTILS_DEPS}
-		dev-lang/swig
-	)
-	verify-sig? ( sec-keys/openpgp-keys-gnupg )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
-	"${FILESDIR}"/${PN}-1.23.1-tests-gnupg-no-tofu.patch
-)
-
-src_prepare() {
-	default
-
-	elibtoolize
-
-	# bug #697456
-	addpredict /run/user/$(id -u)/gnupg
-
-	local MAX_WORKDIR=66
-	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
-		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
-		die "Could not run tests as requested with too-long WORKDIR."
-	fi
-
-	# Make best effort to allow longer PORTAGE_TMPDIR
-	# as usock limitation fails build/tests
-	ln -s "${P}" "${WORKDIR}/b" || die
-	S="${WORKDIR}/b"
-}
-
-my_src_configure() {
-	# bug #847955
-	append-lfs-flags
-
-	cd "${BUILD_DIR}" || die
-
-	local languages=(
-		$(usev common-lisp 'cl')
-		$(usev cxx 'cpp')
-		$(usev qt5 'qt5')
-		$(usev qt6 'qt6')
-	)
-
-	use qt5 && export MOC5="$(qt5_get_bindir)/moc"
-	use qt6 && export MOC6="$(qt6_get_libdir)/qt6/libexec/moc"
-
-	local myeconfargs=(
-		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
-		--enable-languages="${languages[*]}"
-		$(use_enable static-libs static)
-		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
-	if use python ; then
-		emake -C lang/python prepare
-
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_configure
-		popd > /dev/null || die
-	fi
-}
-
-my_src_compile() {
-	cd "${BUILD_DIR}" || die
-
-	emake
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_compile
-		popd > /dev/null || die
-	fi
-}
-
-my_src_test() {
-	cd "${BUILD_DIR}" || die
-
-	emake check
-
-	if use python ; then
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	emake -C lang/python/tests check \
-		PYTHON=${EPYTHON} \
-		PYTHONS=${EPYTHON} \
-		TESTFLAGS="--python-libdir=${BUILD_DIR}/lib"
-}
-
-my_src_install() {
-	einstalldocs
-
-	cd "${BUILD_DIR}" || die
-
-	emake DESTDIR="${D}" install
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_install
-		popd > /dev/null || die
-	fi
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	# Backward compatibility for gentoo
-	# (in the past, we had slots)
-	dodir /usr/include/gpgme
-	dosym -r /usr/include/gpgme.h /usr/include/gpgme/gpgme.h
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
index 851345f5f63..d7197f1d5ce 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
@@ -1,2 +1 @@
-DIST p11-kit-0.25.3.tar.xz 991528 BLAKE2B 5c695c1ef95edf4bbbab001aa634076c433df0bc89cb8104deaec2ce00c6908640e467755b49c6900e5d7d5d81e1a3871f4978a212c6f6ae088386ac0b95289a SHA512 ad2d393bf122526cbba18dc9d5a13f2c1cad7d70125ec90ffd02059dfa5ef30ac59dfc0bb9bc6380c8f317e207c9e87e895f1945634f56ddf910c2958868fb4c
 DIST p11-kit-0.25.5.tar.xz 1002056 BLAKE2B 96d6a9c2807586abafae4da4df89f566672733963997d6a83e00aaf83a7a0c0e2995638f505e98fb87a90c60bde28814f1e8b7d5071bf0af96bb0467105a1ddc SHA512 177ec6ff5eb891901078306dce2bf3f5c1a0e5c2a8c493bdf5a08ae1ff1240fdf6952961e973c373f80ac3d1d5a9927e07f4da49e4ff92269d992e744889fc94
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
deleted file mode 100644
index 9b316ee2fad..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-https://bugs.gentoo.org/918982
-https://github.com/p11-glue/p11-kit/commit/d49c92c8420db6ee4c88515bdb014f68f4d471d9
-
-From d49c92c8420db6ee4c88515bdb014f68f4d471d9 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sat, 2 Dec 2023 09:24:01 +0900
-Subject: [PATCH] import-object: Avoid integer truncation on 32-bit platforms
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The build fails when compiling for 32-bit platforms with
--Werror=incompatible-pointer-types:
-
-  CFLAGS="-m32 -march=i686 -Werror=incompatible-pointer-types -Werror=implicit -Werror=int-conversion" setarch i686 -- meson setup _build
-  setarch i686 -- meson compile -C _build -v
-  ...
-
-  ../p11-kit/import-object.c: In function ‘add_attrs_pubkey_rsa’:
-  ../p11-kit/import-object.c:223:62: error: passing argument 3 of ‘p11_asn1_read’ from incompatible pointer type [-Werror=incompatible-pointer-types]
-    223 |         attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-        |                                                              ^~~~~~~~~~~~~~~~~~~~~~~~
-        |                                                              |
-        |                                                              long unsigned int *
-
-Reported by Sam James in:
-https://github.com/p11-glue/p11-kit/issues/608
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- p11-kit/import-object.c | 30 +++++++++++++++++++++++++++---
- 1 file changed, 27 insertions(+), 3 deletions(-)
-
-diff --git a/p11-kit/import-object.c b/p11-kit/import-object.c
-index feee0765..fb47b964 100644
---- a/p11-kit/import-object.c
-+++ b/p11-kit/import-object.c
-@@ -55,6 +55,7 @@
- #endif
- 
- #include <assert.h>
-+#include <limits.h>
- #include <stdbool.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -201,6 +202,7 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_encrypt = { CKA_ENCRYPT, &tval, sizeof (tval) };
- 	CK_ATTRIBUTE attr_modulus = { CKA_MODULUS, };
- 	CK_ATTRIBUTE attr_exponent = { CKA_PUBLIC_EXPONENT, };
-+	size_t len = 0;
- 
- 	pubkey = p11_asn1_read (info, "subjectPublicKey", &pubkey_len);
- 	if (pubkey == NULL) {
-@@ -220,17 +222,31 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 		goto cleanup;
- 	}
- 
--	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-+	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &len);
- 	if (attr_modulus.pValue == NULL) {
- 		p11_message (_("failed to obtain modulus"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain modulus"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_modulus.ulValueLen = len;
- 
--	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &attr_exponent.ulValueLen);
-+	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &len);
- 	if (attr_exponent.pValue == NULL) {
- 		p11_message (_("failed to obtain exponent"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain exponent"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_exponent.ulValueLen = len;
- 
- 	result = p11_attrs_build (attrs, &attr_key_type, &attr_encrypt, &attr_modulus, &attr_exponent, NULL);
- 	if (result == NULL) {
-@@ -260,12 +276,20 @@ add_attrs_pubkey_ec (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_key_type = { CKA_KEY_TYPE, &key_type, sizeof (key_type) };
- 	CK_ATTRIBUTE attr_ec_params = { CKA_EC_PARAMS, };
- 	CK_ATTRIBUTE attr_ec_point = { CKA_EC_POINT, };
-+	size_t len = 0;
- 
--	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &attr_ec_params.ulValueLen);
-+	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &len);
- 	if (attr_ec_params.pValue == NULL) {
- 		p11_message (_("failed to obtain EC parameters"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain EC parameters"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_ec_params.ulValueLen = len;
- 
- 	/* subjectPublicKey is read as BIT STRING value which contains
- 	 * EC point data. We need to DER encode this data as OCTET STRING.
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
deleted file mode 100644
index f27bbaf48cf..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
+++ /dev/null
@@ -1,77 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit bash-completion-r1 meson-multilib python-any-r1
-
-DESCRIPTION="Provides a standard configuration setup for installing PKCS#11"
-HOMEPAGE="https://p11-glue.github.io/p11-glue/p11-kit.html"
-SRC_URI="https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+libffi gtk-doc nls systemd test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	app-misc/ca-certificates
-	>=dev-libs/libtasn1-3.4:=[${MULTILIB_USEDEP}]
-	libffi? ( dev-libs/libffi:=[${MULTILIB_USEDEP}] )
-	systemd? ( sys-apps/systemd:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	${PYTHON_DEPS}
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	virtual/pkgconfig
-	gtk-doc? ( dev-util/gtk-doc )
-	nls? ( sys-devel/gettext )
-"
-
-PATCHES=(
-	"${FILESDIR}"/p11-kit-0.25.3-pointer.patch
-)
-
-src_prepare() {
-	default
-
-	# Relies on dlopen which won't work for multilib tests (bug #913971)
-	cat <<-EOF > "${S}"/p11-kit/test-server.sh || die
-	#!/bin/sh
-	exit 77
-	EOF
-}
-
-multilib_src_configure() {
-	# Disable unsafe tests, bug#502088
-	export FAKED_MODE=1
-
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# p11-kit doesn't need this to build and castxml needs Clang. To get
-	# a deterministic non-automagic build, always disable the search for
-	# castxml.
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	castxml='castxml-falseified'
-	EOF
-
-	local emesonargs=(
-		--native-file "${native_file}"
-		-Dbashcompdir="$(get_bashcompdir)"
-		-Dtrust_module=enabled
-		-Dtrust_paths="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
-		$(meson_feature libffi)
-		$(meson_use nls)
-		$(meson_use test)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_native_true man)
-		$(meson_native_use_feature systemd)
-	)
-
-	meson_src_configure
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
index 766326e43ae..09a2d15ba80 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
@@ -1,2 +1,4 @@
 DIST pinentry-1.3.1.tar.bz2 611233 BLAKE2B 47a510b3746fc8cdd83b56302132f4f4d9c61324fc857ce0867387f70f79490dad375bca4dc72e5d1cdca707bf89a16e1c9a20bf1aa0e857d69e59dc59403afd SHA512 3b72034dc1792b1475acb6d605ff7c1bd7647a0f02d1b6bdcd475acdef24bc802f49e275055436c3271261c4b7a64168477a698aab812a145962146b2f67a0e2
 DIST pinentry-1.3.1.tar.bz2.sig 119 BLAKE2B ca562d2903c88c4297e641ddc39f6cd99db3e3fd40cf5d69e7b4335f006c7717c874fa4b5e47920af3ec97385a96c0c96aafb849cf399d11a7f9f1a6b693f479 SHA512 22bd94f74486300eb84c1c9c371a43b05fb6179118518004fba0d42b6d3e6731f94d79b37c2a3a6b0c5886578c4575f75d2460accd36cd4874342e7239521be9
+DIST pinentry-1.3.2.tar.bz2 612858 BLAKE2B 985bcf0b4f85d4e5001bfd714ddd064e05ba6d5bd6e1d3b6f1044f27ca148921d22148b301c91cce4fa7f2f7e7f3b743a9bc1383cb9d8e1d0583a595109a699e SHA512 3b4d50a42d412d649a7830f7378aa966342c2bc0157d03b0ad79cf0aed29d6698d48c734e23b1dccada5f6ef81d0c09d3ead6cd703eadfc8082987e6bea0aafc
+DIST pinentry-1.3.2.tar.bz2.sig 266 BLAKE2B 1c428abb285dd56566a83fe4ceef5e0efc3b2a9ed40a2a0b48e7dc06575d24044677091f6a042e1f08ac6308f2bb1e82eddc82f22b78f1a316ca78ed670745f3 SHA512 82352cb5183a7922ab27619e19fc4d7adaa461847040232610b002365db605200961d1d950887aa5b09d12488d70f432fe739e0e2501a28465a28fb428b62aad
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
new file mode 100644
index 00000000000..751965cc73f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools qmake-utils verify-sig
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/related_software/pinentry/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="caps efl emacs gtk keyring ncurses qt6 wayland X"
+
+DEPEND="
+	>=dev-libs/libassuan-2.1:=
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	efl? ( dev-libs/efl[X] )
+	keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:= )
+	qt6? (
+		dev-qt/qtbase:6[gui,widgets]
+		wayland? (
+			kde-frameworks/kguiaddons:6
+			kde-frameworks/kwindowsystem:6
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	gtk? ( app-crypt/gcr:4[gtk] )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+PDEPEND="emacs? ( app-emacs/pinentry )"
+IDEPEND=">=app-eselect/eselect-pinentry-0.7.4"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+	"${FILESDIR}/${PN}-1.3.0-automagic.patch" # bug #819939, bug #837719
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	unset FLTK_CONFIG
+
+	local myeconfargs=(
+		$(use_enable efl pinentry-efl)
+		$(use_enable emacs pinentry-emacs)
+		$(use_enable keyring libsecret)
+		$(use_enable gtk pinentry-gnome3)
+		$(use_enable ncurses fallback-curses)
+		$(use_enable ncurses pinentry-curses)
+		$(use_enable qt6 pinentry-qt)
+		$(use_with X x)
+
+		--enable-pinentry-tty
+		--disable-kf5-wayland
+		--disable-pinentry-fltk
+		--disable-pinentry-gtk2
+		--disable-pinentry-qt5
+		--disable-qtx11extras
+
+		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+	)
+
+	if use qt6 ; then
+		export PATH="$(qt6_get_bindir):${PATH}"
+		export QTLIB="$(qt6_get_libdir):${QTLIB}"
+		export MOC="$(qt6_get_libdir)/qt6/libexec/moc"
+
+		myeconfargs+=(
+			$(use_enable wayland kf6-wayland)
+		)
+	else
+		myeconfargs+=(
+			--disable-kf6-wayland
+		)
+	fi
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/bin/pinentry || die
+
+	# The preferred Qt implementation upstream gets installed as just 'qt'.
+	# Make a symlink for eselect-pinentry and friends.
+	if use qt6 ; then
+		dosym pinentry-qt /usr/bin/pinentry-qt6
+	fi
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
index e0a935653e3..df797fca9df 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
@@ -1,3 +1,2 @@
 DIST sbsigntool-0.8-ccan.tar.gz 113537 BLAKE2B 8fbf27463d30c1895930628a145be2d521ae4f6adb7af3299bf2f5f4319fd643df0a07347ef6851bd41d233af4c3fc5f77002771af1c43aa0f20665aef2390b8 SHA512 6857096879f116f1802eb6b44789cbea7bb24440bc0f16503aeadf5f276fa45943f322f844dbb9abee717655205d82b830143be3a7f4424fd4146b9360674a09
-DIST sbsigntools-0.9.4.tar.gz 57714 BLAKE2B 94797af6c98a9c13cb71e52ba6f7ff07de70660af2194b14061e0cb618d6effff52ef7a4dd2fd4e44e75f022b979442d4290b1d65d63017b2fbebdca5951c5c9 SHA512 953d3d9a7f92b837da966eabe3572163a29c5292e792d5ef17cf842d7373ffaa901377cb4ec68006a6ef2f9c97d48db8ffdd3a6d2853be67016d3484a118bba9
 DIST sbsigntools-0.9.5.tar.gz 57876 BLAKE2B 677f87eac9fba9185acd7e25b8d7a3682083938313f3086aaaa6871e010bd403bdda5b9a5fe931151af75a344802c964918be8feb38ec6229d9a16c5b63416b6 SHA512 3b23bdf1855132a91e2063039bd4d14c5564e9cd8f551711aa89a91646ff783afb6e318479e9cf46eedbc914a1eade142398c774d8dbfef8fd1d65cbbe60aabd
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
deleted file mode 100644
index 0ce5dbbe30a..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-MY_PN="${PN::-1}"
-
-inherit autotools toolchain-funcs
-
-DESCRIPTION="Utilities for signing and verifying files for UEFI Secure Boot"
-HOMEPAGE="https://git.kernel.org/cgit/linux/kernel/git/jejb/sbsigntools.git/"
-SRC_URI="https://git.kernel.org/pub/scm/linux/kernel/git/jejb/${PN}.git/snapshot/${P}.tar.gz
-	https://dev.gentoo.org/~tamiko/distfiles/${MY_PN}-0.8-ccan.tar.gz"
-
-LICENSE="GPL-3 LGPL-3 LGPL-2.1 CC0-1.0"
-SLOT="0"
-KEYWORDS="amd64 arm64 ~riscv x86"
-IUSE=""
-
-RDEPEND="
-	dev-libs/openssl:0=
-	sys-apps/util-linux"
-DEPEND="${RDEPEND}
-	sys-apps/help2man
-	sys-boot/gnu-efi
-	sys-libs/binutils-libs
-	virtual/pkgconfig"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.9.4-no-werror.patch
-	"${FILESDIR}"/${PN}-0.9.4-openssl3.patch
-)
-
-src_prepare() {
-	mv "${WORKDIR}"/lib/ccan "${S}"/lib || die "mv failed"
-	rmdir "${WORKDIR}"/lib || die "rmdir failed"
-
-	local iarch
-	case ${ARCH} in
-		amd64) iarch=x86_64 ;;
-		arm64) iarch=aarch64 ;;
-		ia64)  iarch=ia64 ;;
-		riscv) iarch=riscv64 ;;
-		x86)   iarch=ia32 ;;
-		*)     die "unsupported architecture: ${ARCH}" ;;
-	esac
-	sed -i "/^EFI_ARCH=/s:=.*:=${iarch}:" configure.ac || die
-	sed -i 's/-m64$/& -march=x86-64/' tests/Makefile.am || die
-	sed -i "/^AR /s:=.*:= $(tc-getAR):" lib/ccan/Makefile.in || die #481480
-
-	default
-	eautoreconf
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
index 7bb518a8779..e7670a4fc9d 100644
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@@ -2,3 +2,4 @@ DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8
 DIST eclass-manpages-20250704.tar.xz 484052 BLAKE2B 9711ec8ba766335eb73cfa69cd406960055213eb7d29f7a1e7fd1fcef504e8becc4f638eb351a54dd5032725bdcb43342dba38d80929aa8843d31be03e8332d4 SHA512 a96be86457a9268e986e07496d4a0ac07737ee58e63d7b4e7d4538519b47795d0cbf164520ab253645befeafae35e79832386a0a6dfce5f686f5c25e62a0d413
 DIST eclass-manpages-20250705.tar.xz 498848 BLAKE2B 0a7907abaf983968c219ae26f3c5f0a0e33103b94ea7afdfad06cea22810094e0fdec2bfb150def85158922a444bdb675c0ae3d618d4a6a52175b83771f9e03a SHA512 2fb686403c8307e3a5259c15abdd23bf117ca9d4bcbda2b301e68755a0ba6dc3a2a4fac48d64803cca72626e410295e8684c0a45812788353cd11366b4df8f36
 DIST eclass-manpages-20250711.tar.xz 499388 BLAKE2B 7f4df3869449444fbc8805f468ea06754b8942eef3aec362765a54ed1e81d644e104847f1ded853321b79d45bfb5f818c5da49bfa8fec9c9d482016a4d2f540c SHA512 e4922972cd282d851405f9f9a3223924df27f7edfda40f0faabcbe5d072936039998cf63823faac8e50c6fcf2851cde7d57c0eee9d291a9469c7c11d70aa5672
+DIST eclass-manpages-20250730.tar.xz 502128 BLAKE2B f798b31c2ac69ab58015941c1cc4cb51b80d70e68f1b9eaf69dcbbe9cd0b488c3b66da2852eb0d8247b62ebfb7faddd13db7a9ddfc312162e3203b09d130263d SHA512 ef8514d5cf79b2549a0bf04deff844bf2bd039644f8a8f4c31201ee681ca94dc8182484685398b432169af7d6c93e3a2794329bc703635aa965414ab32f6823a
diff --git a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
new file mode 100644
index 00000000000..0e318cc5afd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Instructions to make a dist tarball:
+# git clone https://github.com/projg2/eclass-to-manpage.git
+# cd eclass-to-manpage
+# make dist ECLASSDIR=~/g/eclass/
+
+DESCRIPTION="Collection of Gentoo eclass manpages"
+HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
+SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+# Keep the keywords stable. No need to change to ~arch.
+KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="sys-apps/gawk"
+
+src_install() {
+	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 3ff296cc052..4814aa37301 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -4,10 +4,7 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
 DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
 DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
-DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
-DIST qemu-7.2.17.tar.xz 124405828 BLAKE2B 0613eb18a3dfc8af3c907110191eb1e639c8e4ed4ec80842f8a81e373800834ecae6701a8e87f54ea143f1d508b0799d6127ad2174cd5402ec8ad0bdc9e1e21a SHA512 8490fe388db6f72f56cf082eac6aeda6d9eed4749096d2b56dc2f878b058742b586f02fe9a13280eb408b563e8470da53e058505286683cf79a5805aefa2a06e
-DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
-DIST qemu-8.2.10.tar.xz 132685948 BLAKE2B a1e9a89ee8bdf36b597c7f59b18d19ea34a83bcbd0c3e6bc18b10b9bb1cfad50561af7814076c07da67b11ac280a1f4b39b55f80bbf715d49f264e6b67c69d2b SHA512 f847f4cf2e17b562fe974cf52ad623c516440344e708141913986130ef0436f6d31653250a458061eff7bbffacd1ec726f69964dddad08c9b907dfb90c3f48b6
+DIST qemu-10.0.3.tar.xz 135736600 BLAKE2B 382800d9a9f5241123ebeb43d8eaa6a4aaf9acae0df7a25f2c7831aa7eeb97014cff29886c53f03ea0a1ac98729b85bad1e4d5634e592a373af84f79a9219adc SHA512 7f37c2df5ac7048fb32f1d89a7c2da0929be9d2f5767bc209ca1e99167f196fb5867fc8b69f915c8c349c58089ce3d7e08c9a3f35a73223abff258b9a5bf3466
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
index c42f7d920b3..dc8404a3f8f 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
@@ -45,7 +45,6 @@
 		<flag name="spice">Enable Spice protocol support via <pkg>app-emulation/spice</pkg></flag>
 		<flag name="ssh">Enable SSH based block device support via <pkg>net-libs/libssh2</pkg></flag>
 		<flag name="static-user">Build the User targets as static binaries</flag>
-		<flag name="static">Build the User and Software MMU (system) targets as well as tools as static binaries</flag>
 		<flag name="systemtap">Enable SystemTap/DTrace tracing</flag>
 		<flag name="jpeg">Enable jpeg image support for the VNC console server</flag>
 		<flag name="png">Enable png image support for the VNC console server</flag>
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
index c539d8c9d5b..4775be325b3 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
index 0ae89ea3b38..ffa623e36d5 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
@@ -13,13 +13,11 @@ QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
 
-PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
@@ -27,11 +25,10 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
-		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
 	)
 
 	for proj in "${!SUBPROJECTS[@]}"; do
@@ -47,7 +44,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -66,14 +63,13 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@@ -84,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@@ -142,6 +137,7 @@ REQUIRED_USE="
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
 	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
@@ -173,19 +169,19 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/gtk+:3
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@@ -236,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
-EDK2_OVMF_VERSION="202202"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
 SEABIOS_VERSION="1.16.3"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@@ -288,8 +301,9 @@ BDEPEND="
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
@@ -315,9 +329,8 @@ RDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
@@ -325,6 +338,7 @@ PATCHES=(
 
 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@@ -368,12 +382,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.
 
 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.
 
 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm
 
 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@@ -402,6 +416,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
 
 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@@ -475,6 +491,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres
 
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@@ -631,6 +651,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@@ -673,6 +694,7 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
 		local static_flag="none"
 		;;
@@ -926,16 +948,6 @@ src_install() {
 	readme.gentoo_create_doc
 }
 
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@@ -949,7 +961,7 @@ pkg_postinst() {
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
 
-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"
 
 		if has_version 'sys-firmware/edk2-bin'; then
@@ -969,8 +981,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
index 50468066b82..190f68bb236 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
index 04e77d0306a..ffa623e36d5 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
@@ -7,31 +7,34 @@ EAPI=8
 # Set to 1 if prebuilt, 0 if not
 # (the construct below is to allow overriding from env for script)
 QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
-QEMU_DOCS_PREBUILT_DEV=ajak
-QEMU_DOCS_VERSION="7.2.0"
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
 
-PYTHON_COMPAT=( python3_{11..12} )
-PYTHON_REQ_USE="ncurses,readline"
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
 
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
-	EGIT_SUBMODULES=(
-		tests/fp/berkeley-softfloat-3
-		tests/fp/berkeley-testfloat-3
-		ui/keycodemapdb
-	)
+	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
 else
 	MY_P="${PN}-${PV/_rc/-rc}"
 	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
@@ -41,7 +44,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -54,20 +57,19 @@ SLOT="0"
 
 IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg
+	jack jemalloc +jpeg keyutils
 	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
-	smartcard snappy spice ssh static static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@@ -78,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@@ -129,17 +130,17 @@ REQUIRED_USE="
 	qemu_softmmu_targets_riscv64? ( fdt )
 	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	virgl? ( opengl )
 	virtfs? ( xattr )
 	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
-	plugins? ( !static !static-user )
+	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
-	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
 done
 
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
@@ -155,12 +156,12 @@ ALL_DEPEND="
 	sys-libs/zlib[static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	systemtap? ( dev-debug/systemtap )
-	xattr? ( sys-apps/attr[static-libs(+)] )"
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
 
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
 # softmmu targets (qemu-system-*).
 SOFTMMU_TOOLS_DEPEND="
-	sys-libs/libcap-ng[static-libs(+)]
 	>=x11-libs/pixman-0.28.0[static-libs(+)]
 	accessibility? (
 		app-accessibility/brltty[api]
@@ -168,7 +169,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@@ -180,10 +181,7 @@ SOFTMMU_TOOLS_DEPEND="
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3
-		x11-libs/libX11
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@@ -192,6 +190,8 @@ SOFTMMU_TOOLS_DEPEND="
 	jack? ( virtual/jack )
 	jemalloc? ( dev-libs/jemalloc )
 	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
 	lzo? ( dev-libs/lzo:2[static-libs(+)] )
 	multipath? ( sys-fs/multipath-tools )
 	ncurses? (
@@ -207,7 +207,8 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[egl(+),gbm(+)]
 	)
 	pam? ( sys-libs/pam )
-	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
 	pulseaudio? ( media-libs/libpulse )
 	rbd? ( sys-cluster/ceph )
 	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
@@ -221,8 +222,8 @@ SOFTMMU_TOOLS_DEPEND="
 	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
 	snappy? ( app-arch/snappy:= )
 	spice? (
-		>=app-emulation/spice-protocol-0.12.3
-		>=app-emulation/spice-0.12.0[static-libs(+)]
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
 	)
 	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
 	udev? ( virtual/libudev:= )
@@ -231,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
-EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
+SEABIOS_VERSION="1.16.3"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@@ -256,7 +274,8 @@ X86_FIRMWARE_DEPEND="
 			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		)
 		sys-firmware/sgabios
-	)"
+	)
+"
 PPC_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
@@ -269,57 +288,57 @@ PPC_FIRMWARE_DEPEND="
 	)
 "
 
+# See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
 	dev-lang/perl
-	dev-build/meson
-	sys-apps/texinfo
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
 	virtual/pkgconfig
 	doc? (
-		dev-python/sphinx[${PYTHON_USEDEP}]
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
 		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
-	!static? (
-		${ALL_DEPEND//\[static-libs(+)]}
-		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
-	)
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
 	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
 "
-DEPEND="${CDEPEND}
+DEPEND="
+	${CDEPEND}
 	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
-	static? (
-		${ALL_DEPEND}
-		${SOFTMMU_TOOLS_DEPEND}
-	)
-	static-user? ( ${ALL_DEPEND} )"
-RDEPEND="${CDEPEND}
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
 	acct-group/kvm
 	selinux? (
 		sec-policy/selinux-qemu
 		sys-libs/libselinux
-	)"
+	)
+"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-6.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@@ -331,7 +350,8 @@ QA_PREBUILT="
 	usr/share/qemu/u-boot.e500
 "
 
-QA_WX_LOAD="usr/bin/qemu-i386
+QA_WX_LOAD="
+	usr/bin/qemu-i386
 	usr/bin/qemu-x86_64
 	usr/bin/qemu-alpha
 	usr/bin/qemu-arm
@@ -362,12 +382,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.
 
 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.
 
 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm
 
 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@@ -396,6 +416,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
 
 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@@ -442,6 +464,23 @@ check_targets() {
 	popd >/dev/null
 }
 
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
 src_prepare() {
 	check_targets IUSE_SOFTMMU_TARGETS softmmu
 	check_targets IUSE_USER_TARGETS linux-user
@@ -452,6 +491,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres
 
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@@ -463,13 +506,8 @@ src_prepare() {
 	# Verbose builds
 	MAKEOPTS+=" V=1"
 
-	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
-	# this setting (-U then -D..=2) will prevent us from trying out 3, so
-	# drop it. No change to level of protection b/c we patch our toolchain.
-	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
-
 	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
+	rm -r roms/*/ || die
 }
 
 ##
@@ -497,7 +535,8 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
-		--with-git-submodules=ignore
+		--disable-download
+		--python="${PYTHON}"
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -516,6 +555,7 @@ qemu_src_configure() {
 		--disable-gcrypt
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
 		--host-cc="$(tc-getBUILD_CC)"
 
 		$(use_enable alsa)
@@ -524,6 +564,7 @@ qemu_src_configure() {
 		$(use_enable jack)
 		$(use_enable nls gettext)
 		$(use_enable oss)
+		$(use_enable pipewire)
 		$(use_enable plugins)
 		$(use_enable pulseaudio pa)
 		$(use_enable selinux)
@@ -582,6 +623,7 @@ qemu_src_configure() {
 		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
 		$(conf_notuser lzo)
 		$(conf_notuser multipath mpath)
 		$(conf_notuser ncurses curses)
@@ -609,6 +651,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@@ -622,6 +665,7 @@ qemu_src_configure() {
 			# Note: backend order matters here: #716202
 			# We iterate from higher-level to lower level.
 			$(usex pulseaudio pa "")
+			$(usev pipewire)
 			$(usev jack)
 			$(usev sdl)
 			$(usev alsa)
@@ -637,7 +681,6 @@ qemu_src_configure() {
 		conf_opts+=(
 			--enable-linux-user
 			--disable-system
-			--disable-blobs
 			--disable-tools
 			--disable-cap-ng
 			--disable-seccomp
@@ -651,18 +694,18 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	tools)
 		conf_opts+=(
 			--disable-linux-user
 			--disable-system
-			--disable-blobs
 			--enable-tools
 			--enable-cap-ng
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	esac
 
@@ -670,12 +713,12 @@ qemu_src_configure() {
 	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
 
 	# Add support for SystemTap
-	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
 
 	# We always want to attempt to build with PIE support as it results
 	# in a more secure binary. But it doesn't work with static or if
 	# the current GCC doesn't have PIE support.
-	if use ${static_flag}; then
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
 		conf_opts+=( --static --disable-pie )
 	else
 		tc-enables-pie && conf_opts+=( --enable-pie )
@@ -855,7 +898,7 @@ src_install() {
 	doins "${FILESDIR}/bridge.conf"
 
 	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	dodoc MAINTAINERS
 	newdoc pc-bios/README README.pc-bios
 
 	# Disallow stripping of prebuilt firmware files.
@@ -905,16 +948,6 @@ src_install() {
 	readme.gentoo_create_doc
 }
 
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@@ -928,7 +961,7 @@ pkg_postinst() {
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
 
-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"
 
 		if has_version 'sys-firmware/edk2-bin'; then
@@ -948,8 +981,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
index 19613bf631f..d7fecf76a3f 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -173,7 +172,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
index d2aa81b37ec..f0967218fa6 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
index 2ffaefa9ee0..713daff5b3b 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index d5861e676ca..25c4d0df684 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
new file mode 100644
index 00000000000..292bac941f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
@@ -0,0 +1,169 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+BASHCOMP_P=bashcomp-2.0.3
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit autotools python-any-r1
+
+DESCRIPTION="Programmable Completion for bash"
+HOMEPAGE="https://github.com/scop/bash-completion"
+SRC_URI="
+	https://github.com/scop/bash-completion/releases/download/${PV}/${P}.tar.xz
+	eselect? (
+		https://github.com/projg2/bashcomp2/releases/download/v${BASHCOMP_P#*-}/${BASHCOMP_P}.tar.gz
+	)
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="+eselect test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-shells/bash-4.3_p30-r1:0
+	sys-apps/miscfiles
+	!<app-text/tree-2.1.1-r1
+	!!<=net-fs/mc-2025.04.16.18.13.26
+"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		$(python_gen_any_dep '
+			dev-python/pexpect[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		')
+	)
+"
+PDEPEND="
+	>=app-shells/gentoo-bashcomp-20140911
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.14.0-optimize-kernel-modules.patch
+	"${FILESDIR}"/${PN}-2.16.0-libsecret-completion.patch
+)
+
+strip_completions() {
+	# Remove unwanted completions.
+	local strip_completions=(
+		# Slackware package stuff, quite generic names cause collisions
+		# (e.g. with sys-apps/pacman)
+		explodepkg installpkg makepkg pkgtool removepkg upgradepkg
+
+		# Debian/Red Hat network stuff
+		ifdown ifup ifquery ifstatus
+
+		# Installed in app-editors/vim-core
+		xxd
+
+		# Now-dead symlinks to deprecated completions
+		hd ncal
+
+		# For GNU mailman, which isn't packaged. If mailman isn't installed,
+		# it triggers a QA warning.
+		arch
+	)
+
+	local file
+	for file in "${strip_completions[@]}"; do
+		rm "${ED}"/usr/share/bash-completion/completions/${file} ||
+			die "stripping ${file} failed"
+	done
+
+	# remove deprecated completions (moved to other packages)
+	rm "${ED}"/usr/share/bash-completion/completions/_* || die
+}
+
+python_check_deps() {
+	python_has_version "dev-python/pexpect[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest-xdist[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use eselect; then
+		eapply "${WORKDIR}/${BASHCOMP_P}/bash-completion-blacklist-support.patch"
+	fi
+
+	default
+	# Only needed for ${PN}-2.16.0-libsecret-completion.patch
+	eautoreconf
+}
+
+src_test() {
+	local EPYTEST_DESELECT=(
+		# redhat-specific, we strip these completions
+		test/t/test_if{down,up}.py
+		# not available for icedtea
+		test/t/test_javaws.py
+		# TODO
+		test/t/test_vi.py::TestVi::test_2
+		test/t/test_xmlwf.py::TestXmlwf::test_2 #bug 886159
+		test/t/test_xrandr.py::TestXrandr::test_output_filter
+		test/t/unit/test_unit_dequote.py
+		test/t/test_sudo.py::TestSudo::test_1 #bug 935400
+		test/t/test_xfreerdp.py::TestXfreerdp::test_6 #bug 935400
+		test/t/unit/test_unit_command_offset.py::TestUnitCommandOffset::test_cmd_quoted #bug 931744
+		test/t/test_make.py::TestMake::test_6 #bug 931744
+	)
+	local EPYTEST_IGNORE=(
+		# stupid test that async tests work
+		test/fixtures/pytest/test_async.py
+	)
+	local EPYTEST_XDIST=1
+
+	# portage's HOME override breaks tests
+	local -x HOME=$(unset HOME; echo ~)
+	addpredict "${HOME}"
+	# used in pytest tests
+	local -x NETWORK=none
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	local -x PYTEST_PLUGINS=xdist.plugin
+	emake -C completions check
+	epytest
+}
+
+src_install() {
+	# work-around race conditions, bug #526996
+	mkdir -p "${ED}"/usr/share/bash-completion/{completions,helpers} || die
+
+	emake DESTDIR="${D}" profiledir="${EPREFIX}"/etc/bash/bashrc.d install
+
+	strip_completions
+
+	dodoc AUTHORS CHANGELOG.md CONTRIBUTING.md README.md
+
+	# install the python completions for all targets, bug #622892
+	local TARGET
+	for TARGET in "${PYTHON_COMPAT[@]}"; do
+		if [[ ! -e "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.} ]]; then
+			dosym python "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.}
+		fi
+	done
+
+	# install the eselect module
+	if use eselect; then
+		insinto /usr/share/eselect/modules
+		doins "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect"
+		doman "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect.5"
+	fi
+}
+
+pkg_postinst() {
+	if has_version 'app-shells/zsh'; then
+		elog
+		elog "If you are interested in using the provided bash completion functions with"
+		elog "zsh, valuable tips on the effective use of bashcompinit are available:"
+		elog "  http://www.zsh.org/mla/workers/2003/msg00046.html"
+		elog
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
index 437c7a111cf..3489ced000b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
@@ -16,12 +16,10 @@ SLOT="0"
 IUSE="+eselect test"
 RESTRICT="!test? ( test )"
 
-# completion collision with net-fs/mc
 RDEPEND="
 	>=app-shells/bash-4.3_p30-r1:0
 	sys-apps/miscfiles
 	!<app-text/tree-2.1.1-r1
-	!!net-fs/mc
 "
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 1471f39fa3f..864fb5eecba 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -26,6 +26,9 @@ DIST bash-5.3.tar.gz 11354270 BLAKE2B 88a4f0146eb11698120890f2afaf28210295135f8f
 DIST bash-5.3.tar.gz.sig 95 BLAKE2B 90a6a47b5b318d03ff7e196e6504a987c281f564db878e8452f0543953832b5ac4f767f69a9bdf6b6a98938b0b439040c10674dd54e38ef03730ae6a2ec4484e SHA512 e9da98e993528d69bec9c6da272eb7a96858b4ba33487435f584c7df2d73c3ce82f373b5277cc3a7d8dc9ee04410dc06ce476d3f9ade097121bea0570abe07bc
 DIST bash-5.4_alpha_pre20250711-80a8f650a1defc3f72539c3b57bf6d228c33c116.tar.gz 16111994 BLAKE2B 7ab445c5580c3c8d0af10a6764d65a33705f42ed79c50297a4cbf3b345b2f0ba9f28001a80ec5cc85291f57f88e81aef41492a79779239a33292b460e4361d8f SHA512 64f5985ad9a94fd37bc5efa06a57b72c5b3ec8d43a0ed36d9cdc9f292b37137e035bcba0d9855965e0f7bc2416ae60ec44d8f19ee2201acef01d3eda43d8989b
 DIST bash-5.4_alpha_pre20250718-01070d43248fb97f3b2a08d780ae5a392573ce34.tar.gz 16112469 BLAKE2B 6ebcf65b4f1ae93f52d549d2c6836cd4ff7e87739efa9746ef10f00bf6010f00d957c0624e3b806c4d581539f9160338a00824302b245f4c82c72c416976a0f0 SHA512 b200d62eb6634bf9f623841b7a024dc8b3a89c43b8e127dbc89dbf06f3df793d82ad37d35e1be43558ef97c473e37e44384d8c73736c7b62794e65dcfb8f30ce
+DIST bash-5.4_alpha_pre20250801-c1d9c088531eef0797e78c66b899d895862de80c.tar.gz 16116027 BLAKE2B 1be7657f61e91acc9e5e3bb9d5051f4d9e6f29e5457db544ebd26ac4ff7931925732d8b81de243bf6374ba3ce3aaa133ec6a33f03133e22317d712e696847bed SHA512 44c890bd46ec87ba11b78a0a817ed42544d32df12270c9766f78418e966d3247457facad0e4dcdbf07fd9a6a8865029f3eb3a93c485e01506d67d4ed1c156670
+DIST bash-5.4_alpha_pre20250804-e9053f2a3ae4ed638d269481626e0e5408ae8965.tar.gz 16116218 BLAKE2B 3722dce5927d2864365e3b1b328719b659a9ef5c0ae66cdfb9df3483a6808edeaa26928deada7b927ebf21733eb34f901a65bdfb7700470161bab9eb32df1445 SHA512 6fcca3592928b36a399dfad04d222e147c885b96d622f227eabd57a6252fb31570919b605d5b5297b47bcc727316664e6a0eafb679087a9e1860665654eb8642
+DIST bash-5.4_alpha_pre20250808-ff6cfb1464a39b964204a4f83caab2b8484829a6.tar.gz 16117028 BLAKE2B edcb02792d3cc2eae3e18770853b540bd741da68de17ba47af37d6ab8329c9cd82bfef66c3ae3a33d156e3ba618572ae3fc74d2971cce5cec97e1718f0d74e56 SHA512 65ec39031e34d74591a44056f134e38fd5bd0fd0cad99d471fa3f40bdb33b7ccbbeaad4d55a2b4e521365f8035a9cb36cd9cfb46f27dea193c4562f6f783be68
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
@@ -450,3 +453,9 @@ DIST bash52-036 5941 BLAKE2B e86b0df8ea7ace1ce4bc6f269de389f2f85fbe20e59e6a1e88a
 DIST bash52-036.sig 95 BLAKE2B 5ed270f26471e08456f73498ea8110c514b8e1bae424182f4cf530ab6e4f89a7946cabd3f7dd703f4f4bab7de9c73922e7be688df18df485cd64a33ce98df223 SHA512 7a26b606ab0d7a5716ac49bd1492e3b3480c3764aaec64e1763a2beda7a962c81a4066887c950b3bdd1ada317b790bd985f8b858e78c7cb8eb4a2bd02f1b07cd
 DIST bash52-037 2835 BLAKE2B 4af190d53b498d6d4403f64f39060f1add17edfe3e48b4b58a4377d1e96caa93017aed3df7011a64c99fd908af967603ed287e6bbb0380a8569d170779d8f26a SHA512 3e104dff63dabceea2f56f9dc58869d48a71ce61c3c8aff4f289d2f4a47d4325e70178d520c265a25ddb2227e0b78f08177fcd594470e5e81f4116aad282b4de
 DIST bash52-037.sig 95 BLAKE2B e3cfa89933fe59159a44dc20832406d3c42e28ac0c33674bf369a2f20a1d9de3e985bd178640f17be7b45a4fe3f96c72f80124384cec42fa263eb95586150a3b SHA512 437a69a167a4b889fca40b03eb2dcaa1ddc53db8fde924a6f8bcd21c3ac0c7629cb87b7bc08fa3b16f46b05c6a198a01dce6af3d2b761429345acd361df105dd
+DIST bash53-001 1531 BLAKE2B ca275ade6a7132d316a4d1ffd401c9bfc6de691c58531385d85087c4d50723aeacb5b4bc7abef0165b4fb3cbed146a0fefd9dae4c99c1547f61618798a772d29 SHA512 66d0987f1a8951974c3a707a1980ef391a1f2a2938f0fa46adb77fcdcef6a3ca49e67182b9640ece3e59bb289e5b4a17eb870aa2a525a03e829a7be158d020a6
+DIST bash53-001.sig 95 BLAKE2B 3f795e8881a9ff075b62ba1b3b87610632509b94472d28f04b20cc60f3023c6237dfcaaf030aa1e9533eb87f70ab2555472d22ef9cb6e3f1a9cb1c56467fbc13 SHA512 e27cac36d8f513a255e928b01661aac3c1a594fd254ceab119dcba662e9344ac8807be679953def9a2aab59035836c3e6a2aa7f1b21b6eec1f381dfe286099f5
+DIST bash53-002 2635 BLAKE2B fec52c475b8126774290eab7a514f8145ae51edab150d413c09f5540719c9578fe1cb99987b6190a9cd82bd947e059c32e740a03d26e9d472af51356cafd8a32 SHA512 05caea1c1f5a3d27f2aa351c24f324f9d544ded89db4183ae2872e0283dde62dd6166ca4e780304398935b4aa3fb4db77ecf57acd0f0e295d279ffe40b772158
+DIST bash53-002.sig 95 BLAKE2B 576dd4535af85d122f62e310ddae5cf7eec4ada59b5c73c5a891f3bc50cb6bbad8b47cd74d8c7a868381d340d1c7391f52f7a6f34ae99caf6b4ee290d2808849 SHA512 bd64fc61e5516a636a039c51a33f72e9adb7761d4e4101584b7dc3b43198be026c4165d6a34ca77e1ea5d4122b942dc853803a0c836bffc618aae9f7f8c008aa
+DIST bash53-003 2683 BLAKE2B 6bb6f6679726d65f95c11b4ac1fb0729eaebfeef02de06e9fda4e3ac2bb3d328cc6f7fd6e29976a0907390ed6709cd5a0a6046682acbed73eb0470143bf144e1 SHA512 3d4004653cb3f2cba984e67b8e7ae54c19351e176b62bb415f88fdd482ae04be063dacf6303c8343ab6c8bf4f2388026c1742ac603a5cd5c330db22a4b76f4cb
+DIST bash53-003.sig 95 BLAKE2B 9827f23ea927f39dd20316eec8b311bc7692c5645a77e15eba31d17252a0035d401f620ed9b51b62f643ae0c6c1ed9340e413564151da884b9361d8026557a06 SHA512 f128a82d19d83da70a8c72f3fca52a376a96a31be2b8e94ffd073329a254c5e9f3a231a4b29d33efe12c0b9a20a4c293331c5fc55767fb3538a6208996b7e2bb
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
new file mode 100644
index 00000000000..b8564f5043c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
@@ -0,0 +1,404 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="b35866a2891a9b069e37ca5684d4309c0391e261"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.3-read-sys.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
new file mode 100644
index 00000000000..1300218c38d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="c1d9c088531eef0797e78c66b899d895862de80c"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild
new file mode 100644
index 00000000000..f27b9b18e93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250804.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="e9053f2a3ae4ed638d269481626e0e5408ae8965"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild
new file mode 100644
index 00000000000..111048455db
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250808.ebuild
@@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="ff6cfb1464a39b964204a4f83caab2b8484829a6"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
index f39e47a2534..2bc307d6f96 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://gitweb.gentoo.org/proj/${PN}.git/snapshot/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 
 src_install() {
 	emake DESTDIR="${D}" install \
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index bf67a044391..1e9e4711396 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -16,3 +16,6 @@ DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d419
 DIST cmake-4.0.3-SHA-256.txt 2015 BLAKE2B a346da6aa064c5b390459ab265680e0835f4a66fae6c957cedce302da13daa31e8387b1113b049d5518a2b0431d6ee9ad8fd10abec9e6b35502f954cc02a15ee SHA512 f1ce0d1d9ca3286d311611de2da19de543105dfedda5f0449648a79d0c4ecb2a221aad540915bdc3f1904966c79c60b828cb8a7e6198a718f6f6906bd07697eb
 DIST cmake-4.0.3-SHA-256.txt.asc 833 BLAKE2B 0e82305e93eedfe888e2c54590e509aad58f5d634d3112c66ff5eff622619aef53e4d97f67921b5998082117430d541220df6e2e58656749ae8620aad4928a8a SHA512 d502d87bbf5bb24bdd2d6a0a1d97b854dcc09e17b00e6fa9af4610eb5984b46fd2d7a2a01c15e89bbeed25882738fa764d4b7746c4e25c197d9017277c6f95b8
 DIST cmake-4.0.3.tar.gz 11830216 BLAKE2B 4dc2705baf2404b64da88a5b8838850b782849a4dcdfb0eaefa819ba00a018885a8bd0b42f17f92c8e24b9e76c66e60880377017d8e2d584cb75b2978018e214 SHA512 d3fb9ef408a1b13cd6ef1c294b2515733d1c7220c2c639426bd8037d023ebb439f02e412dd8dd42e385b8e3553547d785eeedc47f2b0843e413b88bd5a7eab18
+DIST cmake-4.1.0-SHA-256.txt 2015 BLAKE2B cbbe940911a0bfb18a0fb0dcc714ad750f348c1a7f7e176816cc6d9e32e0ae4b3f0c1ace3779e17cb443f2cce2b41bf53d756a20b665a3bdcb95d4acd0b6638f SHA512 e81e07abae94588a5ed9cb62396dba04885ed8ddda98751c991af970509e07e6899896d998b52c04c67e58e81e1af243fc64bf7a127e37027385539c5cf6a050
+DIST cmake-4.1.0-SHA-256.txt.asc 833 BLAKE2B 28b6415e1e60f81cf3295573ad43e732fbd53b8d8c76b589a56ea9a8abb02bc7de1d0875fe55ffde8588368a1555f8010769b6ffa92ef860a085b15d0b7f5917 SHA512 beb141dbb66c302a6aff1667afa56898f266e9f8d630e75b806bc2e59178ba56f5a84022b5c9d2e24fb8e762168644ba49fe059812750132c2b11b5821ee456a
+DIST cmake-4.1.0.tar.gz 12042798 BLAKE2B 57e086b18f24d97e386a391151b09fe228feb22fbf0af31f26859069cf269de32b763d1545cdd18f5f73ede1980a83cb21a2b9a8a04a5aa0b08f2525def4c134 SHA512 644b6b13539ba0e7f35a7496e4240b1d3361606163f35b69006e47d03ffd9759d35c62a73826253ed168af4196df29983ec10c0f561ea74d7ed6ffee0c2cd8e4
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
new file mode 100644
index 00000000000..d5c57e85205
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
@@ -0,0 +1,321 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=4.0.0_rc1
+#CMAKE_DOCS_VERSION=${PV}
+#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == *9999* ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+	inherit verify-sig
+
+	SRC_URI+=" verify-sig? (
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
+	)"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? ( dev-qt/qtbase:6[gui,widgets] )
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+pkg_pretend() {
+	if [[ -z ${EPREFIX} ]] ; then
+		local file
+		local errant_files=()
+
+		# See bug #599684 and bug #753581 (at least)
+		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
+			if [[ -e ${file} ]]; then
+				errant_files+=( "${file}" )
+			fi
+		done
+
+		# If errant files exist
+		if [[ ${#errant_files[@]} -gt 0 ]]; then
+			eerror "Errant files found!"
+			eerror "The presence of these files is known to confuse CMake's"
+			eerror "library path logic. Please (re)move these files:"
+
+			for file in "${errant_files[@]}"; do
+				eerror " mv ${file} ${file}.bak"
+			done
+
+			die "Stray files found in /etc/, see above message"
+		fi
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	# 4.0.0_rc1 is missing this, fails to configure
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
+	touch .clang-tidy Utilities/.clang-tidy || die
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actually bootstrap it every time so why test it?
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index 4be4857a8d4..358e5717417 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -18,6 +18,10 @@ DIST meson-1.8.1.tar.gz 2332007 BLAKE2B 8fa77bd0e1494d94de585f8f740cb01dfc302fef
 DIST meson-1.8.1.tar.gz.asc 833 BLAKE2B a31c10eb386597049eed127987dfa32f044fbd2ec0261fa0547c066a47a57e27893821f80eb6a7ad82fd72278ff77abdaf4a88fd057b9b960edd8626530a17be SHA512 5d6a0681ccd1132f86904b88fdef4838a9de403d29b6dddb8d8626ce3f1e9d1d911b79f821aa81cd1421fd4c095ca488494a1b77e59f94ba616504eef251dbc7
 DIST meson-1.8.2.tar.gz 2335538 BLAKE2B c3a4e2c505af02b85407f66bb076d4c1a96ca0fde85576d26d8ad6522dce8107f1bdb97c771b0f28e527da0383853b36cd56e8533d5be175cf62b7fbadca40b6 SHA512 d3d87c806a0ac8405af9205cc2c9a5f2dbeda8639506bf96bfb3821aa8184c185a1afc29738a54b47902ef830c1b5253e3ee3542a3f9bbc8fd91b9ea02f0a0b7
 DIST meson-1.8.2.tar.gz.asc 833 BLAKE2B c59ef68cf74daf9658c6589cc037a21bbc9fa03134093b1a30425ba19a69036868c1c7bd1c7f26b486a6eb9e6e13796f02b52e7caa78701d546d9da3f7591b41 SHA512 9f6dbe0329a8f1685110fadd803239eb675b67f59f2f1988494ec6e95110aca754ff7dbb6edad708c53b9420bd09c2d115af5f9f879175a9e37cb28f978add8b
+DIST meson-1.8.3.tar.gz 2335924 BLAKE2B 3c440854bd91c757d4370b498f0e6e903df4589f4958e05fa16ae70e6efc01d2e96f101612146556b81cc3db370255f4319bd5d49d8e46210df282cc447ec12e SHA512 effd6f556152e508185a5bc59131b3a31696577298aec5f3d3ab68153ade9e98242171d6b72c00f8c32fc3492aba3487252d77a94a96b5a92e89724de045d49b
+DIST meson-1.8.3.tar.gz.asc 833 BLAKE2B 25f00f76819c74e64b3750ddd4507fdd8a0be764db54ea48ba49f0985bfbf04d294e5eff1ee799ec082cba24ed59b21a8fd75f81dee9d824e5f8cd9c775b0dcd SHA512 9c28747ff4756422dae4eb4a86de24fe230e6676660aa9cfb72d29311012106a9edbcfff3559682917a7e0ed8c80af8b8ec37807d3f7e0f4005eed5793367307
+DIST meson-1.9.0rc2.tar.gz 2367323 BLAKE2B fbc00274c7c7b434517d8dffa80bf7bde13847b45ed9942b75495a2446e8e9721fde083d0ed446577771548e61c5e2bb12dbd7512ee2ccf8c8929519600d7652 SHA512 d50553e211ba68f27865c01dd3e00f48feda430f047b5be9725fe45b14dd3fb68a256668fbc70e7773e1076cc8f993a1c1006d106e2bf0d0eb8fef6773608fd6
+DIST meson-1.9.0rc2.tar.gz.asc 833 BLAKE2B a9d8c571520b2015bcb0f18eacc20df3f0e2d0da1cf560f405163ac077935eea1b57e342cb69610fff88b077c4bf8d7a4706c1c8825ab8e138bd5eb07226fc2b SHA512 fd34b5abca57fb31ef113006d0ae20997f800a57f60eff192d3a2e1a7d8c27237090b104b4863f24552997952732b3031e78700b2f16bc5cf780a36c5b04e3ac
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
@@ -25,3 +29,5 @@ DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150
 DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
 DIST meson-reference-1.8.1.3 345633 BLAKE2B 026423161eeddff3e663016c4b3fff885e96dc1a652562fe312cb80cfcc845015cab0d0f51c39f187cc484752f8f2bf7954dc8daf6762a74f895338cac4c35c4 SHA512 d3041eee86e63c178a04d5ec1ec383e7bbd209f358103806d488b28383471c1ecb5a13aa3716f699c1973a1d32dace34b0fdb0375e19abc0050deeb66fc5d376
 DIST meson-reference-1.8.2.3 345633 BLAKE2B a53888284967c1beb8875a380eb7fd58402db0ae8d3357f47cd265a1695f73f85dd5ef6c36ee95252012120f3b904d74dabcbd4b1aa4174975b1d1899d30283c SHA512 b40904bebedc678f4e8567cd0b6a377a678d4f3fa13feb5d978d65b39a308b607c78adfc6b742f9d7c2f2c57e7b011f52d875e97b85f1c4ffbfd4ebe52814443
+DIST meson-reference-1.8.3.3 345855 BLAKE2B c8825ba7b72b36866ebfa8cdf63362f2d38673315378ea213c438057f5dafa36b9e729e8c415a29715c1da4fe72733a4a6a2cdbee4b7df57e5eb97f50152491b SHA512 3085c10cfc08ce4f0edad7129ce4d9a0bf75c6522309e344ba14e27c34d46c3da25ebb46260de28caef4a6c8134857d63297ded26f1296639a8a097e62a1801c
+DIST meson-reference-1.9.0rc2.3 347290 BLAKE2B 992705aa79f7706dcd9bda49e047cdb5ac64e1561049bc6af60b6dcf29a403bf6ade00494135c1419c912063066fef9c7b4fa844a865f967f432860a9fe88596 SHA512 5c0ac755be8830b55505612e2009820d2296b10fac8e49acd2c5af63749dfe224fc91d4df88510a7694ab4f46db1e1c9c7c079944a8d17fdd2932b7ce4aa7c5b
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
index 74fc5cee9d8..fa4fbb404a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
@@ -84,6 +84,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
index f944f07ba00..5714816dda6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@@ -32,8 +32,8 @@ else
 	# Releases may be signed by those listed in Releasing.md. Jussi
 	# remains the default release manager.
 	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-eschwartz )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.gpg
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-eschwartz-20250723-r1 )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.asc
 
 	if [[ ${PV} != *_rc* ]] ; then
 		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
@@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
new file mode 100644
index 00000000000..699967ac5f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
@@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild
new file mode 100644
index 00000000000..699967ac5f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc2.ebuild
@@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
index dcb9ffd2067..699967ac5f1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
@@ -119,6 +120,7 @@ python_prepare_all() {
 		# https://bugs.gentoo.org/673016
 		-e 's/test_generate_gir_with_address_sanitizer/_&/'
 		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
 
 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
index e8902affed0..2424a832a1d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
@@ -1,2 +1,3 @@
+DIST azure-sdk-for-cpp-6aea93d0410f5bc3e3a58a8d492a3063cac3aced.tar.gz 3360426 BLAKE2B 027729aece30196a607a3bb9d6b12e1f884069526b96773701fe211945426a0175ed94d65ae5df6577dfe871a89cbbcff53ea1c6ab814719385af9c9a821aad5 SHA512 f7abcf97468caa04c841935911490c134f1d860b9ae11f2ba57a2a480b9c63a7277fe2ed1440ae0d3c8d2ba76890bc170f38ee936016f9a4ba9b4989f2b7eb11
 DIST azure-sdk-for-cpp-de3cc64a55b2a67d672b7ca899a8675182d1c989.tar.gz 3359660 BLAKE2B eda2034cc789ad6d5e1d477bbb5a3619a53ee22b511707b8aec9471dc8b09814b4b6c199442532790f7b43c07e21bfa3f6534cf49e1f46d7f8a5e60f3e5eecce SHA512 b6004de0e1f312bdd55f91f597d2ee831be9d3d500a0c554a8258f52d054c288a6caff3ae86cc023b9ee1167df9fd898d65278f0b076ae23b2e65e9ab5791d36
 DIST azure-sdk-for-cpp-e8d34efc671b7dff133bd32bd2fe65aab4737ef2.tar.gz 3330505 BLAKE2B 3693cc1d587ad3cba32f5dfdbbc650fbd077f05092f0bd44809d1b99b27a2e3e4a9eeb6fa725e5385f117cd76fb09101839e74c3fdc1e082b45d824cad059fb4 SHA512 ffa0ec9e10dfefd948607761dcc328d39bbb3ed56aa9d1df7c1e370fcfd61e91df6f207c85a97e84fb1bd5ad7f2ec848f2f5f1cb85181174c6c7850ade265eeb
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.13.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.13.0.ebuild
new file mode 100644
index 00000000000..79814f2229e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.13.0.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake
+
+COMMIT="6aea93d0410f5bc3e3a58a8d492a3063cac3aced"
+MY_P="azure-sdk-for-cpp-${COMMIT}"
+DESCRIPTION="Azure SDK for C++"
+HOMEPAGE="https://azure.github.io/azure-sdk-for-cpp/"
+SRC_URI="https://github.com/Azure/azure-sdk-for-cpp/archive/${COMMIT}.tar.gz -> ${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}/sdk/identity/${PN}"
+LICENSE="MIT"
+SLOT="0/${PV}"
+KEYWORDS="~amd64"
+IUSE="doc"
+RESTRICT="test" # Too many online tests.
+
+RDEPEND="
+	dev-cpp/azure-core:=
+	dev-libs/openssl:=
+	net-misc/curl[ssl]
+"
+DEPEND="
+	${RDEPEND}
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+src_configure() {
+	local mycmakeargs=(
+		-DBUILD_DOCUMENTATION=$(usex doc)
+		-DWARNINGS_AS_ERRORS=no
+	)
+
+	AZURE_SDK_DISABLE_AUTO_VCPKG=yes \
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+	rm -v "${ED}"/usr/share/*/copyright || die
+	use doc && dodoc -r "${BUILD_DIR}"/docs/html
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index ac104ac4329..410ea07a572 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -5,6 +5,8 @@ DIST sqlite-doc-3490200.zip 11340124 BLAKE2B 56c1456f5720ee98553350790232d043caf
 DIST sqlite-doc-3500000.zip 11367399 BLAKE2B 3356bfc188a8827dbee655df559e0c12391e74d7d1a8afff47f19fd4e6136f30b8eaf43ad1a51da39b9e8e4259e24dc5c4f976d96ea5be008219b4caa48cd105 SHA512 bc385c3d47f738547eac353d78121076bc188cb972b78b5ef8176da91e7c325e99111ebdd80f93538254562281113a527bbfbcd687923874291f19481980cb22
 DIST sqlite-doc-3500100.zip 11377048 BLAKE2B 1634de3e4e31661d0039a62c362f3668b47bc01b3220c82e97d93f8d93a3502960d7fbd1d26dd1a3a6924d795fa50a61273956ccec14c0c4b596b117517ee598 SHA512 a4be8415e07750e6e414fbb3282087438dabf0a36cf81c60052e78618264688784da98ee30ad476fbc47fa405f5cc0d2db92010a1173d0b65a58608177e12589
 DIST sqlite-doc-3500200.zip 11382890 BLAKE2B f7cea3721d77b32ac4b4c514023750aae8fd95e417fa594452b6f29aa56a061f4177187effaad82d25b868076c6dd8b15db08cf5b9353aa6be06e9938be73e9d SHA512 d1dbec8bc41cc83d2fd048cdc353e44f1ae4a60949aabec1e5aee50485f8535efba85bdae88f93785c8e53d48feb76b8143f272d70f73ce13368815f978bd4bc
+DIST sqlite-doc-3500300.zip 11390337 BLAKE2B ba6d03c78d7c3c865f6ef7fab4077b5eac17c77bba6f64c8fec440da21611e03bf1c558cad1b45b20c30ac01c112624d7e14db273cba0f8023029e041f035de2 SHA512 abd9f19574268d11e8980166c257b7e7361c9fbdb5508fbcb67bb855809a4d7823f658acfeb8c48a142508a5a355882b4f4c976ffd53071f13357c4c5892c861
+DIST sqlite-doc-3500400.zip 11398708 BLAKE2B a179191767c86b10604ad03ebd6408ebc3e6b14ce5a85d7dd14cfc933da8e92b76a7ad8b40616699c54022259ba852e30e6f7eeb34640326d51623a7c52c0065 SHA512 24db55ec5d29a6389cf930e3fa3c7205ca47973f5857f7cc5444166bd10d00109cbe4141e87cbb94f75711cb981e60bde286b15c0384cdcfb41337f0f0eaa446
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
@@ -12,3 +14,5 @@ DIST sqlite-src-3490200.zip 14377708 BLAKE2B b455388c3c9d0424b7f36b5ab41b7506f52
 DIST sqlite-src-3500000.zip 14387288 BLAKE2B 9df808ca2e754d8196c19bba3eca370b7675edb89c1fe3bce4d50f848132a5a67079ef6bfceef44fafc7f96f2ded495416093dcda821ea64e06b04b81f3678f1 SHA512 d1b14906011c22bdb1a77e2668aceb42ea912047d8c6358e68fd4097cdaf1dc932ad47f3e621b5242c0c30366a1ecea26c170cd21ff4153d4f0c91d4b9c9eb14
 DIST sqlite-src-3500100.zip 14391009 BLAKE2B 4e8568e3994b6fc63f0d27e035001fcf4798b6dda50e9a52943b618a5585c87b2658b57f7153361253bf574f2948c0f44436514c890f1e98f7d816e77d3b985c SHA512 20d5bda28ab6a9edff28c7a7b5c36b3aeabf34758560e87205626dad4202cd2e1e0e01226791e866e995423f7c76e89f26da49515f47c774a3241f59228a27f7
 DIST sqlite-src-3500200.zip 14392422 BLAKE2B d1d21b53e4eb5b4a89d1460e2a1f57f198fa194efa804f1eb71a747d8a8ff75240f7d2757bee537b901830c359b42d7639943f59d28623bc2fb3c870b725debf SHA512 827c78b2bfd823626cdae6a88fff882cbd90430babfab6c6fd224cf05c8764b43499184a4f07293fb00bfcbbaedfec958d1afbfe4431ea9b24b189c561213e7d
+DIST sqlite-src-3500300.zip 14393097 BLAKE2B 98c751f9d2aeaaef11d447b2921c7d9df160cdf74231d92f83b49a94df96bf3e09ba99a2aad54e85029f483c864430950f5869146f453accf4319b11cb30a825 SHA512 b09293191341df781353d1f76e7280b806e79ec79857e6ab881e4a0a2311ae8d524c2a918f1beeb007b487cc5615ad5c5ca96e2657c1e9853b2e727f637bcb5f
+DIST sqlite-src-3500400.zip 14393367 BLAKE2B e94589cb80ce64b5b8c0a2d28582b223a7cb9355424366fc3135c261ca33b4a93dcdeafb86252deeb9beca0ea94490ec6461ba5ab9e8f16b33e9628a85a19813 SHA512 003b03ddc4dd9618b48370e2aaf339c12c3384963f142f1f97110d6ed74f45aa7477477f53bc8b24b6d9f473b899ecb5d13889f52b8cd4fbdce2e6e5fa24502f
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
new file mode 100644
index 00000000000..b1a38b74238
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild
new file mode 100644
index 00000000000..b1a38b74238
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.4.ebuild
@@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
index a1cd9e7d10d..e7aac512a60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
@@ -4,3 +4,5 @@ DIST strace-6.14.tar.xz 2650972 BLAKE2B 940bb7d54c29e8f22dcf67e617e8a664a7147bb9
 DIST strace-6.14.tar.xz.asc 801 BLAKE2B d25bc4e4164861c258da9037579603f5cfbfc45ee75c172fa90783d3ef9bfb743690b50bb6a6350f24937aa4cb4d87ea63e05f48d081c07ac45f0796486bb733 SHA512 8c107df8bedd2a9574e390e4bb576062681a5137bb48efbdb9ed2f9229871ffc847936b5e2341e335702601feba3a0935b9cc22a316607b5e32858b5cbcb0fd8
 DIST strace-6.15.tar.xz 2662388 BLAKE2B 73bac2016b3a92e88c1bfcdf4b0ce7a273c07554e61c1ba59d5b7c27f219ea0fc0f976413a26cf34e512739d0275e702dab280dd73d6124a4eabe67c6d8d0109 SHA512 5bb21b55d52aab6883821d4aea9449138d5efafac99f72b3831de710ed1ece11bb4a21b16fab97d772397213f43d06072e1d467ae03c38198ead0e65ddcd6ab5
 DIST strace-6.15.tar.xz.asc 801 BLAKE2B 08eb7aac938ab8f0fbb1f37b3072a3243b4a97e9206d2f6e23202d1494a0917e061a814a1a55cec5264dd828dbc2480a9ed63cc8b55fe68945d00a52c85e5bbf SHA512 c2c0098d9b415950c6f0591e2b8c59b96bb929df9270f5e256078d27e93b791f3bca2bf52f36d8ddf3b7354e711a94b4588b78a94da3327a35777c859808d993
+DIST strace-6.16.tar.xz 2674064 BLAKE2B 42155b733d18de50e38b95847a018b315ab36622823ba1113d1a58666de9eda373cc4110b2acdc0c4173520eb55859ff4493fa4a01df1b7c4c1902b11afaa88e SHA512 47d806e7a91537977a41b0289f896c4e36a2c2715554ea31df6c416de581b974d8826be1abf02999fd3ca2f90af122cfefe7c4f20c935026b84421aa8a516f96
+DIST strace-6.16.tar.xz.asc 801 BLAKE2B bcf1729906866c7d92a6672ffe4f89946b27fbdf9963775f1a6703c7fa297f62f1fef80a029f5e0caa117f2c7094fb959dba967ff628117785b934b28ececb79 SHA512 cb4c71780a817ec6e0dcd0f994e91870b8a1ee26b2062fe51000414624343d05dce799c8677683264d9c051a20d4a40e028159282e979e4f3307447cecc16446
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild
new file mode 100644
index 00000000000..196f558d280
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.16.ebuild
@@ -0,0 +1,120 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools edo flag-o-matic toolchain-funcs verify-sig
+
+DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
+HOMEPAGE="https://strace.io/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/strace/strace.git"
+	inherit git-r3
+else
+	SRC_URI="
+		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
+
+LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
+SLOT="0"
+IUSE="aio perl selinux static test unwind elfutils"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="?? ( unwind elfutils )"
+
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
+"
+LIB_DEPEND="
+	unwind? ( sys-libs/libunwind[static-libs(+)] )
+	elfutils? ( dev-libs/elfutils[static-libs(+)] )
+	selinux? ( sys-libs/libselinux[static-libs(+)] )
+"
+# strace only uses the header from libaio to decode structs
+DEPEND="
+	static? ( ${LIB_DEPEND} )
+	aio? ( >=dev-libs/libaio-0.3.106 )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	perl? ( dev-lang/perl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-6.5-static.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ! -e configure ]] ; then
+		# git generation
+		sed /autoreconf/d -i bootstrap || die
+		edo ./bootstrap
+		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
+	fi
+
+	eautoreconf
+
+	# Stub out the -k test since it's known to be flaky. bug #545812
+	sed -i '1iexit 77' tests*/strace-k.test || die
+}
+
+src_configure() {
+	# Set up the default build settings, and then use the names strace expects.
+	tc-export_build_env BUILD_{CC,CPP}
+	local v bv
+	for v in CC CPP {C,CPP,LD}FLAGS ; do
+		bv="BUILD_${v}"
+		export "${v}_FOR_BUILD=${!bv}"
+	done
+
+	filter-lfs-flags # configure handles this sanely
+
+	export ac_cv_header_libaio_h=$(usex aio)
+	use elibc_musl && export ac_cv_header_stdc=no
+
+	local myeconfargs=(
+		--disable-gcc-Werror
+
+		# Don't require mpers support on non-multilib systems. #649560
+		--enable-mpers=check
+
+		# We don't want to pin to exact linux-headers versions (bug #950309)
+		--enable-bundled=yes
+
+		$(use_enable static)
+		$(use_with unwind libunwind)
+		$(use_with elfutils libdw)
+		$(use_with selinux libselinux)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if has usersandbox ${FEATURES} ; then
+		# bug #643044
+		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
+		return 0
+	fi
+
+	default
+}
+
+src_install() {
+	default
+
+	if use perl ; then
+		exeinto /usr/bin
+		doexe src/strace-graph
+	fi
+
+	dodoc CREDITS
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
index 5f9909e3d0e..17af0e6d638 100644
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
@@ -1,3 +1,4 @@
-DIST go-md2man-2.0.3.tar.gz 64961 BLAKE2B 790fe7c247e0f934a397d7389be589c6e4d75be3cd533da13ae4e46c927604c3249e3a2f0c975320bac0f21f3040059202434f6fd4b2ea6dd50d6b772fa01842 SHA512 237e8039beea11b4efb7d0c75fb5826c17dea50057b0149b9533e72e2a5198811f9a3a5b264ea3788922d2f03b07cb57914448b2d4325d54d0f946fb42c42f40
 DIST go-md2man-2.0.6-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
 DIST go-md2man-2.0.6.tar.gz 11064 BLAKE2B fec5c061c5d1b85e3ad86563a301afd01d47f2d83ef5b97bf964f77ebbbbb19c58108ecd8caa9df1663396a13c8b178578a9b02c3c30341cea0bb9abe1d196ea SHA512 c6273040edf7e4c97851c0bfb5366ed0298e92ff1f7f4740104979f1cac17d6303b998ff75396a4264b164872886854e7dadfee3f139d76f684c1b6ca5512828
+DIST go-md2man-2.0.7-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
+DIST go-md2man-2.0.7.tar.gz 11337 BLAKE2B 4b82e6cff896317e555b0eb50da69e9c29b9532d115e3c9b2c5a9c98681ba2726db81bab6dc8fac95a2dc4ca32f9e99161c0a8943001863ef68191acf8fd6c09 SHA512 cc6878af3cfdb0c06ee46b39aa407ec5e48814dc8f68eeae885607407833ac263995fe61c0870217e7c2b2102904f1cf732fa210d89ba38e2443ab1436212905
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
deleted file mode 100644
index de6a9433af8..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit go-module
-
-DESCRIPTION="A utility to convert markdown to man pages"
-	SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-HOMEPAGE="https://github.com/cpuguy83/go-md2man"
-
-LICENSE="BSD-2 MIT"
-SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
-
-# restrict tests because they need network-sandbox disabled
-# bug https://bugs.gentoo.org/715028
-RESTRICT+=" test"
-
-src_compile() {
-	emake BUILD_FLAGS="-mod=vendor" build
-}
-
-src_install() {
-	"${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1 ||
-		die "Unable to create man page"
-	dobin bin/go-md2man
-	doman go-md2man.1
-}
-
-src_test() {
-	emake test
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
new file mode 100644
index 00000000000..bcac703061a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
@@ -0,0 +1,30 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo go-module
+
+DESCRIPTION="A utility to convert markdown to man pages"
+HOMEPAGE="https://github.com/cpuguy83/go-md2man"
+SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/dev-go/${PN}/${P}-deps.tar.xz"
+
+LICENSE="BSD-2 MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+
+src_compile() {
+	emake build
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	dobin bin/go-md2man
+
+	edo "${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1
+	doman go-md2man.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index 62317fc69cd..37be346bb1a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,6 +1,6 @@
 DIST go1.23.10.src.tar.gz 28183775 BLAKE2B 877d61cc6dce0846feb0e2b3f901be9f233d458f549afe9c547d8a279b10c483120c3224cdb2add11af1ff4fb229a1a6d362b0701cf02d8d1c12721275fc954a SHA512 20639185b05720aa8bb295c54e3eaa7cf56739763544d28ce14a6f0323bf890900d5fad13086032291fbefad4482f1442772875bbdf16a94e2286eb405c8f327
 DIST go1.23.11.src.tar.gz 28185977 BLAKE2B 7624458c815210fe9b91a7cef8ca6fa0222518d84ebae500b3b36df2af1ecece6e2eee1fcb2a5d724492ba7dfdfe07509f18cd1976ca7e40c2f5d26802f4ad02 SHA512 108b86d384de01617b7c58fba8a2c6446f6d1e8d07b720de2c49854e664c8c2660f6a3700827bf77cb7f018f78c7f3dc4f9c9f3a8fba8ca5e91cadde2df98a95
-DIST go1.23.9.src.tar.gz 28182928 BLAKE2B fe1038bb32982c4b2032e4a2a9aa533e7ff648337107581b905e484ae9cbbb8bb4e6d8b5b6041f06dd9b25b47c271e9240d6b329813d7777736fc9a33538a381 SHA512 0f80680caabbf50a4f55555d0515530c55e297f38bf193a9da531e640f069719e3c7a5670b72f7629fada8162f978305ae1e4e6398369b8021cfe6dc9157254a
-DIST go1.24.3.src.tar.gz 30789282 BLAKE2B b9ddb484900129f2b916c224ce30b59fdd14ed396f92b8935baa775e9574c5970494d8e612b60c675f699a73683781dfa9802a4c3906f5cc112b9de8ea83154f SHA512 05d19372fb923eeea19395b4de569d2ecfec7fadf2d8236d47cd667982de51c569e9816372cb79e32166553f9bcbe68f7bc2a6ded5655809b1caf5bd941011e7
+DIST go1.23.12.src.tar.gz 28185486 BLAKE2B a4d66382a56b89987084e06cc7d18fa48eb870cb1cb4202c86f7a8136f2dd1e2f592a8f3129384c426635aae74d4dae073520a124163497f143a047c61aa753d SHA512 c7f2125328da13aa956b58e5238ff4bba6bd94f2e93dac88c1b96c0556c1de3de28c512197a780366806bba92fb4ec03f1ccd14b606b8544b16bb08df106cb50
 DIST go1.24.4.src.tar.gz 30788576 BLAKE2B a553d7f3ec647fb962a4bf89c131b2eb6ad5da4f9335b9e3ef417a9eeca20d81d61c4e92a48fa050d3f422affbcf371a2bcc81e23a7c1b2c408677f7bcaa1025 SHA512 b785583fc53d62094b2de793a0e3281a26d2de17897a35b378fc2d13cb912ca473c37a7bae54a50660141809d5d0a70a97663d406cf30d7f0221ecbb5ffddec6
 DIST go1.24.5.src.tar.gz 30792943 BLAKE2B 47d281c221ca87f7b668e5e44017b77c408c08543ded64c54de9515cd3759f92228983f878e39ae0d52e7bbdae4c09161381196bb7efb48e77f38694195c883e SHA512 917cd6ac83e3370227da40f8490697e8638847e9279ed1806044a173d3b52829c67c429990db92d8aadcfba6a37bfc00114c1ecec3ac387a781bb7edc8dcab22
+DIST go1.24.6.src.tar.gz 30794139 BLAKE2B b51693de6047402baa555e3d6c0c37511de60270c538797ea09317c604345b7577c0a24aa0f9f3963340538965f130360d4d98ed91470df83e790c95972af265 SHA512 65f535c722f4a0f6111c9ed829677621e456a5bc969ccb99009da1ade096b2b1a648a44ccfa913543677c220baeaf1afe634ba8ba165d9474ac9433ac249c914
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
index 804fca4ff06..3c89d598512 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.10.ebuild
@@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
index 8055c81cefa..5fbb4075aa3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
@@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 ~arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
index 3c89d598512..fba569335c3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.9-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.12.ebuild
@@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
deleted file mode 100644
index f3fe286ef7a..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.3.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.22.12
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-	;;
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
-	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-	cd src
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R . "${ED}"/usr/lib/go
-	einstalldocs
-
-	# testdata directories are not needed on the installed system
-	# The other files we remove are installed by einstalldocs
-	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
-	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
-	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
index 2a3d3932da5..f3fe286ef7a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.4.ebuild
@@ -20,7 +20,7 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 	;;
 esac
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
index 2be24178ea7..e974391efc3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
@@ -20,7 +20,7 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="-* amd64 ~arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 	;;
 esac
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
index 73979ffd662..646faac6569 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.6.ebuild
@@ -20,7 +20,7 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 	;;
 esac
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
index af542129b69..1ec3c923c8e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
@@ -3,7 +3,10 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+# This is just a stub for tooling, see the IUSE hack below. Don't panic
+# if the array here doesn't contain the latest impl. If you can't use a
+# new impl., it's likely because it's a stable-masked flag.
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 
 inherit python-any-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 18e3c9871a1..911020e9ffb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -10,19 +10,31 @@ DIST Python-3.13.4.tar.xz 22672472 BLAKE2B d453538db82084f490456416829c7d30672e5
 DIST Python-3.13.4.tar.xz.asc 963 BLAKE2B 5c594f95a7b74c2191b553f50020cd6db9b400f32af62d12094fa4c449651079a662645de8118a7a661c4ceafceb9ce5bcecbbbf8d6bc80d6657a0247e88e510 SHA512 ba9c1dee0f3bf564e6ac19cbe08cf4fdc3779a04ed8289654f6dda3fba9f07a0937764a12f1e7e2f6d7ff17bb5b86c05b8ea19296a2b98d1c81a48362ccf6104
 DIST Python-3.13.5.tar.xz 22856016 BLAKE2B 9caacad8745dcd238b208022cb140a6655ae57ae0b7f5ac88efc84a96635c310102a5de20cbaa43ef3c329f454b142a0a019141279d49a4d657be5682a1d6521 SHA512 2a058072e87b614b204bd1321b2bfa9c4b6614dbd5ded98dc0ee51c0d6b81504f902b7c003ad14295b371a37918f6975dc37d5a9c836dd9c30f8b086e4759193
 DIST Python-3.13.5.tar.xz.asc 963 BLAKE2B 2db0162d18129ec42b48393108a72c28e7f8f8c3fa40b2e231c87fe0bdc3c166fb6ca4a1c1dfb3fffe1aa0c2618c7ccb245513beb7a0919b4aaca5ec7eb23b36 SHA512 07c1a2ec2d6ba2805680b7f1dc262fdc5dc3eec4503780ecdc08cd570ccbb5f1efa736ee03c83d36bdb33ce87db06be5892cf5a6eaf4018d5fe78fff99e615ae
+DIST Python-3.13.6.tar.xz 22761268 BLAKE2B 9f025130ffbedfb105a33abf47a85c598f31df25f39c1c2b18d9a778d62cce8005b7716618d094e38b30670855a388d18e90cbc2ba25d22c8a6e7728fdbbd0d8 SHA512 fca724dbb4f3fed889d0b51c86ee0559c70ee2c7aba1d8b089b08538d82411ec9e6bc9c7a39c1dc4bb4f13b5cf0d9a332f7759412fa540a1940477cb47052316
+DIST Python-3.13.6.tar.xz.asc 963 BLAKE2B 7c360c7fb269e36bb886e9adcbbf667a781ee6abe2c0b133d3470f9ec0568aa376cb42d6760f3e836caf5f91c96243a0c42619d6dcd7afd3f7d4e0df617cc924 SHA512 133b2c017f9f8cf93209f11bb398908528dabf9b66ece034cb8a26fc9550b84a3589f85deb1acfe322b01db20da083c039ce91db1452bdda9fb885a948d53c50
 DIST Python-3.14.0b4.tar.xz 23641472 BLAKE2B e894c115d50371e2ecfd5c0cf79f37d3bff230338524bbb2352af8e42d256cd8fe17a38c68769d3125ddcae33500fd151ed64b5641d7f35f4b8968fcae9e31b4 SHA512 faaea000a474430a4ee41bdc95f9a77aa6573354698bc987a7617a6d36eae4b8e7f02ac945eb5b97df8dc62a256725ccd59fec08d4af2bd7b6e8a31ef4f92e2a
 DIST Python-3.14.0b4.tar.xz.sigstore 5038 BLAKE2B 95bd040d9be4d746b8d1a5a7486d309783248093b032b85ac5e7e7eaf35caa99b43bf3bf7c3ad69635a7b4f14bf6e42a9ba0b54d19986069b5dc075d17a8ddd5 SHA512 3e2a7a73d5cd98e4e8139ef89bf75c1213459db7634bb57ea2de126ff403e7f9244ec6fca525bcb55b9cd5342cbc80d659772709ebf405d330dcd4f14f93a7cc
+DIST Python-3.14.0rc1.tar.xz 23661916 BLAKE2B 77657bb87fe5a8ef538d97ca5ab39be8243d222400f0439ae6a719f528f19d79a22b3c0832c8e0ed9650e8d18a546cec4f40dd881d142b0739e97add688662be SHA512 6f34f593713282e105f9cf0396c523f738f3e4e8c2d4bcc4051c9febff96ab521e67abfe5fd072d7f584c3afcc7acb96a42939f51259ea411308a48468f7fd4e
+DIST Python-3.14.0rc1.tar.xz.sigstore 5134 BLAKE2B 10f93540d5acfcd1509826b606d5a2ded0b40c5c60951c893d18c1baa39d8189ac15fa586fcd34318ac6cfeb4c9ad51a86936849a8cdcbb179a11cc86f5f3189 SHA512 0ecd23bf303e42be6f639d55e2b00c13a87caf512923fd529b2661de6e73f76491def062037befbefd6c2fcf2608ae8cb27faae7431137b53e60c8cc20fec740
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.23.tar.xz 19659284 BLAKE2B 17c7c9acec1e2f2e9d146b2c35738ea05cf16609f267dd784668ab43bcce7be93e164c14106f9640a060326ebb2b8bd4ee4e58086bdced4ca611d7f96dbb3699 SHA512 ad2eb2eebff286a16ad631339bc0890b0686cf5e669d28905a98f96e9b1af6673d255f36bf19e146aa4de8d012587dc6b3193e903718f9cdba4b97041318f418
 DIST Python-3.9.23.tar.xz.asc 833 BLAKE2B a17a88b1997ece75e6447398d20c67e4b1be6d64204e6ac20aa4650e465b0657e7ae8bd497602d2e3c7193b50ecf7d15a1eb996942a05aab117eb25446dab159 SHA512 10187b0df66743308548780f82872d032530f8233f539cf66a2cfbdef1095b760f81f2fcc1759f003cc6f20752be91bdef71e4d821e76a75c0c85df112335698
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.18.tar.xz 29664 BLAKE2B dd69f7866cebad2536b41056571d74cbd90800062b06612b7509c9ce8f258aef66586f3c6e08f52caaceb7b0a01a52502b9c763b6f7d94caac0e929d9d77219b SHA512 b4cf4ff2d7e5b73e1102acc2183c4da3e734bdbec1c284d1fef8aceba0d49246dcdc954d3e4119521fde1e895bab0754b34b346b736b46ce45aff1afc6d38cef
+DIST python-gentoo-patches-3.10.18_p2.tar.xz 40708 BLAKE2B 9fb59889ffec1215511b0a1540d4765366ae850c43ea4fa41cdb65ffbae073b03288cf4071a0451cfc240a0e3a172224121c583ede5baa0784e47509aba83a1f SHA512 58404ae035becbac51031ac1dab84191f2ea342f763f9ac9ca0ded10bc2c3ece4c68d1b49f202c1ccf8faf5c5417f779d56a977da93af27c15aa08754e8bded8
 DIST python-gentoo-patches-3.11.13.tar.xz 16492 BLAKE2B 8b188742dd3f25974cead290e5793c31f02741a901dce65137c596045fa2fbd5baaef332204af90f95ddcd864ee542b252c00b190e15c25af60a7bda771b116f SHA512 b5abad341d2eede81df445b56a98720466ec23df40a8a2e99a04dba5a106205655c8e2b64df0ca2630f036c8fe457ba64524280d137bbc99f52e4fd8e6bbd5ae
+DIST python-gentoo-patches-3.11.13_p1.tar.xz 27748 BLAKE2B 26e0b5397d7927711bcc40330f72f54fb16c660c56a2f87166c5336eb2f53ccd4e920b906854ee122d64360b414e11a38a31a410936b4a49f6610626203f4322 SHA512 7c7eca7bf827255925e073c0ed5c69e9036b79e35e8f6ccb2684709bdc41fec80823a1df192c3decf56ba6d53e2c9feaf7fb81f3a214da69773da6a2997ca19b
 DIST python-gentoo-patches-3.12.11.tar.xz 12020 BLAKE2B b419d32b1d7bef9408027edda7eac9a920a877e1b8f521483df595199bad1bbadd9dd9500079c09beab63286a801bfb25da5f93a5d31462ed3e457a6e40ad6af SHA512 1b0eaff4c0df06554525a50576da7eadb4067c4f2970851e5c9e3e527a9ccc4216cbd65c45fd562af4a1cedc2c66278a74bee5cf5c1a65df8feb22f34f5a19e4
+DIST python-gentoo-patches-3.12.11_p1.tar.xz 23276 BLAKE2B 794485d0fa596f0f2797e2aa505f888a05e2ef63840068b3214efbe51b592586bcfdf193b71e239beb3c3037f01ca086b6b97aeff092b2a344e74d962fb9dffc SHA512 1402b0bbeb189ed4a16364398495fcccc31da0aad4fc88e30978e7754575fbd8f51974dcd97d2a57a581072f083233dfb00b30af687455ad170fc3c64875a9d5
 DIST python-gentoo-patches-3.13.4.tar.xz 8912 BLAKE2B e3d9f2a12f801dc75e09c5301757f35216d712b5e5394f2ec3ce1d79d0cb57571dbca525e3d5c35b90fa059c2b78ee24341b6a51cbe9691deac84c9ee0578824 SHA512 1a7141accb7aa70c7bd8dd12528f7de031dfeab9ff089f3d044da0b7b52461e2d6d7d1467161e0fe1e259d9fa06d70bcf107d86ad3590e8cf73aa1132ef3aaf9
 DIST python-gentoo-patches-3.13.5.tar.xz 8916 BLAKE2B 9d985b12af62b8a917cac1dab9576aac099bc81ad954a5de254a14a3c7d2254edcdcfaadc46314b69a1bb76bd30ca8bed7c866c0de3fc3f89aac0f76af344f32 SHA512 5ac92aa3eef82eae5d707ffcb5085ac98bd9bf64f72fc7ac4aa1b12a0c3aa86c57d0f671ca07f46e2250779f4cf4885916e4d175357ad626eca6e41257a027e7
+DIST python-gentoo-patches-3.13.5_p1.tar.xz 19756 BLAKE2B ecc594573bbe3a28364d541d5e1014778c342b6e8ecb09e5e9def238ce73d51f178d02ae91bedce3f7aee4a753f2653aee4f4035f238fa60d603baa59ce4e89b SHA512 a60f3cf65b57aa6c85f59dc5f36fbabe1fa19a5225c3e224c99696bb3d1186b54bdad94627638a3a73b66ceb5958b3a5dcb2b83d13357c71ded04c98ad7da0b9
+DIST python-gentoo-patches-3.13.6.tar.xz 7100 BLAKE2B 71f3a4dd65ccfbd25ec9655fdff0a6d8cd4f0ac73e2589658ec321e67672e3ab2b95bd8b99dd2998deb5af9fa41470e1ced46eceefd565b741015beb52e613aa SHA512 0c9b3dd60d1038154f1a5e5a1e5e45ef548f2cc065fcc5012eabb3d3776b0703c39cea17a7360f182392efc4b3490f77fb919687d13c5be7a50c680497424643
 DIST python-gentoo-patches-3.14.0b1.tar.xz 5680 BLAKE2B 514b3edc3025e5bf675d371b5ada17dea426856edf1fb6095c2ee400eae95bd4265ef81fe593ae9338e801e7d0a25b1d5ba2d05ca563fd9dd020114b13575746 SHA512 74289e42cf532b54bb1b66a283ec19156f8a36ba38764209c133842314c9efb2ce2ebcba5aa9213bcf7fc0c8a5ca9b6e7adbd5dbfa4397233136d7cd55f53ee7
 DIST python-gentoo-patches-3.14.0b4.tar.xz 3780 BLAKE2B ad67e213b21bc039bf33c0a2e6d3a4ce5e06179ce167f89d56561834dfb5c5b5b5d7f43f6fe2597e94e4ea5d544bb0b60d38b847bb0c32277a0151f2084f3618 SHA512 e5e6fa02d2d24e46848fa5a79ba7fd8a6703473e3bee257fee7b5c55d5c82fedb29f0ba6de1117c6ca738df3841bae5bb00962ae0290d553020e3617dc557c6d
+DIST python-gentoo-patches-3.14.0rc1.tar.xz 3776 BLAKE2B 4f2cf7598dac08c3118bbca6c111684fe68fa7c8749ef394eae35c50bc7d78e30f6c54a77199fc87270ccdafa7725dad974226964841d666ceab7cb34d7bd778 SHA512 323586bfd662ff4ed41b7f5f34d1dc394e7e7e1ad87e8a9283b99a14e226cc73d7ff7fb510e772319e361f2ad2becfe4ac246cc0be34d0a981df286cb20c9734
+DIST python-gentoo-patches-3.14.0rc1_p1.tar.xz 5436 BLAKE2B 04a7e01c758e7e162ab05607e1a5f035c4bd77ad09cdbdfee183f02af396140f3b4f7cc0c627fbfeb05e076d4bb763afd77502a35178ec2eb0f4050d7d829734 SHA512 3795d4aa89d433196da74361b0b7ea9fa52966409667f88e8b069ec85674286068cfa3666a5503c62597c5cff4aa5ebf360b907c7571ced269a38019e593cf45
 DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.23.tar.xz 37148 BLAKE2B a7c0514037169b9938b2180ec2dd22063621d532367f6febfa47da43f47534559baab992d9c5257271121af755b8445346d4d92582e7e11b6468a1c359f28bf2 SHA512 73ef00a7aa671016de396c9e1c4bb5f5c1a97dc735739f806d809f987e802ec440370bf4c85468097547284a5d2b476cbffcec3cf219b7cb6fc890d5029eb5bd
+DIST python-gentoo-patches-3.9.23_p2.tar.xz 48060 BLAKE2B 2d4ddd3aa48fc52b9f63fbc6020e534234b4183366d121e836544cab93632cd05439205893a11bb505f679946b0690f0962eb0fc029e624cb1c61bc0936127be SHA512 61b3e2c7e8629e1c522c9de8ce9384ee8d1f90ca5ef0f7b902e6315c80196e5f13e0258f8002405a2a752e1c9b5e60f5c3c767c07554d83635fa074bce8a86bd
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
index 1c29c715ac4..2e133b563a9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.4.ebuild
@@ -247,6 +247,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -272,16 +275,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -289,11 +282,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -307,7 +295,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
index 1c29c715ac4..2e133b563a9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5.ebuild
@@ -247,6 +247,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -272,16 +275,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -289,11 +282,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -307,7 +295,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild
new file mode 100644
index 00000000000..2e133b563a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.6.ebuild
@@ -0,0 +1,611 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
index 013df0cf467..ff19b29faff 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.9999.ebuild
@@ -234,6 +234,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -259,16 +262,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -276,11 +269,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -294,7 +282,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
index aded6ca75f7..a9a1bc733e3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_beta4.ebuild
@@ -243,6 +243,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -268,16 +271,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -285,11 +278,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -303,7 +291,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
new file mode 100644
index 00000000000..742a14ccd3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
@@ -0,0 +1,621 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
new file mode 100644
index 00000000000..742a14ccd3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
@@ -0,0 +1,621 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
index 2b71ace381b..9d9d70958f7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.9999.ebuild
@@ -234,6 +234,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -259,16 +262,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -276,11 +269,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -294,7 +282,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
index 034cc43a588..246ae13dfe7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.15.9999.ebuild
@@ -229,6 +229,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -254,16 +257,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -271,11 +264,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -289,7 +277,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
index a8d31067ba6..43f8ee3db8e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18-r1.ebuild
@@ -233,6 +233,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
new file mode 100644
index 00000000000..2ffd36444ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
@@ -0,0 +1,572 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
index f31bba4946b..13edc56d65e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.9999.ebuild
@@ -222,6 +222,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
index 12f13e84a1a..830041bc385 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13-r1.ebuild
@@ -228,6 +228,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -251,11 +254,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -266,7 +264,6 @@ src_configure() {
 		powerpc64-*) # big endian
 			COMMON_TEST_SKIPS+=(
 				-x test_descr
-				-x test_gdb
 			)
 			;;
 		riscv*)
@@ -283,7 +280,6 @@ src_configure() {
 
 				-x test_ctypes
 				-x test_descr
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
new file mode 100644
index 00000000000..33eb872c4ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
@@ -0,0 +1,619 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
index 28f563fc339..c174b1c2a94 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9999.ebuild
@@ -217,6 +217,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -240,11 +243,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
index 6de4b2d0090..9986c578aa5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11.ebuild
@@ -224,6 +224,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -247,11 +250,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -259,11 +257,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -277,7 +270,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
new file mode 100644
index 00000000000..0627a62b043
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
@@ -0,0 +1,602 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
index 9de13a1b925..5ac7078919b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9999.ebuild
@@ -213,6 +213,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 	)
@@ -236,11 +239,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -248,11 +246,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -266,7 +259,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
index 726461c034b..3daede2bcaa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5.ebuild
@@ -258,6 +258,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -283,16 +286,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -300,11 +293,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -318,7 +306,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
new file mode 100644
index 00000000000..b6cd0106fea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild
new file mode 100644
index 00000000000..13bdac28ade
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.6.ebuild
@@ -0,0 +1,616 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
index 3a94cf50aa4..90faf189a2a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.9999.ebuild
@@ -246,6 +246,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -271,16 +274,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -288,11 +281,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -306,7 +294,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
index 3a555c73330..0e12041ad47 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_beta4.ebuild
@@ -260,6 +260,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -285,16 +288,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -302,11 +295,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -320,7 +308,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
new file mode 100644
index 00000000000..fefea218044
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
@@ -0,0 +1,632 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
new file mode 100644
index 00000000000..fefea218044
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
@@ -0,0 +1,632 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
index bce16a6df9f..6b946baf908 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.9999.ebuild
@@ -246,6 +246,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -271,16 +274,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -288,11 +281,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -306,7 +294,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
index 054fcbcab78..f85907c04d2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.15.9999.ebuild
@@ -241,6 +241,9 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
 		# this is actually test_gdb.test_pretty_print
 		-x test_pretty_print
 		# https://bugs.gentoo.org/933840
@@ -266,16 +269,6 @@ src_configure() {
 				-x test_strtod
 			)
 			;;
-		arm*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		mips*)
 			COMMON_TEST_SKIPS+=(
 				-x test_ctypes
@@ -283,11 +276,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
@@ -301,7 +289,6 @@ src_configure() {
 				-x test_multiprocessing_spawn
 
 				-x test_ctypes
-				-x test_gdb
 				# bug 931908
 				-x test_exceptions
 			)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
index 4555932e5c9..b74ae04ae88 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7-r1.ebuild
@@ -158,6 +158,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
index 4c74c776485..2d7101334fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23-r1.ebuild
@@ -167,6 +167,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
new file mode 100644
index 00000000000..d1493c0eaf7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
@@ -0,0 +1,566 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm +ncurses pgo +readline
+	+sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
index 1f0cd19c1e6..39973c9fe4d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.9999.ebuild
@@ -156,6 +156,8 @@ src_configure() {
 
 	# Set baseline test skip flags.
 	COMMON_TEST_SKIPS=(
+		# running gdb inside an ebuild as non-root, within sandbox,
+		# and possibly within a container is unreliable
 		-x test_gdb
 	)
 
@@ -185,11 +187,6 @@ src_configure() {
 				-x test_statistics
 			)
 			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_descr
-			)
-			;;
 		riscv*)
 			COMMON_TEST_SKIPS+=(
 				-x test_urllib2
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index 0168870676d..0b553581091 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -541,6 +541,8 @@ DIST rust-1.87.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e762097c3bfd
 DIST rust-1.87.0-powerpc64-unknown-linux-musl.tar.xz 80980736 BLAKE2B bacf5aed3af21f8b825e54e7f58fd4c442c47d2898da26d120ffcda3238b4cb9d52ce3256ec37df1def2f0313d822424d6b9ba8e47cc48c072861c631a6b33bc SHA512 904dd60d80edcb1b9a9b34c4184b27cfc21f7480ebd2910447ad6e8e9d11872e4c84432e658ad5f6d8c439c687ccb2ec87611df9d499d73b21602cab13a97632
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz 271039948 BLAKE2B 1bf3516b146fa88b4460e15bfb51960ebce8ea46ea2d79ea391cd30c5685d7d5e0d7178450538577aab462180f777789bb5061d1f5a4460fb609784d0e35c636 SHA512 60fa1a2656c6b9273bf27ad87b04b676e2cb71219e2f26b5ad4ae045809378d5072b9e1dcc19829dc0eb46be9819f20f3a53731d83a2ef6b024d458ebfdcd656
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fe05b3cd1746932222690932292bf36af9cd9ee36efa30598c52d66a4e7452220901f6da0acd9b498aabfc3de457f36e5d69e07799e51dd417ae98ef171c9482 SHA512 052512118f795c63bd9a4ba50a68212ef57f21bc031b70fcf88b5903f6a95b3251d43d2a7895d3a697637d94e76623b5ffc1b6c190c9e1e426d3955d71e7d549
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz 276069796 BLAKE2B 9babd064bce24b081fa8f98a7ba0bca6aebe2cc153255c4407f874b1a0d13474958d07e0931668aeaa3848cddf94554bfdde9b0b2a46fd37df7b874f6672975c SHA512 46f53c1543276263be63936999e0e9bc5571d7feba59ad1cd2513ddbdb64a8cfdc723fb95fc1e04fd44b9fe5347f96a614f3dbc8fc25557c452b37601ba86814
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 53554e54b65f289a7f2cbdad908db3aabcc8284746c4ee155275cea0f628480d78644ac248f8e9194c46b07d841cd81a21fa01b1f8663d272de7094677e5c4e5 SHA512 827948466feee0eb4206e0bebc5764e3f7db67b394177939248336423f172f9a52a7746b54efdae465fd6da5ac1ea0d7a1dfe4e3e7492c2a101fe15202588085
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz 250242712 BLAKE2B d9d75de2381bdbf40ca77cb8dc1c8ecb23b5e209f2c919b56c08605aa557c4d827b92404bf0012093fcf551cd01520c41c6c8f9f2f56798104c6db8592b4d918 SHA512 e5520a5d6fbc0a50a54ccd9c850652475bac2e95e19ec2141e57c038d9a26ccf7cc2a046fb2fe4272b721005a4deabfc2c35c6c7d0a6cc2426e8e45e3e97834b
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e7c01e8a1027c408231812482418af16b1147ec577b6b67cea00172eba0716c58954b2a4378ee0213d839e35546efd7eab9f3d3b69ea57e8b560101229bad3d8 SHA512 4279b423334a9ec356d42d1973bf9d3388d5de8aa745b18c34d634d4d9d60c70cf165d851f571ab99a567e49bdd635eb0094c5c932571b0a5325408319403341
 DIST rust-1.87.0-riscv64gc-unknown-linux-musl.tar.xz 86942496 BLAKE2B 3c19dc3eb317518108cc269bc57c53296876d7f4d58a9dd0859dd2d42f377f204c7ee3337672875ee93f3f3a2459f9cdb882460d848dc4d12ca55bb0239e7a96 SHA512 872bb2a158159274b0eb70e21350ce56bf2edf5177ef3d9b8d63b7344930b6d93834d87ff24652f2487a1a997225e562567c53c906939836bff2cd374394e00b
@@ -565,20 +567,66 @@ DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz 261235476 BLAKE2B 5ff3f9167158844
 DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B dbcfa2e32906b07d4d9eb8d62af464f38c626d16b831e5d25fd9517f8f4e22ab60a2d6521f61ac3d36c0d9d6707a702ed3248fa0343462f62e1404574f83af9b SHA512 09f707dbed6f8d46872e4445e49c793a9f9cfedb71f3cc3b115b9447c7c4b86811081400bbf342c5a26b2f929738ffd9fb25f75ed1b13e333683ca6eedde430d
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz 261520268 BLAKE2B 23d53eecaa14898537cb3647cbff114870223173f4e50cbdc19a7514f34995196792b0390337ad53387a7bb515ec34330502acdc361826429b8f3985a9341c8a SHA512 6f4a040e22de950e975c29f16563f19030fab9fbe9476f55a4542c3ad9eaa9c34500cdd4344819b5cc27831b32811d25d296845fef01475224a2bfbae7ef9ce7
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ad7b0c85d6ec2085e6005f0789b6eaa30af0fefbf6e621b58f470b916320141e78ec6e112a4bb69867417b69ef740bc033db65a2fd3f54e5cfacfae56b58b57f SHA512 0fb6caa3fa06a28fa1f3a3657df6c2c1d4d87db9a94a74b9ccab14418af7057f3be75ff33556507f48bcec2e648324bc1629ef94c8c57e5ca62b8a9fbc49c9c3
+DIST rust-1.88.0-mips-unknown-linux-gnu.tar.xz 78511648 BLAKE2B 83c2cb810b9d884e06bdd74b55a59e305e9121c0b9f8808afc2f015d53e3e6c3bdbdc94621cbf4bafd64a923dca76229baa99cc9cce3cf08e3c24bb52121376b SHA512 de758b89d3a44727ccbdadf00e32c1c2dfdee2dcf0d291d92ff204c839d41b3dded08b0f045ffde67649af1c02903db65241f3449aa738bc7546420aee2b6a40
+DIST rust-1.88.0-mips64-unknown-linux-gnuabi64.tar.xz 78365128 BLAKE2B b71689ad4fcd9f6688250a3da28d7256eb3409a3b9799c2d431037781a1591abc39bd9070fd7e68cb86153a910a04600c0de8bdb07853c63320075dd969dc31b SHA512 1108adc0be1a3b558cd0d0bbf92c88dcba78660dda1cb2beb8662f16b76bb381272b7700bf17a4ee110d065ca44a2460fd59873e337521db519ce12a9e612d6c
+DIST rust-1.88.0-mips64el-unknown-linux-gnuabi64.tar.xz 79916392 BLAKE2B 71d41fba617da56603a49c371d854980eeb62b5aee31dc268a9068b2a401e06cdc23464c17d21786fb338157ee97b69ef65f22f994f756e43d1f3b4f55e64d46 SHA512 c3c42ed9ab87f84332ea6c4faa8ca7d7ba321ed31a16aaaef4dd0339b941c1df6d35536763a99efeced9f50783e66195fdb659228ed4e37eb9165a2588e8f61d
+DIST rust-1.88.0-mipsel-unknown-linux-gnu.tar.xz 80184380 BLAKE2B 232b96fae72abc499ce31e8b9f7c8f61baad8e2d29069dc49aff9bb455ca7ceaa300dbca88cffae90ca903ae945e7391b4ac8343abd82d3160ae0bedafcc84bb SHA512 6609a3fb037f65ac49e61c4a20e5e8ca8466f83adc4f7becbd1bcbc04df3418adf5a2894a934a159ef8d905ed86dfbbdaa38721c5db4d74e9a47ce4642180b9a
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz 255291852 BLAKE2B 4ef3d89f38bbbf12ef2ee190457f4ce96b5e60e02cc72a1e312a897c73fc28677277008f322381f7f084ae7d93671a9b3a46dc5e266a1b8c9987c780b26e61ac SHA512 f7100076968cbc4bf529ec2214f2ead865e87fc5e55f0a683ffa3034d3e31db0c9619fbcd9e854a7fba8d2e06732456edc59280bbd8de75e33df9897e65520d4
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7bf2a3229c6ae8a718812edd41dd0ffdd61dc792801d365dbeb46d7ae32cf12ecc7210ae67ba19be35349a27d656fa76a887a5d91d8e2dcd12b93600635d67df SHA512 2940a66102c6dc33dab8d410884f7bad88589c8df45f361c4f10a9be8a15d896c91a45c95f4c9b5f23a9d696af343b64d056274816b2454acba3adf1eccc0780
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz 255371956 BLAKE2B 45607ff673bab803e794a3ddb070de237e94eeda43ca5fe52c49d006db2789433dfe324f706bd57d82d14f18bea0bb02372e71593c0251420628f5edba9c0fde SHA512 55889385893cfd957d85376ff68a677dd70886476392bf8f4f8ff671777d0ea168491e4d778c88f40a9a06f68717887b8b0ff3dbb0a65b956a98aa00e6b81dba
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0625be465cbfdd2b73e73c8adf5ada2d7c0eaa4541f3735eec32d464cae44b475fa860cf126e433aa69a6f2de02d94af31bceae4ac23364ce394f34cf8f65586 SHA512 b25598551b7c0946adbd11ffdeb1761640f6bb255a9925cc734b4c12d82f666fc4344fdba9ab83fa63bdc82129dbc68df7ba125b8851238ca8558ca5de5c7dc5
+DIST rust-1.88.0-powerpc64-unknown-linux-musl.tar.xz 81542068 BLAKE2B a27027a975d87e7fbffc4d8bbad0f4b9ce8975eeff724e0607e2d26636bff075867a50b426ac79da1e6d1d0104869d39ac6f0215f012c438ee24a1293baab2ca SHA512 f6c643f2e86efa4e5793d745c04c2c37481bb7630ccf33735474554973926952d0b80ad3028f07e94b103cc28aae3b7c9b93e73786d215ab095c7ed104bc854a
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz 270351680 BLAKE2B 0b47e4e756d571232ec07d73fb99a2dd8e5542fa8d7046d565ed0277111ce07e5801815f2391fc0c19681f63b45e781c18d43a3fc818cc0352aee4c0a8da71fe SHA512 0e0d800f02bfebcc10792f71a48a7c70fe197bf965b5a055df07e54408e49a9cdee4dc744f4e06a2e400174265c833fbb4075f5a477508e72deacf48e955fdce
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fdbf7a59a1a37c8ad09d0568e30487d01513734ae9bed276e3e3ba45cc0d39b14f958a377def77d9505e158d256780a7c1c936eaef40d7541279effa88f8c5e7 SHA512 1ccfe4f582783a80dc8bb0e50f5b782da661940930870c713ffd4a8ffed6df7e760829ee224e368bca583f611bdaad33eb46f3728fbe2b3062107510194671c9
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz 275018668 BLAKE2B 3c6307a0bfa9b67be222f010533107b56a81860e8db07b44b2155464df5f24ec77a83753d00c71ae85f03cf1ebf3d91739a892a3af94f025c664c5fa0b276cdb SHA512 1eb9128f32432e9ccccf26f326946a734ad09416587ea0ba191f602e3335deb83cb1c45bbae08ee4ba711ac3ee6ca2de628efd008a4d6f39f6268dbfaec17dd1
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 283a3b9555499e5bc2f8d422e120802c5566593ac1aae625bc1d9ffefa7a746a53f1da5535c79a5b64eafccb112ebf0af50c6f04d83f9dcf7d2a15e9a83a8760 SHA512 62b75696fa82dd41677fbf878bcf36d9f5de489a2f2eb4733b800fa9b28009ad59287d72d5f9333fa9c67b1f68963d4295a376d2800c6392b60c0d55d7f715ad
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz 250151976 BLAKE2B 04b732c4d251af2d8279620a3a7da81a31161ec8f143396fc3cf39a5b6fa8dec5ff569253126b709a0ec147dfe7902a1748b313324173f0ef76ee89f54d1292c SHA512 389d92297915cce0155a8a96c0052df655768987fa1846e1e7f71a2f3da3e29e6b256f85f0d77f816b53cc33ddb7394f472f7ce92b81d40baad4c7fa0d2b2883
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B f3602574232fe5e0af2e21e2a3178a227070aca5163230ba2a229d7ca63a798f0fa8564d2b16fb912493ef1d8d925cee5a21448c69843411c0df65f4454ad716 SHA512 b3036020032c51e6b739475c4c2c21aaaa742018ee6cad2a0b7f7a6eff193977eb93450cba01a5ef6c436d6b4ba491c79787c980a465306f42c85ed0dcc034ff
+DIST rust-1.88.0-riscv64gc-unknown-linux-musl.tar.xz 87040024 BLAKE2B 760b06ca652654f51268a9fef8e8eb026e6b0c6e22eecb161693b8d62f3f2fc1df34e4ab896d6d7d18e2a3d065fad6a133abb918a94dfe4b016b3251de87da13 SHA512 25db6caef2823b93bf7bfde00676ccb06344b500bf0a4013567354fa94002770ca8457e8f461b79944f506a6243091f8ac5162a79818d538c874e022ce34dfad
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz 239909412 BLAKE2B e92e9f51f2af3c638b82fa8e7ed1c553b7f7537f32a67bd875ade77a04ba646e3b22a7ff88c28bdb3f02b6ddd753efa400962b4dbe36bda58ac5ae8326b9b35b SHA512 01d914bfcbfbe061ee2269445376112ca61fb87fff8acda07c3183aa051a50f270425d2a9761bf036a3d14c7b9cdabf392d3d532bce8a7e0d2ac9b5c22cc212e
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7a85b49f5e311bd3261ac0f6d967fe5505f73589c1d218481270adf00e72ee6bf57158d0da86f8289da7f4bce1452b3ba7447e1cf116175573eea8c07e58b0bd SHA512 349d119bbc4c12cc005e3ea9780b259413d93e4b052f5f7fc677a2e2bf71e7cbafa5db9770ed8378ec4a3053a2d590562c354c1db924247a74e20d1dcd4abdbe
+DIST rust-1.88.0-sparc64-unknown-linux-gnu.tar.xz 76772328 BLAKE2B 4958a6846edb1531793acdfaf3df064b17ebacc94d6485834c895cf4e1eff15bbc1e40645688ab981b0a1a0ea200bcf4256f182437377fe9339f27d7c096307b SHA512 e8225d15889cb82276ccf6490a6f2d534755b33d701a22501ac33ec4069eb8b47213d86ca7d2116d63702901780cc481935b4e6985c7a847bc4b92189cb64e9b
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz 197237052 BLAKE2B 5ce55a2b5faa41ccdb365764e1a3a10d46b385b678460de6dbaf3ef816e4f36164040070ef8c56183bdfe90389c1f81017bd7c411906d0a7b39899432f710e8d SHA512 ce97eb4697415bdb1fc33438ad62d9c410b00bfdb7c78c8c80e5887e6a23d3299302694918cbe259851c85b971f0ae3198ab6a89e26c94836a82bbf9e77cd80d
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d3bd096b1d1c7fce42f60cbd5f3b3a459c0063430366adc78c026a0159f379d2537d74d4f1fd768ea5b666a33cc28aa185a867aeed04ef1ae735a3eb794baa47 SHA512 62a5a9ffac0e95fbb547c504336b3aa160698e20b8ba322769c2233972c6ace48b2afdc42e84559b244099f9d8115cb96ba3c8f0923806559c53f80d3e248d04
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz 291407088 BLAKE2B 17c8144b9acf12f190ed8bd3367a9602535ecea365a402e1248b26457f263103680b3d55d4b670aa381de816db76d263fa1c3d9715f60a3100c96765dac4d61d SHA512 d4da2f9cfeb50377616a48437ddab836717de94fc0362e6b8f4afcd7b4ca939be1c902db54b7204fb35863189e1f8b8d9b7bd4713e4e4729e42db9db2d249711
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 31f344b4f8cb6beb58e2cbd62d7891abe764bb6a8a473b805ad55a7ef2b0952677e32481c22a2ec81146b61f74dafcbd384f629bdb7f7799ee642ce926f80953 SHA512 64824b1f927080e8272d29e4fee56e2237621a48b3178c2b4a5ae580519d1c954a85ce383232d0fcd98468a6530579353ae65f84b4205f90c4fc144188f3adb0
+DIST rust-1.89.0-aarch64-unknown-linux-gnu.tar.xz 167842432 BLAKE2B 222b9173c5a53c043df0c25e9ad28d4d41cdfdecf5008de73ab32886349ab5e173de6499e6bc53b7a3bd62389cc8a19d9b33697ce7a46cafd6f8d73bf0b78118 SHA512 bf3229189ce371dacdb02413e15ecbfa17e7e2c511e838e456810da5bbe81d31ca15f03b9a6d11176f63ff4653414910fdb5886bfa1ada0a1e79c3fd1f99b804
+DIST rust-1.89.0-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 1c5621234b00004a619070da70781cb5b7f4fc93cee9874b275c7be8098c240a02f7505e62c658dff4200023c0517fd62f6386fa0c36bc19a2898953e10375bf SHA512 300a870006b4a26f9d2a3a70f086b30784361bcccfe32cb80d77e8f1d0a8d24ae6dce5dc57ae705242ccd2147e631c9c26a0220a4dcc4f672e5d4879b46557b4
+DIST rust-1.89.0-aarch64-unknown-linux-musl.tar.xz 245117812 BLAKE2B d6ffc92c0da14e2048530b9bc01103b9a176361094f3eec8b85f3a5c8933a163caa54db98cc71b8db7d5672cfd93774525037bfff0e938fa3424fd7e3619df2e SHA512 0231db8b3bc0c2f7c14bc4681a7967677d3f23c1a8901b3a277a419739a0cb84331dadf7fa655a340021e41b8b30a0cd39f66ecf57990907fae4faf1f1364470
+DIST rust-1.89.0-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 071e14a76e3215dc7ca9cc627c9ae8b629e8f2167f88917dd7de033a873aa000461dfd2fd759f5e02d8a158ab7cc78d13c93b08da3c218d47b4c5be4100229b2 SHA512 70d9d1797ff592356a94f2792eca5eb29175199e1cad09be4310b9247ecb49d4b24212c3b3d4f0e1907e0dcf2a4b3fa156bd289e7d3583fdcc66e9446fc4b24c
+DIST rust-1.89.0-arm-unknown-linux-gnueabi.tar.xz 230269052 BLAKE2B 5b89fda89934a350d5135b3a2196bdffc65088f5db3167c1d68f79ce4e1bb6997aa3ba24aa780226431c2d921bed43f003ae8551e6c5f848f37d61258c10971d SHA512 c748ef69ad9617a8925a8f28237f561c6e9be102cf23f6f8f4a9a1ff40c24b1e89592f232f276fc35a813a01985ccdcdd8e33840d3c9c94fa2841f693454ef52
+DIST rust-1.89.0-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B b7da749fa9fa0f9a62d34cc1fd8436e3a173e34fff5a2e19e5d1ef9ca183db28f08410a88a5865bac4c5866194c8244c0a70329cc2f1101e79ea2561322f30a4 SHA512 f9445968e89239995614de933036c64e9e2d4f1f2f201161bd115aea722c0110d39c4299823d6423b81f40dc00a3733988b4968f709237e180afa4c8abd72a02
+DIST rust-1.89.0-arm-unknown-linux-gnueabihf.tar.xz 230569320 BLAKE2B e46ebf2fff070ef27fdc146d6f16fa0b093d3b0e65739bc6305b0d4fce8ed7320ba8964279b401f5386d3927dda8806d1291daab80bca11cee66ff07b83865fa SHA512 3eb78dab9c65e5aa90735c17bff2bcc49698a8f8a582b0273f8ebd3f3536767f8f604c432264ef1420d5909a8ca1d2ce8198ed21af5f91b8d34e367eba6edebb
+DIST rust-1.89.0-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 4019c8738028543f195d419e87c0938f765755f8604dddf5e46ee36a292d287b8fdb3b2f0ce56844cf4af30bb349c523f25dabe2b88eef02a862eaf4f9823dce SHA512 a8d2a1818707122121a00a61aa2219cd7a90cdf0eeebce10d49fb6be130072e985a996f7389566d565ae6958b43696c8199b824eba610440380b67f4d7cd9966
+DIST rust-1.89.0-armv7-unknown-linux-gnueabihf.tar.xz 236421804 BLAKE2B 7e52df2ec7a66546419abb24c37f74cea904aac72695af5ee6c29da06389be8e49d76675aa0d99058a2350297ef4217f7c50008a6d7c1252814346d59e377e12 SHA512 9aa477fcc4db6373941deced70de8354ba98763cb8fea71f49eb178c8e630bbd33db6b6b53fbecdf7dbd7979399f65338fba579a3eab2e6525e1cc0417c3a201
+DIST rust-1.89.0-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 950e1f296a883bdb5c77435428bd59f961fd70a63efa5078516e81f3f49211e968fc5c32d60f8eb969e27416616428f1b5315d336339df7376eaeedde8d73825 SHA512 810733b44f59f7c86e7bc2fc8bd1f737601f6ab4fc834f00415f566f08b836076fcd8bc1e0d9f8c46218c90f08cdbefd9255b7d550798e2d2eda1b55e476c501
+DIST rust-1.89.0-i686-unknown-linux-gnu.tar.xz 263655764 BLAKE2B ff9f2fa8b1c268311de530ac815c0bdd07357a157abc9ef457a309b6211336fa423964a56e05fe736d6d190c946850585e480f234dd030ea18e1c7b847bb58c0 SHA512 122a3f1d9152bb4fdf3978d3b567c2662abe6a7aa7cf9993e0f5bbdf509980be10759a60872bd5a63fdd27f3c592e4b1751d9550b49b9232c68d94732523fa77
+DIST rust-1.89.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 12622868707e549f99cc21fb42a4816a844f089df53f7c039d8df2129ad2847ec4300ee0d2fbbfa656730ce1476ad54d7c4603db98bdf7588cd33d8d7661da09 SHA512 ba548bc6c79b9bccaa15fd34d54a03a653cf3351727f8a918f6ef03b3c70d443116ace622388e84c92288ab0fa623f0fcaf2bf7222a5eb58dd55a68bcc5809df
+DIST rust-1.89.0-loongarch64-unknown-linux-gnu.tar.xz 262411344 BLAKE2B afd842e9b742bc61127b800190dd475e337bbcffb8e65c9c7a1e03a54de4ce9a661bdb81a6754dc89a4ec75f4f97417283a616ebce00f9196d464b739db57248 SHA512 8ac5d66a32348417cdd4b71379b089c95c7119f32621b2f9ea7f4a98f7a79a277f925bdde7d2c2606442f534782b01c6bd5b630b0a14395f935b70292e6d40ec
+DIST rust-1.89.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7089e317280245582e9ad414ff8c43f87b888ab7c451c07fbc7652b2bc59290e57a1fdf4583d4230f16cc5873277c4bc2dfbc8c07621c865df10f95ab314465b SHA512 014f822ac210e70370c7bc75581ecf6bcdac140795cefc61b9c25d8620843c6f0a3afee405026a46dbf05f038ab3520db0bdd08fa011cc7f502bb7a3acc90871
+DIST rust-1.89.0-mips-unknown-linux-gnu.tar.xz 79214364 BLAKE2B e08965697d3e804264f22a65354e4528c7d4198b6cb2e7fb64ca0cb321d072168670d3bac92918f4fec81fcef0d1f5e77e2b6a89e26296c11e0b3e7e2c282b42 SHA512 b0fa04f42bac729971bfae1b2ad4b439ec813782f70d4a8bba6cd98b9c34011c8197153d1ada9c91806458546f74b654fba8ffce4afe3667ae747b6bc95b70de
+DIST rust-1.89.0-mips64-unknown-linux-gnuabi64.tar.xz 79048664 BLAKE2B 1c3627737c551d1dae29c5502b97b6e2e9566bf4a773c75b55fc936e57a94072e3a83ed8283f3e01a0e76bfc7e781213ac9accc288db3e82d287e215264062c9 SHA512 b48d5543cb43e55ef3185a976bb71c42859845d7a4a33dff0fa7a722fba781d3f51e2f84bf1e8f029ac057d6c072880542017cefaf07995abbfda7b1fcb341d9
+DIST rust-1.89.0-mips64el-unknown-linux-gnuabi64.tar.xz 80772072 BLAKE2B 4872c27c64a9f629d9706aaca6b501ffae3ae82c457ca3ae0be9155615953f935da0d2da8672f697f53f15660bfbc56e058c3ae10c1cd18b17b9582ef0b93fd3 SHA512 f151ac5cb5260c8064e192a03de5ea30a615dd7201355f90af5172891f16064c8215ce8a6de5b7561cb3ea0e776fc666811ef9b2c79bb9fc89fa3cf6477e9b06
+DIST rust-1.89.0-mipsel-unknown-linux-gnu.tar.xz 80990052 BLAKE2B ba158d9f8834ea54ff2ed713ab200092d198907f4b397e2f0c06b3302cf65c77fa271f677df51dcf4370b07b4ffc909440c550fbd528af0217521ce4d8350f00 SHA512 eeca0d19c13320aed6847eefbf00ef7a71c94c580f02304235fc8738d766c4c797f14240e7cf5ae10390eb1835d4aea595c12b8ea6337852e8cce619258ec430
+DIST rust-1.89.0-powerpc-unknown-linux-gnu.tar.xz 255902040 BLAKE2B 655f2ac95fd93754d18ad592f8260065239cc2e9b1f4004c16f32381f595fc71d7323ee2082e3f644001ae21cf7984961af77e211d65ad9bc1077d7de4386c3d SHA512 d55a01a267e1103a079d2eaf1f560ad70b1aaa127064e4772b9badd350dd62be22183c89e97ddb1dee02a36a6ec53ff2bc6528b7c0fa86c54207ed85625657b6
+DIST rust-1.89.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6397d58e1d35861bedca92318e2444fe3e427a0f8efd10f94301e0767159049fcc58cf35f265f0a3ebd5fd9270830ab099b67b93d0b6f78ca722db86d9207daf SHA512 8b08acd4572d2dd86fb0550ef41d9e5619309bd0ee7f0da518f652cf9b324169366f659250004ff490bf7fc65a4d4bed5834ec70253a160f9a9ffd1cc2fb1fe8
+DIST rust-1.89.0-powerpc64-unknown-linux-gnu.tar.xz 256734336 BLAKE2B 4b875c37b154226518d1251fdf33796637e612a8b35523fdbccd0d471adf42593a4936a02c51dd38e9d2580686a7f48d89289f3eac0a657f8d3cb1f3147e812e SHA512 4335b67f85e9af0b62373d576dbc06360678fd7d16ddab506a2f063a5a44664961b2e194cbbd92c351c97c93fadc79de11cefd2e1f73ccde6c47560b2b96f69e
+DIST rust-1.89.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3673a2627ce5c6b4c46fb7a5aa723aaaaecd90d1592236539e8246343ac2da3a513796eea09be7209b3d56d0552efab204a89112cb842c358a25c010c79c0ca4 SHA512 f00190f407709d3d86a395ebe89d9121662a8adc837727a42966a2cad319ba5e83ed652e19332eef7a8306c1be147249273932e7e6e14fcc0126f0453b1c49b0
+DIST rust-1.89.0-powerpc64-unknown-linux-musl.tar.xz 82545996 BLAKE2B da2db5c69f90a7153785104249e7eb36d7ae319ed0aec61dd7f5b95127e309935cb8b2071f1534af8eb02d3f9d33adf25ffbc60551a1a08386265b444ac03ba3 SHA512 1c8c61ecfcf4c2f700743d2fda4e960674d2802b3ac7af93dc34a839ee2fac01b817aad376d99eff4b9b558bd23851b01d2fcd727172e2a558fb54882bbedc0e
+DIST rust-1.89.0-powerpc64le-unknown-linux-gnu.tar.xz 271860376 BLAKE2B 7fdb2223384de0cee04b0d97f307f69ee739d15e5e7e260e7c8873b552f5395cf76f3fa005f7107d28b3dda49faddf96992c727a15ec3d69e7eea16e7d9c5db0 SHA512 2fb5f2a3d99fe35a10a78798328be16516776020848245aeee1f4ba35b8a567e0869cf28e6438333ade33ba3e992b63e77bf9f2dd14458c5d68fa804450155f0
+DIST rust-1.89.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ac64d25d1f8ef9c8fc27cc0aee48f9e8d6b423c733ee198a16490030a9188ca875d82747b2589b50cadf340b58d29c3000a911082fa5fe32564bb8a425b2ce9b SHA512 23b3f9f19f8fb69a518df9441cac824cd8bb2e733938acab174cdcef29f6bfa3d07db0dde1a9cd129931bf28743249e0e70ddf99f5074458b43c23350980bb4d
+DIST rust-1.89.0-powerpc64le-unknown-linux-musl.tar.xz 276967104 BLAKE2B 868eca61e9fa9a03806abcf8dea40d9468887cf839ee363468a67032a58aacf99624090a6337e93917bb5db5c95c2e91a0e4070c153ae16249c7122d3258b0e8 SHA512 4c3bc630ff662b0ee3d726db8e425333584881a88ae06afade906345c8a07fc7dca60b423b78b6817d114368039f847b1cec3b385a1f6b458125c5b137c50349
+DIST rust-1.89.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B bb62a2240ab685f214cde51903ee1d37b5ddfeed6d57ac102a18fa497e51b5af6fa50e3b7970335a62e95f106632125c0db53f5f12628361d52eeb0a00e23d20 SHA512 c4d1e86eb0ec845edd9b272a28211c24ecff21e9b25ca1f1e3450d60f761f25bc3994df0cbfb4c0f9d6375aee37b302d2f7f0906999170893cbb28409620dc9d
+DIST rust-1.89.0-riscv64gc-unknown-linux-gnu.tar.xz 250747592 BLAKE2B b47ae43be1e46eec7f2333f30e63e47a94d504a8bbf546d2d0dea701c8f200780846e65a523f71430772c8630a4dafe33d215a3fc29215995db578cc93c8c771 SHA512 2efab720f427c973d3c8ca87f1a7d68280b4498882de13a5053cacf156afa56da62879818922eec6b92f083e7e7de2b882656efb7a7cdb61e053a28c9aeb0ffe
+DIST rust-1.89.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 98e4dfbe54459f15da2f202df43ae79a52bf51849d4a098f795f97290d7d35bec90da8e4e0ba48cf81ffca72d54d1bc1af3f0f2a063708637d45b1cdfdaaecc2 SHA512 3646552c993d0aca107ab6cc70f3cb585b4dd25f724e5de38940558a0a0c8bfa5ade8bbbb0220141ee1fa1fe7c21001d43bde599cd9a96a04b5fa92c33416c15
+DIST rust-1.89.0-riscv64gc-unknown-linux-musl.tar.xz 87810188 BLAKE2B 3f89f641f8026133fbb3af744cf50ae6e27a4f6221be3dcd6d1e90ed2c9b01fd759b1273d221ddfe39ec8b4bbbde46367069a8879fb5c396769a09d1ce607adb SHA512 18e07d95a8f6d566c71403eb9a17f44d95f8e4ca6de99ee687f099570c43078921f749546e1e24793ce2e1ebb9b70520c1206ed5a5d4e3b66dcb02c8ae76ade5
+DIST rust-1.89.0-s390x-unknown-linux-gnu.tar.xz 240848884 BLAKE2B 76c7983c847340d46987357624bd78cfd8f5efe1ebacbf3b7d8eabcdc990883a1f88a87d92214380f3087d81df73edceffdd97509f69c56a4327c6ade14d2730 SHA512 0ffc3cbbd334310a75c033e8f6f99adaa328fd9d360da833f3f4caae20a9f09017487a069baae76d54316d1382fca6b58c40bbf44170608b94a4b30e31937069
+DIST rust-1.89.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c01aec9696803a49600608add339fe39d45c006abd71542a94c8109a3a1b2f2b0e1652356e6e04c7e5429e1373e7e33e1ff539ab58811e8cb820d6654abbb15f SHA512 1cb49912acec64c4fb00c79040f4f878c7fb1636f3512a189b52cb04d658d03923891944dfe77748f38b3e3071f0012f05d795d197f5a2048344ce4accce934b
+DIST rust-1.89.0-sparc64-unknown-linux-gnu.tar.xz 77659052 BLAKE2B f41d6ff704455db38ae16323ec592c2273efdf6712a6c176c73abfd5afe07d70b5aa751940af2e6ddef1fb901131a0e5ceac9f06f49d9b4b60f5f9cb7dabd64d SHA512 9cb64cba2ed5d1472020a812f9c6fa614295dbbd2002eb46596464918d6b060e7a612b905544f3a8c18b13272bb6b9d00ed8bf8a821d5c4a7324eb328f748dee
+DIST rust-1.89.0-x86_64-unknown-linux-gnu.tar.xz 201436760 BLAKE2B f0b77a74c27a7fd1396bb9d640ccd64b1549604dacc7638dae245d2380aaf8b1b9e2c0e7270708193ab725c2f5bde27cbb01621831d2a9404cb9953d18be062d SHA512 1eec2845633a30eb49aa8babbcaf9b6fa0cb617b32944dec17f4440518192ac2eb071bc391913ab1ef14e31e6e973e490d9651d9cc3f376eba4a7691ac917077
+DIST rust-1.89.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B cd7e0e527601b36bcb133f0fa2786bc2720e0dc35cd340acc839220cd4b13c1f2622ace457ed3dbc7dda70bcd5199873cebdab36eec0569b0905524ae68a7cca SHA512 8e366e0e70ea78dd4a6a8414fa0349c2a178dc17a11809f350f08b700c3ff3cb1baff0ff363ce9dc3532dcb2d7b7518b5b2b30c07623e0f35f7162bffe59aad8
+DIST rust-1.89.0-x86_64-unknown-linux-musl.tar.xz 292022352 BLAKE2B d1f268d67011824ce6b9b27581518620e6ba51f4b49cdcf9a215fd649550a22b8fdc9c2e154a9c6e39986e52b46036813b4d3c0c115dbd55a1ce04fc0482feb0 SHA512 e9bb0e4a45a273fb6cf1e46264b879fd410465ea2f3cc396cc8a797a744cc71a0c95db8af9754462ca1c9ec1fdc699ee64262483cbd625dffaef50476462eb32
+DIST rust-1.89.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 54b4b8a887c7fe441d3ee33bc37f6ad8f7f1b99d01f54b660bfaae0cb29cecfe7208e27cce9360db68bb275ee7aa0f760539ec3ae37fb5a44edc2365c1f115cb SHA512 666d87fd3ab91375dc081fe9a6300b945db6ffc317c8ba7f5f01e58421793d3f1ff68dd0d72aac1add426834a0bd81ce48949683ee379e60afe820c1baf960f0
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
 DIST rust-src-1.76.0.tar.xz 2590884 BLAKE2B d1a6215dab34d7b10c3177d2b248f997d3a846388f3442567572880aa5c5bc51b56398f5d4dc32727cee7c9dbef494430d6534a76b66c4ae5ac4fed07266644d SHA512 39d2fe58fae8c8c5a6cb3fb1ef2a1c7548c018fef6ccea531659fdfecd68a4aa77125299d2cbe5b58e500337b4d074928318fa9ebce358af500d0ef27260e3ca
@@ -596,3 +644,4 @@ DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a0
 DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
 DIST rust-src-1.87.0.tar.xz 3119800 BLAKE2B 6429eb419f17109537a2a5463b0c68f504b3cb0f55766e18f73cf053883b06eedc934ab4598756790cec147ff41c4eb30a807d2ce0b7e6af33310710fdc5a8c1 SHA512 9747c60268d772b7c6e7694260c0808d2b8a42028f5606499c81595d76f5bc32c9acf6b4b9aad168235f8fd77d980c56bc4afc3d40f5d0374b23d3e66e3de390
 DIST rust-src-1.88.0.tar.xz 3155272 BLAKE2B bca923d2264337366b8013c45f3a40cbdfc1e1b746775161eaa66a1db653aa4ccb2a55980368ecf9808d6f4885194e2dfbf1f678d0500a43f7b2fcc0f79d27c8 SHA512 6dfe1fc3565927a9ac2ff9821ef3222cca170ff538833e1969ebe662af2cad5257c1ab3d82f5ca10aeaab40f54916a25dd96fd16449cd59e4d104b631911931b
+DIST rust-src-1.89.0.tar.xz 3461444 BLAKE2B b1e43def4cc0f47f0e776d383954b339a62b3efa77d5db71180b7b7620a67bd2d2714afe0b08ae26a06d7d8c785eed03f545d91813d074cbe6641e883a2d40dd SHA512 055c09854e47d1bdfc7f393ac6f2783d35cb8cf13100deb227598ad91020f1d91e4cec1658d8e71db3c266dc6e267ab4172dc1007428cb05105dc4aac57bf89d
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
index 94a82670eae..5cced8d50de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
@@ -24,6 +24,9 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/rust-}/2025-05-15/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl ${PV})
+		) ) )
 	"
 	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
index 5132ee797ad..047f7b9fcd6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
@@ -23,8 +23,11 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-06-26/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
 	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
@@ -32,7 +35,7 @@ GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/$
 DESCRIPTION="Systems programming language from Mozilla"
 HOMEPAGE="https://www.rust-lang.org/"
 
-if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
 	# Keep this separate to allow easy commenting out if not yet built
 	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
 	SRC_URI+=" mips? (
@@ -50,7 +53,6 @@ if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
 	)"
 	SRC_URI+=" ppc64? ( elibc_musl? (
 		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
 	) )"
 fi
 
@@ -58,9 +60,11 @@ LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
 SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
 
+# net-misc/curl is needed for our own bootstrapped rustc, since cross-compiling bundled curl is not supported
 RDEPEND="
 	>=app-eselect/eselect-rust-20190311
 	dev-libs/openssl
+	net-misc/curl
 	sys-apps/lsb-release
 	|| (
 		llvm-runtimes/libgcc
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild
new file mode 100644
index 00000000000..cd80f2761b1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-08-07/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+# net-misc/curl is needed for our own bootstrapped rustc, since cross-compiling bundled curl is not supported
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	net-misc/curl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${PN}-${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
index c474e60ada6..da509c8bee0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@@ -14,3 +14,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0-src.tar.xz 267487572 BLAKE2B 9f6e3c595f843c239b57f14e26685e9856cffa10189b75627fee4dc82970a9b5f2c6f42e145d1c1042d934bd4db0334014c046450f7594d621b378d951546d5d SHA512 3ac0f02baaff12c67fe35cef4d56b315134d0a043bb6103a248a2842456c74733c6e3039f079bacfb8b8ab9b7487f92d678987e588bd41276abf9bf7c2f7870b
+DIST rustc-1.89.0-src.tar.xz.asc 801 BLAKE2B cd94da916d3646048d8f90c6de658de2981d0c815a1f8da01fe58ab6ec133e47180c8b506a41e22c68b3cb77aff5bd3bfc966a71ae2b73849918096d68764386 SHA512 006b91bf41fbedf91c39b8a6e483b089f69af7e78026f2903928fed64e44ee6aa53e46fd19bae31b1576b53a80dab66bf3e53a3bf79f820066d36285d706b90c
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
index 26c4792d0fb..c2c09947292 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.88.0.ebuild
@@ -32,7 +32,7 @@ else
 		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
 	"
 	S="${WORKDIR}/rustc-${MY_PV}-src"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~sparc ~x86"
 fi
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild
new file mode 100644
index 00000000000..26c4792d0fb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0.ebuild
@@ -0,0 +1,73 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+inherit shell-completion verify-sig
+
+DESCRIPTION="Common files shared between multiple slots of Rust"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	# In case cargo is not in sync we'll fetch it as a submodule
+	# Nightly users will probably already have the repo cloned and up-to-date anyway.
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=( "-*" "src/tools/cargo" )
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	MY_PV=beta
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+else
+	MY_PV=${PV}
+	SRC_URI="https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="0"
+
+# Legacy non-slotted versions bash completions will collide.
+RDEPEND="
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-rust )"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz "${DISTDIR}"/rustc-${PV}-src.tar.xz.asc
+		fi
+
+		# Avoid unpacking the whole tarball which would need check-reqs
+		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz \
+			"rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
+	fi
+}
+
+src_configure() {
+	:
+}
+
+src_compile() {
+	:
+}
+
+src_install() {
+	newbashcomp src/tools/cargo/src/etc/cargo.bashcomp.sh cargo
+	dozshcomp src/tools/cargo/src/etc/_cargo
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index 0e8f57d6865..f4f700c5ca5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -12,9 +12,10 @@ DIST rust-patches-1.84.0-r2.tar.bz2 2507 BLAKE2B ffe4e5fc49deebdb8b8b3022f951dfe
 DIST rust-patches-1.84.1-r2.tar.bz2 2982 BLAKE2B 2f7addfa4530f3eab79f55ea44eee6390970874ae5ed40ef8706224024db47c861326dc5a79ed9bffcffbad5b27d44b6a3aebab7987fdb61124be3083fbabd71 SHA512 cc852e1e679827390134b47bfaa68567a75a5e8559a3caa24ab3931955050bac59f4fe6a4c249d83bde0aa25667ea04749f3763ff3566daa2999df8cbf2d0981
 DIST rust-patches-1.85.0-r2.tar.bz2 4462 BLAKE2B 61cfde8688fecab1a5c3c80f29b37b691581f3f8be1648f9db34fff15026dab426458cba3b9f06fc5606a0a878b0527698ea6f94c7dff014e4339154ac907d13 SHA512 317ab0bcbb792faa1a761893264a29bd650b0d6c5ab17aa762075daccfda684bc6cdd20c0ef89b51bde1a7384fb1df576b18b5303115a8cf04877b435b2d6491
 DIST rust-patches-1.85.1-r1.tar.bz2 4473 BLAKE2B fad2fe3222e2625b5cbc60ea1fb805080ce70f751c930c0e3bde9cf043059e1fc3ba4d8e618166fe99a7fcf12d5cccb684c05d4c2542a89c9794869204cbcb09 SHA512 edf680a1d3a29ae5d8140031dc8b232b747d08494db2f3393ccc286d9197139583bcaf536d5125b8c896a610c075115b9a16a6e6f3f6b5da60e58433f000dba6
-DIST rust-patches-1.86.0-r2.tar.bz2 5980 BLAKE2B 179d6acc8c7006eac4d00e073ec1f5496756ef51d465bc098daf1cfe650f469f4341893c72a65e21d84ecb3ccaeb46f5204ef517ae942482d835f89c0a934391 SHA512 31e902661d5ee2da82858910551393890583d9702303fed5652122c852e9384fb88a42eddd0b968558865e16b5bd4ac2a13a35bd01ec3f8c3adbb673bc465596
-DIST rust-patches-1.87.0-r1.tar.bz2 4635 BLAKE2B d813ec4a602d3bb879927a44a0b9f752aac255e31dfd13c56ab71b3fae7ce46a742c1d2e7494a7e17728f1edb2327ddd6ad6ebabc0c47d66326b766bbd323fbd SHA512 596ffe744a5849b443f077bbd4edbcbb240b9ac51c9d53e0e436e46d7c93a6734477d22eba4a066a0cf474503a6357a72dfa124e594f645be6f50d9bd25bdb10
+DIST rust-patches-1.86.0-r2-1.tar.bz2 6308 BLAKE2B eca644026942bd729a748df57dd67465bbec96b2d18a71c58fe04bb8e2514aabb1ca02cbd3761be5283328a3b728e063b1b85ea78f4f242c182071c44b8cb148 SHA512 1f1edcf76c64b0555366253e21d759e904a752746c2e5d88aba6e31f5ee2a2b0b06275674d2fc3acc42f589905eddc006d788f95b48a5d79a6ab767251d934da
+DIST rust-patches-1.87.0-r1-1.tar.bz2 5116 BLAKE2B 783ad21464a7e393d0aee506119be12b0137a7d360402b74f36b6fde154c2804cc0779da63875977d09f7e9f2d273ff41dd189bbe4eb239a314fea27bbaa704c SHA512 8c67e4e43bf2afb226f70bb2a03aad0abfd525cd484c8c9ff663da06d63b471f4f1b48169d952a6a6c14258c0029dedea14aadaaca2ee75389df65b806188363
 DIST rust-patches-1.88.0.tar.bz2 4062 BLAKE2B 64168ffa608f2edf2e0b3d079152c3b5dd59d0cea29078894f286bf91488e2e7769c55ede2d43769368d2147b46699d1bf981190d6800dc3d41c736289122eaf SHA512 b565acfb4d1146e52b1fb66b4a242927407cc34f1b38c2a100135cbbde24c8374af1997bc22069cca25f33cc8d747e56391f3d98a2d4e13dc0abcec0d6f88b0b
+DIST rust-patches-1.89.0.tar.bz2 4091 BLAKE2B 0fea3488a39d2b00627084f6b192dfbd7ed49bdceabbb1141d1a849ba053f786e31115e00365679b1b6fb5b0ccdf5dc0dc0803057cbffbcf0ae3d75ae9830d94 SHA512 de6c9b693bdd719d06605b5da730ee5d9cf9a1d88d58194a0ba48bd378a951c66723f561e39181222d28abb38e974a2921e14ea1f40156caf7b903778cf65790
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
 DIST rustc-1.74.1-src.tar.xz.asc 801 BLAKE2B ddf73175b164233babf31ca3a381b03e20c0f36d017c1d5f85d6ab11f0986d861ab23b11c061e6b2444ced70c3d6a494cc3de4ec86f0deb221a805491bd75420 SHA512 9a96ff9ba9a4e2af4e267b2ec126fc0675c78d0eb767703daa2f28491c3d85c2ab00fbd8584390bf658812ec6c4ab6c57e43b386db59fd505bd3134a8873a09e
 DIST rustc-1.75.0-src.tar.xz 159624388 BLAKE2B 8937b80585eddaa3e1f1ef948899d14a170308518c6fef9fe569560cdd870053776956743f796055f2119399b9ca6c0df12fedd789ae46324d071e5126c4e495 SHA512 7b0f25d91b1b5c317980fc88e059200bd43b56a70b445fbc72fb9b96e09775bfd3a98e9bd9d662af80f0ce3aef527c777ee82777e96ca876f47a972d63da8606
@@ -49,3 +50,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0-src.tar.xz 267487572 BLAKE2B 9f6e3c595f843c239b57f14e26685e9856cffa10189b75627fee4dc82970a9b5f2c6f42e145d1c1042d934bd4db0334014c046450f7594d621b378d951546d5d SHA512 3ac0f02baaff12c67fe35cef4d56b315134d0a043bb6103a248a2842456c74733c6e3039f079bacfb8b8ab9b7487f92d678987e588bd41276abf9bf7c2f7870b
+DIST rustc-1.89.0-src.tar.xz.asc 801 BLAKE2B cd94da916d3646048d8f90c6de658de2981d0c815a1f8da01fe58ab6ec133e47180c8b506a41e22c68b3cb77aff5bd3bfc966a71ae2b73849918096d68764386 SHA512 006b91bf41fbedf91c39b8a6e483b089f69af7e78026f2903928fed64e44ee6aa53e46fd19bae31b1576b53a80dab66bf3e53a3bf79f820066d36285d706b90c
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
deleted file mode 100644
index 11d7738f2ee..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff '--color=auto' -Nuar rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs
---- rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs	2025-03-31 22:37:24.000000000 +0100
-+++ rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs	2025-04-17 12:31:37.651607535 +0100
-@@ -451,12 +451,12 @@
-     if !builder.is_lld_direct_linker(target) && builder.config.lld_mode.is_used() {
-         match builder.config.lld_mode {
-             LldMode::External => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
deleted file mode 100644
index 37d054222cd..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 76e13020767e7ff783284b5bcf7a7509259ceb51 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jakub=20Ber=C3=A1nek?= <berykubik@gmail.com>
-Date: Fri, 4 Apr 2025 18:29:20 +0200
-Subject: [PATCH] Use target-agnostic LLD flags in bootstrap for use-lld
-
----
- src/bootstrap/src/utils/helpers.rs | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/bootstrap/src/utils/helpers.rs b/src/bootstrap/src/utils/helpers.rs
-index f8e4d4e04717d..78dcdcbd1874a 100644
---- a/src/bootstrap/src/utils/helpers.rs
-+++ b/src/bootstrap/src/utils/helpers.rs
-@@ -474,13 +474,13 @@ pub fn linker_flags(
-                 if stage == 0 && target.is_windows() {
-                     args.push("-Clink-arg=-fuse-ld=lld".to_string());
-                 } else {
--                    args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                    args.push("-Zlinker-features=+lld".to_string());
-                 }
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
--                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
index 877fac40cfb..102ec7ee6b4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
@@ -264,6 +264,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
index 988471ca47f..ed00b285343 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
index b30ccfabb5c..02b705c0331 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
index 8eb384190d4..f8096883ddd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
index 51d7cbe0bf5..bf0f4a9f2cc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
index 916a48f6b3d..1a4e15eb06d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
index 101321ff60d..0309e05390c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
index c5dc04af29b..e7b39689f06 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
@@ -244,6 +244,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
index 690ca13d010..62fcfc8aa3f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
index 01c787cdb74..6b44e212445 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
@@ -243,6 +243,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
index 481be29a720..e78e687cc9b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
@@ -249,6 +249,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
index bcee8100e1b..74c60132f62 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
@@ -249,6 +249,8 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
index 55a53cbf5e7..ef0915f9a4b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
@@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
index 4b334f7c33d..e64ed601296 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
@@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
index c7bbd326073..9586a6dcae6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 PYTHON_COMPAT=( python3_{11..13} )
 
-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@@ -307,6 +307,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -316,8 +318,6 @@ src_prepare() {
 	fi
 
 	default
-
-	eapply "${FILESDIR}"/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }
 
 src_configure() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
index 44ae18b9046..9ef6faaf802 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 20 )
 PYTHON_COMPAT=( python3_{11..14} )
 
-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@@ -308,6 +308,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -317,8 +319,6 @@ src_prepare() {
 	fi
 
 	default
-
-	eapply "${FILESDIR}"/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }
 
 src_configure() {
@@ -446,6 +446,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -483,7 +484,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
index 1bb3c5f4711..cf6636c8b24 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
@@ -42,7 +42,7 @@ else
 		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
 	"
 	S="${WORKDIR}/${MY_P}-src"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ~ppc ppc64 ~riscv ~sparc ~x86"
 fi
 
 DESCRIPTION="Systems programming language originally developed by Mozilla"
@@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild
new file mode 100644
index 00000000000..5ace910567f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0.ebuild
@@ -0,0 +1,837 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+PYTHON_COMPAT=( python3_{11..14} )
+
+RUST_PATCH_VER=${PVR}
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}=]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+# dev-libs/oniguruma is used for documentation
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	dev-libs/oniguruma
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	lto? ( system-llvm? (
+		|| (
+			$(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}')
+			sys-devel/mold
+		)
+	) )
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+rust_live_get_sources() {
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/rust-patches.git
+	"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/rust-patches-${RUST_PATCH_VER}"
+	git-r3_src_unpack
+
+	EGIT_REPO_URI="
+		https://github.com/rust-lang/rust.git
+	"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+	S="${WORKDIR}/rust"
+	EGIT_CHECKOUT_DIR="${S}"
+	git-r3_src_unpack
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		rust_live_get_sources
+
+		# Vendor dependencies
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/bootstrap.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-bootstrap.toml"
+			# Suppresses a warning about tracking changes which we don't care about.
+			change-id = "ignore"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -v --config="${T}"/vendor-bootstrap.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	elif use verify-sig ; then
+		# Patch tarballs are not signed (but we trust Gentoo infra)
+		verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz{,.asc}
+		default
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
+	fi
+
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
+	PATCHES=(
+		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
+	)
+
+	if use lto && tc-is-clang && ! tc-ld-is-lld && ! tc-ld-is-mold; then
+		export RUSTFLAGS+=" -C link-arg=-fuse-ld=lld"
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	# Avoid bundled copies of libraries
+	export RUSTONIG_SYSTEM_LIBONIG=1
+	# Need to check if these can be optional
+	#export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
+	#export LIBSSH2_SYS_USE_PKG_CONFIG=1
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/bootstrap.toml
+		# Suppresses a warning about tracking changes which we don't care about.
+		change-id = "ignore"
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"${CHOST}-cc\""
+		fi)
+		channel = "${build_channel}"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		omit-git-hash = false
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		$(if use lto && tc-is-clang && ! tc-ld-is-mold; then
+			echo "use-lld = true"
+		fi)
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" bootstrap.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "bootstrap.toml contents:"
+	cat "${S}"/bootstrap.toml || die
+	echo
+}
+
+src_compile() {
+	# -v will show invocations, -vv "very verbose" is overkill, -vvv "very very verbose" is insane
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/bootstrap.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
index 1bb3c5f4711..3ef79e7077b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@@ -10,7 +10,7 @@ RUST_PATCH_VER=${PVR}
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
-	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+	RUST_MIN_VER="1.89.0" # Update this as new `beta` releases come out.
 elif [[ ${PV} == *beta* ]]; then
 	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
 	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
@@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi
 
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
index 43e6da97445..5818fec3b70 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
@@ -1,2 +1,3 @@
 DIST libffi-3.4.8.tar.gz 1397992 BLAKE2B 10b3d970dc598fb8689bca49751cda499ddc5216baf89d38625385b0d42d57f10d15cce3c4c044c9c73a4fce384c26f2a8e1b99269e9db1174c2631201c6bfd4 SHA512 05344c6c1a1a5b44704f6cf99277098d1ea3ac1dc11c2a691c501786a214f76184ec0637135588630db609ce79e49df3dbd00282dd61e7f21137afba70e24ffe
 DIST libffi-3.5.1.tar.gz 1419757 BLAKE2B eaeb04beeb4ab6e0ef5652175d5c9d29a18b6f1edbf05db819a3a6ac9c8ed47de32c54fca4c3a9a476283c0771650d5a577e7868f16c671ee46e25db27369066 SHA512 3da9e21fdb920e7962ceb01ee671ef36196df4d5dad62e0cdd8e87cc60e350f241c204350560ae26ea04cc898161b5585c8a5a5125bdbcc84508efbb7ea61eb8
+DIST libffi-3.5.2.tar.gz 1423124 BLAKE2B 35ce590926bcdd2556c30c94bb0fef3f0cfe8f32e809ffad00eb0bc7a8ba1ba40da844b108069c87e86bff278221cc42dc7c7aacd02a7b7bc408ea054085398c SHA512 76974a84e3aee6bbd646a6da2e641825ae0b791ca6efdc479b2d4cbcd3ad607df59cffcf5031ad5bd30822961a8c6de164ac8ae379d1804acd388b1975cdbf4d
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild
new file mode 100644
index 00000000000..441ddca3e01
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.5.2.ebuild
@@ -0,0 +1,97 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a multilib-minimal preserve-libs
+
+MY_PV=${PV/_rc/-rc}
+MY_P=${PN}-${MY_PV}
+
+DESCRIPTION="Portable, high level programming interface to various calling conventions"
+HOMEPAGE="https://sourceware.org/libffi/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/libffi/libffi"
+	inherit autotools git-r3
+else
+	inherit libtool
+	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
+
+	if [[ ${PV} != *@(alpha|beta|pre|rc)* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+# This is a core package which is depended on by e.g. Python.
+# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
+# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
+SLOT="0/8" # SONAME=libffi.so.8
+IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
+
+RESTRICT="!test? ( test )"
+BDEPEND="test? ( dev-util/dejagnu )"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+
+	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
+		# ensure we use aarch64 asm, not x86 on arm64
+		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
+			configure configure.host || die
+	fi
+}
+
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# --includedir= path maintains a few properties:
+	# 1. have stable name across libffi versions: some packages like
+	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
+	#    ${includedir} at build-time. Don't require those to be
+	#    rebuilt unless SONAME changes. bug #695788
+	#
+	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
+	#
+	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
+	#
+	#    We use /usr/$(get_libdir)/... to have ABI identifier.
+	ECONF_SOURCE="${S}" econf \
+		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
+		--disable-multi-os-directory \
+		--with-pic \
+		$(use_enable static-libs static) \
+		$(use_enable exec-static-trampoline exec-static-tramp) \
+		$(use_enable pax-kernel pax_emutramp) \
+		$(use_enable debug)
+}
+
+multilib_src_test() {
+	emake -Onone check
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+	strip-lto-bytecode
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
index 2e4f0d3014f..b815865a75d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest
@@ -5,4 +5,6 @@ DIST libgcrypt-1.10.3.tar.bz2.sig 238 BLAKE2B 216baebca91b2e940f60d70a4260b6b6b8
 DIST libgcrypt-1.11.0.tar.bz2 4180345 BLAKE2B fe3f42480c0b9a0c50c24f4c54197404b4e1056d8baa9c0c07c671c9c05b90777580b4cbcde931b50ecb4dd93f5ddad89cea99aa36a35f86f796a003e3816f7d SHA512 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
 DIST libgcrypt-1.11.0.tar.bz2.sig 119 BLAKE2B e64d59dae5556e2826f6d297988a3300c36d05aeecfe19544c5092b5f7b777b9b3f37c5ddcfcba5a916ae237cf981efdd9e3bdec482f7c36b12ac5c70f9d4c52 SHA512 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
 DIST libgcrypt-1.11.1.tar.bz2 4233557 BLAKE2B 6416c6a782665e8a8d1c7993d94e620c586cfb65f273bde3d609bd7ca729a92d7ac3e156dabea42c34dbe50af7ce9b16333f63115f968aebb2b4a6dd37d4b99c SHA512 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678
-DIST libgcrypt-1.11.1.tar.bz2.sig 119 BLAKE2B b8d5bca5b903b34f48694a49e6da2c1ce449b0b28a71b9a0a6ce156e413cd19510ae7bc051bbc194bb17eec07501ee58538b45baf89918803077645f22c2244c SHA512 a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc
+DIST libgcrypt-1.11.1.tar.bz2.sig 238 BLAKE2B fb625c167b6939eaf795858cbbb3b09787c92b53f94a328611e7dc3c565d623ecf0ccbaddc656cb98f617723147978184c8a7a1dd072fa6477eb06a6a873518c SHA512 832119acbc094346b5648520ac6991a90a944db80886c31001f49bc17c77bf1e2c26dc99180c25c0ef4de010b159fc7b7576b8d80fba284acebc6da1706067db
+DIST libgcrypt-1.11.2.tar.bz2 4237802 BLAKE2B 8ad2dd84e8ec2bddb5c008c6823a6d72b8f2d6237972966bc590be0d89bb6b50a5cbba1b42631d0950c4bea125a6d9a845fbf703b756a38088f66054712efa9c SHA512 b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+DIST libgcrypt-1.11.2.tar.bz2.sig 147 BLAKE2B 5126fa06a9a67b2b71711f76ecbf9f3596f300f97256378961768a2f3c3927321da649eb0df4ddfb653e4503712b8b3c363c252bcb83ca53c7eea89a3ac8d4d4 SHA512 73b1d6d53e2f9061f06628a0fe983919f745c1c92930fd6a9871a0a3a589878efe68ec48b4e17e3fd3c1e098bc38c38cc8895246cee25463377a8bfa8590b164
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
index 006aad0fc98..fb7359c76eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
@@ -101,6 +101,9 @@ src_configure() {
 	# least solve it the ebuild see https://bugs.gentoo.org/959349
 	use x86 && filter-flags -mfpmath=sse
 
+	# Temporary workaround for build failures with gcc-15, see bug 951267
+	append-cflags -std=gnu17
+
 	# Hardcodes the path to FGREP in libgcrypt-config
 	export ac_cv_path_SED="sed"
 	export ac_cv_path_EGREP="grep -E"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild
new file mode 100644
index 00000000000..c25e8ab2f46
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.2.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.49[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Sensitive to optimisation; parts of the codebase are built with
+	# -O0 already. Don't risk it with UB.
+	strip-flags
+
+	# Temporary workaround for a build failure (known gcc issue):
+	#
+	#  * https://bugs.gentoo.org/956605
+	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
+	#
+	use riscv && filter-lto
+
+	# Temporary workaround for mfpmath=sse on x86 causing issues when -msse is
+	# stripped as it's not clear cut on how to handle in flag-o-matic we can at
+	# least solve it the ebuild see https://bugs.gentoo.org/959349
+	use x86 && filter-flags -mfpmath=sse
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
index 98cc0646bef..af8569780d4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
@@ -1,10 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>reavertm@gentoo.org</email>
-		<name>Maciej Mrozowski</name>
-	</maintainer>
+	<!-- maintainer-needed -->
 	<upstream>
 		<remote-id type="github">kyz/libmspack</remote-id>
 	</upstream>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
index 9cc1bab040f..6a2054e35db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.10.2.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="|| ( GPL-2+ LGPL-3+ )"
 # Subslot = libnettle - libhogweed soname version
 SLOT="0/8-6"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
 # The arm64 crypto option controls AES, SHA1, and SHA2 usage.
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
index beb2c8497ab..7bfceb9d377 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
@@ -25,3 +25,5 @@ DIST openssl-3.5.0.tar.gz 53136912 BLAKE2B 9bf55ad242863123ec117296ff4d3067a27da
 DIST openssl-3.5.0.tar.gz.asc 833 BLAKE2B 3c92d7f08ae64b175140215be633e72b80fb49de0ef3485ab0738999fa339b40ca09bdc3ae9fb4b0738ae7182b3d5821cb4d04811796775e6648621fcfc8941b SHA512 6a73755c34f4caabf531d2b4335bf1c800548b41c6e6436ed4bf3ab25cf7c01f1a0594d641deac7e1aa66c3beed00091265d49c2711dadaacd8bba1ce2075d02
 DIST openssl-3.5.1.tar.gz 53158817 BLAKE2B 172db56ac41cee78bcb5d2223c33d78baf3326d8d466115f39be414384d265ad4541e00096d3f53435f9f89119882ae587b20b1ac05dc2ace46a0d43d7cc6996 SHA512 0fa152ae59ab5ea066319de039dfb1d24cbb247172d7512feb5dd920db3740f219d76b0195ea562f84fe5eae36c23772302eddfbb3509df13761452b4dafb9d3
 DIST openssl-3.5.1.tar.gz.asc 833 BLAKE2B 4d0ecaaf72ccf0c28f050b9c451bc44c142670caed7188fdaa3275391c0c5b41e3265ad8ea3bf29b4fcc6d38214c48c7964b95991d38b4a1d07aca3ce566360c SHA512 1682a767380ce375ae7d1f31363c68ce8af9e4575361265893c49a12a7cb720b2528d2c8229c472feadd8369b447991bf04fa066b88960e173ad7d6d76f3c644
+DIST openssl-3.5.2.tar.gz 53180161 BLAKE2B fd6179457b85d7a2ae87ee432de4d9e0d5b5dba30b6b57d0f289a0d034c6d7de7c7166b1f69f00d822105c5119bfa44fd52bf5b9035a14aae21015ad3fe2d224 SHA512 db2c7a88bea432f96d867a98af15f850f371d4136c657338de93cb88a39a3578c025b5df7310e195a02fc715ad5a2422a319a44f0247c6a7e2ba8b36aad77651
+DIST openssl-3.5.2.tar.gz.asc 833 BLAKE2B f22883c76bc636f6d5916913486ef0873da91b0e29dd24569def0409e8573ebe23f28b9e3b3ed6120fb85afaa3181470b8fc83959b40389d8b1cd2dc4852f404 SHA512 2be00d03e5b246833f8e47f59bd7ca3dbaec519f2160fd9dfed3a7b2c65b9977703811c06662c17b301e456bbfc73477c76e3b444329741e99e2576005900580
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
index 5af9adcda85..978763db405 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
index 6d7eefcece5..c183d21b68d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.17.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
index 6d7eefcece5..c183d21b68d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild
@@ -268,7 +268,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
index 417b482e59d..e1103cfa929 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild
@@ -269,7 +269,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
index 56f9601dd58..1ae5a138a77 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild
@@ -269,7 +269,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
index fe3dcd069ee..63b9b878fe3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.4.ebuild
@@ -276,7 +276,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
index 7cdb49b1373..270945bf5ed 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild
@@ -276,7 +276,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
index 162a9453a62..1e01d73e617 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild
@@ -275,7 +275,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
index bbe688813d5..c91a29912aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
@@ -277,7 +277,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
index 0cd678123ea..5ce8a7074aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.4.ebuild
@@ -277,7 +277,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
index 99f230c3fbd..7d052d23daf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.1.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.2.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
index 41de3131f21..f492950eefa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		ebegin "Running openssl fipsinstall"
-		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
 		eend $?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.1.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild
new file mode 100644
index 00000000000..ab2f92680e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.2.ebuild
@@ -0,0 +1,294 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
index a7df1d73c9c..ab2f92680e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
@@ -273,7 +273,8 @@ pkg_preinst() {
 	if use fips; then
 		# Regen fipsmodule.cnf, bug 900625
 		einfo "Running openssl fipsinstall"
-		sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
 			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
 			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
 			|| die "fipsinstall failed"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
index 287d94a46e0..679072f48dd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/Manifest
@@ -1,6 +1,5 @@
 DIST tree-sitter-0.23.0.tar.gz 2977346 BLAKE2B e10846d5bd0a6aa1ecac362e2ab2ccf0f0bdb17c5fde796d8d65f8bc84a6e054d86c18a42e66e8effef865f95013c38ff6bd6ab5498a680ae172d7d57020604e SHA512 ab821be564ac7223cc4f9659c08922a78016af9dd3bd69166706fb6a889ac175ba2712a337a1303aceb8f44beaf58640a183e77dddc2c57e35da23079d0cd7b9
 DIST tree-sitter-0.24.3.tar.gz 3018668 BLAKE2B fa703b6250e11274d0c5ebccb741cc41f521cc5e882383d8f891369540ce6b3b4b048eddb4d0c88186e57516e2d01977e76b42352f26759b3f6093a339cc6a11 SHA512 2d934c03b0ee71419654d03bf6e4ca759b4ef3217b8837fcaef64ee5b4bc8ea8298ff685ae4aaa477b615d11d538ff960b92529b11f13e936b85bad52e369cd3
-DIST tree-sitter-0.25.1.tar.gz 855493 BLAKE2B 6b9e4bf454c50e9b7341aa94d5131d333f45a0a047090ca04da71bfc54357568d0c098c6f7df65ee9d20ede7050537342fc394e281f4070f2d021a7e4134cedf SHA512 9861b18c7209e3c37d180a399bcae181cea46c4e58eff743ff6044ed0f2923ee838fa88993f1266272e07163748d5df1bef7d7dc6d8800e004e8af1227e489af
-DIST tree-sitter-0.25.2.tar.gz 855826 BLAKE2B 5c2cdaeba229c58d40f5d9b2c4af920d4e1d9fd60ce1d49e632cd660d441d3c32632864b1e226e4c99b4e8f054bfc0082a80c2eb1cdca0684f899b913378a17d SHA512 8acdb410c8b5c2552e9dd5524d80ab1d529e418f408d7c495619e6781f3b70ea2d61b6f69b5b3d1ebd753b739c0f9dd744302808d9a3051b5c7dcf68dba30002
 DIST tree-sitter-0.25.3.tar.gz 856455 BLAKE2B 4527d13ea702dced09d9227ad9f6a18484e8517c5da1840c22c5e69686084dbc46de0c07e7e06980e6dde4cf07791fe88fba10f90684a2ef29b58f84b59a2176 SHA512 a626dcea5378774511aa1ef669e4dbada3079440b596882172a676c61e53aa6f701b537e3575851af9e10b1e264da25a9f6487b01f43a896cf1a22d58ca7e623
 DIST tree-sitter-0.25.6.tar.gz 857070 BLAKE2B 3bb6b6130e1a96c96b5af4608bf60f8bbd00cbf1fdc9905b7a6169db52351c2ae3a907eca444363ab2b3185a54d0080aa487cbe252e6e015c1cd7a735e420679 SHA512 47213b68233d376e145e3f42b4674d64e7ff27436f4a028e751d9ad8494469ff67b002ce184346d3f6848df2c91386c28127827c43a8bea34da5e84f2530f02f
+DIST tree-sitter-0.25.8.tar.gz 857462 BLAKE2B aa3f0d9056544bb6ef1127723563449c7672e06b5289e1596f2c1b5826905c578830c7e6c3bc58a91e388d647a5a5629e71f5f0af2a431e73c3be4f93ce5b6f4 SHA512 0d26d0699f61fa27b5adbc298ff53f8e0f5b9f2f1b216744200f6f50cff777c9c5a5a5b92304a4d1889fccd9d8a6dd6b7d4947bac907a91850322281f754ea53
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild
deleted file mode 100644
index 7121e61d879..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.2.ebuild
+++ /dev/null
@@ -1,50 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit optfeature toolchain-funcs
-
-DESCRIPTION="Tree-sitter is a parser generator tool and an incremental parsing library"
-HOMEPAGE="https://github.com/tree-sitter/tree-sitter"
-
-if [[ ${PV} == *9999* ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
-else
-	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
-fi
-
-LICENSE="MIT"
-# ABI is not stable. Revisit after tree-sitter-1.0.
-# https://bugs.gentoo.org/930039
-# https://github.com/tree-sitter/tree-sitter/pull/3302
-SLOT="0/${PV}"
-RESTRICT="test" # tests are for CLI and not the lib
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.22.2-no-static.patch"
-)
-
-src_prepare() {
-	default
-	tc-export CC
-}
-
-src_compile() {
-	emake \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		STRIP="" # bug 930020
-}
-
-src_install() {
-	emake DESTDIR="${D}" \
-		  PREFIX="${EPREFIX}/usr" \
-		  LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		  install
-}
-
-pkg_postinst() {
-	optfeature "building and testing grammars" dev-util/tree-sitter-cli
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
index 7121e61d879..20863acffab 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.6.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
 else
 	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos"
 fi
 
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.8.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.25.8.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
index 39184736f5e..39fa548c09d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/Manifest
@@ -1 +1,2 @@
 DIST cffi-1.17.1.tar.gz 516621 BLAKE2B 902844a14c0765ada6adf5054a9462a195b49b2ea4d7441deeff97dd6d9209accd29257697002ee1bad7e143ebf983a2d98077b17e08b060dd1ee75dc682e3d8 SHA512 907129891d56351ca5cb885aae62334ad432321826d6eddfaa32195b4c7b7689a80333e6d14d0aab479a646aba148b9852c0815b80344dfffa4f183a5e74372c
+DIST cffi-2.0.0b1.tar.gz 521625 BLAKE2B a62b15652e02ed62ce33cc92f6bfd4454a81a6a7c3fb84cc048fbf8cc39325af09c19f5c2a2f1e6c80063e9fc8ae6537d1b917a01f15e8e56c2bb847bd79bfac SHA512 974f724a4c819f0a32da38a7209c6f54e63810817794bab286e8721bab6c59ce50c2c0992c828af54088ff8f1dec40480ffe37155d979cadc26c79cdc6b78f54
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild
new file mode 100644
index 00000000000..1f850d13ea6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cffi/cffi-2.0.0_beta1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+# DO NOT ADD pypy to PYTHON_COMPAT
+# pypy bundles a modified version of cffi. Use python_gen_cond_dep instead.
+PYTHON_COMPAT=( python3_{11..14} python3_14t )
+
+inherit distutils-r1 toolchain-funcs pypi
+
+DESCRIPTION="Foreign Function Interface for Python calling C code"
+HOMEPAGE="
+	https://cffi.readthedocs.io/
+	https://pypi.org/project/cffi/
+"
+
+LICENSE="MIT"
+SLOT="0/${PV}"
+
+# Needs recent libffi for HPPA fixes
+DEPEND="
+	>=dev-libs/libffi-3.4.4-r1:=
+"
+# setuptools as a modern distutils provider
+RDEPEND="
+	${DEPEND}
+	dev-python/pycparser[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	virtual/pkgconfig
+	test? (
+		dev-python/py[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_sphinx doc/source
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/cffi-1.14.0-darwin-no-brew.patch
+)
+
+src_prepare() {
+	if [[ ${CHOST} == *darwin* ]] ; then
+		# Don't obsessively try to find libffi
+		sed -i -e "s/.*\-iwithsysroot\/usr\/include\/ffi.*/\tpass/" setup.py || die
+	fi
+	distutils-r1_src_prepare
+}
+
+src_configure() {
+	tc-export PKG_CONFIG
+}
+
+python_test() {
+	local EPYTEST_IGNORE=(
+		# these tests call pip
+		testing/cffi0/test_zintegration.py
+	)
+
+	"${EPYTHON}" -c "import _cffi_backend as backend" || die
+	epytest src/c testing
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
index 87228c0a45c..7f2d979a1ba 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/Manifest
@@ -1 +1,2 @@
 DIST charset_normalizer-3.4.2.tar.gz 126367 BLAKE2B a83f719394753e7612657caee102c2a662980ef78e2be25a7f109913eb2650ec94b6a01a885a4f7a66b6ca8d47c680c163fdaf6bd043226b340a7aec6f15ab78 SHA512 702d9c23fe68d3538e4f45d5d9451beb02853ecf1ec6b36a7068ed8ade707bd0fd2a1764137381294590d0e5ffc2e296866f402dff33f65ec0458cf1102970fe
+DIST charset_normalizer-3.4.3.tar.gz 122371 BLAKE2B 9735b4419aec98a11e3b53fc96e892f63299d89653cda489a5938e90526d24241ee2224f2aed149ae2e4becdf2742335175e8c25a2952b76098cfca61edef72a SHA512 b8ee22e9da98d09a3a36b2cd49e0bb27956a444dd59a1d27f1244040147a4e09fbd67d112ec59ace2133fe92b72a4de3a26f0b678bc2b6455c3ead2c2aaa9cfd
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild
new file mode 100644
index 00000000000..1f0970c976a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/charset-normalizer/charset-normalizer-3.4.3.ebuild
@@ -0,0 +1,31 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="The Real First Universal Charset Detector"
+HOMEPAGE="
+	https://pypi.org/project/charset-normalizer/
+	https://github.com/jawah/charset_normalizer/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+python_test() {
+	epytest -o addopts=
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
index d4c4920deeb..d961954d28d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
@@ -7,8 +7,10 @@ DIST cc-1.2.23.crate 106527 BLAKE2B 0fd9e69ad743f4df15da3d25f85e1a422ef64b81b72a
 DIST cfg-if-1.0.0.crate 7934 BLAKE2B e99a5589c11d79d77a4537b34ce0a45d37b981c123b79b807cea836c89fc3926d693458893baca2882448d3d44e3f64e06141f6d916b748daa10b8cc1ae16d1b SHA512 0fb16a8882fd30e86b62c5143b1cb18ab564e84e75bd1f28fd12f24ffdc4a42e0d2e012a99abb606c12efe3c11061ff5bf8e24ab053e550ae083f7d90f6576ff
 DIST cryptography-45.0.4.tar.gz 744890 BLAKE2B 34687a369894b0dfcf8a81c6d1b8cbb0b4a711fd17d4419c5368c41b7e5192cad7233295976a236a52c20493b980a5df77ff4af5a9d54925510d00e833971a22 SHA512 d5bdb21956b80675ccfae78be3d56a2e3bfe8c6ceac15c87c9a3ca470605cb798774018c6c9b9597e90a6918912c9a6b5d83eac9f446364b917d7e8888b83eee
 DIST cryptography-45.0.5.tar.gz 744903 BLAKE2B c8bee14a11b613b8e37fa9ed57dc8fc65b136c738ebe41a2aa753e9dbfed1976bebb429a62e869fd0a138ff222860d629280589b2340a4654f85b5b968af3a8c SHA512 1704f17250d8da6a33ac361f0fe07f6f91ebf087e81cee8fa783b220e118eba83f5c79eab001d79b383d7577b6dabd1e18de718cb16b5780d2f145107bf9cc79
+DIST cryptography-45.0.6.tar.gz 744949 BLAKE2B 271143188d0a7485066b5c89fc0397e6f9e5f5219844961a85e9fd382fb0b05521a093fb943252ea2985bb89645a285345fcf66a6022a58176fe809a83376a81 SHA512 2c675834fa26db0773fe51855c248927a2a7d45963e07144afdfa73573ce1e6940d40849d23fb45f7599c0821e4dbbec956ce2bd993c614617312b8e67fe7f1f
 DIST cryptography_vectors-45.0.4.tar.gz 35345034 BLAKE2B 578bd6dc066079a47cc8291a6b4ecec055b2374046efe12fdc1479505fd9bd5afbc9750e879d6d66b896ff7465abf4f1c133eb41dc4a75c57f5dc635ed8163f0 SHA512 0f2b6310eec21add1caa8ab60e8bb1399177b5a4bc50832fb5db581ed94d030871d2fdd53256e3764c67f58391673005db0527e15063554876306364a8111972
 DIST cryptography_vectors-45.0.5.tar.gz 35344700 BLAKE2B 620d31f2ef2482990567bfaeb21163a96b4da20829c80367511a9803bfc2ecad9edb54e37ad1d3c2848c747d14db61323d9613765bd94462adb9228d8a6d43fc SHA512 7d5706243ec69ae670a7d8e0e6e7a650d4ba7e10b5bd8b05641d7f0e2291cd719c3b2bfccb975c429046a1a347316aa86f40d128160ef176efa294c1d843ff86
+DIST cryptography_vectors-45.0.6.tar.gz 35344645 BLAKE2B 78e8cc7b27eefdf9f499ce64479c67be9ea320967fa6791f19e89c298b783972845728fe43b3c7e6d37fbe1bcd894b268a63cf47be7cc10c5487612cd3587cc5 SHA512 0571c8b5b6e6f7b8787f6bcd395f75460ef615cb9cfd2c779b11326c74b38f285dcb1d84123d3a7996530976fdda78ec266d5c849ea9d6c51835c5ef933b9bfa
 DIST foreign-types-0.3.2.crate 7504 BLAKE2B 520818b702d990d296ecd31a8646850202509ccfa18edd0e1b260289619a6c351e758f317ec0824bd76eccb209b6f087057c25f1bd01a47897715013dd834867 SHA512 bf27b8243ed482c202d120383374f19ff09422535e24b9c1aebccc66529bf300ca17b8bbc76d67f98ac092e614497afe3add9dc68aa69c93074df05762f91232
 DIST foreign-types-shared-0.1.1.crate 5672 BLAKE2B d2e42e04b6657e7a69fe0bd20c672176629c743e49a55fd007bb30e289710b70045d445ae9cae0eeaa747ee708c90e8abd9b5fc39bad8ec0666befe1b696d4f1 SHA512 bafdb2143e136fb0818e2ffd90b5c862b7181647d6568947d4e4531012bbf7a57b597221ec7056c1b562dfc0c3b5dead26d1a4111ebc15e7863737a873518a4a
 DIST heck-0.5.0.crate 11517 BLAKE2B 5365ec43b2239a76b33a174f1a4292ece4147f9d382a68c6c60db78fdc8bad0afb1d51a65bcb25e96675372faa4ea37c318265030b0546ba51942f7c929e1835 SHA512 f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild
new file mode 100644
index 00000000000..c157835b21c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-45.0.6.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=yes
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+
+CRATES="
+	asn1@0.21.3
+	asn1_derive@0.21.3
+	autocfg@1.4.0
+	base64@0.22.1
+	bitflags@2.9.1
+	cc@1.2.23
+	cfg-if@1.0.0
+	foreign-types-shared@0.1.1
+	foreign-types@0.3.2
+	heck@0.5.0
+	indoc@2.0.6
+	itoa@1.0.15
+	libc@0.2.172
+	memoffset@0.9.1
+	once_cell@1.21.3
+	openssl-macros@0.1.1
+	openssl-sys@0.9.108
+	openssl@0.10.72
+	pem@3.0.5
+	pkg-config@0.3.32
+	portable-atomic@1.11.0
+	proc-macro2@1.0.95
+	pyo3-build-config@0.25.0
+	pyo3-ffi@0.25.0
+	pyo3-macros-backend@0.25.0
+	pyo3-macros@0.25.0
+	pyo3@0.25.0
+	quote@1.0.40
+	self_cell@1.2.0
+	shlex@1.3.0
+	syn@2.0.101
+	target-lexicon@0.13.2
+	unicode-ident@1.0.18
+	unindent@0.2.4
+	vcpkg@0.2.15
+"
+
+inherit cargo distutils-r1 flag-o-matic pypi
+
+VEC_P=cryptography_vectors-$(ver_cut 1-3)
+DESCRIPTION="Library providing cryptographic recipes and primitives"
+HOMEPAGE="
+	https://github.com/pyca/cryptography/
+	https://pypi.org/project/cryptography/
+"
+SRC_URI+="
+	${CARGO_CRATE_URIS}
+	test? (
+		$(pypi_sdist_url cryptography_vectors "$(ver_cut 1-3)")
+	)
+"
+
+LICENSE="|| ( Apache-2.0 BSD ) PSF-2"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	>=dev-libs/openssl-1.0.2o-r6:0=
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.8:=[${PYTHON_USEDEP}]
+	' 'python*')
+"
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	${RUST_DEPEND}
+	>=dev-util/maturin-1.8.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/certifi[${PYTHON_USEDEP}]
+		dev-python/iso8601[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/pyasn1-modules[${PYTHON_USEDEP}]
+		dev-python/pytz[${PYTHON_USEDEP}]
+	)
+"
+
+# Files built without CFLAGS/LDFLAGS, acceptable for rust
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/cryptography/hazmat/bindings/_rust.*.so"
+
+EPYTEST_PLUGINS=( hypothesis pytest-subtests )
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_unpack() {
+	cargo_src_unpack
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	sed -i -e 's:--benchmark-disable::' pyproject.toml || die
+
+	# work around availability macros not supported in GCC (yet)
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		local darwinok=0
+		if [[ ${CHOST##*-darwin} -ge 16 ]] ; then
+			darwinok=1
+		fi
+		sed -i -e 's/__builtin_available(macOS 10\.12, \*)/'"${darwinok}"'/' \
+			src/_cffi_src/openssl/src/osrandom_engine.c || die
+	fi
+}
+
+python_configure_all() {
+	filter-lto # bug #903908
+}
+
+python_test() {
+	local -x PYTHONPATH="${PYTHONPATH}:${WORKDIR}/cryptography_vectors-${PV}"
+	local EPYTEST_IGNORE=(
+		tests/bench
+	)
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
index a1ccbd45923..18301c9762d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/Manifest
@@ -1,2 +1 @@
-DIST distlib-0.3.9.gh.tar.gz 1244538 BLAKE2B 08f5257f5a1125c1c76a23b9a78ded6a08f26d2f1491be9b104ab1e02a9737ae49f3750a607d3c7c744397879aeb3cd1a94a355743c95c702eec8a3cfebd70cb SHA512 d89b3ae450a02f634db10baef8d2ff445afa99cd69377f40ef07d591b4bbb2e24fff43c92eeeb93628eaee292fa1e8324eb1a842cf9401feb1f309dbb6f20a25
 DIST distlib-0.4.0.gh.tar.gz 1245571 BLAKE2B c36fe726918bc04849465a55a2708b8686d2ba0b05baa7ff0595e03b7ff95a1afc45b037dbeab9bd14ec7a26ec49807ea5a7c458d8f8da16038c92f32291c62e SHA512 ff61f9ab4e38061d5fee3168c8b26c741a21403d793476477e0733b28b2ba5b1fb31ae6ddb5275efe7ad6936b7e79a5e7ec1b160c86bfbfe6b4ecff10e0193d2
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
deleted file mode 100644
index ff73d11048e..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.3.9.ebuild
+++ /dev/null
@@ -1,59 +0,0 @@
-# Copyright 2021-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
-
-inherit distutils-r1
-
-DESCRIPTION="Low-level components of distutils2/packaging"
-HOMEPAGE="
-	https://pypi.org/project/distlib/
-	https://github.com/pypa/distlib/
-"
-SRC_URI="
-	https://github.com/pypa/distlib/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
-"
-
-LICENSE="PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-# pypiserver is called as external executable
-BDEPEND="
-	test? (
-		dev-python/pypiserver
-		dev-python/test[${PYTHON_USEDEP}]
-	)
-"
-
-src_prepare() {
-	local PATCHES=(
-		# use system pypiserver instead of bundled one
-		"${FILESDIR}"/distlib-0.3.9-system-pypiserver.py
-		# https://github.com/pypa/distlib/pull/244
-		"${FILESDIR}/${P}-freethreading.patch"
-	)
-
-	# make sure it's not used
-	rm tests/pypi-server-standalone.py || die
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	local -x SKIP_ONLINE=1
-	local -x PYTHONHASHSEED=0
-
-	# disable system-site-packages -- distlib has no deps, and is very
-	# fragile to packages actually installed on the system
-	sed -i -e '/system-site-packages/s:true:false:' \
-		"${BUILD_DIR}/install${EPREFIX}/usr/pyvenv.cfg" || die
-
-	"${EPYTHON}" tests/test_all.py -v -x ||
-		die "Tests failed with ${EPYTHON}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
index 16f1bea342b..e14e6a98b58 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/distlib/distlib-0.4.0.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch b/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch
deleted file mode 100644
index 5f7ccb28bfc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/distlib/files/distlib-0.3.9-freethreading.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 99248e3681036af5132bf5338ec939148da13478 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
-Date: Fri, 18 Apr 2025 16:33:35 +0200
-Subject: [PATCH] Update `test_wheel.WheelTestCase.test_abi` for freethreading
-
-Update `test_wheel.WheelTestCase.test_abi` to account for the `t` suffix
-added in freethreaded CPython builds.
-
-Fixes #243
----
- tests/test_wheel.py | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/test_wheel.py b/tests/test_wheel.py
-index da5bd58..c14bba3 100644
---- a/tests/test_wheel.py
-+++ b/tests/test_wheel.py
-@@ -719,6 +719,8 @@ def test_abi(self):
-                 us = sysconfig.get_config_var('Py_UNICODE_SIZE')
-                 if us == 4 or (us is None and sys.maxunicode == 0x10FFFF):
-                     parts.append('u')
-+            if bool(sysconfig.get_config_var("Py_GIL_DISABLED")):
-+                parts.append('t')
-         if vi < (3, 5):
-             abi = ABI
-         else:
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index 7449657682a..8e95d338409 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,4 +1,2 @@
 DIST docutils-0.21.2.tar.gz 2204444 BLAKE2B 727c2f97fc5835a0ffa62e38ea85af366cd89ad1eaec0b8af8b1f3b12e6cddfddb65161ba34f9109952d37ba2cf8985f3c3b6905ebb2ac1c9a984cce3fb4d170 SHA512 7fafa331f5687448e80d299c20cdccc4b49819fa471b5f586bf0ab18c694ba43a70f58e7c76b0a70a16267585548389214e11a4998ad7fdc19a27f0f7644539c
-DIST docutils-0.22rc2.tar.gz 2275875 BLAKE2B 62140304e9715e31d8be69c9b65fa382832805368cbf3c184b6319405f22d6c05a16b3b28b5444b4e498c21f4bb7baee8520ef80b445123341aaab7a6a6965d6 SHA512 fcb347d29315a5c2e9f070057962094457bdaf08693c1393a649ae24bab572be027c253deb98561c5cd5a27f2d1f994cf7dea63d0cb74c3a3993c4cea45e0a48
-DIST docutils-0.22rc3.tar.gz 2278230 BLAKE2B 650373b87230bc376c785becfbe2d61e2d67e561facd364f877bd580113223e39b42053b1b5fcab09990f0fc0be9f7aebaff0fc5fdb4fd524e6f45bc4de34a89 SHA512 7fa2cdceb818a69bc1b52ee16680ce23f9d15dc51b684097b479204611e2b320d778e32d5494f88543d77bc1424ee04628680610ed2dc1f5c0798a18b8da5cbd
-DIST docutils-0.22rc5.tar.gz 2279312 BLAKE2B b0473cddb656c0ebcba2177ac46b8c4d246902d646e8baa486df7e33556d88c8f659df6443adfe83efe5a00a7a642fc6ec01843b04f416c85b08b465fd1bc8f3 SHA512 60e98478f331959c55cc6c7bcc7ecb33c0f1a4d6760500ec6186a0d7f5b5c0140ebd690f86221418dcf7d4976ff9386a0f2a83d00d823f6d5dcb97d7b9917c2e
+DIST docutils-0.22.tar.gz 2277984 BLAKE2B 8ad9fc3d064e39bb618f5bac7ef6b69a77e7e811ff2f7c4c1b34f4f8bc1ba793f995e653d20ba536d24af5905f68b8e3f636a0f28f1c9eef46bb6f755d988bc2 SHA512 09082eb3bdd5f9b3e977d356740efee47725a50fbaca7bf35c7fddff06003c2b2177a38d160a9956f9e96261f881c0d870c0aa9fef84f90d0cac079ccc73669d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
index d5ea86951ef..00820ad3bd1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22.ebuild
@@ -17,6 +17,7 @@ HOMEPAGE="
 # GPL-3+ only for emacs/rst.el
 LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
 SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	dev-python/pillow[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
deleted file mode 100644
index d5ea86951ef..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc2.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-# GPL-3+ only for emacs/rst.el
-LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
-SLOT="0"
-
-RDEPEND="
-	dev-python/pillow[${PYTHON_USEDEP}]
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/buildhtml.py
-}
-
-python_install_all() {
-	local DOCS=( *.rst )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild
deleted file mode 100644
index d5ea86951ef..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.22_rc3.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-# GPL-3+ only for emacs/rst.el
-LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
-SLOT="0"
-
-RDEPEND="
-	dev-python/pillow[${PYTHON_USEDEP}]
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/buildhtml.py
-}
-
-python_install_all() {
-	local DOCS=( *.rst )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
index 3622d339ccd..86f564765d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
@@ -1,2 +1,2 @@
-DIST pip-25.1.1-py3-none-any.whl 1825227 BLAKE2B 13170fa08dd26edced5e5fe8d89b38f5b3b63882489d2a951a7238f950a332ce0df11109482840595984bca187960d8fe2b7aeabfcbdaf94e5586631cc1de4e3 SHA512 e0c56f04a306cba9e13ed87f7460ad5a3bda7d6c37e05098082c58acb1f7493c8061e48df279f2c476e75d12df12d0f1a74d82e00e6fc2badffe484d281c56fc
 DIST pip-25.1.1.gh.tar.gz 9219969 BLAKE2B eb443451deeb71888c2fc56ac5c8cb2d0515ec0efff975fab98cfa65d1fc5e66948243b3acebf1f4b0446e46082abb9fd350816579a4f5af1292c160490ce930 SHA512 ce61c9861265139b3c5ea9be9dc246097cd75c21687cf8301f80a377d02420c4524f0d6307d2ca0232ff8715b1105343bcfdb9cac6b69503780ab2c4645558dc
+DIST pip-25.2.gh.tar.gz 9121715 BLAKE2B 3bfe61d6d0d6f3a79c3fd801f5cb40b203fd12085d925ae7cde53adca3c5ee523fdfd9449546e1bc8ca719b3e8766cfef3162919e13a77f7adc0d20a951d11c7 SHA512 5cc65c9091fdda7905e26ce32ddaa3a1c2fd287d69fd3da67c814ba7e8e5be59301d8327c06cdca78c1b95f4a5b5f75c87f36a549022408cc0e8f9411c0db11e
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
index bf8abb59726..6aa83df3777 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1-r1.ebuild
@@ -24,7 +24,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test test-rust"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
deleted file mode 100644
index 23904e1f43a..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.1.1.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared pip wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/pip/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild
new file mode 100644
index 00000000000..93cadffb584
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.2.ebuild
@@ -0,0 +1,181 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+# PYTHON_COMPAT is used only for testing
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+PYTHON_REQ_USE="ssl(+),threads(+)"
+
+inherit distutils-r1
+
+MY_P=${P#ensurepip-}
+DESCRIPTION="Shared pip wheel for ensurepip Python module"
+HOMEPAGE="
+	https://pip.pypa.io/en/stable/
+	https://pypi.org/project/pip/
+	https://github.com/pypa/pip/
+"
+SRC_URI="
+	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test test-rust"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		<dev-python/ensurepip-setuptools-80
+		dev-python/ensurepip-wheel
+		dev-python/freezegun[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/scripttest[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-python/werkzeug[${PYTHON_USEDEP}]
+		dev-python/wheel[${PYTHON_USEDEP}]
+		test-rust? (
+			dev-python/cryptography[${PYTHON_USEDEP}]
+		)
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=()
+EPYTEST_RERUNS=5
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+declare -A VENDOR_LICENSES=(
+	[cachecontrol]=Apache-2.0
+	[certifi]=MPL-2.0
+	[dependency_groups]=MIT
+	[distlib]=PSF-2
+	[distro]=Apache-2.0
+	[idna]=BSD
+	[msgpack]=Apache-2.0
+	[packaging]="|| ( Apache-2.0 MIT )"
+	[pkg_resources]=MIT
+	[platformdirs]=MIT
+	[pygments]=BSD-2
+	[pyproject_hooks]=MIT
+	[requests]=Apache-2.0
+	[resolvelib]=ISC
+	[rich]=MIT
+	[tomli]=MIT
+	[tomli_w]=MIT
+	[truststore]=MIT
+	[urllib3]=MIT
+)
+LICENSE+=" ${VENDOR_LICENSES[*]}"
+
+python_prepare_all() {
+	local PATCHES=(
+		# remove coverage & pytest-subket wheel expectation from test suite
+		# (from dev-python/pip)
+		"${FILESDIR}/pip-25.2-test-wheels.patch"
+	)
+
+	distutils-r1_python_prepare_all
+
+	if use test; then
+		local wheels=(
+			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
+		)
+		mkdir tests/data/common_wheels/ || die
+		cp "${wheels[@]}" tests/data/common_wheels/ || die
+	fi
+
+	# Verify that we've covered licenses for all vendored packages
+	cd src/pip/_vendor || die
+	local packages=( */ )
+	local pkg missing=()
+	for pkg in "${packages[@]%/}"; do
+		if [[ ! -v "VENDOR_LICENSES[${pkg}]" ]]; then
+			missing+=( "${pkg}" )
+		else
+			unset "VENDOR_LICENSES[${pkg}]"
+		fi
+	done
+
+	if [[ ${missing[@]} || ${VENDOR_LICENSES[@]} ]]; then
+		[[ ${missing[@]} ]] &&
+			eerror "License missing for packages: ${missing[*]}"
+		[[ ${VENDOR_LICENSES[@]} ]] &&
+			eerror "Vendored packages removed: ${!VENDOR_LICENSES[*]}"
+		die "VENDOR_LICENSES outdated"
+	fi
+
+	local upstream_count=$(wc -l < vendor.txt || die)
+	if [[ ${#packages[@]} -ne ${upstream_count} ]]; then
+		eerror "VENDOR_LICENSES: ${#packages[@]}"
+		eerror "vendor.txt:      ${upstream_count}"
+		die "Not all vendored packages matched"
+	fi
+}
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		tests/functional/test_inspect.py::test_inspect_basic
+		# Internet
+		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
+		tests/functional/test_install.py::test_double_install_fail
+		tests/functional/test_install.py::test_install_sdist_links
+		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		tests/functional/test_lock.py::test_lock_archive
+		tests/functional/test_lock.py::test_lock_vcs
+		# broken by system site-packages use
+		tests/functional/test_freeze.py::test_freeze_with_setuptools
+		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
+		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
+		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
+	)
+	local EPYTEST_IGNORE=(
+		# from upstream options
+		src/pip/_vendor
+		tests/tests_cache
+		# requires proxy.py
+		tests/functional/test_proxy.py
+	)
+
+	case ${EPYTHON} in
+		pypy3*)
+			EPYTEST_DESELECT+=(
+				# unexpected tempfiles?
+				tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+				tests/functional/test_install_config.py::test_prompt_for_authentication
+			)
+			;;
+	esac
+
+	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
+		EPYTEST_DESELECT+=(
+			tests/functional/test_install.py::test_install_sends_client_cert
+			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		)
+	fi
+
+	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
+	# rerunfailures because test suite breaks if packages are installed
+	# in parallel
+	epytest -m "not network" -o addopts= -o tmp_path_retention_policy=all \
+		--use-venv
+}
+
+src_install() {
+	if [[ ${DISTUTILS_WHEEL_PATH} != *py3-none-any.whl ]]; then
+		die "Non-pure wheel produced?! ${DISTUTILS_WHEEL_PATH}"
+	fi
+	# TODO: compress it?
+	insinto /usr/lib/python/ensurepip
+	doins "${DISTUTILS_WHEEL_PATH}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch
new file mode 100644
index 00000000000..c99af85681d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/files/pip-25.2-test-wheels.patch
@@ -0,0 +1,74 @@
+From f172db76c62cf8e00fb547828c43cd8bf78a31ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Thu, 31 Jul 2025 05:10:08 +0200
+Subject: [PATCH] Disable coverage & socket plugins inside test venvs
+
+---
+ tests/conftest.py | 33 ---------------------------------
+ 1 file changed, 33 deletions(-)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index c98b87117..f4ef35a7e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -444,25 +444,6 @@ def wheel_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -
+     return _common_wheel_editable_install(tmpdir_factory, common_wheels, "wheel")
+ 
+ 
+-@pytest.fixture(scope="session")
+-def coverage_install(
+-    tmpdir_factory: pytest.TempPathFactory, common_wheels: Path
+-) -> Path:
+-    return _common_wheel_editable_install(tmpdir_factory, common_wheels, "coverage")
+-
+-
+-@pytest.fixture(scope="session")
+-def socket_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -> Path:
+-    lib_dir = _common_wheel_editable_install(
+-        tmpdir_factory, common_wheels, "pytest_subket"
+-    )
+-    # pytest-subket is only included so it can intercept and block unexpected
+-    # network requests. It should NOT be visible to the pip under test.
+-    dist_info = next(lib_dir.glob("*.dist-info"))
+-    shutil.rmtree(dist_info)
+-    return lib_dir
+-
+-
+ def install_pth_link(
+     venv: VirtualEnvironment, project_name: str, lib_dir: Path
+ ) -> None:
+@@ -479,8 +460,6 @@ def virtualenv_template(
+     pip_editable_parts: tuple[Path, ...],
+     setuptools_install: Path,
+     wheel_install: Path,
+-    coverage_install: Path,
+-    socket_install: Path,
+ ) -> VirtualEnvironment:
+     venv_type: VirtualEnvironmentType
+     if request.config.getoption("--use-venv"):
+@@ -494,11 +473,7 @@ def virtualenv_template(
+ 
+     # Install setuptools, wheel, pytest-subket, and pip.
+     install_pth_link(venv, "setuptools", setuptools_install)
+     install_pth_link(venv, "wheel", wheel_install)
+-    install_pth_link(venv, "pytest_subket", socket_install)
+-    # Also copy pytest-subket's .pth file so it can intercept socket calls.
+-    with open(venv.site / "pytest_socket.pth", "w") as f:
+-        f.write(socket_install.joinpath("pytest_socket.pth").read_text())
+ 
+     pth, dist_info = pip_editable_parts
+ 
+@@ -511,13 +485,6 @@ def virtualenv_template(
+     # detects changed files.
+     venv.site.joinpath("easy-install.pth").touch()
+ 
+-    # Install coverage and pth file for executing it in any spawned processes
+-    # in this virtual environment.
+-    install_pth_link(venv, "coverage", coverage_install)
+-    # zz prefix ensures the file is after easy-install.pth.
+-    with open(venv.site / "zz-coverage-helper.pth", "a") as f:
+-        f.write("import coverage; coverage.process_startup()")
+-
+     # Drop (non-relocatable) launchers.
+     for exe in os.listdir(venv.bin):
+         if not exe.startswith(("python", "libpy")):  # Don't remove libpypy-c.so...
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index 7db4debdccc..36450563226 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,3 +1,2 @@
 DIST setuptools-79.0.1-py3-none-any.whl 1256281 BLAKE2B 8ae51bdd1c0ccada116757c2bd765225fcf4bedc7ada18567ae12f09b6978cdbcddd4f635a39a5568b6d3ed4388e4f73af5c33a7060f2ac0d0907fc82d8fd74f SHA512 fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
-DIST setuptools-80.9.0-py3-none-any.whl 1201486 BLAKE2B 79895683ef4df387aee698984dfdf13adb14314f2d0267f41291c1c1ca68f4383a4273f004b6f3457463913eb19f8d386f32e2630ceaceaaf27ef32c4f61b7ed SHA512 2a0420f7faaa33d2132b82895a8282688030e939db0225ad8abb95a47bdb87b45318f10985fc3cee271a9121441c1526caa363d7f2e4a4b18b1a674068766e87
 DIST setuptools-80.9.0.tar.gz 1319958 BLAKE2B ab367912eec92b0d1251916d09c1dd2e311767eec87225beaff870dff923b47ba1732d2f7393b7d9e55d1ff1249c612e4403019e0021048951f9fc3b775c04c9 SHA512 36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
index 525cda9611b..b07355376bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0-r1.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
deleted file mode 100644
index 473fddfd3cc..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-80.9.0.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/setuptools/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
index 08cbb3a739a..86f564765d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
@@ -1 +1,2 @@
 DIST pip-25.1.1.gh.tar.gz 9219969 BLAKE2B eb443451deeb71888c2fc56ac5c8cb2d0515ec0efff975fab98cfa65d1fc5e66948243b3acebf1f4b0446e46082abb9fd350816579a4f5af1292c160490ce930 SHA512 ce61c9861265139b3c5ea9be9dc246097cd75c21687cf8301f80a377d02420c4524f0d6307d2ca0232ff8715b1105343bcfdb9cac6b69503780ab2c4645558dc
+DIST pip-25.2.gh.tar.gz 9121715 BLAKE2B 3bfe61d6d0d6f3a79c3fd801f5cb40b203fd12085d925ae7cde53adca3c5ee523fdfd9449546e1bc8ca719b3e8766cfef3162919e13a77f7adc0d20a951d11c7 SHA512 5cc65c9091fdda7905e26ce32ddaa3a1c2fd287d69fd3da67c814ba7e8e5be59301d8327c06cdca78c1b95f4a5b5f75c87f36a549022408cc0e8f9411c0db11e
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch
new file mode 100644
index 00000000000..c99af85681d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-25.2-test-wheels.patch
@@ -0,0 +1,74 @@
+From f172db76c62cf8e00fb547828c43cd8bf78a31ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Thu, 31 Jul 2025 05:10:08 +0200
+Subject: [PATCH] Disable coverage & socket plugins inside test venvs
+
+---
+ tests/conftest.py | 33 ---------------------------------
+ 1 file changed, 33 deletions(-)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index c98b87117..f4ef35a7e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -444,25 +444,6 @@ def wheel_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -
+     return _common_wheel_editable_install(tmpdir_factory, common_wheels, "wheel")
+ 
+ 
+-@pytest.fixture(scope="session")
+-def coverage_install(
+-    tmpdir_factory: pytest.TempPathFactory, common_wheels: Path
+-) -> Path:
+-    return _common_wheel_editable_install(tmpdir_factory, common_wheels, "coverage")
+-
+-
+-@pytest.fixture(scope="session")
+-def socket_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -> Path:
+-    lib_dir = _common_wheel_editable_install(
+-        tmpdir_factory, common_wheels, "pytest_subket"
+-    )
+-    # pytest-subket is only included so it can intercept and block unexpected
+-    # network requests. It should NOT be visible to the pip under test.
+-    dist_info = next(lib_dir.glob("*.dist-info"))
+-    shutil.rmtree(dist_info)
+-    return lib_dir
+-
+-
+ def install_pth_link(
+     venv: VirtualEnvironment, project_name: str, lib_dir: Path
+ ) -> None:
+@@ -479,8 +460,6 @@ def virtualenv_template(
+     pip_editable_parts: tuple[Path, ...],
+     setuptools_install: Path,
+     wheel_install: Path,
+-    coverage_install: Path,
+-    socket_install: Path,
+ ) -> VirtualEnvironment:
+     venv_type: VirtualEnvironmentType
+     if request.config.getoption("--use-venv"):
+@@ -494,11 +473,7 @@ def virtualenv_template(
+ 
+     # Install setuptools, wheel, pytest-subket, and pip.
+     install_pth_link(venv, "setuptools", setuptools_install)
+     install_pth_link(venv, "wheel", wheel_install)
+-    install_pth_link(venv, "pytest_subket", socket_install)
+-    # Also copy pytest-subket's .pth file so it can intercept socket calls.
+-    with open(venv.site / "pytest_socket.pth", "w") as f:
+-        f.write(socket_install.joinpath("pytest_socket.pth").read_text())
+ 
+     pth, dist_info = pip_editable_parts
+ 
+@@ -511,13 +485,6 @@ def virtualenv_template(
+     # detects changed files.
+     venv.site.joinpath("easy-install.pth").touch()
+ 
+-    # Install coverage and pth file for executing it in any spawned processes
+-    # in this virtual environment.
+-    install_pth_link(venv, "coverage", coverage_install)
+-    # zz prefix ensures the file is after easy-install.pth.
+-    with open(venv.site / "zz-coverage-helper.pth", "a") as f:
+-        f.write("import coverage; coverage.process_startup()")
+-
+     # Drop (non-relocatable) launchers.
+     for exe in os.listdir(venv.bin):
+         if not exe.startswith(("python", "libpy")):  # Don't remove libpypy-c.so...
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild
new file mode 100644
index 00000000000..fbfd75f3e9f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.2.ebuild
@@ -0,0 +1,191 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# please bump dev-python/ensurepip-pip along with this package!
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( pypy3_11 python3_{11..14} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="ssl(+),threads(+)"
+
+inherit distutils-r1 shell-completion
+
+DESCRIPTION="The PyPA recommended tool for installing Python packages"
+HOMEPAGE="
+	https://pip.pypa.io/en/stable/
+	https://pypi.org/project/pip/
+	https://github.com/pypa/pip/
+"
+SRC_URI="
+	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="test test-rust"
+RESTRICT="!test? ( test )"
+
+# see src/pip/_vendor/vendor.txt
+RDEPEND="
+	>=dev-python/cachecontrol-0.14.3[${PYTHON_USEDEP}]
+	>=dev-python/dependency-groups-1.3.0[${PYTHON_USEDEP}]
+	>=dev-python/distlib-0.4.0[${PYTHON_USEDEP}]
+	>=dev-python/distro-1.9.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-1.1.1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-25.0[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-4.3.8[${PYTHON_USEDEP}]
+	>=dev-python/pyproject-hooks-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/requests-2.32.4[${PYTHON_USEDEP}]
+	>=dev-python/rich-14.1.0[${PYTHON_USEDEP}]
+	>=dev-python/resolvelib-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-70.3.0[${PYTHON_USEDEP}]
+	>=dev-python/tomli-w-1.2.0[${PYTHON_USEDEP}]
+	>=dev-python/truststore-0.10.1[${PYTHON_USEDEP}]
+	>=dev-python/typing-extensions-4.13.2[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/ensurepip-setuptools
+			dev-python/ensurepip-wheel
+			dev-python/freezegun[${PYTHON_USEDEP}]
+			dev-python/pretend[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			dev-python/scripttest[${PYTHON_USEDEP}]
+			<dev-python/setuptools-80[${PYTHON_USEDEP}]
+			dev-python/virtualenv[${PYTHON_USEDEP}]
+			dev-python/werkzeug[${PYTHON_USEDEP}]
+			dev-python/wheel[${PYTHON_USEDEP}]
+			test-rust? (
+				dev-python/cryptography[${PYTHON_USEDEP}]
+			)
+			dev-vcs/git
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+python_prepare_all() {
+	local PATCHES=(
+		# remove coverage & pytest-subket wheel expectation from test suite
+		"${FILESDIR}/pip-25.2-test-wheels.patch"
+		# prepare to unbundle dependencies
+		"${FILESDIR}/pip-25.0.1-unbundle.patch"
+	)
+
+	distutils-r1_python_prepare_all
+
+	# unbundle dependencies
+	rm -r src/pip/_vendor || die
+	find -name '*.py' -exec sed -i \
+		-e 's:from pip\._vendor import:import:g' \
+		-e 's:from pip\._vendor\.:from :g' \
+		{} + || die
+
+	if use test; then
+		local wheels=(
+			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
+		)
+		mkdir tests/data/common_wheels/ || die
+		cp "${wheels[@]}" tests/data/common_wheels/ || die
+	fi
+}
+
+python_configure() {
+	if use test && has_version "dev-python/pip[${PYTHON_USEDEP}]"; then
+		"${EPYTHON}" -m pip check ||
+			die "${EPYTHON} -m pip check failed, tests will fail"
+	fi
+}
+
+python_compile_all() {
+	# 'pip completion' command embeds full $0 into completion script, which confuses
+	# 'complete' and causes QA warning when running as "${PYTHON} -m pip".
+	# This trick sets correct $0 while still calling just installed pip.
+	local pipcmd='if True:
+		import sys
+		sys.argv[0] = "pip"
+		__file__ = ""
+		from pip._internal.cli.main import main
+		sys.exit(main())
+	'
+	"${EPYTHON}" -c "${pipcmd}" completion --bash > completion.bash || die
+	"${EPYTHON}" -c "${pipcmd}" completion --zsh > completion.zsh || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping tests on ${EPYTHON}"
+		return 0
+	fi
+
+	local EPYTEST_DESELECT=(
+		tests/functional/test_inspect.py::test_inspect_basic
+		# Internet
+		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
+		tests/functional/test_install.py::test_double_install_fail
+		tests/functional/test_install.py::test_install_sdist_links
+		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		tests/functional/test_lock.py::test_lock_archive
+		tests/functional/test_lock.py::test_lock_vcs
+		# broken by system site-packages use
+		tests/functional/test_freeze.py::test_freeze_with_setuptools
+		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
+		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
+		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
+		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
+		# broken by unbundling
+		"tests/functional/test_debug.py::test_debug[vendored library versions:]"
+		tests/functional/test_debug.py::test_debug__library_versions
+		tests/functional/test_python_option.py::test_python_interpreter
+		tests/functional/test_uninstall.py::test_uninstall_non_local_distutils
+	)
+	local EPYTEST_IGNORE=(
+		# from upstream options
+		tests/tests_cache
+		# requires proxy.py
+		tests/functional/test_proxy.py
+	)
+
+	case ${EPYTHON} in
+		pypy3*)
+			EPYTEST_DESELECT+=(
+				# unexpected tempfiles?
+				tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+				tests/functional/test_install_config.py::test_prompt_for_authentication
+			)
+			;;
+	esac
+
+	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
+		EPYTEST_DESELECT+=(
+			tests/functional/test_install.py::test_install_sends_client_cert
+			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_authentication
+			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
+		)
+	fi
+
+	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
+	local EPYTEST_PLUGINS=()
+	# rerunfailures because test suite breaks if packages are installed
+	# to system site-packages while it's running
+	local EPYTEST_RERUNS=5
+	local EPYTEST_XDIST=1
+	epytest -m "not network" -o addopts= -o tmp_path_retention_policy=all \
+		--use-venv
+}
+
+python_install_all() {
+	local DOCS=( AUTHORS.txt docs/html/**/*.rst )
+	distutils-r1_python_install_all
+
+	newbashcomp completion.bash pip
+	newzshcomp completion.zsh _pip
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
index a0b371d6e84..7826d080a02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ply/ply-3.11-r2.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
index 3ed190f94ed..1a66d95adbe 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pycparser/pycparser-2.22.ebuild
@@ -5,7 +5,7 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
index 6600432e8cd..2ab4c21eb8c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
@@ -1 +1 @@
-DIST rich-14.0.0.gh.tar.gz 15065886 BLAKE2B b1e47ee163561f714cbddf6d809e7f5b2c28d09c196ec0132a04bdcaa05415fe7189a9c471bd68d3cb18e526d4aecb4499229cf3adac85164cf6309c77f53b74 SHA512 e3192d75d35d9f63fa687a8e9e7893ea273ef193b7e27c266d2f1a1c62c7fa44e83cfb6ea3fef716fff6d337a826af393c223d5d4bddc52b4ec84aa6554379ef
+DIST rich-14.1.0.gh.tar.gz 15070577 BLAKE2B b1ce2783dc3292df250f416812a6bd7d1c6cc2f15a979f50dd6811771de3beb01f4baf8d5b1ec50c2929dd572578daac58e332017e62e60f51b45e34ed5ac953 SHA512 39971d8811b754e708aa422f71a777164aee1ec0b76df3b350b637fdd6c3d3a715ccc36dfce587355b4ec95ce73a8d197da1179be13c7c1d936ba45bd2073a64
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
index 5cf4037f031..899620cbea9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.1.0.ebuild
@@ -38,6 +38,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-14.0.0-py314.patch
 )
 
+EPYTEST_PLUGINS=()
 distutils_enable_tests pytest
 
 python_test() {
@@ -50,6 +51,9 @@ python_test() {
 		tests/test_markdown.py::test_inline_code
 		tests/test_syntax.py::test_blank_lines
 		tests/test_syntax.py::test_python_render_simple_indent_guides
+		# pygments version?
+		tests/test_syntax.py::test_from_path
+		tests/test_syntax.py::test_syntax_guess_lexer
 	)
 	# version-specific output -- the usual deal
 	case ${EPYTHON} in
@@ -72,7 +76,6 @@ python_test() {
 	esac
 
 	local -x COLUMNS=80
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
 	epytest
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
index 08b01bd3e37..989a937112a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
@@ -1 +1,3 @@
 DIST setuptools_scm-8.3.1.tar.gz 78088 BLAKE2B 6cedb55fc16830d12a28fe5b662c371b134bc4d7ef0e6de446b71152e5d83a031cf763b0753042c96745e82bf9dc42fa7cfee05a9a7e7824a4cf659b0a401a51 SHA512 e924abf81c7ee466241c5d66c39b416c8b308f01df9e1498c55ad6ed9812fbf883d8bcafd6fdcdcb96c5ec42b868ae04088de1870ca09a650fa07eb3ea9901c8
+DIST setuptools_scm-9.0.0.tar.gz 184752 BLAKE2B f6ec73dd4733b7cf24cd67bebde9cc96e1c611187774c35fa33e96a29b8aab29c13069ba68e52406dee30e1bf19d2fe38f61031f66b4abb7aeec60a5d3cb72aa SHA512 2d22695ac7036d70d23d8c2613b1c9a9948cc517754b93f38d561065746b8df001d6bae9878477f2df622711b6809b8e178c2c21ad82bdd9c7877b5816251e47
+DIST setuptools_scm-9.0.3.tar.gz 187006 BLAKE2B 8e936eda4802aae82d3aafa4ee8d4cfd3beae7afc7df0719e97a268d63a3f1e701334734fcb94c31fa16b11f67b3e38f2097fd9c7951b1d185bc4cfc1d2f6809 SHA512 642b11ec216a7f332492d6cfa6b4972aa7e58bdf6181f62f0e9d8ab8dba24feb771aa4e87facf704aabad500bd75a12d2ad420f00b0f36fb61d3b35158a71ea7
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild
new file mode 100644
index 00000000000..ea65d71e9c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+
+		# calls flake8, unpredictable
+		testing/test_functions.py::test_dump_version_flake8
+
+		# incompatible with current mypy version
+		testing/test_functions.py::test_dump_version_mypy
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild
new file mode 100644
index 00000000000..ea65d71e9c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-9.0.3.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} python3_{13,14}t pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools-scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	>=dev-python/setuptools-64[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/build[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+
+		# calls flake8, unpredictable
+		testing/test_functions.py::test_dump_version_flake8
+
+		# incompatible with current mypy version
+		testing/test_functions.py::test_dump_version_mypy
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
index f983770caa7..f04da78c52e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0-r1.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
deleted file mode 100644
index 26356f533d5..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-80.9.0.ebuild
+++ /dev/null
@@ -1,130 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-# please bump dev-python/ensurepip-setuptools along with this package!
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_TESTED=( python3_{11..14} pypy3_11 )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_{13,14}t )
-PYTHON_REQ_USE="xml(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Collection of extensions to Distutils"
-HOMEPAGE="
-	https://github.com/pypa/setuptools/
-	https://pypi.org/project/setuptools/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	dev-python/jaraco-collections[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
-	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
-	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
-			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
-			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
-			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
-			dev-python/pip[${PYTHON_USEDEP}]
-			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
-			dev-python/pytest[${PYTHON_USEDEP}]
-			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
-			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
-			dev-python/pytest-timeout[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
-			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-# setuptools-scm is here because installing plugins apparently breaks stuff at
-# runtime, so let's pull it early. See bug #663324.
-#
-# trove-classifiers are optionally used in validation, if they are
-# installed.  Since we really oughtn't block them, let's always enforce
-# the newest version for the time being to avoid errors.
-# https://github.com/pypa/setuptools/issues/4459
-PDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	local PATCHES=(
-		# TODO: remove this when we're 100% PEP517 mode
-		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
-		# https://github.com/abravalheri/validate-pyproject/pull/221
-		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# breaks tests
-	sed -i -e '/--import-mode/d' pytest.ini || die
-
-	# remove bundled dependencies
-	rm -r */_vendor || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		return
-	fi
-
-	local EPYTEST_DESELECT=(
-		# network
-		setuptools/tests/integration/test_pbr.py::test_pbr_integration
-		setuptools/tests/test_build_meta.py::test_legacy_editable_install
-		setuptools/tests/test_develop.py::TestNamespaces::test_namespace_package_importable
-		setuptools/tests/test_distutils_adoption.py
-		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
-		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
-		# TODO
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
-		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		# expects bundled deps in virtualenv
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
-		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
-		# fails if python-xlib is installed
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
-		# TODO, probably some random package
-		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# broken by unbundling
-		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
-		# fails on normalized metadata, perhaps different dep version?
-		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
-		# TODO
-		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
-		# relies on -Werror
-		setuptools/_static.py::setuptools._static.Dict
-		setuptools/_static.py::setuptools._static.List
-		setuptools/tests/test_bdist_egg.py::Test::test_bdist_egg
-		# TODO
-		setuptools/dist.py::setuptools.dist.Distribution._find_pattern
-	)
-
-	local EPYTEST_XDIST=1
-	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
-	epytest -o tmp_path_retention_policy=all \
-		-m "not uses_network" setuptools
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
index a0d5a62778d..335acadcc5e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/Manifest
@@ -1,3 +1,5 @@
 DIST tree-sitter-0.23.0.gh.tar.gz 167761 BLAKE2B 694e90f608f51fe4f9add476cd5ebcd0ce04a7b027efc4948ce49a6cc0f05ebf4f15e0fe3f365f89f3e04cfec542cb3f1db1e5b05ff7ca23d3134561ea3dcf36 SHA512 67a6f3359c6283c58afcdbe5b6a521cdfcf2585a5361fb69a55eff82941726a143528a402e6d609286d8846c77e20d0a38551525d761e35abb21045ad9c5a2f8
 DIST tree-sitter-0.23.1.gh.tar.gz 168079 BLAKE2B fe3f8d9dae426d7771eab7775d78a0af72e59bf3448005cec1e597a3263b2ac89d7b2c1a80aa12da42db54b242da10d0395673412257d57dff557b2cf4763869 SHA512 39ed2d5d8a737bd72d539701a2dab5abc501b151a3666180f127645895582757eba2ec98607bbeb07bf90377fccad4a93cb385ce16565ed3420908129cea4f57
 DIST tree-sitter-0.24.0.gh.tar.gz 170141 BLAKE2B 3d7f076f947192105be2fc9d93831eb331c1ec189619f6db860db8b6b6c1f2f33cd03edf315c09a5de6637d870351d06d5507d9c0de8a4dadc4e9e863ac233e8 SHA512 471d605cc29bcf7fd228eefe8a3bc2dd39c163d584e941cfd8ac0e498ff1815c7cadb9a7a45c643f704b8c9f12932bcc53597c835e23b5988da087f9a6a59067
+DIST tree-sitter-0.25.0.gh.tar.gz 173820 BLAKE2B 63dbb9992fb6c4212a7a7cffd44b852d94d78a9699ec856807ce333ac494409f7dcd5cf3d8b0fdfa03c03a484ed3d5b0ee51c3847667474a04c811ae561f0918 SHA512 357a0aa1c9393f9ec1a056e87b54e5178abbd6b2525a863b2ed5ba788337a9ae555a52092fe89803215487d324e287f2c2cbe2d60f878e1c053cf6b41a387eeb
+DIST tree-sitter-0.25.1.gh.tar.gz 174288 BLAKE2B 2580e7909e28ea05dfe8a015eb0e26d465318a0962666dc8de3d82d80c7647a62398abee093ccea13a04119e685dac3365ed098a70f7c50fac383cef34f7cb62 SHA512 37a6035921d44a13ef2128c8ff5dd7d8424dd50c1b5089a143ecfd921848304d91339d17108fa9e2f7ea0a6755b03413061ed6a6561ef1d8473534e8cf4636ef
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild
new file mode 100644
index 00000000000..cee8a94c10a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.0.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python bindings to the Tree-sitter parsing library"
+HOMEPAGE="
+	https://github.com/tree-sitter/py-tree-sitter/
+	https://pypi.org/project/tree-sitter/
+"
+SRC_URI="
+	https://github.com/tree-sitter/py-tree-sitter/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+S=${WORKDIR}/py-${P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+# setuptools is needed for distutils import
+DEPEND=">=dev-libs/tree-sitter-0.25.0:="
+RDEPEND="${DEPEND}
+	$(python_gen_cond_dep '
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	' 3.12 3.13)
+"
+BDEPEND="
+	test? (
+		>=dev-libs/tree-sitter-html-0.23.2[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-javascript-0.23.1[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-json-0.24.8[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-python-0.23.6[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-rust-0.23.2[python,${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.22.2-unbundle.patch
+)
+
+src_unpack() {
+	default
+	rmdir "${S}/tree_sitter/core" || die
+}
+
+src_test() {
+	rm -r tree_sitter || die
+	distutils-r1_src_test
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild
new file mode 100644
index 00000000000..cee8a94c10a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.25.1.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python bindings to the Tree-sitter parsing library"
+HOMEPAGE="
+	https://github.com/tree-sitter/py-tree-sitter/
+	https://pypi.org/project/tree-sitter/
+"
+SRC_URI="
+	https://github.com/tree-sitter/py-tree-sitter/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+S=${WORKDIR}/py-${P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+# setuptools is needed for distutils import
+DEPEND=">=dev-libs/tree-sitter-0.25.0:="
+RDEPEND="${DEPEND}
+	$(python_gen_cond_dep '
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	' 3.12 3.13)
+"
+BDEPEND="
+	test? (
+		>=dev-libs/tree-sitter-html-0.23.2[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-javascript-0.23.1[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-json-0.24.8[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-python-0.23.6[python,${PYTHON_USEDEP}]
+		>=dev-libs/tree-sitter-rust-0.23.2[python,${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.22.2-unbundle.patch
+)
+
+src_unpack() {
+	default
+	rmdir "${S}/tree_sitter/core" || die
+}
+
+src_test() {
+	rm -r tree_sitter || die
+	distutils-r1_src_test
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index 0808d7839f2..c53b51160f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1 +1,2 @@
 DIST trove_classifiers-2025.5.9.12.tar.gz 16940 BLAKE2B f6143f341d280eca611269c1a04b7f795d8f8733e97518d81d5872b8e1e13f745f7428737993a5c50285de24f56f899737d05fe073c683ddd69765b6081a6ebe SHA512 ee858f52c08b867fe4845ebb19f9b431308d216b5313e2bc030d63340860205d40125ef6cee218f734ccd49e5ae36011c8e3415f03d0ace182cb518ed5f2318d
+DIST trove_classifiers-2025.8.6.13.tar.gz 16932 BLAKE2B f4567cd2362897fe6cacea6c7a554bd1501d5ac176b7cc83d55a53a53599f8996efaa7c0d57f6911ed0a66f441d24127391bfab0f87ff81ea0d0ac4e5c46905e SHA512 14c9c4b082f4f92d02b84103e5fbb205ea8a716635e1db77c549776c6ce5caa46d4891bd79702f80323e0b140f65d2c9e0779cc168717c938fd471c046ae3102
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild
new file mode 100644
index 00000000000..362573b9839
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.8.6.13.ebuild
@@ -0,0 +1,46 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} python3_{13,14}t )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
+HOMEPAGE="
+	https://github.com/pypa/trove-classifiers/
+	https://pypi.org/project/trove-classifiers/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease hatchling bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "trove-classifiers"
+		version = "${PV}"
+		description = "Canonical source for classifiers on PyPI (pypi.org)."
+
+		[project.scripts]
+		trove-classifiers = "trove_classifiers.__main__:cli"
+	EOF
+}
+
+python_test() {
+	epytest
+	"${EPYTHON}" -m tests.lib || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
index d97c8d06d81..99a78aa331b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/Manifest
@@ -1 +1,2 @@
 DIST truststore-0.10.1.gh.tar.gz 29120 BLAKE2B 2efb72b04f3e6fd5365d0d4f8fda12fcaa6fd2008cb17fdc76a679b4bff965040d30465cf78dc0a2cec2e02430100b5e6cc1f4ec4102326805a6d9bd52c38b10 SHA512 8a1c1269d44c0c33444c67d4302484eddcd3223b3e792b133efcf547ed1292cdca0ebc15447f68e7078928ea01d5c2108692dffb703d6bbdad0b9f1c23eeebe9
+DIST truststore-0.10.3.gh.tar.gz 29678 BLAKE2B b7731c471d749c2e685a84964d64afda93161d55fe74316da465ded4dabba01656b4e51e95b41cd0ce9e2745472f2835c5b2ad2cd4e393fa3891ee83bba54fa3 SHA512 64db26581aab8a010382f99b7609b46f4b6508b89430c75398d5f7c3f07b8bf666b12d7f82ff407aa163fbd614eaf309a00c8aac55eae0f7c031a4f66c9822de
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
index 3ad6dfe6683..acbd352144e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.1.ebuild
@@ -28,20 +28,13 @@ RESTRICT="test"
 BDEPEND="
 	test? (
 		dev-python/aiohttp[${PYTHON_USEDEP}]
-		dev-python/flaky[${PYTHON_USEDEP}]
 		dev-python/httpx[${PYTHON_USEDEP}]
 		dev-python/pyopenssl[${PYTHON_USEDEP}]
-		dev-python/pytest-asyncio[${PYTHON_USEDEP}]
-		dev-python/pytest-httpserver[${PYTHON_USEDEP}]
 		dev-python/requests[${PYTHON_USEDEP}]
 		dev-python/trustme[${PYTHON_USEDEP}]
 		dev-python/urllib3[${PYTHON_USEDEP}]
 	)
 "
 
+EPYTEST_PLUGINS=( pytest-{asyncio,httpserver,rerunfailures} )
 distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p asyncio -p pytest_httpserver
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild
new file mode 100644
index 00000000000..c7fedfd0565
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/truststore/truststore-0.10.3.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="Verify certificates using native system trust stores"
+HOMEPAGE="
+	https://github.com/sethmlarson/truststore/
+	https://pypi.org/project/truststore/
+"
+SRC_URI="
+	https://github.com/sethmlarson/truststore/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+# The vast majority of tests require Internet access.
+PROPERTIES="test_network"
+RESTRICT="test"
+
+BDEPEND="
+	test? (
+		dev-python/aiohttp[${PYTHON_USEDEP}]
+		dev-python/httpx[${PYTHON_USEDEP}]
+		dev-python/pyopenssl[${PYTHON_USEDEP}]
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-python/trustme[${PYTHON_USEDEP}]
+		dev-python/urllib3[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-{asyncio,httpserver,rerunfailures} )
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
index 2f0798f394c..307d8b5b171 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
@@ -1 +1,2 @@
 DIST bpftool-libbpf-v7.5.0-sources.tar.gz 1510032 BLAKE2B cc9beac4034317f89ae3c1088d1b1a1948778bcdb51d7ed7f566e4e5ab720c1128ca467d51d0bc3ffe7b1f69800249362baef5dfaf858275050f96b744fdbca6 SHA512 db12c305b77fea3689dbc1ce94527f0f21fa9de21fcdb36385e3fe492137335bb393f90e456c06601495ccc984230a531c432709db6514b545e0aeeda7ca3c99
+DIST bpftool-libbpf-v7.6.0-sources.tar.gz 1527883 BLAKE2B 5918519009b1ee258c33506cb52d216b08fbcd6365083a71d74b11e2c788fd4c6f7cfd78c84bb85074eb463dfa8d087b8e35c79d00f3a0810979640af6b334e6 SHA512 d443601227acd9a0db15896da186b0a47d426c44f2b6eaa822391594aa23d617a94ee94f284abb841529d41ef7c585a1087dd5ab1708ce068cc02b3c08b0a51b
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
index 2d8c0adfad3..970f2542062 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0-r1.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 LLVM_COMPAT=( {15..20} )
 LLVM_OPTIONAL=1
-PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild
new file mode 100644
index 00000000000..b7516d18f9e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.6.0.ebuild
@@ -0,0 +1,150 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..20} )
+LLVM_OPTIONAL=1
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
+
+DESCRIPTION="Tool for inspection and simple manipulation of eBPF programs and maps"
+HOMEPAGE="https://github.com/libbpf/bpftool"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/libbpf/bpftool.git"
+	EGIT_SUBMODULES=(libbpf)
+else
+	# bpftool typically vendors whatever libbpf is current at the time
+	# of a release, while libbpf publishes minor updates more frequently.
+	# Uncomment the following to bundle an updated libbpf e.g. in case of
+	# security or crasher bugs in libbpf and to keep the two synchronized.
+	# This allows us to quickly update the vendored lib with a revbump.
+	# Currently bpftool-x.y vendors libbpf-1.y; DO NOT mix different y versions.
+	# See the libbpf repo (https://github.com/libbpf/libbpf) for possible updates.
+	# LIBBPF_VERSION=1.5.0
+
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		SRC_URI="https://github.com/libbpf/bpftool/archive/refs/tags/v${PV}.tar.gz -> bpftool-${PV}.tar.gz
+			https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz
+			  -> libbpf-${LIBBPF_VERSION}.tar.gz"
+	else
+		# use tarball with bundled libbpf
+		SRC_URI="https://github.com/libbpf/bpftool/releases/download/v${PV}/bpftool-libbpf-v${PV}-sources.tar.gz"
+		S="${WORKDIR}/bpftool-libbpf-v${PV}-sources"
+	fi
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="|| ( GPL-2 BSD-2 )"
+SLOT="0"
+IUSE="caps +clang llvm"
+REQUIRED_USE="llvm? ( ${LLVM_REQUIRED_USE} )"
+
+RDEPEND="
+	caps? ( sys-libs/libcap:= )
+	llvm? ( $(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}') )
+	!llvm? ( sys-libs/binutils-libs:= )
+	sys-libs/zlib:=
+	virtual/libelf:=
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.8
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-arch/tar
+	dev-python/docutils
+	clang? ( $(llvm_gen_dep 'llvm-core/clang:${LLVM_SLOT}[llvm_targets_BPF]') )
+	!clang? ( sys-devel/bpf-toolchain )
+"
+
+CONFIG_CHECK="~DEBUG_INFO_BTF"
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+	use llvm && llvm-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# prepare libbpf if necessary
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		rm -rf libbpf || die
+		ln -s "${WORKDIR}/libbpf-${LIBBPF_VERSION}" libbpf || die
+	fi
+
+	# remove -Werror from libbpf (bug 887981)
+	sed -i -e 's/\-Werror//g' libbpf/src/Makefile || die
+
+	# remove -Werror from bpftool feature detection
+	sed -i -e 's/-Werror//g' src/Makefile.feature || die
+
+	# remove hardcoded/unhelpful flags from bpftool
+	sed -i -e '/CFLAGS += -O2/d' -e 's/-W //g' -e 's/-Wextra //g' src/Makefile || die
+
+	# always build bpf bits with std=gnu11 for kernel compatibility (bug 955156)
+	sed -i 's/-fno-stack-protector/& -std=gnu11/g' src/Makefile || die
+
+	if ! use clang; then
+		# make people aware of what they are doing
+		ewarn "Using bpf-toolchain instead of clang due to USE=-clang."
+		ewarn "Please report any odd behaviours you observe, since using gcc for BPF"
+		ewarn "is still under development in both the Linux kernel and gcc itself."
+
+		# prevent attribute warning about preserve_access_index
+		# since gcc does not support '#pragma clang attribute push':
+		# https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=675b4e2
+		sed -i 's/std=gnu11/& -DBPF_NO_PRESERVE_ACCESS_INDEX/g' src/Makefile || die
+
+		# remove bpf target & add assembly annotations to fix CO-RE feature detection
+		sed -i -e 's/-target bpf/-dA/' src/Makefile.feature || die
+
+		# remove bpf target from skeleton build
+		sed -i -e 's/--target=bpf//g' src/Makefile || die
+	fi
+
+	# Use rst2man or rst2man.py depending on which one exists (#930076)
+	type -P rst2man >/dev/null || sed -i -e 's/rst2man/rst2man.py/g' docs/Makefile || die
+}
+
+bpftool_make() {
+	# which BPF compiler should we use?
+	if use clang; then
+		export CLANG="$(get_llvm_prefix -b)/bin/clang"
+		export LLVM_STRIP="$(get_llvm_prefix -b)/bin/llvm-strip"
+	else
+		# use bpf-toolchain
+		export CLANG="bpf-unknown-none-gcc"
+		export LLVM_STRIP="bpf-unknown-none-strip"
+	fi
+
+	tc-export AR CC LD
+
+	emake \
+		ARCH="$(tc-arch-kernel)" \
+		HOSTAR="$(tc-getBUILD_AR)" \
+		HOSTCC="$(tc-getBUILD_CC)" \
+		HOSTLD="$(tc-getBUILD_LD)" \
+		bash_compdir="$(get_bashcompdir)" \
+		feature-libcap="$(usex caps 1 0)" \
+		feature-llvm="$(usex llvm 1 0)" \
+		prefix="${EPREFIX}"/usr \
+		V=1 \
+		"$@"
+}
+
+src_compile() {
+	bpftool_make -C src
+	bpftool_make -C docs
+}
+
+src_install() {
+	bpftool_make DESTDIR="${D}" -C src install
+	bpftool_make mandir="${ED}"/usr/share/man -C docs install
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
index 0139c6ee78d..b7516d18f9e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 LLVM_COMPAT=( {15..20} )
 LLVM_OPTIONAL=1
-PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 
 inherit bash-completion-r1 linux-info llvm-r1 python-any-r1 toolchain-funcs
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
index e7fb803301e..8c6b974834b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/Manifest
@@ -2,3 +2,7 @@ DIST maturin-1.8.6-vendor.tar.xz 15035340 BLAKE2B 0bc4016f460c704ac2be81af27842f
 DIST maturin-1.8.6.gh.tar.gz 551946 BLAKE2B 4fbeadeb25b69e99286238c9f7b7acb2bdde05242af760a0279664277334831a8cd03db49ddb3a0d528b6acd827d3ee3863e283318270ee53c3710c103c7461f SHA512 2616b3bcdbb96c77a3efeda5a24841675fded9d1299507c64905c94e57af15afa855c329f013a1e36527c2b8de4bf7acfb060e5d2828558da658a7b86d88bf8f
 DIST maturin-1.9.1-vendor.tar.xz 15643332 BLAKE2B cf7fd445186c5de8d09c99eb4a270b85c547bcf8dddf891c24bf0d2a75f634f49115de7841b1bce88c97391d784119e9dd4873a6a4903735443ce05958056a3b SHA512 93665219f09bb16f1abcf810bc60e3b9056521d42b03d5b42d03e76ad782f56c86f1ead5077ab260eb530ff444dd16cd7ce18df89cd72d3ac8f6dcb588f46582
 DIST maturin-1.9.1.gh.tar.gz 559847 BLAKE2B 8c69a437f7cabb71242e231baefb02b2f5c2a2f361318ddbcab18055d13b08836f36d690eac55307c61134e15f03511ea6bf711288f10871aff9578be41e6b44 SHA512 d4bc9994966cc654f109596a65d450924bdfd84b2ad5c1ea21ab93f8861b313258e0c60edc0843eeeb7d0d975a2f64f76d784868f1ef301fbb7748fc1ce56b96
+DIST maturin-1.9.2-vendor.tar.xz 15642720 BLAKE2B 59ac8c7371fa576b4e8514cafa14badeb750052ea89e197c2149ba83bd7f08a7197d1b3d56c8c20c3295676fbf103eb8ee84f6dc47504c4d84a6d9e2ac47b935 SHA512 3d34a10ebfaa4a3ad34442d71f113651ef91c5a6bd46daaff60b73d9eff36b6091a50c25484cb883a8afbffb84180c051ff6b9f60c1f4455b10b54f211752540
+DIST maturin-1.9.2.gh.tar.gz 562400 BLAKE2B 1cb97591e611a17bff562010178c1424a6f47ebb0c28c5ef2758a68b03936e88fc4447f73c87f2ec699959bf26d803343e0ee3870cbc4ab6439ab8528a298ade SHA512 537f2cf1e44339dca6631408a57e3136e2c2a4f9c5de8fa0b3ee52798776d9cede2f5f8691fe0e23b4d055eb3070367585253bbc28bb24509ad06337be593030
+DIST maturin-1.9.3-vendor.tar.xz 15638528 BLAKE2B bde95efcdcf0bcd0e559df0753b402756c1b8fa354c9be0b927f9dc969adb6b0b186914c6f35fcc0d7a02919c28e882de6b4d779fd51037ae3d6e963b23a1f16 SHA512 a3441ea6fd36e9284f6f8229ba2e370f5f43130e7bc4437e21d6a1612fb07b0671f29d98c2092c848db5dc22e1072ce06ae75f33bdc6a59e9297273c1fedcaf4
+DIST maturin-1.9.3.gh.tar.gz 563145 BLAKE2B a9b303d9279f007ce86f51fb423787e53e8a86e9c0cfda03795d85c8e781eca8141258e2ce7eeb8c0841205f69005d14ded6641e631cab872d2337c5e7f9969c SHA512 9c0c2e428db725b2f6e3bd06b166e2bb3448018c8f3b2e3e85effc4294cb0b7f25918761ac2fce70b4e98890b3f3fbeb93db64f5e5de39886d009ba8bc62a707
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild
new file mode 100644
index 00000000000..0b54cdcc1fa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.2.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-arch/xz-utils
+	app-arch/zstd:=
+	ssl? ( dev-libs/openssl:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild
new file mode 100644
index 00000000000..0b54cdcc1fa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.9.3.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_UPSTREAM_PEP517=standalone
+PYTHON_COMPAT=( pypy3_11 python3_{11..14} )
+RUST_MIN_VER=1.75.0
+inherit cargo distutils-r1 flag-o-matic shell-completion toolchain-funcs
+
+DESCRIPTION="Build and publish crates with pyo3, rust-cpython and cffi bindings"
+HOMEPAGE="https://www.maturin.rs/"
+SRC_URI="
+	https://github.com/PyO3/maturin/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~ionen/distfiles/${P}-vendor.tar.xz
+"
+# ^ tarball also includes test-crates' Cargo.lock(s) crates for tests
+
+LICENSE="|| ( Apache-2.0 MIT ) doc? ( CC-BY-4.0 OFL-1.1 )"
+LICENSE+="
+	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD Boost-1.0 MIT
+	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+" # crates
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc +ssl test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-arch/xz-utils
+	app-arch/zstd:=
+	ssl? ( dev-libs/openssl:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( app-text/mdbook )
+	test? (
+		$(python_gen_cond_dep 'dev-python/cffi[${PYTHON_USEDEP}]' 'python*')
+		dev-python/boltons[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+		dev-vcs/git
+		elibc_musl? ( dev-util/patchelf )
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/${PN}"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# we build the Rust executable (just once) via cargo_src_compile
+	sed -i -e '/setuptools_rust/d' -e '/rust_extensions/d' setup.py || die
+
+	if use test; then
+		# used to prevent use of network during tests, and silence pip
+		# if it finds unrelated issues with system packages (bug #913613)
+		cat > "${T}"/pip.conf <<-EOF || die
+			[global]
+			quiet = 2
+
+			[install]
+			no-index = yes
+			no-dependencies = yes
+		EOF
+
+		# uv does not work easily w/ network-sandbox, force virtualenv
+		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
+
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
+		# used by *git_sdist_generator tests
+		git init -q || die
+		git config --global user.email "larry@gentoo.org" || die
+		git config --global user.name "Larry the Cow" || die
+		git add . || die
+		git commit -qm init || die
+	fi
+}
+
+src_configure() {
+	export OPENSSL_NO_VENDOR=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
+
+	# https://github.com/rust-lang/stacker/issues/79
+	use s390 && ! is-flagq '-march=*' &&
+		append-cflags $(test-flags-CC -march=z10)
+
+	local myfeatures=(
+		# like release.yml + native-tls for better platform support than rustls
+		full
+		password-storage
+		$(usev ssl native-tls)
+	)
+
+	cargo_src_configure --no-default-features
+}
+
+python_compile_all() {
+	cargo_src_compile
+
+	use !doc || mdbook build -d html guide || die
+
+	if ! tc-is-cross-compiler; then
+		local maturin=$(cargo_target_dir)/maturin
+		"${maturin}" completions bash > "${T}"/${PN} || die
+		"${maturin}" completions fish > "${T}"/${PN}.fish || die
+		"${maturin}" completions zsh > "${T}"/_${PN} || die
+	else
+		ewarn "shell completion files were skipped due to cross-compilation"
+	fi
+}
+
+python_test() {
+	local -x MATURIN_TEST_PYTHON=${EPYTHON}
+	local -x PIP_CONFIG_FILE=${T}/pip.conf
+	local -x VIRTUALENV_SYSTEM_SITE_PACKAGES=1
+
+	# need this for (new) python versions not yet recognized by pyo3
+	local -x PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
+
+	local skip=(
+		# picky cli output test that easily benignly fail (bug #937992)
+		--skip cli_tests
+		# avoid need for wasm over a single hello world test
+		--skip integration_wasm_hello_world
+		# fragile depending on rust version, also wants libpypy*-c.so for pypy
+		--skip pyo3_no_extension_module
+		# unimportant tests that require uv, and not obvious to get it
+		# to work with network-sandbox (not worth the trouble)
+		--skip develop_hello_world::case_2
+		--skip develop_pyo3_ffi_pure::case_2
+		# compliance test using zig requires an old libc to pass (bug #946967)
+		--skip integration_pyo3_mixed_py_subdir
+		# fails on sparc since rust-1.74 (bug #934573), skip for now given
+		# should not affect the pep517 backend which is all we need on sparc
+		$(usev sparc '--skip build_context::test::test_macosx_deployment_target')
+	)
+
+	cargo_src_test -- "${skip[@]}"
+}
+
+python_install_all() {
+	cargo_src_install
+
+	dodoc Changelog.md README.md
+	use doc && dodoc -r guide/html
+
+	if ! tc-is-cross-compiler; then
+		dobashcomp "${T}"/${PN}
+		dofishcomp "${T}"/${PN}.fish
+		dozshcomp "${T}"/_${PN}
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index 990a78cd9b1..7d4480bc210 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,3 +1,4 @@
 DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.15.tar.xz 151168812 BLAKE2B 465596c6dc053ff3a3966302a906d3edb4f7ee1ef82f8c20b96360196d3414f5b1deeafa67b8340fcdecd3617280ba9b756d7073ad15c707865e256397b4af53 SHA512 d03788ffa8d8ae1b84ef1286bb44a08fc01432e509dfec6cccae5c5a5a47201d378aec2bcd21e6f0bbd1e625b26f47780c06ee9c1cef3775358f98b160923f30
+DIST linux-6.16.tar.xz 152620004 BLAKE2B 87bc4da7e89cc8265aebffea7ec6c09f711be24fee87cb1c03a264c03fd5a538d66aa806640835aa5103926e612cdfbc52d7c861d7f7065f1a8bb11d893b0921 SHA512 55a00f89ad6db6db2e26ff5dc5cfc96bbf6654e5bd5d17d2a3b944a47640367e54139716d230923187bebc6cb7756edc9511a620fb8abc6f32c50a658a734784
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild
new file mode 100644
index 00000000000..7f0ba7a9ef0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.16.ebuild
@@ -0,0 +1,350 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {18..20} )
+PYTHON_COMPAT=( python3_{10..14} python3_{13,14}t)
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perfwiki.github.io/main/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl +python +slang systemtap tcmalloc unwind"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.34-r2
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	app-alternatives/yacc
+	app-alternatives/lex
+	sys-apps/which
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="
+	babeltrace? ( dev-util/babeltrace:0/1 )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}=
+			llvm-core/llvm:${LLVM_SLOT}=
+		')
+	)
+	caps? ( sys-libs/libcap )
+	capstone? ( dev-libs/capstone )
+	crypt? ( dev-libs/openssl:= )
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-debug/systemtap )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	app-arch/zstd:=
+	dev-libs/elfutils
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+	virtual/libcrypt
+"
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	local CONFIG_CHECK="
+		~!SCHED_OMIT_FRAME_POINTER
+		~DEBUG_INFO
+		~FRAME_POINTER
+		~FTRACE
+		~FTRACE_SYSCALLS
+		~FUNCTION_TRACER
+		~KALLSYMS
+		~KALLSYMS_ALL
+		~KPROBES
+		~KPROBE_EVENTS
+		~PERF_EVENTS
+		~STACKTRACE
+		~TRACEPOINTS
+		~UPROBES
+		~UPROBE_EVENTS
+	"
+
+	use bpf && llvm-r1_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT ~UNWINDER_FRAME_POINTER"
+	fi
+
+	linux-info_pkg_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
+		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
+		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
+		'tools/scripts/*'
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
+		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
+		eend $? || die "filterdiff failed"
+		test -s ${P}.patch || die "patch is empty?!"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	# Gentoo patches go here
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" 1; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+
+	# sync this with the whitelist in tools/perf/Makefile.config
+	local disable_libdw
+	if ! use amd64 && ! use x86 && \
+	   ! use arm && \
+	   ! use arm64 && \
+	   ! use ppc && ! use ppc64 \
+	   ! use s390 && \
+	   ! use riscv && \
+	   ! use loong
+	then
+		disable_libdw=1
+	fi
+
+	# perf directly invokes LD for linking without going through CC, on mips
+	# it is required to specify the emulation.  port of below buildroot patch
+	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
+	local linker="$(tc-getLD)"
+	if use mips
+	then
+		if use big-endian
+		then
+			use abi_mips_n64 && linker+=" -m elf64btsmip"
+			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32btsmip"
+		else
+			use abi_mips_n64 && linker+=" -m elf64ltsmip"
+			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32ltsmip"
+		fi
+	fi
+
+	# FIXME: NO_CORESIGHT
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
+		CLANG="${CHOST}-clang"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_CAPSTONE=$(puse capstone)
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=1
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
+		NO_LIBELF=
+		NO_LIBLLVM=$(puse bpf)
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_SDT=$(puse systemtap)
+		NO_SHELLCHECK=1
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		DEBUG=$(usex debug 1 "")
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
+		"$@"
+	)
+	emake "${emakeargs[@]}"
+}
+
+src_compile() {
+	filter-lto
+
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
index 7bed1e46c94..ee0d282ddb3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
@@ -1,2 +1,3 @@
 DIST pkgcheck-0.10.34.tar.gz 382566 BLAKE2B d91302f673326bf4756e06c2bad1ad89b10f14a08ac54a24a6a00d7a95d4313e5e1755393aefa55e1057a396483b023cc38e67902238e2620a76961feb8b2a81 SHA512 57ec0ccea00cde4187219f85d23f755878e2298f6219cb9b18eb35f927a685aac2d9b9c73045f6750f90959abb6313a1ed99dedaae4f0ec6b59f08585253a410
 DIST pkgcheck-0.10.36.tar.gz 383659 BLAKE2B 1129695650790409d338f0a885d305dd4713c7f5222ae812ea6381c004b4c28321929df963240cd2a27c5dd0db7dd96f1a2829fff72dc627cdbd1399c600bb4e SHA512 c6c87ccd2d63e558efd7613142b2ac6dcfe4b4ea55b0e78d4502760d508015158189debebe26579e0cb26447fc4529ccb779fa4462d78af75e1c216f8a85177b
+DIST pkgcheck-0.10.37.tar.gz 388402 BLAKE2B 8e93290da49ed9d8231550a7602300c93d16f2dc4be040f88690bf4cf996b51f8aac3cb26b2478345b10dfb1faddc185d6316810d5bac091fc5cae504ced459d SHA512 84c1717fad6a7f41dcc069dbdb68e73062606d7e0497286cba7255e415e8b317cb4aa396d9bc46f873712a65fa0e3cd95216df368ca73381f81c160308329f15
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch
new file mode 100644
index 00000000000..0e728e848ce
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/files/pkgcheck-0.10.36-ts0.25.patch
@@ -0,0 +1,66 @@
+Subject: [PATCH] bash: update support to tree-sitter~=0.25
+
+Also add backward compatible code for tree-sitter < 0.25.
+
+Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -6,7 +6,7 @@ requires = [
+ 	"lazy-object-proxy",
+ 	"lxml",
+ 	"pathspec",
+-	"tree-sitter~=0.24.0",
++	"tree-sitter~=0.25.0",
+ 	"tree-sitter-bash~=0.23.1",
+ 	"snakeoil~=0.10.11",
+ 	"pkgcore~=0.12.30",
+@@ -45,7 +45,7 @@ dependencies = [
+ 	"lazy-object-proxy",
+ 	"lxml",
+ 	"pathspec",
+-	"tree-sitter~=0.24.0",
++	"tree-sitter~=0.25.0",
+ 	"tree-sitter-bash~=0.23.1",
+ 	"snakeoil~=0.10.11",
+ 	"pkgcore~=0.12.30",
+--- a/src/pkgcheck/bash/__init__.py
++++ b/src/pkgcheck/bash/__init__.py
+@@ -6,7 +6,17 @@ import tree_sitter_bash
+ from tree_sitter import Language, Parser, Query
+
+ lang = Language(tree_sitter_bash.language())
+-query = lang.query
++
++try:
++    from tree_sitter import QueryCursor
++
++    def query(query_str: str) -> "QueryCursor":
++        return QueryCursor(Query(lang, query_str))
++except ImportError:  # tree-sitter < 0.25
++    QueryCursor = Query
++    query = lang.query
++
++
+ parser = Parser(language=lang)
+
+ # various parse tree queries
+@@ -29,14 +39,14 @@ class ParseTree:
+         """Return the ebuild string associated with a given parse tree node."""
+         return self.data[node.start_byte : node.end_byte].decode("utf8")
+
+-    def global_query(self, query: Query):
++    def global_query(self, query: QueryCursor):
+         """Run a given parse tree query returning only those nodes in global scope."""
+         for x in self.tree.root_node.children:
+             # skip nodes in function scope
+             if x.type != "function_definition":
+                 yield from chain.from_iterable(query.captures(x).values())
+
+-    def func_query(self, query: Query):
++    def func_query(self, query: QueryCursor):
+         """Run a given parse tree query returning only those nodes in function scope."""
+         for x in self.tree.root_node.children:
+             # only return nodes in function scope
+--
+2.50.1
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
index dedc375e9b1..ffa0bc88512 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.36-r1.ebuild
@@ -55,8 +55,13 @@ BDEPEND="${RDEPEND}
 	)
 "
 
+PATCHES=(
+	"${FILESDIR}"/${P}-ts0.25.patch
+)
+
 SITEFILE="50${PN}-gentoo.el"
 
+EPYTEST_PLUGINS=( pkgcore )
 distutils_enable_tests pytest
 
 export USE_SYSTEM_TREE_SITTER_BASH=1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild
new file mode 100644
index 00000000000..ac92e160714
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.37.ebuild
@@ -0,0 +1,102 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{11..14} )
+inherit elisp-common distutils-r1 optfeature
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/pkgcheck.git
+		https://github.com/pkgcore/pkgcheck.git"
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	inherit pypi
+fi
+
+DESCRIPTION="pkgcore-based QA utility for ebuild repos"
+HOMEPAGE="https://github.com/pkgcore/pkgcheck"
+
+LICENSE="BSD MIT"
+SLOT="0"
+IUSE="emacs"
+
+if [[ ${PV} == *9999 ]]; then
+	RDEPEND="
+		~dev-python/snakeoil-9999[${PYTHON_USEDEP}]
+		~sys-apps/pkgcore-9999[${PYTHON_USEDEP}]"
+else
+	RDEPEND="
+		>=dev-python/snakeoil-0.10.11[${PYTHON_USEDEP}]
+		>=sys-apps/pkgcore-0.12.30[${PYTHON_USEDEP}]"
+fi
+RDEPEND+="
+	app-arch/zstd
+	>=dev-libs/tree-sitter-bash-0.21.0[python,${PYTHON_USEDEP}]
+	dev-python/chardet[${PYTHON_USEDEP}]
+	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
+	dev-python/lxml[${PYTHON_USEDEP}]
+	dev-python/pathspec[${PYTHON_USEDEP}]
+	>=dev-python/tree-sitter-0.25.0[${PYTHON_USEDEP}]
+	emacs? (
+		>=app-editors/emacs-24.1:*
+		app-emacs/ebuild-mode
+		app-emacs/flycheck
+	)
+"
+BDEPEND="${RDEPEND}
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+EPYTEST_PLUGINS=( pkgcore )
+distutils_enable_tests pytest
+
+export USE_SYSTEM_TREE_SITTER_BASH=1
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# unpin dependencies
+	sed -i -e 's:~=:>=:' pyproject.toml || die
+}
+
+src_compile() {
+	distutils-r1_src_compile
+
+	if use emacs ; then
+	   pushd "${S}"/contrib/emacs >/dev/null || die
+	   elisp-compile *.el
+	   popd >/dev/null || die
+	fi
+}
+
+python_install_all() {
+	local DOCS=( NEWS.rst )
+	[[ ${PV} == *9999 ]] || doman build/sphinx/man/*
+	distutils-r1_python_install_all
+
+	if use emacs ; then
+		elisp-install ${PN} "${S}"/contrib/emacs/*.el{,c}
+		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
+	fi
+}
+
+pkg_postinst() {
+	use emacs && elisp-site-regen
+
+	optfeature "Network check support" dev-python/requests
+	optfeature "Perl module version check support" dev-perl/Gentoo-PerlMod-Version
+}
+
+pkg_postrm() {
+	use emacs && elisp-site-regen
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
index 8a8dae53dfc..ac92e160714 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-9999.ebuild
@@ -33,12 +33,13 @@ else
 		>=sys-apps/pkgcore-0.12.30[${PYTHON_USEDEP}]"
 fi
 RDEPEND+="
+	app-arch/zstd
 	>=dev-libs/tree-sitter-bash-0.21.0[python,${PYTHON_USEDEP}]
 	dev-python/chardet[${PYTHON_USEDEP}]
 	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
 	dev-python/lxml[${PYTHON_USEDEP}]
 	dev-python/pathspec[${PYTHON_USEDEP}]
-	>=dev-python/tree-sitter-0.23.0[${PYTHON_USEDEP}]
+	>=dev-python/tree-sitter-0.25.0[${PYTHON_USEDEP}]
 	emacs? (
 		>=app-editors/emacs-24.1:*
 		app-emacs/ebuild-mode
@@ -56,6 +57,7 @@ BDEPEND="${RDEPEND}
 
 SITEFILE="50${PN}-gentoo.el"
 
+EPYTEST_PLUGINS=( pkgcore )
 distutils_enable_tests pytest
 
 export USE_SYSTEM_TREE_SITTER_BASH=1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
index 6654342ab94..38d7f542b36 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.5.1.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/pkgconf/pkgconf"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
index ca61eeba127..b1164367d23 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/xdelta/xdelta-3.0.11-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2002-2022 Gentoo Authors
+# Copyright 2002-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -12,7 +12,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2"
 SLOT="3"
-KEYWORDS="~alpha amd64 ~arm64 ~hppa ~loong ppc ppc64 ~riscv sparc x86"
+KEYWORDS="~alpha amd64 arm64 ~hppa ~loong ppc ppc64 ~riscv sparc x86"
 IUSE="examples lzma"
 
 RDEPEND="lzma? ( app-arch/xz-utils:= )"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
index 49977c18795..975efd2d63c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/dist-kernel-utils.eclass
@@ -180,7 +180,14 @@ dist-kernel_reinstall_initramfs() {
 	local kernel_dir=${1:-${KV_DIR}}
 	local ver=${2:-${KV_FULL}}
 
+	# If this is set it will have an effect on the name of the output
+	# image. Set this variable to track this setting.
+	if grep -q "CONFIG_EFI_ZBOOT=y" "${kernel_dir}/.config"; then
+		KERNEL_EFI_ZBOOT=1
+	fi
+
 	local image_path=${kernel_dir}/$(dist-kernel_get_image_path)
+
 	if [[ ! -f ${image_path} ]]; then
 		eerror "Kernel install missing, image not found:"
 		eerror "  ${image_path}"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 7b025261eb2..e9826f4cf3d 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -292,7 +292,7 @@ _distutils_set_globals() {
 			;;
 		scikit-build-core)
 			bdep+='
-				>=dev-python/scikit-build-core-0.10.7[${PYTHON_USEDEP}]
+				>=dev-python/scikit-build-core-0.11.5[${PYTHON_USEDEP}]
 			'
 			;;
 		setuptools)
@@ -554,6 +554,9 @@ distutils_enable_tests() {
 			;&
 		pytest)
 			test_pkgs+=' >=dev-python/pytest-7.4.4[${PYTHON_USEDEP}]'
+			if [[ -n ${EPYTEST_RERUNS} ]]; then
+				test_pkgs+=' dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]'
+			fi
 			if [[ -n ${EPYTEST_TIMEOUT} ]]; then
 				test_pkgs+=' dev-python/pytest-timeout[${PYTHON_USEDEP}]'
 			fi
@@ -1142,9 +1145,9 @@ distutils_pep517_install() {
 					ninjaopts = shlex.split(os.environ["NINJAOPTS"])
 					print(json.dumps({
 						"build.tool-args": ninjaopts,
+						"build.verbose": True,
 						"cmake.args": ";".join(sys.argv[1:]),
 						"cmake.build-type": "${CMAKE_BUILD_TYPE}",
-						"cmake.verbose": True,
 						"install.strip": False,
 					}))
 				EOF
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index 9cdfdc87019..13ed8750120 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -1354,6 +1354,16 @@ _set_epytest_plugins() {
 	fi
 }
 
+# @ECLASS_VARIABLE: EPYTEST_RERUNS
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# If set to a non-empty value, enables pytest-rerunfailures plugin
+# and sets rerun count to the specified value.  This variable can be
+# either set in ebuilds with flaky tests, or by user to try if it helps.
+# If this variable is set prior to calling distutils_enable_tests
+# in distutils-r1, a test dependency on dev-python/pytest-rerunfailures
+# is added automatically.
+
 # @ECLASS_VARIABLE: EPYTEST_TIMEOUT
 # @DEFAULT_UNSET
 # @DESCRIPTION:
@@ -1517,6 +1527,18 @@ epytest() {
 		)
 	fi
 
+	if [[ -n ${EPYTEST_RERUNS} ]]; then
+		if [[ ${PYTEST_PLUGINS} != *pytest_rerunfailures* ]]; then
+			args+=(
+				-p rerunfailures
+			)
+		fi
+
+		args+=(
+			"--reruns=${EPYTEST_RERUNS}"
+		)
+	fi
+
 	if [[ -n ${EPYTEST_TIMEOUT} ]]; then
 		if [[ ${PYTEST_PLUGINS} != *pytest_timeout* ]]; then
 			args+=(
diff --git a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
index 183d5cd4efa..3c9693e00f5 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
@@ -68,6 +68,7 @@ fi
 # Definitive list of Rust slots and the associated LLVM slot, newest first.
 declare -A -g -r _RUST_LLVM_MAP=(
 	["9999"]=20
+	["1.89.0"]=20
 	["1.88.0"]=20
 	["1.87.0"]=20
 	["1.86.0"]=19
@@ -95,6 +96,7 @@ declare -A -g -r _RUST_LLVM_MAP=(
 # this array is used to store the Rust slots in a more convenient order for iteration.
 declare -a -g -r _RUST_SLOTS_ORDERED=(
 	"9999"
+	"1.89.0"
 	"1.88.0"
 	"1.87.0"
 	"1.86.0"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
index eff6db31062..4b4d5334670 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/sgml-catalog-r1.eclass
@@ -1,4 +1,4 @@
-# Copyright 2019-2023 Gentoo Authors
+# Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: sgml-catalog-r1.eclass
@@ -6,14 +6,14 @@
 # Michał Górny <mgorny@gentoo.org>
 # @AUTHOR:
 # Michał Górny <mgorny@gentoo.org>
-# @SUPPORTED_EAPIS: 7
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: Functions for installing SGML catalogs
 # @DESCRIPTION:
 # This eclass regenerates /etc/sgml/catalog as necessary for the DocBook
 # tooling. This is done via exported pkg_postinst and pkg_postrm phases.
 
 case ${EAPI} in
-	7) ;;
+	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 274789559d5..efa78f61367 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -1199,6 +1199,8 @@ toolchain_setup_d() {
 toolchain_src_configure() {
 	BUILD_CONFIG_TARGETS=()
 	is-flagq '-O3' && BUILD_CONFIG_TARGETS+=( bootstrap-O3 )
+	is-flagq '-fsanitize=address' && BUILD_CONFIG_TARGETS+=( bootstrap-asan )
+	is-flagq '-fsanitize=undefined' && BUILD_CONFIG_TARGETS+=( bootstrap-ubsan )
 
 	downgrade_arch_flags
 	gcc_do_filter_flags
@@ -2178,7 +2180,7 @@ gcc_do_filter_flags() {
 	fi
 
 	if ver_test -lt 16.1 ; then
-		filter-flags -fdiagnostics-details
+		filter-flags '-fdiagnostics-show-context=*'
 	fi
 
 	# Ada: PR116226
diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
index c99936a12cb..4079e1b4c9c 100644
--- a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.50-r1.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="libpng2"
 SLOT="0/16"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="apng cpu_flags_x86_sse static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
index ae799017076..1c4fc567ffb 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
@@ -1,6 +1,8 @@
 DIST bind-9.18.29.tar.xz 5562720 BLAKE2B f3e7de6936362bcce4993e401ed8fdd9d597459e82ad908a918fff1da619f91ef4896595ea210b43f2b492d763d7be2b71105495858da55431b60874c7fd2312 SHA512 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
 DIST bind-9.18.31.tar.xz 5385812 BLAKE2B e069ab3caab887a87220b54804e5b19a4c21b8d3e4e8f1bc6a7135b3990a228d6c48b1ca4a22c75242485275eff1de145a9aff89addf81124e7dfcafd8ab30cf SHA512 e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
 DIST bind-9.18.37.tar.xz 5358128 BLAKE2B 59753a594e1e8249b9104377260701a9453eeecb6a233a94a33c6a134a6368c5c0b9473c4e08d956d0746a331dc7b121550f5e426a521d6c8d0441d9164f0547 SHA512 9789cb3fa7739cc7e1b137d1642861d9517adc4391e2f8c526bfa271e13f7489794ed20cb5f64c26e432d7b79cfe7aa1f7d59c476fd2749bc2dccfb85c514943
+DIST bind-9.18.38.tar.xz 5362772 BLAKE2B 04a7eeba174dc0333f5f4f3a0767ac66a0f81665dc26dc5a88434ab1c1c12fdd2deaee91b62f77001a92283d40942a0487f6d314b465d9dac6c817d4f78166d4 SHA512 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
 DIST bind-9.20.10.tar.xz 5677276 BLAKE2B e5a7824ff5b901be447a2f4f067aa8b3345eb8187ed86f3bf6bc623e2b6c812722667eefd1f915026dab078846011e222336a30c4da640c4e54aa828398b180d SHA512 2d4510e2e73aed94424b065b9371a1422f1b53ec8c01b281fdc78f90401dcd229b7095a175bb4f4d44b07d81e5edbee78bbfb1bf31b981e26fe1ea6df53d415d
+DIST bind-9.20.11.tar.xz 5674856 BLAKE2B 582e6de2699713e870dfc853f461c78b2d2b505bed0b571f853c94a731be9006783f45a4f897692289c1a9411725eac0b4de3818f1641221e62754316f410081 SHA512 bacc19eaf37133d37202db521e2c6727fc4e494562caad68e7c22e8dad84411684ba2c7430aa3bb2d916b9078c3aab8277d35e0f9b1f9893b89071de7ad7eee4
 DIST bind-9.20.7.tar.xz 5655168 BLAKE2B c5198939382e7295b4dfcb2ddbd86e5bccc10047d5e963dab2381404eb7a14543218e3caa438b395a2982cb607da84012f3a76a41c790a48ed615238bc080b5c SHA512 b9570c0c6588819108017d30dc7fb5e2f34361f941186d29da3d2830bbe3333c8c16bdb6581f5bec4786d90b74db860a9cad5f66d4f1c65168eae69f401a9df0
 DIST bind-9.20.9.tar.xz 5668452 BLAKE2B 40a1428d2da9d92b3604f04234b2ff44701abcf2ea22883caea7fb4ee157547125fd68accb8fe10853ff64cd5018fa89e36eeb53021fa3ee9bc056e05ac228d6 SHA512 78efb4c4a5d78bd04efe222982efa1d6bb6748965e40d816d9e4329d6f2687a43d1e439bc3f98c00c85abaf8fc435063bcbe2d96a61b252fe3df0a8affa19f8f
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
index bbf5a130a51..eb7820cebb1 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.37-r1.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild
new file mode 100644
index 00000000000..d5fe3e00d7d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.18.38.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild
new file mode 100644
index 00000000000..0c8dc469f9f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.20.11.ebuild
@@ -0,0 +1,287 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemtap test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	sys-libs/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+	systemtap? (
+		dev-debug/systemtap
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
index e017318e002..6e1308a4f6e 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.10.ebuild
@@ -17,7 +17,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
index e01979662a9..71e07d9d6ef 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.14.1.ebuild
@@ -22,7 +22,7 @@ else
 		S="${WORKDIR}/${P//_/-}"
 	else
 		CURL_URI="https://curl.se/download/"
-		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 	SRC_URI="
 		${CURL_URI}${P//_/-}.tar.xz
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
index cda2049c198..e2a566d9c91 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
@@ -1,4 +1,5 @@
 DIST iperf-2.0.13.tar.gz 326148 BLAKE2B 2a40aea9e2d7fdc935b91be5e4e586bf68dd27604375d2570570145e5db1ea5837469a4989f47586986932bef33cba05ed19ed3a9ce40c0a5531581c6d3ba982 SHA512 40fcfb8f4d27887f53a743ac07396511fb2a7ac59f4b300fe36896bd0241e191945fa253705990711772ee776d5e4227ed62760fc92abebdfebcedd11c27c0ea
-DIST iperf-3.17.1.tar.gz 670547 BLAKE2B 90afa47ba2de2f789b118ea42d7eabe3a7ec202116d51915b05350932231788a95ae142bdf2cff041f5504e67ae5ac1da2c66f408bc302c4e230ef4b7e496e15 SHA512 99c731e2e060d2b241d3137742bf92a975f2b7a94c6c723c9c1625f69c294fd7fe15b7dbf085a6120038fc1dd7628c83d2c7d16b059849fdbecbc88e48fb0974
+DIST iperf-2.2.1.tar.gz 509514 BLAKE2B 9075df9513e98beeaed5c2f6799f62f72fbfd8fc63696674018b7435dae87d5edeca3fb0541775c37c188bd61bd8394c3125a8a8c07e0c4ba1c2efa86a602404 SHA512 07a08afe647e87939e05c9cd55601ca1227c91f44ef32fdf305a0e15e524d1de29d38e9a3f66253d7308585224e54db395d7dec654d31eea746f45c6947ebc2a
 DIST iperf-3.18.tar.gz 688037 BLAKE2B 64272ab8288cb217603d4fa438bc547967baa964bc518c91f9f1f1c85d9a0a9a7ca5b4c558b3e2c68507c1cb76b40592fd9a80f0bb4cc8a1716e029b32289276 SHA512 a458292c34c29a60cce60eb6be4afd15220d4cf29f225a1c1be9ec8ef86baa85fa4e174e747cacfa5711c6957ad16d448c2d3d4029b6bfd58db9c39269f30caa
+DIST iperf-3.19.1.tar.gz 698445 BLAKE2B fae065d3e8131c072bd70666c87067c85b2ea56fcee70197bea1d5b82266b1d2f4dbb9318b566fdd4add08776dadb1feebe9915108531d3af9e13a777e2b60e7 SHA512 7239eddf55197c45aa751d05b6518a0782ec4f2ce4d9b4246b74c41dc21077102f3f5cc3359129c32c6842d482f4a9557a92ab84d96e0a9c7063052c9cbed4f6
 DIST iperf-3.19.tar.gz 694741 BLAKE2B b6f5e9bdef5ee3fc38bef893144bc6ad003ccbc7b3db4793dbd2aec5998faa55cac215a0db06ab37729dc1c05787ebacbf09db8a6e6517f82492a6c67ec3d9e6 SHA512 f0631cd1158a90dc402fa30563e6f26dbdbc5d5b0665bed25248f9153118f55296913abeb89bf0b1db760ca2c68f60e0c9cf2df82aa096318ca618ca09176388
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch b/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch
deleted file mode 100644
index 856403ca6b6..00000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.17.1-Unbundle-cJSON.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-Date: Tue, 30 Jul 2024 21:11:48 +0300
-Subject: [PATCH] Unbundle cJSON
-
-Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org>
---- a/configure.ac
-+++ b/configure.ac
-@@ -61,6 +61,8 @@ AC_ARG_ENABLE([profiling],
-     AS_HELP_STRING([--enable-profiling], [Enable iperf3 profiling binary]))
- AM_CONDITIONAL([ENABLE_PROFILING], [test x$enable_profiling = xyes])
- 
-+PKG_CHECK_MODULES([libcjson], [libcjson >= 1.7.15])
-+
- # Check for the math library (needed by cjson on some platforms)
- AC_SEARCH_LIBS(floor, [m], [], [
- echo "floor()"
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -10,8 +10,6 @@ include_HEADERS         = iperf_api.h                                   # Define
- 
- # Specify the source files and flags for the iperf library
- libiperf_la_SOURCES     = \
--                        cjson.c \
--                        cjson.h \
-                         flowlabel.h \
-                         iperf.h \
-                         iperf_api.c \
-@@ -46,10 +44,13 @@ libiperf_la_SOURCES     = \
-                         units.c \
-                         units.h \
-                         version.h
-+libiperf_la_CPPFLAGS    = $(CPPFLAGS) @libcjson_CFLAGS@
-+libiperf_la_LIBADD      = @libcjson_LIBS@
- 
- # Specify the sources and various flags for the iperf binary
- iperf3_SOURCES          = main.c
--iperf3_LDADD            = libiperf.la
-+iperf3_CPPFLAGS         = $(CPPFLAGS) @libcjson_CFLAGS@
-+iperf3_LDADD            = libiperf.la @libcjson_LIBS@
- 
- if ENABLE_PROFILING
- # If the iperf-profiled-binary is enabled
---- a/src/iperf.h
-+++ b/src/iperf.h
-@@ -52,7 +52,7 @@
- 
- #include "timer.h"
- #include "queue.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "iperf_time.h"
- #include "portable_endian.h"
- 
---- a/src/iperf_api.c
-+++ b/src/iperf_api.c
-@@ -79,7 +79,7 @@
- #endif /* HAVE_SCTP_H */
- #include "timer.h"
- 
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "units.h"
- #include "iperf_util.h"
- #include "iperf_locale.h"
---- a/src/iperf_tcp.c
-+++ b/src/iperf_tcp.c
-@@ -42,7 +42,7 @@
- #include "iperf_api.h"
- #include "iperf_tcp.h"
- #include "net.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- 
- #if defined(HAVE_FLOWLABEL)
- #include "flowlabel.h"
---- a/src/iperf_udp.c
-+++ b/src/iperf_udp.c
-@@ -45,7 +45,7 @@
- #include "iperf_udp.h"
- #include "timer.h"
- #include "net.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- 
- /* iperf_udp_recv
-  *
---- a/src/iperf_util.c
-+++ b/src/iperf_util.c
-@@ -46,7 +46,7 @@
- #include <errno.h>
- #include <fcntl.h>
- 
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include "iperf.h"
- #include "iperf_api.h"
- 
---- a/src/iperf_util.h
-+++ b/src/iperf_util.h
-@@ -28,7 +28,7 @@
- #define __IPERF_UTIL_H
- 
- #include "iperf_config.h"
--#include "cjson.h"
-+#include <cjson/cJSON.h>
- #include <sys/select.h>
- #include <stddef.h>
- 
--- 
-2.45.2
-
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild
new file mode 100644
index 00000000000..ea2912d4485
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.2.1.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="Tool to measure IP bandwidth using UDP or TCP"
+HOMEPAGE="https://sourceforge.net/projects/iperf2/"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+	inherit git-r3
+else
+	SRC_URI="https://downloads.sourceforge.net/iperf2/${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
+
+LICENSE="HPND"
+SLOT="2"
+IUSE="debug"
+# Fails w/ connection refused to just-spawned daemon
+RESTRICT="test"
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable debug debuginfo)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake AR="$(tc-getAR)"
+}
+
+src_install() {
+	default
+
+	dodoc doc/*
+	newinitd "${FILESDIR}"/${PN}.initd-r1 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
index cd4130c2772..ea2912d4485 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-2.9999.ebuild
@@ -1,25 +1,34 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-inherit git-r3 toolchain-funcs
+inherit toolchain-funcs
 
 DESCRIPTION="Tool to measure IP bandwidth using UDP or TCP"
 HOMEPAGE="https://sourceforge.net/projects/iperf2/"
-EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="https://git.code.sf.net/p/iperf2/code"
+	inherit git-r3
+else
+	SRC_URI="https://downloads.sourceforge.net/iperf2/${P}.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+fi
 
 LICENSE="HPND"
 SLOT="2"
-IUSE="ipv6 threads debug"
-
-DOCS=( INSTALL README )
+IUSE="debug"
+# Fails w/ connection refused to just-spawned daemon
+RESTRICT="test"
 
 src_configure() {
-	econf \
-		$(use_enable debug debuginfo) \
-		$(use_enable ipv6) \
-		$(use_enable threads)
+	local myeconfargs=(
+		$(use_enable debug debuginfo)
+	)
+
+	econf "${myeconfargs[@]}"
 }
 
 src_compile() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
similarity index 62%
rename from sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
index 25afe469008..fa59959a784 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.17.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.19.1.ebuild
@@ -1,17 +1,17 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 inherit autotools systemd
 
-DESCRIPTION="A TCP, UDP, and SCTP network bandwidth measurement tool"
-HOMEPAGE="https://github.com/esnet/iperf"
-SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
+DESCRIPTION="TCP, UDP, and SCTP network bandwidth measurement tool"
+HOMEPAGE="https://software.es.net/iperf/ https://github.com/esnet/iperf"
+SRC_URI="https://github.com/esnet/${PN}/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="sctp"
 
 DEPEND="
@@ -26,8 +26,7 @@ DOCS=( README.md RELNOTES.md )
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-3.10.1-drop-forced-debugging-symbols.patch
-	"${FILESDIR}"/${PN}-3.17.1-Unbundle-cJSON.patch
-	"${FILESDIR}"/${PN}-3.17.1-c23.patch
+	"${FILESDIR}"/${PN}-3.18-unbundle-cJSON.patch
 )
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
index e966dec4de3..6952d36b034 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/metadata.xml
@@ -12,6 +12,6 @@
 	<upstream>
 		<remote-id type="cpe">cpe:/a:iperf_project:iperf</remote-id>
 		<remote-id type="github">esnet/iperf</remote-id>
-		<remote-id type="sourceforge">iperf</remote-id>
+		<remote-id type="sourceforge">iperf2</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
index 83b0903cfd3..f6ac967b64e 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/Manifest
@@ -1,2 +1,2 @@
-DIST rpcbind-1.2.6.tar.bz2 124590 BLAKE2B bb0e9f81e4747f8a732c9e25af561e79f2b6cd1c1955db586833871901b6da73f4b7ef32149a81b75daa81359b9c0554726670460b28857042dd66a2f861cac2 SHA512 fb89c61be4c533fe2e6057749d97079a2d1c9fac0d35d6be1a159a0edbf86092b3fc121f19fa920e75aac5ecdd3f59f5978e6401d5cad16cd438c977736206a7
 DIST rpcbind-1.2.7.tar.bz2 125792 BLAKE2B f1e79b304ce5fe06c1c256d3512d999daffca782d956440f612b8a957ad7ddb35356b47aa4f4105d5b24d820daab32ec3a0f4a3b8ac76bb7adf5c3ed22d2ef01 SHA512 ca1517bdab86221d13c645042cc31b25b4d2b574d63ebaa20da4f5392b611cf58811f267214293e953f504d364e5daaa5875eab7aa68a04b89e68fd5508e3926
+DIST rpcbind-1.2.8.tar.bz2 129079 BLAKE2B 70bef658aafc4b1b626a7e9ff312b34748e0142a0a93d058c28d6599545281464f27a5546abe287f0dd369e5264cb38940f85e5e6c128cb0e0f7aaa4b841ab77 SHA512 66f3955a67c4d0142ec635614ceafbc9bdbea985f2edaeec903f17efaf3c2e98f6483e8e6b7f1358cf8d2c1c877b281d153a3bf1b6748b6d259ae7ad1465ee71
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
index ab1dff1e44c..dd695f57edd 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.7.ebuild
@@ -16,7 +16,8 @@ else
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
similarity index 76%
rename from sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild
rename to sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
index 6429cb9bb47..a553446a231 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-1.2.8.ebuild
@@ -1,33 +1,37 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit systemd
 
+DESCRIPTION="portmap replacement which supports RPC over various protocols"
+HOMEPAGE="https://sourceforge.net/projects/rpcbind/"
+
 if [[ ${PV} == "9999" ]] ; then
 	EGIT_REPO_URI="git://linux-nfs.org/~steved/rpcbind.git"
 	inherit autotools git-r3
 else
 	SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-DESCRIPTION="portmap replacement which supports RPC over various protocols"
-HOMEPAGE="https://sourceforge.net/projects/rpcbind/"
-
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"
 
-DEPEND=">=net-libs/libtirpc-0.2.3:=
+DEPEND="
+	>=net-libs/libtirpc-0.2.3:=
 	systemd? ( sys-apps/systemd:= )
-	tcpd? ( sys-apps/tcp-wrappers )"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-rpcbind )"
-BDEPEND="
-	virtual/pkgconfig"
+	tcpd? ( sys-apps/tcp-wrappers )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-rpcbind )
+"
+BDEPEND="virtual/pkgconfig"
 
 src_prepare() {
 	default
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
index dae4c2ee6ab..a553446a231 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/rpcbind/rpcbind-9999.ebuild
@@ -16,7 +16,8 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-LICENSE="BSD"
+# GPL-2 for init script (bug #426104)
+LICENSE="BSD GPL-2"
 SLOT="0"
 IUSE="debug remotecalls selinux systemd tcpd warmstarts"
 REQUIRED_USE="systemd? ( warmstarts )"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index ec68d39a856..8850b3a4b83 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ian Jordan <immoloism@gmail.com> (2025-07-28)
+# Needs app-text/ronn-ng, which is not keyworded here
+app-accessibility/espeakup man
+
 # Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-07-15)
 # Needs gui-apps/grim, which is not keyworded here
 x11-misc/xscreensaver wayland
@@ -343,10 +347,6 @@ dev-util/ragel doc
 # Dependency not keyworded on this arch.
 app-text/enchant voikko
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-11-12)
-# media-sound/lash not keyworded, bug #736725
-media-sound/fluidsynth lash
-
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not keyworded.
 media-libs/libsdl2 fcitx
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index c82d58878ff..0131842955f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# x86-64 supports sframe
+>=sys-libs/glibc-2.42 -sframe
+
 # Alfred Wingate <parona@protonmail.com> (2025-05-22)
 # Upstream supports amd64
 media-libs/svt-av1 -test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 19800aa16e8..93403e9f53d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -183,7 +183,6 @@ app-metrics/ceph_exporter
 # Michał Górny <mgorny@gentoo.org> (2018-04-15)
 # Broken multilib dependencies.
 net-im/mattermost-desktop-bin
-net-im/skypeforlinux
 net-im/slack
 
 # Pawel Hajdan jr <phajdan.jr@gentoo.org> (2012-10-07)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 7e68b737ca2..1b28df7624d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-07-15)
 # Needs gui-apps/grim, which is not keyworded here
 x11-misc/xscreensaver wayland
@@ -339,10 +343,6 @@ dev-ruby/capybara test
 # pre-built, no ARM support
 net-wireless/gr-osmosdr sdrplay
 
-# Markus Meier <maekke@gentoo.org> (2018-05-30)
-# unkeyworded deps for bug #621434
-net-analyzer/zmap mongo
-
 # Michał Górny <mgorny@gentoo.org> (2018-04-15)
 # Unkeyworded dep masks moved from default/linux.
 net-libs/gnutls test-full
@@ -395,10 +395,6 @@ dev-db/mariadb -jdbc
 # does not build on arm at all (upstream bug)
 dev-scheme/racket futures jit
 
-# Ian Whyman <thev00d00@gentoo.org> (2016-05-22)
-# RPI support on arm
-dev-libs/libcec -raspberry-pi
-
 # Thomas Deutschmann <whissi@gentoo.org> (2016-03-19)
 # Unkeyworded deps, bug #564274
 app-metrics/collectd collectd_plugins_ipmi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
deleted file mode 100644
index 0d2aaf8a10e..00000000000
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright 2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-03-31)
-# gcc-14 fails to build (no idea about gcc-15 but upstream says
-# 14/15 regression)
-# https://bugs.gentoo.org/948045
-# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118891
->=sys-devel/gcc-14
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index d06de452a00..59f245e2a11 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# aarch64 supports sframe
+>=sys-libs/glibc-2.42 -sframe
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-08-01)
+# dev-qt/qtlanguageserver:6 is keyworded here
+dev-qt/qtdeclarative:6 -qmlls
+dev-qt/qttools:6 -qmlls
+dev-python/pyside -tools
+
 # Alfred Wingate <parona@protonmail.com> (2025-06-10)
 # Upstream supports arm64
 media-libs/svt-av1 -test
@@ -529,10 +539,6 @@ net-voip/mumble g15
 # media-libs/libemf fails with #error unknown CPU.
 media-gfx/pstoedit emf
 
-# Alexis Ballier <aballier@gentoo.org> (2017-07-10)
-# openvz-sources are likely too old for any proper arm64 usage
-app-emulation/libvirt openvz
-
 # Alexis Ballier <aballier@gentoo.org> (2017-06-21)
 # net-fs/openafs-kernel does not recognize arm64 properly
 # Need to check if this has a chance to work with in-kernel drivers
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 202d53f6252..4cbc9b5d1d6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -231,9 +231,6 @@ app-laptop/pbbuttonsd macbook
 # www-servers/nginx requires keywording
 www-servers/nginx nginx_modules_http_security
 
-# media-libs/libxmp requires keywording
-media-sound/qmmp xmp
-
 # Kai-Chun Ning <kaichun.ning@gmail.com> (2022-05-23)
 # Need intel-hybrid-codec-driver, which only works on amd64
 media-libs/libva-intel-driver hybrid
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index dcc76e12668..b640fee7c56 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -287,7 +287,7 @@ sys-libs/libcap tools
 # Michał Górny <mgorny@gentoo.org> (2021-07-25)
 # PyQt5 and wxpython are not keyworded.
 dev-python/ipython qt5 qt6
-dev-python/matplotlib qt5 qt6 wxwidgets
+dev-python/matplotlib qt6 wxwidgets
 
 # Matt Turner <mattst88@gentoo.org> (2021-07-23)
 # gui-libs/gtk is not keyworded
@@ -320,10 +320,6 @@ sys-apps/groff uchardet
 # Dependency not keyworded on this arch.
 app-text/enchant voikko
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-11-12)
-# media-sound/lash not keyworded, bug #736725
-media-sound/fluidsynth lash
-
 # Joonas Niilola <juippis@gentoo.org> (2020-10-08)
 # Dependency not keyworded on this arch.
 dev-libs/efl avif lua_single_target_luajit physics
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index 4c99f634460..694d7349f0c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Alfredo Tupone <tupone@gentoo.org> (2025-07-02)
 # sci-ml/pytorch is not keyworded here
 sci-ml/huggingface_hub test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
index 68edf904aff..ae12620d946 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
@@ -59,12 +59,6 @@ x11-wm/mutter screencast
 # Non-stable dependency.  Used to be masked completely.
 media-sound/abcde replaygain
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2018-06-20)
-# dev-python/pyqt5 is not stable.
-dev-python/matplotlib qt5 qt6 test
-net-print/hplip qt5
-dev-python/pyudev qt5
-
 # David Seifert <soap@gentoo.org> (2017-09-23)
 # MPI does not have stable keywords on ppc/ppc64
 sci-libs/fftw mpi
@@ -84,7 +78,6 @@ media-plugins/frei0r-plugins facedetect
 
 # Michael Palimaka <kensington@gentoo.org> (2016-05-25)
 # Dependencies not stable
-app-arch/p7zip kde
 dev-vcs/subversion kwallet
 x11-misc/xscreensaver new-login
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 5b58a22601a..4bb5178356d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,15 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-31)
+# dev-python/pyqt5, dev-python/pyqt6 are not stable.
+dev-python/matplotlib qt6 test
+net-print/hplip qt5
+
 # Hans de Graaff <graaff@gentoo.org> (2025-06-29)
 # Requires large parts of dev-ruby/rails to be keyworded.
 dev-ruby/globalid test
 dev-ruby/minitest-hooks test
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Sam James <sam@gentoo.org> (2025-05-16)
 # gpio: dev-libs/libgpiod not keyworded here
 # modbus: dev-libs/libmodbus not keyworded here
@@ -137,7 +138,7 @@ llvm-core/clang extra
 # Nowa Ammerlaan <nowa@gentoo.org> (2022-09-23)
 # The corresponding Qt5 modules are not keyworded on ppc, and we don't want to
 # keyword them solely because of PyQt5 while there are no other in-tree users.
-dev-python/pyqt5 bluetooth location speech
+dev-python/pyqt5 speech
 
 # Arthur Zamarin <arthurzam@gentoo.org> (2022-08-15)
 # deps not keyworded
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index ca9699a9db8..42cfb07e310 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,10 +1,6 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Sam James <sam@gentoo.org> (2025-06-05)
 # dev-util/spirv-llvm-translator not keyworded here
 dev-libs/pocl spirv
@@ -216,12 +212,6 @@ net-analyzer/snort open-appid
 # Incomplete support, bug #605878.
 net-vpn/tor seccomp
 
-# Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2016-08-01)
-# kde-frameworks/*:5 not keyworded.
-net-irc/kvirc kde
-app-arch/p7zip kde
-dev-vcs/subversion kwallet
-
 # Jeroen Roovers <jer@gentoo.org> (2015-12-26)
 # Mask until >sys-cluster/ceph-0.94 goes stable
 net-analyzer/rrdtool rados
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
index 17d3058453f..695f75e84f2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
@@ -71,11 +71,6 @@ dev-ruby/kramdown unicode
 # app-emacs/flycheck is not marked stable here yet
 dev-util/pkgcheck emacs
 
-# Nowa Ammerlaan <nowa@gentoo.org> (2022-09-23)
-# The corresponding Qt5 modules are not stable keyworded on ppc64, and we don't want to
-# keyword them solely because of PyQt5 while there are no other in-tree users.
-dev-python/pyqt5 bluetooth
-
 # Sam James <sam@gentoo.org> (2022-03-07)
 # sys-cluster/torque not marked stable on ppc64
 sys-cluster/openmpi openmpi_rm_pbs
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index 744b729ab8b..4f258d6fda5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2019-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
 # Broken bundled Eigen, fails to compile. See bug #865191.
 sci-geosciences/grass pdal
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 0d59b7e535a..368765dfb68 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -7,7 +7,7 @@ x11-misc/xscreensaver wayland
 
 # Christopher Byrne <salah.coronya@gmail.com> (2025-06-13)
 # dev-ml/findlib is not keyworkded here
-sys-libs/libnbd test
+sys-libs/libnbd ocaml
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-06-13)
 # dev-libs/libwacom is not keyworded here
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 4f2f3d586de..d9e765cf93d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,15 +1,19 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2025-07-31)
+# mongodb not keyworded here
+sci-libs/gdal mongodb
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-26)
+# kde-apps/kamoso not keyworded yet, bug #946343
+>=kde-apps/kdemultimedia-meta-25.04.2-r1 gstreamer
+
 # Robin H. Johnson <robbat2@gentoo.org> (2025-07-04)
 # Deeper test dependencies with Ruby 3.3 are no longer yet keyworded keyword;
 # manually tested instead; Test dependencies work with stable Ruby 3.2.
 dev-ruby/facter test
 
-# Mike Gilbert <floppym@gentoo.org> (2025-06-18)
-# media-libs/libsdl3 is missing keywords.
->=net-misc/freerdp-3.16.0 sdl
-
 # Paul Zander <negril.nx+gentoo@gmail.com> (2025-05-02)
 # dev-python/nanobind is not keyworded here
 media-gfx/openvdb python
@@ -86,7 +90,6 @@ games-emulation/rmg -dynarec
 # We only want to support spirv-llvm-translator >= 17 on x86, which is a
 # dependency of mesa.
 >=media-libs/mesa-24.1 llvm_slot_15 llvm_slot_16
->=dev-util/intel_clc-24.1 llvm_slot_16
 
 # Michael Orlitzky <mjo@gentoo.org> (2024-07-09)
 # The opcache extension fails to build on hardened x86, but only
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 2d1b08f7dde..7badc70693e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -41,7 +41,11 @@ app-emulation/qemu X
 
 # Ionen Wolkens <ionen@gentoo.org> (2025-04-21)
 # Currently fails to build without, and Valve would likely not be
-# interested in a bug. May leave forced depending on how this goes.
+# interested in a bug. Even if this gets fixed, not sure if want
+# to unforce because of this lack of upstream support outside
+# normal Steam+Proton usage with matching build options, we try
+# to only allow a configuration similar to upstream's to minimize
+# issues (but feel free to unforce at your own risks).
 app-emulation/wine-proton mingw
 
 # Sebastian Pipping <sping@gentoo.org> (2025-03-27)
@@ -78,6 +82,8 @@ llvm-runtimes/libcxxabi clang
 #    echo "dev-lang/rust:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 #    echo "dev-lang/rust-bin:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 # done
+dev-lang/rust:1.89.0 llvm_slot_20
+dev-lang/rust-bin:1.89.0 llvm_slot_20
 dev-lang/rust:1.88.0 llvm_slot_20
 dev-lang/rust-bin:1.88.0 llvm_slot_20
 dev-lang/rust:1.87.0 llvm_slot_20
@@ -112,8 +118,6 @@ dev-lang/rust:1.75.0 llvm_slot_17
 dev-lang/rust-bin:1.75.0 llvm_slot_17
 dev-lang/rust:1.74.1 llvm_slot_17
 dev-lang/rust-bin:1.74.1 llvm_slot_17
-dev-lang/rust:1.71.1 llvm_slot_16
-dev-lang/rust-bin:1.71.1 llvm_slot_16
 
 # Sam James <sam@gentoo.org> (2024-06-03)
 # Poor rendering performance otherwise (bug #931215).
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 585d19a988d..7663c862b58 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,19 @@
 
 # New entries go on top.
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-08-06)
+# General mask, to be unmasked on arches where glibc supports this
+>=sys-libs/glibc-2.42 sframe
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-08-02)
+# Fails to build, needs looking into but isn't currently needed
+# by anything and can leave it masked for now.
+>=media-libs/vips-8.17 vala
+
+# Alfred Wingate (2025-07-31)
+# Missing dependency
+sci-libs/gdal mongodb
+
 # Ivy <openrc@posteo.de> (2025-07-11)
 # app-editors/gnome-text-editor[spell] has been dropped upstream and
 # replaced with app-text/libspelling, but will likely be added back
@@ -13,10 +26,6 @@
 ~app-editors/gnome-text-editor-47.2 spell
 ~app-editors/gnome-text-editor-47.4 spell
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-27)
-# Prepare cleanup of kde-apps/cervisia
-kde-apps/kdesdk-meta cvs
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-06-26)
 # >=kde-plasma/drkonqi-6.3.90 requires systemd, so specifically
 # unmasked only in targets/systemd.
@@ -31,20 +40,11 @@ media-libs/svt-av1 test
 # Doesn't work well at runtime.
 dev-games/ogre wayland
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-23)
-# media-sound/hydrogen[lash] build is broken, and dropped upstream in next
-# version. Bug #946125
-media-sound/hydrogen lash
-
 # Maciej Mrozowski <reavertm@gentoo.org> (2025-05-22)
 # Does not compile as of 2024.1.1, requires buildsystem fixes.
 dev-games/simgear gdal
 games-simulation/flightgear gdal
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-14)
-# dev-qt/qtwebchannel:5 is masked, last revdep was dev-python/pyqtwebengine
-dev-python/pyqt5 webchannel
-
 # Joonas Niilola <juippis@gentoo.org> (2025-05-14)
 # Experimental, no official upstream support.
 www-client/firefox jpegxl
@@ -70,7 +70,6 @@ dev-cpp/fbthrift io-uring
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-04-21)
 # Prepare cleanup of dev-qt/qtwebengine:5
 app-i18n/fcitx-chinese-addons webengine
-app-office/libalkimia webengine
 
 # Matt Jolly <kangie@gentoo.org> (2025-04-16)
 # Older versions of freeciv build an incompatible client and
@@ -110,10 +109,6 @@ sci-libs/opencascade ffmpeg
 # Requires dev-python/recommonmark with Python 3.10
 <llvm-core/clang-18 doc
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-02-13)
-# Prepare cleanup of dev-qt/qtgamepad:5
-dev-qt/qt3d gamepad
-
 # Michał Górny <mgorny@gentoo.org> (2025-02-08)
 # Requires dev-cpp/cpp-httplib that has extremely unstable ABI.
 # Not worth the constant churn of having to rebuild LLVM again and again.
@@ -141,11 +136,6 @@ dev-build/meson test-full
 # Blocking cleanup of kde-apps/kdegraphics-mobipocket:5
 kde-frameworks/kfilemetadata:5 mobi
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-03)
-# Prepare cleanup of kde-apps/kaccounts-integration:6[qt5] and
-# kde-frameworks/bluez-qt:5
-kde-frameworks/purpose:5 bluetooth kaccounts
-
 # Michał Górny <mgorny@gentoo.org> (2024-12-31)
 # None of the sci-libs/symengine versions work with the modern versions
 # of dev-libs/boost in Gentoo.
@@ -489,10 +479,6 @@ app-misc/pax-utils seccomp
 # app-text/pandoc is not keyworded on most architectures
 net-libs/gssdp man
 
-# Sam James <sam@gentoo.org> (2022-11-19)
-# Needs long-EOL dev-lang/spidermonkey:60 (which also needs python:2.7).
-media-libs/coin javascript
-
 # Matt Turner <mattst88@gentoo.org> (2022-11-16)
 # gnome-music and gnome-photos have not been ported to libsoup:3.0, while
 # other non-slotted dependencies have been.
@@ -503,12 +489,6 @@ gnome-base/gnome-extra-apps tracker
 # which has not been ported to libsoup:3.0.
 >=app-misc/localsearch-3.4.0-r1 rss
 
-# Viorel Munteanu <ceamac.paragon@gmail.com> (2022-10-07)
-# Cannot test and fix pax-kernel related bugs on a current grsec kernel
-# Mask the flag for now
-# Bugs: #643466, #674872, #832161, #855722
-app-emulation/virtualbox pax-kernel
-
 # Sam James <sam@gentoo.org> (2022-10-02)
 # USE=compat / possibly allowing sys-libs/zlib needs to be figured out,
 # but packages want to use the actual zlib-ng library, so we need to
@@ -910,10 +890,6 @@ sys-libs/glibc vanilla
 # This is a security risk if not used carefully, bug #628596.
 net-analyzer/nrpe command-args
 
-# Michał Górny <mgorny@gentoo.org> (2017-08-04)
-# sys-kernel/openvz-sources is being treecleaned wrt bug #580516.
-app-emulation/libvirt openvz
-
 # Mike Gilbert <floppym@gentoo.org> (2017-07-09)
 # Matthias Dahl <matthias.dahl@binary-island.eu> (2017-07-05)
 # Both are not your typical garden-variety Linux programs and are
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent
new file mode 100644
index 00000000000..9e06c4505a7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent
new file mode 100644
index 00000000000..2122741fb81
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/gnome/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent
new file mode 100644
index 00000000000..db8ce088c69
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/desktop/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/desktop
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults
new file mode 100644
index 00000000000..dba188dfd7d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="powerpc-unknown-linux-gnut64"
+CHOST_ppc="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent
new file mode 100644
index 00000000000..320c1b2c0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/parent
@@ -0,0 +1,2 @@
+..
+../../../../../features/time64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent
new file mode 100644
index 00000000000..d5a56a13f69
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent
new file mode 100644
index 00000000000..fae96e8d36b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/desktop/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../targets/desktop
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent
new file mode 100644
index 00000000000..25281026829
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/split-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../features/split-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent
new file mode 100644
index 00000000000..7e061533c15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/ppc/23.0/time64/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults
new file mode 100644
index 00000000000..0c2f07fa052
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/make.defaults
@@ -0,0 +1,5 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CHOST="s390-ibm-linux-gnut64"
+CHOST_s390="${CHOST}"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent
new file mode 100644
index 00000000000..320c1b2c0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/parent
@@ -0,0 +1,2 @@
+..
+../../../../../features/time64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent
new file mode 100644
index 00000000000..25281026829
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/split-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../features/split-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi
new file mode 100644
index 00000000000..7ed6ff82de6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent
new file mode 100644
index 00000000000..7e061533c15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/s390/23.0/time64/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
index 213bbb46d54..a674e69b1e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
@@ -56,6 +56,7 @@ gnome-base/gnome-control-center wayland
 sys-apps/xdg-desktop-portal-gnome wayland
 net-libs/webkit-gtk:6 wayland
 dev-libs/libportal wayland
+gnome-extra/tecla wayland
 
 # matoro <matoro_gentoo@matoro.tk> (2023-04-10)
 # media-libs/libldac casualties (#80238)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 33449386cd5..5e4da506fd4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# PPN-SD <nicolas.parlant@parhuet.fr> (2025-07-28)
+# Bundled pcap-thread, not ported to musl
+# bug #713498, https://github.com/DNS-OARC/pcap-thread/issues/128
+net-dns/dnscap
+
 # Ian Jordan <immoloism@gmail.com> (2025-07-13)
 # Binary is compiled against glibc
 net-misc/anydesk
@@ -370,7 +375,6 @@ net-im/element-desktop-bin
 net-im/gitter-bin
 net-im/mattermost-desktop-bin
 net-im/rocketchat-desktop-bin
-net-im/skypeforlinux
 net-im/slack
 net-im/telegram-desktop-bin
 net-im/whatsapp-desktop-bin
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index c8fdc17aee3..86d4b99c8de 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -71,6 +71,7 @@ dev-libs/mongo-c-driver test
 dev-php/pecl-mongodb test
 dev-python/pymongo test-full
 net-analyzer/zmap mongo
+sci-libs/gdal mongodb
 
 # Nowa Ammerlaan <nowa@gentoo.org> (2024-04-25)
 # No Level-Zero on musl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
index 90cb5ca5f69..4b38b6d6509 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2025-08-05)
+# Native extensions are using Rust.
+dev-python/fastbencode native-extensions
+
+# Holger Hoffstätte <holger@applied-asynchrony.com> (2025-07-24)
+# dnsdist-2.0.0[yaml] needs Rust
+net-dns/dnsdist yaml
+
 # Sam James <sam@gentoo.org> (2025-02-21)
 # Needs Rust
 media-video/ffmpeg rav1e svg
@@ -74,6 +82,7 @@ sys-kernel/installkernel efistub
 dev-python/botocore test
 dev-python/ipython nbconvert test
 dev-python/sphinx-autodoc-typehints test
+>=sci-libs/gdal-3.11.3 python
 
 # Michał Górny <mgorny@gentoo.org> (2024-02-01)
 # Need dev-python/trio.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index 0fb1221970c..8ca453a308e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -17,6 +17,15 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2025-07-29)
+# dev-python/flaky and dev-python/pytest-rerunfailurse have conflicting
+# pytest fixtures, with the latter providing a more powerful fixture
+# (and the former breaking packages requiring it).  If your package
+# uses `@pytest.mark.flaky`, use pytest-rerunfailures instead.
+# If it uses `@flaky.flaky`, send a patch upstream to switch
+# to `@pytest.mark.flaky`.
+dev-python/flaky
+
 # Michał Górny <mgorny@gentoo.org> (2025-06-28)
 # versioningit does not provide any support for building via GitHub
 # archives, and has rejected the efforts to provide an envvar override
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index decbca6f435..a99ced1a709 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -36,6 +36,132 @@
 
 #--- END OF EXAMPLES ---
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-10)
+# Outdated version packaged in Gentoo, pending version bump request for
+# over a year, depends on Qt5 but worse, Qt5Script, no signs of upstream
+# porting away from it, many unattended build error bugs.
+# Bugs #922311, #926229. Removal on 2025-09-14.
+media-gfx/opentoonz
+
+# Michał Górny <mgorny@gentoo.org> (2025-08-10)
+# Significant regression breaking dev-python/websockets.
+# Masking until upstream decides how to proceed.
+=dev-lang/python-3.13.6
+=dev-python/python-tests-3.13.6
+
+# Hans de Graaff <graaff@gentoo.org> (2025-08-08)
+# ruby-openid fails tests and is archived upstream. Last release 6 years
+# ago. rack-openid is the only reverse dependency.
+# Removal on 2025-09-08
+dev-ruby/rack-openid
+dev-ruby/ruby-openid
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2025-08-07)
+# Unused java library, pinned to virtual/jdk:1.8.
+# Removal on 2025-09-07.
+dev-java/jide-oss
+
+# Michał Górny <mgorny@gentoo.org> (2025-08-05)
+# Accidental breaking change.  Yanked upstream.  Bug #961089.
+# Followed by another yanked breaking release.
+=dev-python/setuptools-scm-9.0.3
+=dev-python/setuptools-scm-9.0.0
+
+# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-08-03)
+# Inactive upstream, stuck on Qt5. Suggested alternatives:
+# media-sound/strawberry, media-sound/amarok.
+# Removal on 2025-09-03. Bug #960012.
+media-sound/clementine
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-08-10)
+# media-libs/liblastfm and media-libs/libmygpo-qt destabiliation mask.
+# No more stable revdeps after media-sound/clementine removal.
+~media-libs/liblastfm-1.1.0_pre20190625
+~media-libs/libmygpo-qt-1.1.0
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-31)
+# KF5 -> KF6 transitional package with no more revdeps since 25.04.
+# Removal on 2025-08-15.
+kde-apps/ffmpegthumbs-common
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-30)
+# Current package is 7 years old and upstream repository only gets the
+# occasional commit. Package is stuck with EAPI-7, Qt5, no Python 3.13
+# support. Bug #952654. Removal on 2025-08-29.
+sci-chemistry/molequeue
+
+# Hans de Graaff <graaff@gentoo.org> (2025-07-30)
+# Obsolete slot that is ruby33-only. Use the newer slot instead. Removal
+# on 2025-08-30.
+dev-ruby/tzinfo:1
+
+# Eli Schwartz <eschwartz@gentoo.org> (2025-07-28)
+# Unmaintained, out of date, last upstream release in 2018, last
+# packaged release 2015. Broken with modern system interfaces for
+# some time. Entire OpenVZ ecosystem is vaporware these days,
+# openvz-sources was last-rited in 2017 already.
+# Removal on 2025-08-27.  Bug #580516, #868252.
+sys-cluster/vzctl
+app-backup/vzdump
+app-misc/vzstats
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Current package is 4 years old and outdated compared to upstream, needs
+# a real maintainer: still EAPI-7, Qt5-based with unclear upstream status.
+# Many bugs: #955642, #957424, #957402, #903803, #841740
+# Removal on 2025-08-27.
+dev-debug/edb-debugger
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Current package is 4 years old and outdated compared to upstream.
+# Still Qt5-based with unclear upstream status. Needs real care.
+# Many bugs: #953380, #701988, #683464, #590002, #565034, #579396
+# Removal on 2025-08-27.
+app-office/texmacs
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Last release in 2015, last commit more than 2 years ago, still Qt5-based,
+# EAPI-7, no signs of work towards Qt6 upstream. Bug #960817
+# Removal on 2025-08-27.
+media-video/baka-mplayer
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-07-28)
+# Dead for many years, Qt5-based, EAPI-7. Anyone interested in its features
+# should look into qmp3gain instead (bug #949077) but it also needs porting
+# to Qt6. Removal on 2025-08-27.
+media-sound/qtgain
+
+# Hans de Graaff <graaff@gentoo.org> (2025-07-28)
+# Obsolete slots of cucumber components. These slots are no longer used
+# by dev-util/cucumber. Removal on 2025-08-28.
+dev-util/cucumber-gherkin:23
+dev-util/cucumber-gherkin:25
+dev-util/cucumber-messages:19
+dev-util/cucumber-messages:24
+
+# Bernard Cafarelli <voyageur@gentoo.org> (2025-07-27)
+# Current version in tree only supports python <=3.11
+# Needs major version bump, relevant dependencies, and tests fixes
+# Removal on 2025-08-26. Bug #952156.
+dev-python/aiocache
+dev-python/arsenic
+dev-python/browser-cookie3
+dev-python/tld
+dev-python/yaswfp
+net-analyzer/wapiti
+
+# Michał Górny <mgorny@gentoo.org> (2025-07-26)
+# Another pytest plugin causing random breakage.  Discontinued upstream,
+# last revdep stopped using it.
+# Removal on 2025-08-25.  Bug #960760.
+dev-python/noseofyeti
+
+# Michał Górny <mgorny@gentoo.org> (2025-07-22)
+# Provider for PyPy3.10 executable.  This branch is no longer maintained
+# upstream, and it is vulnerable.  Removal on 2025-08-05.
+dev-lang/pypy:3.10
+dev-python/pypy3_10-exe
+dev-python/pypy3_10-exe-bin
+
 # Matt Turner <mattst88@gentoo.org> (2025-07-20)
 # No reverse dependencies remaining.
 # Removal on 2025-08-19.
@@ -101,19 +227,6 @@ virtual/perl-Term-ReadLine
 virtual/perl-Unicode-Collate
 virtual/perl-Unicode-Normalize
 
-# Joonas Niilola <juippis@gentoo.org> (2025-07-01)
-# Python-3.13 enabled version of Spidermonkey. The test phase crashes
-# with 3.13 so I'm not fully convinced there won't be runtime issues
-# with rdeps (gjs, libpeas) but try it out and report back in
-# bug #952299.
-=dev-lang/spidermonkey-128.12.0-r1
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-29)
-# KF5-based package, unmaintained upstream, see also:
-# https://mail.kde.org/pipermail/release-team/2025-June/013683.html
-# Removal on 2025-07-29.
-kde-apps/cervisia
-
 # Michał Górny <mgorny@gentoo.org> (2025-06-29)
 # File collision against gnome-base/gnome-keyring[pam], which is
 # required via pambase.  Masked until the maintainer determines a good
@@ -125,100 +238,21 @@ kde-apps/cervisia
 # no longer be used on this architecture.
 =net-proxy/mitmproxy-9.0.1
 
-# Jay Faulkner <jayf@gentoo.org> (2025-06-26)
-# Discontinued by upstream in Sept 2023, running on a likely vulnerable
-# electron version. Bug #959128.
-net-irc/irccloud-desktop-bin
-
-# David Seifert <soap@gentoo.org> (2025-06-25)
-# Skype has been shut down on 2025-05-05, use the Teams progressive web
-# application with your Skype username as alternative.
-# Removal on 2025-07-25.  Bug #942322.
-net-im/skypeforlinux
-sec-policy/selinux-skype
-x11-plugins/pidgin-skypeweb
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-25)
-# New problematic test dependencies.  No reverse dependencies.
-# Removal on 2025-07-25.  Bug #958987.
-dev-python/caldav
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-06-24)
-# Qt5 package without any revdeps. Removal on 2025-07-24. Bug #938823
-dev-libs/libdbusmenu-qt
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-21)
-# Last commit in 2019.  Has an entry point conflict with
-# dev-python/pytest-tornasync.  No reverse dependencies left.
-# Removal on 2025-07-21.  Bug #958601.
-dev-python/pytest-tornado
-
-# Michał Górny <mgorny@gentoo.org> (2025-06-21)
-# No commits for two years.  Broken with Python 3.14
-# and with >=dev-python/pytest-asyncio-1.0.0.  No reverse dependencies.
-# Removal on 2025-07-21.  Bug #958592.
-dev-python/backoff
-
 # Sam James <sam@gentoo.org> (2025-06-12)
 # Breaks several applications (bug #957943)
 >=dev-python/pygobject-3.52
 >=net-im/gajim-2.3.0
 
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, fails to compile with gcc 15 and cmake 4.
-# Removal on 2025-07-12. Bugs #957271, #944255
-games-arcade/tuxanci
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, doesn't build with gcc 15, we're the only ones packaging it.
-# Removal on 2025-07-12. Bugs #944434, #943845, #906249, #680698.
-app-shells/esh
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Unmaintained upstream since 2008, doesn't build. x86-only.
-# Removal on 2025-07-12. Bugs #77471, #926465, #941191, #948965.
-games-fps/tenebrae
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Dead upstream, fails to compile.
-# Removal on 2025-07-12. Bugs #919185, #882585, #871018, #913572
-net-analyzer/cryptcat
-
-# Alexey Sokolov <alexey+gentoo@asokolov.org> (2025-06-09)
-# Deprecated and no longer maintained upstream. Open security
-# issues. Use media-gfx/fig2dev instead.
-# Removal on 2025-07-12. Bug #917279.
-media-gfx/transfig
-
 # Sam James <sam@gentoo.ogr> (2025-06-08)
 # Masked for testing (bug #957583).
 =sys-devel/gettext-0.25*
 =dev-libs/libintl-0.25*
 
-# Michał Górny <mgorny@gentoo.org> (2025-06-07)
-# Broken and dangerous.  Archived in 2022.  The last reverse dependency
-# stopped using it in 2023 (except for outdated ebuilds).
-# Removal on 2025-07-07.  Bug #957272, #806474.
-dev-python/pytest-tempdir
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2025-06-07)
-# EAPI=7, maintainer-needed, fails to compile, upstream gone, not
-# packaged anywhere else.
-# Removal on 2025-07-07.  Bug #957444.
-dev-util/bin_replace_string
-
 # Michał Górny <mgorny@gentoo.org> (2025-06-07)
 # Destabilized due to unresolved test failures.  If you need this
 # package, please use the ~arch version.
 =dev-python/lmdb-1.5.1
 
-# Sam James <sam@gentoo.org> (2025-06-03)
-# Major changes to packaging as bindings are split out by upstream.
->=app-crypt/gpgme-2
->=dev-cpp/gpgmepp-2
->=dev-libs/qgpgme-2
-dev-python/gpgmepy
-
 # Sam James <sam@gentoo.org> (2025-06-03)
 # Fetching from GitHub seems broken with this:
 # > Connecting to github.com|20.26.156.215|:443... connected.
@@ -226,39 +260,10 @@ dev-python/gpgmepy
 # >  Unable to locally verify the issuer's authority.
 =app-misc/ca-certificates-20250419.3.112
 
-# Michael Orlitzky <mjo@gentoo.org> (2025-05-28)
-# I added this for SageMath, but in hindsight do not think anyone is
-# using it. It has code issues and upstream is not terribly interested
-# in fixing it. (They are active and helpful, just not in love with this
-# particular codebase.) Bug 940232. Removal after 30 days.
-dev-gap/cohomolo
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-05-27)
-# sci-electronics/gazebo depends on x11-libs/qwt:6[qt5] and Qt5, lots of
-# open bugs. Most packages perpetually stuck at EAPI-7 and several major
-# version bumps out of date. Bugs #937608, #947390; removal on 2025-06-26.
-sci-electronics/gazebo
-dev-libs/sdformat
-net-libs/ignition-msgs
-net-libs/ignition-transport
-sci-libs/ignition-common
-sci-libs/ignition-fuel-tools
-sci-libs/ignition-math
-dev-build/ignition-cmake
-dev-libs/console_bridge
-dev-libs/urdfdom
-dev-libs/urdfdom_headers
-
 # Sam James <sam@gentoo.org> (2025-05-26)
 # Breaks some reverse dependencies and is abandoned upstream (bug #956630).
 =dev-cpp/glog-0.7.1
 
-# Nowa Ammerlaan <nowa@gentoo.org> (2025-05-25)
-# Archived upstream and no longer builds with modern compilers.
-# Bugs #956601, #930253
-# Removal on 2025-06-24
-media-libs/oneVPL-cpu
-
 # Sam James <sam@gentoo.org> (2025-05-23)
 # Severe memory leak (bug #953874)
 =app-i18n/ibus-anthy-1.5.17
@@ -271,18 +276,6 @@ media-libs/oneVPL-cpu
 # Pretest versions, masked for testing.
 <app-editors/emacs-30.1.9999:30-vcs
 
-# Hans de Graaff <graaff@gentoo.org> (2025-05-18)
-# Obsolete slot depending on an old cucumber version. Use the newer slot
-# instead. Masked for removal on 2025-06-18.
-dev-util/cucumber-rails:2
-
-# David Seifert <soap@gentoo.org> (2025-05-17)
-# Historically split from dev-libs/icu, disabled by default upstream and not
-# recommended anymore. If need be, we can make it optional in icu itself.
-# Removal on 2025-06-16. Bug #956106.
-dev-libs/icu-layoutex
-dev-libs/icu-le-hb
-
 # Alfred Wingate <parona@protonmail.com> (2025-05-17)
 # Masked for testing
 dev-db/mysql:8.4
@@ -385,11 +378,6 @@ dev-libs/libxml2-compat
 =dev-lang/rust-bin-1.84.0
 =dev-lang/rust-bin-1.84.1
 
-# Michał Górny <mgorny@gentoo.org> (2025-02-08)
-# Suspicious subslot bump, causing humongous rebuilds.
-# https://bugs.gentoo.org/949414
-=dev-cpp/cpp-httplib-0.18.6
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-01-23)
 # Qt5 tools without any revdeps. Removal on 2025-06-10.
 dev-qt/assistant
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
index c8d63be093b..850509166e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/amd64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/amd64/17.1/no-multilib
+../../../default/linux/amd64/23.0/no-multilib
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
index 979515f54f0..5aa0c177ba9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm/parent
@@ -1,2 +1,2 @@
-../../../default/linux/arm/17.0/armv7a
+../../../default/linux/arm/23.0/armv7a_hf
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
index 41057b56ddf..f1a986bae44 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/arm64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/arm64/17.0
+../../../default/linux/arm64/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
index 7c6ab7df6a7..9a86fb44629 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64/parent
@@ -1,2 +1,2 @@
-../../../default/linux/ppc64/17.0
+../../../default/linux/ppc64/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
index 3301fe4e640..9b729845c49 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/ppc64le/parent
@@ -1,2 +1,2 @@
-../../../default/linux/ppc64le/17.0
+../../../default/linux/ppc64le/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
index d3b49d5628b..32c1fbbd836 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/riscv/parent
@@ -1,2 +1,2 @@
-../../../default/linux/riscv/20.0/rv64gc/lp64d
+../../../default/linux/riscv/23.0/rv64/lp64d
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
index c1189513e91..215342880ae 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/x86/parent
@@ -1,2 +1,2 @@
-../../../default/linux/x86/17.0
+../../../default/linux/x86/23.0
 ..
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index b3320c3edb1..ca10765d049 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -293,6 +293,14 @@ ppc		default/linux/ppc/23.0/systemd					stable
 ppc		default/linux/ppc/23.0/split-usr				stable
 ppc		default/linux/ppc/23.0/split-usr/desktop			stable
 ppc		default/linux/ppc/23.0/split-usr/desktop/gnome			stable
+ppc		default/linux/ppc/23.0/time64					exp
+ppc		default/linux/ppc/23.0/time64/desktop				exp
+ppc		default/linux/ppc/23.0/time64/desktop/gnome			exp
+ppc		default/linux/ppc/23.0/time64/desktop/gnome/systemd		exp
+ppc		default/linux/ppc/23.0/time64/systemd				exp
+ppc		default/linux/ppc/23.0/time64/split-usr				exp
+ppc		default/linux/ppc/23.0/time64/split-usr/desktop			exp
+ppc		default/linux/ppc/23.0/time64/split-usr/desktop/gnome		exp
 
 
 # PPC64 profiles
@@ -363,11 +371,14 @@ riscv		default/linux/riscv/23.0/rv32/split-usr/ilp32				exp
 # S390 Profiles
 # @MAINTAINER: s390@gentoo.org
 s390		default/linux/s390/23.0						stable
-s390		default/linux/s390/23.0/systemd					dev
+s390		default/linux/s390/23.0/systemd					stable
 s390		default/linux/s390/23.0/split-usr				dev
 s390		default/linux/s390/23.0/split-usr/s390x				stable
 s390		default/linux/s390/23.0/s390x					stable
 s390		default/linux/s390/23.0/s390x/systemd				stable
+s390		default/linux/s390/23.0/time64					stable
+s390		default/linux/s390/23.0/time64/systemd				stable
+s390		default/linux/s390/23.0/time64/split-usr			dev
 
 
 # SPARC Profiles
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
index c5838b85a20..a37950c33f1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
@@ -19,7 +19,6 @@ move dev-util/valgrind dev-debug/valgrind
 move dev-util/meson-format-array dev-build/meson-format-array
 move dev-util/meson dev-build/meson
 move dev-util/cmake-fedora dev-build/cmake-fedora
-move dev-util/ignition-cmake dev-build/ignition-cmake
 move dev-util/rocm-cmake dev-build/rocm-cmake
 move dev-util/tinycmmc dev-build/tinycmmc
 move dev-util/cmake dev-build/cmake
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
index b77aad7be61..ce7d08ccc9a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
@@ -3,7 +3,6 @@ move media-sound/zam-plugins media-plugins/zam-plugins
 slotmove =dev-ruby/elasticsearch-transport-6.8.3 6 6.8.3
 move dev-python/cfn-python-lint dev-python/cfn-lint
 move dev-python/dbusmock dev-python/python-dbusmock
-move dev-python/python-backoff dev-python/backoff
 move dev-python/python-musicbrainz-ngs dev-python/musicbrainzngs
 move dev-python/python-podman dev-python/podman
 move dev-python/u-msgpack dev-python/u-msgpack-python
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025
new file mode 100644
index 00000000000..a1ee241d7c8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2025
@@ -0,0 +1 @@
+move dev-python/pixelmatch-py dev-python/pixelmatch
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
index de1e262bd94..0514bb0f69a 100644
--- a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
@@ -1,2 +1,3 @@
 DIST gentoo-release-test-sigs-20190224.tar.gz 3235 BLAKE2B 924c69a62d5321716f536144f0607bd3ec4a65d76be492adc729864fd9bef82df0086541ae13034a83152ea0c8dc3cbd168be6cff111a3484128a22cbc8ef1d4 SHA512 f8cc2e84bedbdf14ace6abe4aacf8f0c9810c77ff6ae0fac301829d9d4d5cf0c128a76516c773ac993879215bcdb0aab097e1e7e747d8e1a7c4cfc815bd4d3e6
 DIST gentoo-release.asc.20240703.gz 18710 BLAKE2B 2436319e0fc05432ea08e7828a337551de0b37783c4376e3249ed132c29d394376fb2e5f36281299cb251473ecb2b2240f75e2b7bdefa02ff35cc1ca4250c515 SHA512 1e17dfb0c626044a50ffc410fc515ea64d9ed53c53c70c046a6ebaf59a8991885c1f7dadb3366334fa840b91882f825a0878988a43a43adec0f10b1a22b4f7ee
+DIST gentoo-release.asc.20250806.gz 18794 BLAKE2B f683266f64357ce869adb04c8efdee296fdfacd72e003d305eecfb91b89c56243e0e7f342f47ca7918f560f961b7f73d874d86018f483ae814f43f40efda7459 SHA512 71b8ef105d49218690d242df2517b1a078f7a8d353ba6d9621cb6690431a46d85a3e45e3a2f4e3b9050b344c3cb636e10a2cc42cbd813a2e926b0b42630cd1cb
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild
new file mode 100644
index 00000000000..608383e3ede
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20250806.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="OpenPGP keys used for Gentoo releases (snapshots, stages)"
+HOMEPAGE="https://www.gentoo.org/downloads/signatures/"
+SRC_URI="
+	https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release.asc.${PV}.gz
+	test? (
+		https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release-test-sigs-20190224.tar.gz
+	)
+"
+S=${WORKDIR}
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( app-crypt/gnupg )
+"
+
+# Keys included:
+# DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
+# D99EAC7379A850BCE47DA5F29E6438C817072058
+# 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910
+# EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
+
+src_test() {
+	local old_umask=$(umask)
+	umask 077
+
+	local -x GNUPGHOME=${T}/.gnupg
+	mkdir "${GNUPGHOME}" || die
+	einfo "Importing keys ..."
+	gpg --import "gentoo-release.asc.${PV}" || die "Key import failed"
+
+	local f
+	for f in gentoo-release-test-sigs*/*.asc; do
+		einfo "Testing ${f##*/} ..."
+		gpg -q --trust-model always --verify "${f}" || die "Verification failed on ${f}"
+	done
+
+	umask "${old_umask}"
+}
+
+src_install() {
+	insinto /usr/share/openpgp-keys
+	newins "gentoo-release.asc.${PV}" gentoo-release.asc
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
index 2221c8ff940..44e97499a9a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
@@ -1,4 +1,2 @@
-DIST gawk-5.3.1.tar.xz 3510032 BLAKE2B be9132324344c0b052e954e004a942ff7c6b14b86b73cda491d7a33485f60341be4d8da1a06d1d7a27445b9b39a528bcce3eee9c2a3f8756de21bdc57a33f54d SHA512 c6b4c50ce565e6355ca162955072471e37541c51855c0011e834243a7390db8811344b0c974335844770e408e1f63d72d0d81459a081c392e0245c726019eaff
-DIST gawk-5.3.1.tar.xz.sig 488 BLAKE2B 2abafbb965912a194d047bed3ac1ef33a2b44dce0bc4b1a83a6ca3e2ecf676da0ad8333bb3817f0f32c7d67ab8662dc6086c9e1d6f2185a93d786390197fc643 SHA512 3e13b1bd598b7d4c715c802dcc9db298aeab12721620692f9dd76d3941fdfd87381f660c93be5cc04b6cd7378a6464b9033c93419dfcb514dcc33da8d0d9f502
 DIST gawk-5.3.2.tar.xz 3749260 BLAKE2B 8536777bb45c63d737ef08b3f1b98285cb29ec54400e35b2139c2bc66b464e3ec4950274614d95d94dc7eae18c57333b7c30a44d993855258155fc82b749042a SHA512 2268150fa35ae049a6ff3d0d0fa110db10477014c25f50e2ab4e3ee5fd60133369d2a994f59db4eb718020a0af5c4003ae7278c63e7fffa72f431ff4a1429e48
 DIST gawk-5.3.2.tar.xz.sig 488 BLAKE2B ea843fce8ca2b93a8006260e8022f3426daccc18b93bd75ef1fb18e391ce110a10682e75509d771ba9c419d1e22a584f66ff9a436512b76b039a85afed6c7596 SHA512 490f29271d06f374e25e13724f5944215734d0c6da465da5b2a723e83fa31a03c7a16e5c8853465561bc0676139588b1046c598554ccde4ae24563455ee28b65
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
deleted file mode 100644
index 2d447605849..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.1.ebuild
+++ /dev/null
@@ -1,111 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-#GAWK_IS_BETA=yes
-
-DESCRIPTION="GNU awk pattern-matching language"
-HOMEPAGE="https://www.gnu.org/software/gawk/gawk.html"
-
-if [[ ${GAWK_IS_BETA} == yes || ${PV} == *_beta* ]] ; then
-	if [[ ${PV} == *_beta* ]] ; then
-		# Beta versioning is sometimes for the release prior, e.g.
-		# 5.2.1_beta is labelled upstream as 5.2.0b.
-		MY_PV=${PV/_beta/b}
-		MY_PV=$(ver_cut 1-2 ${MY_PV}).$(($(ver_cut 3 ${MY_PV}) - 1))$(ver_cut 4- ${MY_PV})
-		MY_P=${PN}-${MY_PV}
-
-		S="${WORKDIR}"/${MY_P}
-	else
-		MY_P=${P}
-	fi
-
-	SRC_URI="https://www.skeeve.com/gawk/${MY_P}.tar.gz"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gawk.asc
-	inherit verify-sig flag-o-matic
-
-	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
-# MPFR support is "on parole" and may be removed:
-# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
-IUSE="mpfr pma nls readline"
-
-RDEPEND="
-	mpfr? (
-		dev-libs/gmp:=
-		dev-libs/mpfr:=
-	)
-	readline? ( sys-libs/readline:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	>=sys-apps/texinfo-7.1
-	>=sys-devel/bison-3.5.4
-	nls? ( sys-devel/gettext )
-"
-
-if [[ ${GAWK_IS_BETA} != yes ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-gawk )"
-fi
-
-src_prepare() {
-	default
-
-	use elibc_musl && append-cppflags -D__GNU_LIBRARY__
-
-	# Use symlinks rather than hardlinks, and disable version links
-	sed -i \
-		-e '/^LN =/s:=.*:= $(LN_S):' \
-		-e '/install-exec-hook:/s|$|\nfoo:|' \
-		Makefile.in doc/Makefile.in || die
-
-	# bug #413327
-	sed -i '/^pty1:$/s|$|\n_pty1:|' test/Makefile.in || die
-
-	# Fix standards conflict on Solaris
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i \
-			-e '/\<_XOPEN_SOURCE\>/s/1$/600/' \
-			-e '/\<_XOPEN_SOURCE_EXTENDED\>/s/1//' \
-			extension/inplace.c || die
-	fi
-}
-
-src_configure() {
-	# README says gawk may not work properly if built with non-Bison.
-	# We already BDEPEND on Bison, so just unset YACC rather than
-	# guessing if we need to do yacc.bison or bison -y.
-	unset YACC
-
-	local myeconfargs=(
-		--cache-file="${S}"/config.cache
-		--libexec='$(libdir)/misc'
-		$(use_with mpfr)
-		$(use_enable nls)
-		$(use_enable pma)
-		$(use_with readline)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	# Automatic dodocs barfs
-	rm -rf README_d || die
-
-	default
-
-	# Install headers
-	insinto /usr/include/awk
-	doins *.h
-	rm "${ED}"/usr/include/awk/config.h || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
index 2d447605849..4a2e8ea7cbd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
@@ -34,10 +34,11 @@ fi
 
 LICENSE="GPL-3+"
 SLOT="0"
-# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
-# MPFR support is "on parole" and may be removed:
-# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
-IUSE="mpfr pma nls readline"
+# The gawk docs claim MPFR support is "on parole" and may be removed,
+# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html
+# however this is somewhat outdated information, see
+# https://public-inbox.org/libc-alpha/202412190851.4BJ8psq4404509@freefriends.org/
+IUSE="+mpfr pma nls readline"
 
 RDEPEND="
 	mpfr? (
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
index a141f6db445..55fca559657 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/Manifest
@@ -1,3 +1,3 @@
 DIST gentoo-functions-0.19.tar.bz2 12079 BLAKE2B be0a3a54d4dee1755866047b670a69cd6fec368239123c3f0c08180b79a33c20147bca0e35e568faef6877513551e731bdf0c181aeb0460f6574d2d708219373 SHA512 2674d3fe5724cc6d685ae58bf0ee33f4a1bdba2c5e5809cfb193fd0a710d4678c2d9392c2c62d2321cf455f524950266dc1629ab684fe46632d179e539d5a39e
-DIST gentoo-functions-1.7.2.tar.bz2 29059 BLAKE2B 2b3d13e6f5b553fd0fa7a0880677bd61c82c8815d3801a2d80e7632a97c36f81b41075109856f6248ad0eb2453b511066e63a110c97984e6427135ad19cdc234 SHA512 3839b04784576cc5c5824b24f967862ea421be051983d1ac587de7e21b0fbc4f403e0d4f707ee5cbcf466ec4a12d188da9413a81ca71993c957328ff225cb9af
 DIST gentoo-functions-1.7.3.tar.bz2 29623 BLAKE2B e37fcaf7ca70eda4507f8b539ad37c989a3a6d28d2a063aa1650f60f8cbb28b00103ffea0f1221fd4e8379d4066bca1fd5aeee30073eed6274cfaaaa277bee84 SHA512 4c5d5c9e8b93e366c5483e8777dfdc15afc6764110cc69f751bb5cc1e335dd70e0952017ea55f1be70fcd5120f07708b1601638c97132f53acde8b3f5a4afe34
+DIST gentoo-functions-1.7.4.tar.bz2 29565 BLAKE2B dd05aaee9c078ef6b623950c120b7e9aa7056a1e02248a098a9b33e69109fa5a642221a2209a55570590e8101f4ec82e727602dce543977670dd7d49f789429e SHA512 184809eb684465639bc2d404c421e33153ffcac3fe985123e5f5815863c427c9e4f6155713a2c0b69006a4afbefc114211f4a4216f49e726a198938d43fcd395
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
index 320c82e6dfe..6517d7f22a6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gentoo-functions/gentoo-functions-1.7.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2014-2024 Gentoo Authors
+# Copyright 2014-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 15c6bdad484..c22d9354233 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -3,3 +3,4 @@ DIST iproute2-6.12.0.tar.xz 925392 BLAKE2B 95aee769662e21c8c6223d09ee0ec365fcdeb
 DIST iproute2-6.13.0.tar.xz 927416 BLAKE2B bbebc44d1a7e35c410869a2a5884df09698ea3950acd126e5736a938718d40e57d539ff88ecd7827cbdf2f9481c3d728fff3948a61c2ba3e1483c5b7a7616577 SHA512 2e392a8ddc3d7662c3a72bba1c845587df85b7afc6efabf7df0ec2830bb1d4b16cac5bfb7a43dc3ac73adf0ea3fe3670824674d4f32209c6d1aa638a7cb7cd6c
 DIST iproute2-6.14.0.tar.xz 929092 BLAKE2B 18bd180c608b657694f4713bf915d45006c97a7206a3260ac52149d4c976422e1949ada425d4989c5a7e327e3d8eb45ea990de25f3645bb1308ac2531bf834d2 SHA512 e79049bdca0e0381f0a93a40e4d597ce59fb509dabc6e8b04a510ff9953f091c67577d6faa62967bd197bf62ab6e56d928558270a1390621431acb237b77fa46
 DIST iproute2-6.15.0.tar.xz 930908 BLAKE2B 50247f293e194601bd138418e55e2dc63421d2a5da863973e9ff78f2c76ba051350523559f2b7b7983af05a827f292135353adbf6c857ea32b7071f69940f73f SHA512 1a438941cd939e1c8e32cfe8c40e6fd826c89185f1bb0c623eaad7380a66afd9fa9e0d7cdc5e5b193d2761b7dbdc78fd0811537eecc500be633730c32ff55ad4
+DIST iproute2-6.16.0.tar.xz 931124 BLAKE2B d1c66f4d63edd6fa2701c92dbc47f8c4388d6a660d541d528e3463e8e261fda64df4a7f8930f510718c71ee82438b5c4859f072eb08c8ff1e4d1d65223108005 SHA512 88930ea1a3a901594a69dc04e533bfd1de0f5b79f176dedb45f11f01035bd680edccc8e04e56d0922ee430580581c646473a3baa941254739878f7ab946f17df
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild
new file mode 100644
index 00000000000..dfc30230bd4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.16.0.ebuild
@@ -0,0 +1,215 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( >=dev-libs/libbpf-0.6:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+	lto-guarantee-fat
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+	strip-lto-bytecode
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
index c35d98dba13..66d872639d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.8.0.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	if [[ $(ver_cut 3) -lt 90 ]] ; then
 		SRC_URI="https://www.kernel.org/pub/linux/utils/kbd/${P}.tar.xz"
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 	else
 		inherit autotools
 		SRC_URI="https://github.com/legionus/kbd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
index 06ec41ec604..75dc4ae3d6b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/Manifest
@@ -1,2 +1,2 @@
 DIST locale-gen-2.23.tar.bz2 7664 BLAKE2B a529b62fbb840c9352f06e8f5c80fc764425a2619dc69cc820f550a026d391788d5e2cfeeb46a8b5b9716da63340b4fce57a5b523edd4196ee1219c1200cb752 SHA512 c1245caadb04403c535a836f19bc410d0f04b5c0e297ea5be9852e6d71e08e528071ae769d63d31a677dda8fdd618b4c4d581ed525cf8786b82d8f37636db754
-DIST locale-gen-3.0.tar.bz2 14810 BLAKE2B f88381ca53eff89016daddedcaf349d4584a991de384e08f0908b025e37df8ecc90ee0b2834e596c8330516bbabd2e17a6c460ce5190e939704ae683732cc456 SHA512 4bfc27a12b2f4822ce7fb8ac7881adc2d1c34f8722aa688c940caaed06225d99a1c81569871de3cac9980725ed9743508ade0f68b171062d607e71261951373a
+DIST locale-gen-3.2.tar.bz2 16340 BLAKE2B a0558a0f84da3ea6a66903a632f261fe9cf63e21ccb32411f827367699fefd3e2e627ee018c2720dce3901e3801089c3aca6a487f2f075a9b6831529b160a0e2 SHA512 76655947a1d28cbda5be75454a3cc38e75d2914ab987bd59359f70acc6e3a3f2961675280ee8a52ada4724fb6393f1d5b6712077a89ebd3511a49c43cf459adf
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
similarity index 61%
rename from sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
index b3a29ad9dff..45a38c7dfc2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-3.2.ebuild
@@ -5,15 +5,21 @@ EAPI=8
 
 DESCRIPTION="Generate locales based upon the config file /etc/locale.gen"
 HOMEPAGE="https://gitweb.gentoo.org/proj/locale-gen.git/"
-SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
 
-LICENSE="GPL-2"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/locale-gen.git"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
 
+LICENSE="GPL-2"
 SLOT="0"
-#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 
 RDEPEND="
-	dev-lang/perl
+	>=dev-lang/perl-5.36
 	!<sys-libs/glibc-2.37-r3
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild
new file mode 100644
index 00000000000..45a38c7dfc2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/locale-gen/locale-gen-9999.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Generate locales based upon the config file /etc/locale.gen"
+HOMEPAGE="https://gitweb.gentoo.org/proj/locale-gen.git/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/locale-gen.git"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/locale-gen.git/snapshot/${P}.tar.bz2"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=dev-lang/perl-5.36
+	!<sys-libs/glibc-2.37-r3
+"
+
+src_install() {
+	dosbin locale-gen
+	doman *.[0-8]
+	insinto /etc
+	doins locale.gen
+	keepdir /usr/lib/locale
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
index 3d12c0ea2a7..3354110b994 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/Manifest
@@ -2,3 +2,4 @@ DIST nvme-cli-2.11.gh.tar.gz 1023249 BLAKE2B c60765aaf8343adb29b2b042223accdd1ac
 DIST nvme-cli-2.12.gh.tar.gz 1079884 BLAKE2B ad08ce7c477cebdbb68efd707de851e9b7187cc6bd4ce4980f9a6f33a02c65d0ae6702e4f38f135db22acadf10bc26b87064ac2c9e09c820837c47ca32b0f093 SHA512 569a60302e4ce71713906417f34a8922b4788d77220a01f2f11dd12fc787ac6590c00588353cbbba292640688995fcefee4ab28c274bedcc02a2e3439c258938
 DIST nvme-cli-2.13.gh.tar.gz 1122216 BLAKE2B 45b181607f22d332fcf9e8d14c0dfba5c5a49e7e95bcf479efaf8eae3a60222af10c2f6699aab2c53ec91ede6e3e262101bbde81248facf25d40c87c0b07fa22 SHA512 71ade7b97354bf70e4909d85265db157715c1afe52fba6d1e2aa614900a8059830e85029f71680884966476363e8846d6cfbc1dcfe57330c749775acc39df6e7
 DIST nvme-cli-2.14.gh.tar.gz 1142108 BLAKE2B 7d482f065de704d9da8c54ea435c3ca8e81f08f683a9679300d8d02fd9bec6ee2c068d77ddbd2e390bd1d761b8b4b4a70a790cc290127968800df361b7a767a7 SHA512 7f600ee719f06283e136427a0f9eb0b22412f7f4549c774768caff54150207ba87e2a431ea1569e5ed86a554aecd23c00c4e8c351aa0168a81807c86a0cb2edc
+DIST nvme-cli-2.15.gh.tar.gz 1182716 BLAKE2B 295ba5f56b8c4aeaafb65132b35e6198127ebad845e48d63f2d4dc185e1e668414880167cd0dc03d20dc47cdb889d20b74b709e0573fe12b609f60a17fd50681 SHA512 6f4c9fe52883df5424ba28d8b66b00e61f4b6f7226d7385f026c1d3b8aeb473bdf637102d9cf7e049349c4f7e61eccbb33f7400cc09056f74be03a80b7d51c0d
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild
new file mode 100644
index 00000000000..32a67a7fe19
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/nvme-cli/nvme-cli-2.15.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson systemd udev
+
+DESCRIPTION="NVM-Express user space tooling for Linux"
+HOMEPAGE="https://github.com/linux-nvme/nvme-cli"
+SRC_URI="https://github.com/linux-nvme/nvme-cli/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="GPL-2 GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv ~sparc ~x86"
+IUSE="+json pdc"
+
+RDEPEND="
+	>=sys-libs/libnvme-1.15:=[json?]
+	json? ( dev-libs/json-c:= )
+	sys-libs/zlib:=
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+"
+BDEPEND="
+	virtual/pkgconfig
+"
+
+src_configure() {
+	local emesonargs=(
+		-Dversion-tag="${PV}"
+		-Ddocs=all
+		-Dhtmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+		-Dsystemddir="$(systemd_get_systemunitdir)"
+		-Dudevrulesdir="${EPREFIX}$(get_udevdir)/rules.d"
+		$(meson_feature json json-c)
+		$(meson_use pdc pdc-enabled)
+	)
+	meson_src_configure
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
index 5b30fe56f12..641d09839f0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.14.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://mj.ucw.cz/download/linux/pci/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 IUSE="dns +kmod static-libs +udev zlib"
 REQUIRED_USE="static-libs? ( !udev )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
index fb28b3ac9d3..a8fbec75a3b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
@@ -1,2 +1,4 @@
 DIST pv-1.9.31.tar.gz 417551 BLAKE2B 6018abe674834f45312faa5ce07b49e11258e29fffc11d88ce73f50ae58c47e94defa3d5d819099a6909610e7423d9e42a8ce939fa39fe476cdbf35e89aa0112 SHA512 63cdc6223cde4f3f0daf47b5808a3f72a9cfaf2c05751e971a99d9dd3df2f36430958213c023931f428c87341a5f6c1f3772f30ca992123ea4c2a2e48000ff1d
 DIST pv-1.9.31.tar.gz.asc 691 BLAKE2B 7b5b998341db887b14c56fc080d87cb4abb186b4df2c8def638822889a734436fe0c4c132396415bbc0dcb0754f76d0456bb667533ef7ed92ed0c09a62522e8b SHA512 549a3bb3f4f404b3a6e407663ba335e3d4e14303185654771c974335ed5e7ac46dbba71bbf4f26e640217829e58a0da8d6fa139b02f426b60ab074ec97084374
+DIST pv-1.9.34.tar.gz 416551 BLAKE2B aa2d56408a96de9b472a3ef5215a270c3c993543dc72b980948ffd2f6f6181bf69beaf911df284ea934c43d5053ada57a35e3dc43de08a184dca89fa75e945e5 SHA512 c590e376d33f49d8bb0d4463a54bb8c5a8dd25737f2d413f83c53c64cf6cb6d5ad977ff907fb6a8d8004ee371d35de08d3a5fb312b07a6c7237565e0bc55a104
+DIST pv-1.9.34.tar.gz.asc 691 BLAKE2B 0bb824f3f8352ab3c32d9df273780039eb81b8bf40f4f90cede5a121cccdd5370a1769da0bfe09735b80a59a75bb4ac3cbd5008bc0fa99c40077cae2dd64cf14 SHA512 8f0b7989b3e8d00b5147fa5ad37e3823b99edd9586210f73fcf553b95c7d2114843ff1c7445ac757689c1eca4cc5920fb86417733fba722bc287c66885e98a33
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild
new file mode 100644
index 00000000000..b66bc7a457d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.34.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pv.asc
+inherit linux-info toolchain-funcs verify-sig
+
+DESCRIPTION="Pipe Viewer: a tool for monitoring the progress of data through a pipe"
+HOMEPAGE="https://ivarch.com/p/pv https://codeberg.org/ivarch/pv"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://codeberg.org/a-j-wood/pv"
+	inherit autotools git-r3
+else
+	SRC_URI="
+		https://ivarch.com/s/${P}.tar.gz
+		verify-sig? ( https://ivarch.com/s/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="debug ncurses nls"
+
+RDEPEND="ncurses? ( sys-libs/ncurses:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-pv )"
+
+pkg_setup() {
+	if use kernel_linux; then
+		CONFIG_CHECK="~SYSVIPC"
+		ERROR_SYSVIPC="You will need to enable CONFIG_SYSVIPC in your kernel to use the --remote option."
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	default
+
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+src_configure() {
+	tc-export AR
+
+	econf \
+		$(use_enable debug debugging) \
+		$(use_with ncurses) \
+		$(use_enable nls)
+}
+
+src_test() {
+	# Valgrind is unreliable within sandbox
+	local -x SKIP_VALGRIND_TESTS=1
+	emake -Onone check
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
index f1565df2a2b..b66bc7a457d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -7,15 +7,15 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/pv.asc
 inherit linux-info toolchain-funcs verify-sig
 
 DESCRIPTION="Pipe Viewer: a tool for monitoring the progress of data through a pipe"
-HOMEPAGE="https://www.ivarch.com/programs/pv.shtml https://codeberg.org/a-j-wood/pv"
+HOMEPAGE="https://ivarch.com/p/pv https://codeberg.org/ivarch/pv"
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://codeberg.org/a-j-wood/pv"
 	inherit autotools git-r3
 else
 	SRC_URI="
-		https://www.ivarch.com/programs/sources/${P}.tar.gz
-		verify-sig? ( https://www.ivarch.com/programs/sources/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
+		https://ivarch.com/s/${P}.tar.gz
+		verify-sig? ( https://ivarch.com/s/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
 	"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
index 364132e10a2..96bcf9e9b25 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.41.1-r1.ebuild
@@ -353,6 +353,12 @@ multilib_src_configure() {
 
 src_configure() {
 	append-lfs-flags
+
+	# Workaround for bug #961040 (gcc PR120006)
+	if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then
+		append-flags -fno-ipa-pta
+	fi
+
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
index 90bee97edbb..32de7e0bb19 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 PYTHON_COMPAT=( python3_{11..14} )
 TMPFILES_OPTIONAL=1
 
-inherit pam python-r1 meson-multilib tmpfiles toolchain-funcs
+inherit flag-o-matic pam python-r1 meson-multilib tmpfiles toolchain-funcs
 
 MY_PV="${PV/_/-}"
 MY_P="${PN}-${MY_PV}"
@@ -128,6 +128,11 @@ src_unpack() {
 src_prepare() {
 	default
 
+	# Workaround for bug #961040 (gcc PR120006)
+	if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then
+		append-flags -fno-ipa-pta
+	fi
+
 	if use test ; then
 		# Known-failing tests
 		local known_failing_tests=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild
new file mode 100644
index 00000000000..42ba546bf4a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/polkit/polkit-126-r2.ebuild
@@ -0,0 +1,157 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+inherit meson pam pax-utils python-any-r1 systemd tmpfiles xdg-utils
+
+DESCRIPTION="Policy framework for controlling privileges for system-wide services"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://github.com/polkit-org/polkit"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/polkit-org/polkit"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Upstream don't make releases very often. Test snapshots throughly
+	# and review commits, but don't shy away if there's useful stuff there
+	# we want.
+	MY_COMMIT=""
+	SRC_URI="https://github.com/polkit-org/polkit/archive/${MY_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+	S="${WORKDIR}"/${PN}-${MY_COMMIT}
+else
+	SRC_URI="https://github.com/polkit-org/polkit/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+fi
+
+LICENSE="LGPL-2"
+SLOT="0"
+if [[ ${PV} != 9999 ]] ; then
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+fi
+IUSE="examples gtk +introspection kde pam nls selinux systemd test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	acct-user/polkitd
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	>=dev-libs/glib-2.32
+	dev-libs/gobject-introspection-common
+	dev-libs/libxslt
+	dev-util/glib-utils
+	virtual/pkgconfig
+	introspection? ( >=dev-libs/gobject-introspection-0.6.2 )
+	nls? ( sys-devel/gettext )
+	test? (
+		$(python_gen_any_dep '
+			dev-python/dbus-python[${PYTHON_USEDEP}]
+			dev-python/python-dbusmock[${PYTHON_USEDEP}]
+		')
+	)
+"
+DEPEND="
+	>=dev-libs/glib-2.32:2
+	dev-libs/expat
+	dev-lang/duktape:=
+	pam? (
+		sys-auth/pambase
+		sys-libs/pam
+	)
+	!pam? ( virtual/libcrypt:= )
+	systemd? ( sys-apps/systemd:0=[policykit] )
+	!systemd? ( sys-auth/elogind )
+"
+RDEPEND="
+	${DEPEND}
+	acct-user/polkitd
+	selinux? ( sec-policy/selinux-policykit )
+"
+PDEPEND="
+	gtk? ( || (
+		>=gnome-extra/polkit-gnome-0.105
+		>=lxde-base/lxsession-0.5.2
+	) )
+	kde? ( kde-plasma/polkit-kde-agent )
+"
+
+DOCS=( docs/TODO HACKING.md NEWS.md README.md )
+
+QA_MULTILIB_PATHS="
+	usr/lib/polkit-1/polkit-agent-helper-1
+	usr/lib/polkit-1/polkitd
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-elogind.patch
+)
+
+python_check_deps() {
+	python_has_version "dev-python/dbus-python[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/python-dbusmock[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# bug #401513
+	sed -i -e 's|unix-group:@PRIVILEGED_GROUP@|unix-user:@PRIVILEGED_GROUP@|' src/polkitbackend/*-default.rules.in || die
+}
+
+src_configure() {
+	xdg_environment_reset
+
+	local emesonargs=(
+		--localstatedir="${EPREFIX}"/var
+		-Dauthfw="$(usex pam pam shadow)"
+		-Dexamples=false
+		-Dgtk_doc=false
+		-Dman=true
+		-Dos_type=gentoo
+		-Dpam_module_dir=$(getpam_mod_dir)
+		-Dprivileged_group=0
+		-Dsession_tracking="$(usex systemd logind elogind)"
+		-Dsystemdsystemunitdir="$(systemd_get_systemunitdir)"
+		-Dlibs-only=false
+		$(meson_use introspection)
+		$(meson_use nls gettext)
+		$(meson_use test tests)
+	)
+	meson_src_configure
+}
+
+src_compile() {
+	meson_src_compile
+
+	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
+	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
+}
+
+src_install() {
+	meson_src_install
+
+	# acct-user/polkitd installs its own (albeit with a different filename)
+	rm -rf "${ED}"/usr/lib/sysusers.d || die
+
+	if use examples ; then
+		docinto examples
+		dodoc src/examples/{*.c,*.policy*}
+	fi
+
+	if [[ ${EUID} == 0 ]]; then
+		diropts -m 0700 -o polkitd
+	fi
+	keepdir /etc/polkit-1/rules.d
+}
+
+pkg_postinst() {
+	tmpfiles_process polkit-tmpfiles.conf
+
+	if [[ ${EUID} == 0 ]]; then
+		chmod 0700 "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+		chown polkitd "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index bae05b1ad2e..e578b46ab1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -22,6 +22,7 @@ DIST binutils-2.42-patches-6.tar.xz 50664 BLAKE2B f13b65a761cfba80caf2e4740c6383
 DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5a019badefda25abeb6275997b16f0891e7ff3424c4b82bbfae92e8992669826920dd53df61cd48469d8f7cd5bd1 SHA512 155f3ba14cd220102f4f29a4f1e5cfee3c48aa03b74603460d05afb73c70d6657a9d87eee6eb88bf13203fe6f31177a5c9addc04384e956e7da8069c8ecd20a6
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
-DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
 DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
+DIST binutils-2.45-patches-1.tar.xz 15588 BLAKE2B b88c62a6483807dfb24c97c534aadc1f930ea2d6cd8ad86734c40458a0e3ac4d149c0ee47c6ba541c462ce0e619dfaa5328c3dd5ffbd94511c487956866c7a38 SHA512 05c890a71d465539b3d066c2fd92930e4d6c9003147395a4c2cb9cc514f412fa392892e2c3b8887493a56b00453ac383612d0cac42e4cacce983e65886537149
+DIST binutils-2.45.tar.xz 27868232 BLAKE2B 1ce72346b1f531c89feb86b407e2c649151b506ffbd1a02d413411d36f7ede98fa9a1adf75dd941c01df5fe7e6bf151828b269eeb7c278315ca8004bff22eb7f SHA512 c7b10a7466d9fd398d7a0b3f2a43318432668d714f2ec70069a31bdc93c86d28e0fe83792195727167743707fbae45337c0873a0786416db53bbf22860c16ce7
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
deleted file mode 100644
index aba22e72ca2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.43.9999.ebuild
+++ /dev/null
@@ -1,571 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
-
-DESCRIPTION="Tools necessary to build programs"
-HOMEPAGE="https://sourceware.org/binutils/"
-
-LICENSE="GPL-3+"
-IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
-
-# Variables that can be set here  (ignored for live ebuilds)
-# PATCH_VER          - the patchset version
-#                      Default: empty, no patching
-# PATCH_BINUTILS_VER - the binutils version in the patchset name
-#                    - Default: PV
-# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
-#                      for the patchsets
-
-PATCH_VER=1
-PATCH_DEV=dilfridge
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	SLOT=${PV}
-elif [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	SLOT=$(ver_cut 1-2)
-else
-	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-	PATCH_DEV=${PATCH_DEV:-dilfridge}
-	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
-	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
-		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-	SLOT=$(ver_cut 1-2)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-#
-# The cross-compile logic
-#
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY} == cross-* ]] ; then
-		export CTARGET=${CATEGORY#cross-}
-	fi
-fi
-is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
-
-#
-# The dependencies
-#
-RDEPEND="
-	>=sys-devel/binutils-config-3
-	sys-libs/zlib
-	debuginfod? (
-		dev-libs/elfutils[debuginfod(-)]
-	)
-	zstd? ( app-arch/zstd:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	doc? ( sys-apps/texinfo )
-	pgo? (
-		dev-util/dejagnu
-		app-alternatives/bc
-	)
-	test? (
-		dev-util/dejagnu
-		app-alternatives/bc
-	)
-	nls? ( sys-devel/gettext )
-	zstd? ( virtual/pkgconfig )
-	app-alternatives/lex
-	app-alternatives/yacc
-"
-
-RESTRICT="!test? ( test )"
-
-MY_BUILDDIR=${WORKDIR}/build
-
-src_unpack() {
-	if [[ ${PV} == *9999 ]] ; then
-		EGIT_REPO_URI="
-			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
-			https://github.com/gentoo/binutils-patches
-		"
-		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
-		git-r3_src_unpack
-		mv patches-git/9999 patch || die
-
-		if [[ ${PV} != 9999 ]] ; then
-			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
-		fi
-		EGIT_REPO_URI="
-			https://sourceware.org/git/binutils-gdb.git
-			https://git.sr.ht/~sourceware/binutils-gdb
-			https://gitlab.com/x86-binutils/binutils-gdb.git
-		"
-		S=${WORKDIR}/binutils
-		EGIT_CHECKOUT_DIR=${S}
-		git-r3_src_unpack
-	else
-		unpack ${P/-hppa64/}.tar.xz
-
-		cd "${WORKDIR}" || die
-		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
-
-		# _p patch versions are Gentoo specific tarballs ...
-		local dir=${P%_p?}
-		dir=${dir/-hppa64/}
-
-		S=${WORKDIR}/${dir}
-	fi
-
-	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
-}
-
-src_prepare() {
-	local patchsetname
-	if [[ ${PV} == 9999 ]] ; then
-		patchsetname="from git master"
-	elif [[ ${PV} == *9999 ]] ; then
-		patchsetname="from git branch ${EGIT_BRANCH}"
-	else
-		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
-	fi
-
-	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
-		if ! use vanilla; then
-			einfo "Applying binutils patchset ${patchsetname}"
-			eapply "${WORKDIR}/patch"
-			einfo "Done."
-
-			# This is applied conditionally for now just out of caution.
-			# It should be okay on non-prefix systems though. See bug #892549.
-			if is_cross || use prefix; then
-				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
-			fi
-		fi
-	fi
-
-	# Make sure our explicit libdir paths don't get clobbered, bug #562460
-	sed -i \
-		-e 's:@bfdlibdir@:@libdir@:g' \
-		-e 's:@bfdincludedir@:@includedir@:g' \
-		{bfd,opcodes}/Makefile.in || die
-
-	# Apply things from PATCHES and user dirs
-	default
-
-	# Run misc portage update scripts
-	gnuconfig_update
-	elibtoolize --portage --no-uclibc
-}
-
-toolchain-binutils_bugurl() {
-	printf "https://bugs.gentoo.org/"
-}
-toolchain-binutils_pkgversion() {
-	printf "Gentoo ${PV}"
-	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
-}
-
-src_configure() {
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	# Setup some paths
-	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
-	INCPATH=${LIBPATH}/include
-	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
-	if is_cross ; then
-		TOOLPATH=/usr/${CHOST}/${CTARGET}
-	else
-		TOOLPATH=/usr/${CTARGET}
-	fi
-	BINPATH=${TOOLPATH}/binutils-bin/${PV}
-
-	# Make sure we filter $LINGUAS so that only ones that
-	# actually work make it through, bug #42033
-	strip-linguas -u */po
-
-	# Keep things sane
-	strip-flags
-	use cet && filter-flags -mindirect-branch -mindirect-branch=*
-	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
-
-	# https://sourceware.org/PR32372
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	local x
-	echo
-	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
-		einfo "$(printf '%10s' ${x}:) ${!x}"
-	done
-	echo
-
-	cd "${MY_BUILDDIR}" || die
-	local myconf=()
-
-	if use plugins ; then
-		myconf+=( --enable-plugins )
-	fi
-	# enable gold (installed as ld.gold) and ld's plugin architecture
-	if use gold ; then
-		myconf+=( --enable-gold )
-	fi
-
-	if use nls ; then
-		myconf+=( --without-included-gettext )
-	else
-		myconf+=( --disable-nls )
-	fi
-
-	myconf+=( --with-system-zlib )
-
-	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
-	# logic in toolchain.eclass. bug #446946
-	#
-	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
-	case $(tc-arch) in
-		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
-	esac
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
-
-	is_cross && myconf+=(
-		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
-		--enable-poison-system-directories
-	)
-
-	myconf+=( --enable-secureplt )
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	myconf+=(
-		--prefix="${EPREFIX}"/usr
-		--host=${CHOST}
-		--target=${CTARGET}
-		--datadir="${EPREFIX}"${DATAPATH}
-		--datarootdir="${EPREFIX}"${DATAPATH}
-		--infodir="${EPREFIX}"${DATAPATH}/info
-		--mandir="${EPREFIX}"${DATAPATH}/man
-		--bindir="${EPREFIX}"${BINPATH}
-		--libdir="${EPREFIX}"${LIBPATH}
-		--libexecdir="${EPREFIX}"${LIBPATH}
-		--includedir="${EPREFIX}"${INCPATH}
-		# portage's econf() does not detect presence of --d-d-t
-		# because it greps only top-level ./configure. But not
-		# libiberty's or bfd's configure.
-		--disable-dependency-tracking
-		--disable-silent-rules
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		--enable-relro
-		--enable-install-libiberty
-		--enable-textrel-check=$(usex hardened error warning)
-		# Things to think about
-		#--enable-deterministic-archives
-		--enable-new-dtags
-		--disable-jansson
-		--disable-werror
-		--with-bugurl="$(toolchain-binutils_bugurl)"
-		--with-pkgversion="$(toolchain-binutils_pkgversion)"
-		$(use_enable static-libs static)
-		$(use_with zstd)
-
-		# Disable modules that are in a combined binutils/gdb tree, bug #490566
-		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
-		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
-
-		$(use_with debuginfod)
-
-		# Avoid automagic dev-libs/msgpack dep, bug #865875
-		--without-msgpack
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-
-		# We can enable this by default in future, but it's brand new
-		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
-		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
-		$(use_enable gprofng)
-
-		# Enables colored disassembly by default (equivalent to passing
-		# --disassembler-color=terminal to all objdump invocations).
-		--enable-colored-disassembly
-	)
-
-	case ${CTARGET} in
-		x86_64-*|aarch64*|arm64*|i[3456]*)
-			# These hardening options are available from 2.39+ but
-			# they unconditionally enable the behaviour even on arches
-			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
-			#
-			# TODO: Get the logic for this fixed upstream so it doesn't
-			# create impossible broken combinations on some arches, like mips.
-			#
-			# TODO: Get the logic for this fixed upstream so --disable-* works
-			# as expected.
-			myconf+=(
-				--enable-warn-execstack=yes
-				--enable-warn-rwx-segments=yes
-			)
-
-			if use hardened ; then
-				myconf+=(
-					# TODO: breaks glibc test suite
-					#--enable-error-execstack=yes
-					#--enable-error-rwx-segments=yes
-					--enable-default-execstack=no
-				)
-			fi
-			;;
-		*)
-			;;
-	esac
-
-	if use elibc_musl ; then
-		# Override our earlier setting for musl, as textrels don't
-		# work there at all. See bug #707660.
-		myconf+=(
-			--enable-textrel-check=error
-		)
-	fi
-
-	if use test || { use pgo && tc-is-lto ; } ; then
-		# -Wa,* needs to be consistent everywhere or lto-wrapper will complain
-		filter-flags '-Wa,*'
-	fi
-
-	if ! is_cross ; then
-		myconf+=( $(use_enable pgo pgo-build $(tc-is-lto && echo "lto" || echo "yes")) )
-
-		if use pgo ; then
-			# We let configure handle it for us because it has to run
-			# the testsuite later on for profiling, and LTO isn't compatible
-			# with the testsuite.
-			filter-lto
-
-			export BUILD_CFLAGS="${CFLAGS}"
-		fi
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running if doc is unset.
-	if ! use doc ; then
-		sed -i \
-			-e '/^MAKEINFO/s:=.*:= true:' \
-			Makefile || die
-	fi
-}
-
-src_compile() {
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	# see linker prefix patch
-	emake \
-		tooldir="${EPREFIX}${TOOLPATH}" \
-		gentoo_prefix=$(usex prefix-guest "${EPREFIX}"/usr /usr) \
-		all
-
-	# only build info pages if the user wants them
-	if use doc ; then
-		emake info
-	fi
-
-	# we nuke the manpages when we're left with junk
-	# (like when we bootstrap, no perl -> no manpages)
-	find . -name '*.1' -a -size 0 -delete
-}
-
-src_test() {
-	cd "${MY_BUILDDIR}" || die
-
-	(
-		# Tests don't expect LTO
-		filter-lto
-
-		# lto-wrapper warnings which confuse tests
-		filter-flags '-Wa,*'
-
-		# bug #637066
-		filter-flags -Wall -Wreturn-type
-
-		emake -k check \
-			CFLAGS_FOR_TARGET="${CFLAGS_FOR_TARGET:-${CFLAGS}}" \
-			CXXFLAGS_FOR_TARGET="${CXXFLAGS_FOR_TARGET:-${CXXFLAGS}}" \
-			LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}" \
-			CFLAGS="${CFLAGS}" \
-			CXXFLAGS="${CXXFLAGS}" \
-			LDFLAGS="${LDFLAGS}"
-	)
-}
-
-src_install() {
-	local x d
-
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
-	rm -rf "${ED}"/${LIBPATH}/bin || die
-	use static-libs || find "${ED}" -name '*.la' -delete
-
-	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
-	cd "${ED}"/${LIBPATH} || die
-	for d in ../* ; do
-		[[ ${d} == ../${PV} ]] && continue
-		mv ${d}/* . || die
-		rmdir ${d} || die
-	done
-
-	# Now we collect everything intp the proper SLOT-ed dirs
-	# When something is built to cross-compile, it installs into
-	# /usr/$CHOST/ by default ... we have to 'fix' that :)
-	if is_cross ; then
-		cd "${ED}"/${BINPATH} || die
-		for x in * ; do
-			mv ${x} ${x/${CTARGET}-} || die
-		done
-
-		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
-			rm -r "${ED}"/usr/${CHOST}/{include,lib}
-		fi
-	fi
-
-	insinto ${INCPATH}
-	local libiberty_headers=(
-		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
-		demangle.h
-		dyn-string.h
-		fibheap.h
-		hashtab.h
-		libiberty.h
-		objalloc.h
-		splay-tree.h
-	)
-	doins "${libiberty_headers[@]/#/${S}/include/}"
-	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
-		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
-		rm -r "${ED}"/${LIBPATH}/lib || die
-	fi
-
-	# Generate an env.d entry for this binutils
-	insinto /etc/env.d/binutils
-	cat <<-EOF > "${T}"/env.d
-		TARGET="${CTARGET}"
-		VER="${PV}"
-		LIBPATH="${EPREFIX}${LIBPATH}"
-	EOF
-	newins "${T}"/env.d ${CTARGET}-${PV}
-
-	# Handle documentation
-	if ! is_cross ; then
-		cd "${S}" || die
-		dodoc README
-
-		docinto bfd
-		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
-
-		docinto binutils
-		dodoc binutils/ChangeLog binutils/NEWS binutils/README
-
-		docinto gas
-		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
-
-		docinto gprof
-		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
-
-		docinto ld
-		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
-
-		docinto libiberty
-		dodoc libiberty/ChangeLog* libiberty/README
-
-		docinto opcodes
-		dodoc opcodes/ChangeLog*
-	fi
-
-	# Remove shared info pages
-	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
-
-	docompress "${DATAPATH}"/{info,man}
-
-	# Trim all empty dirs
-	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
-}
-
-pkg_postinst() {
-	# Make sure this ${CTARGET} has a binutils version selected
-	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
-	binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
-}
-
-pkg_postrm() {
-	local current_profile=$(binutils-config -c ${CTARGET})
-
-	# If no other versions exist, then uninstall for this
-	# target ... otherwise, switch to the newest version
-	# Note: only do this if this version is unmerged.  We
-	#       rerun binutils-config if this is a remerge, as
-	#       we want the mtimes on the symlinks updated (if
-	#       it is the same as the current selected profile)
-	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
-		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
-		choice=${choice//$'\n'/ }
-		choice=${choice/* }
-		if [[ -z ${choice} ]] ; then
-			binutils-config -u ${CTARGET} || eerror binutils-config returned an error
-		else
-			binutils-config ${choice} || eerror binutils-config returned an error
-		fi
-	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
-		binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
-	fi
-}
-
-# Note [slotting support]
-# -----------------------
-# Gentoo's layout for binutils files is non-standard as Gentoo
-# supports slotted installation for binutils. Many tools
-# still expect binutils to reside in known locations.
-# binutils-config package restores symlinks into known locations,
-# like:
-#    /usr/bin/${CTARGET}-<tool>
-#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
-#    /usr/include/
-#
-# Note [tooldir hack for ldscripts]
-# ---------------------------------
-# Build system does not allow ./configure to tweak every location
-# we need for slotting binutils hence all the shuffling in
-# src_install(). This note is about SCRIPTDIR define handling.
-#
-# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
-# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
-# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
-# Thus we can't just move files around after compilation finished.
-#
-# Our goal is the following:
-# - at build-time set scriptdir to point to symlinked location:
-#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
-# - at install-time set scriptdir to point to slotted location:
-#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
index 18bb5a30165..48f6a637726 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r4.ebuild
@@ -134,13 +134,16 @@ src_prepare() {
 
 	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
 		if ! use vanilla; then
+			# We backported a patch in 2.44 but it needed a few
+			# followups. Better to just handle it in 2.45 instead.
+			rm "${WORKDIR}/patch/0007-strip-Add-GCC-LTO-IR-support.patch" \
+				"${WORKDIR}/patch/0008-ld-testsuite-Use-plug_opt-for-plugin-option.patch" \
+				"${WORKDIR}/patch/0009-binutils-Don-t-complain-plugin-with-all-LTO-sections.patch" || die
+
 			einfo "Applying binutils patchset ${patchsetname}"
 			eapply "${WORKDIR}/patch"
 			einfo "Done."
 
-			# This is a fix on top of a patch we backported to 2.44
-			eapply "${FILESDIR}"/${P}-strip-static.patch
-
 			# This is applied conditionally for now just out of caution.
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
@@ -418,6 +421,9 @@ src_test() {
 		# lto-wrapper warnings which confuse tests
 		filter-flags '-Wa,*'
 
+		# Adds a property which confuses tests
+		filter-flags '-mno-direct-extern-access'
+
 		# bug #637066
 		filter-flags -Wall -Wreturn-type
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
index ec413eb353d..926f86447ca 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44.9999.ebuild
@@ -19,7 +19,7 @@ IUSE="cet debuginfod doc gprofng hardened multitarget +nls pgo +plugins static-l
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=1
+PATCH_VER=4
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999 ]]; then
@@ -134,6 +134,12 @@ src_prepare() {
 
 	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == *9999 ]] ; then
 		if ! use vanilla; then
+			# We backported a patch in 2.44 but it needed a few
+			# followups. Better to just handle it in 2.45 instead.
+			rm "${WORKDIR}/patch/0007-strip-Add-GCC-LTO-IR-support.patch" \
+				"${WORKDIR}/patch/0008-ld-testsuite-Use-plug_opt-for-plugin-option.patch" \
+				"${WORKDIR}/patch/0009-binutils-Don-t-complain-plugin-with-all-LTO-sections.patch" || die
+
 			einfo "Applying binutils patchset ${patchsetname}"
 			eapply "${WORKDIR}/patch"
 			einfo "Done."
@@ -415,6 +421,9 @@ src_test() {
 		# lto-wrapper warnings which confuse tests
 		filter-flags '-Wa,*'
 
+		# Adds a property which confuses tests
+		filter-flags '-mno-direct-extern-access'
+
 		# bug #637066
 		filter-flags -Wall -Wreturn-type
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
index 2203fe5beec..8dbee0266ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.9999.ebuild
@@ -35,7 +35,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 #
@@ -142,7 +142,7 @@ src_prepare() {
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
 				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
 	fi
@@ -295,9 +295,9 @@ src_configure() {
 
 		# We can enable this by default in future, but it's brand new
 		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - Doesn't build on musl (https://sourceware.org/PR29477)
+		# - No man pages (https://sourceware.org/PR29521)
+		# - Broken at runtime without Java (https://sourceware.org/PR29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
 
@@ -311,7 +311,7 @@ src_configure() {
 			# These hardening options are available from 2.39+ but
 			# they unconditionally enable the behaviour even on arches
 			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			# See https://sourceware.org/PR29592.
 			#
 			# TODO: Get the logic for this fixed upstream so it doesn't
 			# create impossible broken combinations on some arches, like mips.
@@ -415,6 +415,9 @@ src_test() {
 		# lto-wrapper warnings which confuse tests
 		filter-flags '-Wa,*'
 
+		# Adds a property which confuses tests
+		filter-flags '-mno-direct-extern-access'
+
 		# bug #637066
 		filter-flags -Wall -Wreturn-type
 
@@ -526,6 +529,57 @@ src_install() {
 	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
 }
 
+# Simple test to make sure our new binutils isn't completely broken.
+# Skip if this binutils is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+binutils_sanity_check() {
+	pushd "${T}" >/dev/null
+
+	einfo "Last-minute run tests with binutils in ${ED}${BINPATH} ..."
+
+	cat <<-EOF > "${T}"/number.c
+	int get_magic_number() {
+		return 42;
+	}
+	EOF
+
+	cat <<-EOF > "${T}"/test.c
+	#include <stdio.h>
+	int get_magic_number();
+
+	int main() {
+		printf("Hello Gentoo! Your magic number is: %d\n", get_magic_number());
+	}
+	EOF
+
+	local -x LD_LIBRARY_PATH="${ED}${LIBPATH}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+
+	local opt opt2
+	# TODO: test multilib variants?
+	for opt in '' '-O2' ; do
+		for opt2 in '-static' '-static-pie' '-fno-PIE -no-pie' ; do
+			$(tc-getCC) ${opt} ${opt2} -B"${ED}${BINPATH}" "${T}"/number.c "${T}"/test.c -o "${T}"/test
+			if "${T}"/test | grep -q "Hello Gentoo! Your magic number is: 42" ; then
+				:;
+			else
+				die "Test with '${opt} ${opt2}' failed! Aborting to avoid broken binutils!"
+			fi
+		done
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}${BINPATH} ]] || return 0
+	[[ -n ${BOOTSTRAP_RAP} ]] || return 0
+	is_cross && return 0
+	binutils_sanity_check
+}
+
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
index dda92e423ed..6caf6f87bae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.44-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.45.ebuild
@@ -19,7 +19,7 @@ IUSE="cet debuginfod doc gprofng hardened multitarget +nls pgo +plugins static-l
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=4
+PATCH_VER=1
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999 ]]; then
@@ -142,7 +142,7 @@ src_prepare() {
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
 				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
-					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
 	fi
@@ -295,9 +295,9 @@ src_configure() {
 
 		# We can enable this by default in future, but it's brand new
 		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - Doesn't build on musl (https://sourceware.org/PR29477)
+		# - No man pages (https://sourceware.org/PR29521)
+		# - Broken at runtime without Java (https://sourceware.org/PR29479)
 		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
 		$(use_enable gprofng)
 
@@ -311,7 +311,7 @@ src_configure() {
 			# These hardening options are available from 2.39+ but
 			# they unconditionally enable the behaviour even on arches
 			# where e.g. execstacks can't be avoided.
-			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			# See https://sourceware.org/PR29592.
 			#
 			# TODO: Get the logic for this fixed upstream so it doesn't
 			# create impossible broken combinations on some arches, like mips.
@@ -415,6 +415,9 @@ src_test() {
 		# lto-wrapper warnings which confuse tests
 		filter-flags '-Wa,*'
 
+		# Adds a property which confuses tests
+		filter-flags '-mno-direct-extern-access'
+
 		# bug #637066
 		filter-flags -Wall -Wreturn-type
 
@@ -526,6 +529,57 @@ src_install() {
 	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
 }
 
+# Simple test to make sure our new binutils isn't completely broken.
+# Skip if this binutils is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+binutils_sanity_check() {
+	pushd "${T}" >/dev/null
+
+	einfo "Last-minute run tests with binutils in ${ED}${BINPATH} ..."
+
+	cat <<-EOF > "${T}"/number.c
+	int get_magic_number() {
+		return 42;
+	}
+	EOF
+
+	cat <<-EOF > "${T}"/test.c
+	#include <stdio.h>
+	int get_magic_number();
+
+	int main() {
+		printf("Hello Gentoo! Your magic number is: %d\n", get_magic_number());
+	}
+	EOF
+
+	local -x LD_LIBRARY_PATH="${ED}${LIBPATH}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+
+	local opt opt2
+	# TODO: test multilib variants?
+	for opt in '' '-O2' ; do
+		for opt2 in '-static' '-static-pie' '-fno-PIE -no-pie' ; do
+			$(tc-getCC) ${opt} ${opt2} -B"${ED}${BINPATH}" "${T}"/number.c "${T}"/test.c -o "${T}"/test
+			if "${T}"/test | grep -q "Hello Gentoo! Your magic number is: 42" ; then
+				:;
+			else
+				die "Test with '${opt} ${opt2}' failed! Aborting to avoid broken binutils!"
+			fi
+		done
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}${BINPATH} ]] || return 0
+	[[ -n ${BOOTSTRAP_RAP} ]] || return 0
+	is_cross && return 0
+	binutils_sanity_check
+}
+
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 97ab5db61c0..8dbee0266ab 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -141,7 +141,7 @@ src_prepare() {
 			# This is applied conditionally for now just out of caution.
 			# It should be okay on non-prefix systems though. See bug #892549.
 			if is_cross || use prefix; then
-				eapply "${FILESDIR}"/binutils-2.43-linker-search-path.patch \
+				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
 					   "${FILESDIR}"/binutils-2.43-linker-prefix.patch
 			fi
 		fi
@@ -415,6 +415,9 @@ src_test() {
 		# lto-wrapper warnings which confuse tests
 		filter-flags '-Wa,*'
 
+		# Adds a property which confuses tests
+		filter-flags '-mno-direct-extern-access'
+
 		# bug #637066
 		filter-flags -Wall -Wreturn-type
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch
deleted file mode 100644
index 2e94e96545f..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/files/binutils-2.44-strip-static.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-https://bugs.gentoo.org/957882
-https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=eee822a66066a17529d7af544b1be767517a6c72
-
-From eee822a66066a17529d7af544b1be767517a6c72 Mon Sep 17 00:00:00 2001
-From: "H.J. Lu" <hjl.tools@gmail.com>
-Date: Fri, 13 Jun 2025 08:20:49 +0800
-Subject: [PATCH] objcopy: Correctly check archive element for LTO IR
-
-commit 717a38e9a02109fcbcb18bb2ec3aa251e2ad0a0d
-Author: H.J. Lu <hjl.tools@gmail.com>
-Date:   Sun May 4 05:12:46 2025 +0800
-
-    strip: Add GCC LTO IR support
-
-added:
-
-@@ -3744,6 +3768,12 @@ copy_archive (bfd *ibfd, bfd *obfd, const char
-*output_target,
-     goto cleanup_and_exit;
-   }
-
-+#if BFD_SUPPORTS_PLUGINS
-+      /* Copy LTO IR file as unknown object.  */
-+      if (bfd_plugin_target_p (ibfd->xvec))
-                                ^^^^ A typo, should be this_element.
-+  ok_object = false;
-+      else
-+#endif
-       if (ok_object)
-   {
-     ok = copy_object (this_element, output_element, input_arch);
-
-to check if the archive element is a LTO IR file.  "ibfd" is the archive
-BFD.  "this_element" should be used to check for LTO IR in the archive
-element.  Fix it by replacing "ibfd" with "this_element".
-
-	PR binutils/33078
-	* objcopy.c (copy_archive): Correctly check archive element for
-	LTO IR.
-	* testsuite/binutils-all/objcopy.exp (strip_test_archive): New.
-	Run strip_test_archive.
-
-Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
----
- binutils/objcopy.c                          |  2 +-
- binutils/testsuite/binutils-all/objcopy.exp | 81 +++++++++++++++++++++
- 2 files changed, 82 insertions(+), 1 deletion(-)
-
-diff --git a/binutils/objcopy.c b/binutils/objcopy.c
-index a973789b1d5..366e1079d82 100644
---- a/binutils/objcopy.c
-+++ b/binutils/objcopy.c
-@@ -3770,7 +3770,7 @@ copy_archive (bfd *ibfd, bfd *obfd, const char *output_target,
- 
- #if BFD_SUPPORTS_PLUGINS
-       /* Copy LTO IR file as unknown object.  */
--      if (bfd_plugin_target_p (ibfd->xvec))
-+      if (bfd_plugin_target_p (this_element->xvec))
- 	ok_object = false;
-       else
- #endif
-diff --git a/binutils/testsuite/binutils-all/objcopy.exp b/binutils/testsuite/binutils-all/objcopy.exp
-index cf94570642c..6aa6d2d9fe7 100644
---- a/binutils/testsuite/binutils-all/objcopy.exp
-+++ b/binutils/testsuite/binutils-all/objcopy.exp
-@@ -661,6 +661,87 @@ proc strip_test_with_saving_a_symbol { } {
- 
- strip_test_with_saving_a_symbol
- 
-+# Test stripping an archive.
-+
-+proc strip_test_archive { } {
-+    global AR
-+    global CC
-+    global STRIP
-+    global srcdir
-+    global subdir
-+
-+    set test "strip -g on archive"
-+
-+    if { [target_compile $srcdir/$subdir/testprog.c tmpdir/testprog.o object debug] != "" } {
-+	untested $test
-+	return
-+    }
-+
-+    set stripobjfile tmpdir/striptestprog.o
-+    set stripobjarchive testprog.o
-+    if [is_remote host] {
-+	set archive libstrip.a
-+	set objfile [remote_download host tmpdir/testprog.o]
-+	remote_file host delete $archive
-+	remote_file host delete $stripobjfile
-+	remote_file host delete $stripobjarchive
-+    } else {
-+	set archive tmpdir/libstrip.a
-+	set objfile tmpdir/testprog.o
-+	remote_file build delete $stripobjfile
-+	remote_file build delete $stripobjarchive
-+    }
-+
-+    remote_file build delete tmpdir/libstrip.a
-+
-+    set exec_output [binutils_run $STRIP "-g -o $stripobjfile $objfile"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $AR "rc $archive ${objfile}"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $STRIP "-g $archive"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    set exec_output [binutils_run $AR "x $archive"]
-+    set exec_output [prune_warnings $exec_output]
-+    if ![string equal "" $exec_output] {
-+	fail $test
-+	return
-+    }
-+
-+    if [is_remote host] {
-+	set stripobjfile [remote_download host $stripobjfile]
-+	set stripobjarchive [remote_download host $stripobjarchive]
-+    }
-+
-+    send_log "cmp $stripobjarchive $stripobjfile\n"
-+    verbose "cmp $stripobjarchive $stripobjfile"
-+    set status [remote_exec build cmp "$stripobjarchive $stripobjfile"]
-+    set exec_output [lindex $status 1]
-+    set exec_output [prune_warnings $exec_output]
-+
-+    if [string equal "" $exec_output] then {
-+	pass $test
-+    } else {
-+	fail $test
-+    }
-+}
-+
-+strip_test_archive
-+
- # Build a final executable.
- 
- set exe [exeext]
--- 
-2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
index 5494e3601b7..450f5772eaa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250622.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	"
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 DESCRIPTION="Gentoo Cross-toolchain generator"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 1b3e248ea39..61f9a12acb0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,51 +1,47 @@
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
-DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
+DIST gcc-10.5.0-patches-7.tar.xz 19600 BLAKE2B b3b168b76ca320f3d2469cff4521554264c45b5bc8e1e1509c53d5ac890233ca6c6a1da8c769d5ef387b524bad905cace4f05d6cd5a13d20a792b425710f0a68 SHA512 96eea70a487ef5648956aea136b0fa82bd88bea1b3ccfcc9b5735da1036e3fe0b3663edb09bbae4c53ddd84466695c70f04a5f8609cb8317a5bc1e91f04add63
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
 DIST gcc-11.5.0-musl-patches-3.tar.xz 4232 BLAKE2B 414e1b7e42cf50012d2d2513fc70f1fd41771f28ee3061fd0ea34e8c5d9ba09f2dc7ccc56ab5cd9fe494ce7a1f57cebf3d208bedbe5f6053a08909267a3d9b9f SHA512 02889bb0b5a80dfd2cf48343598d38b4e4e8e179164697265baefb4acc1cadeac6a1e64d90cc0ef0b5473524cfcd36e6d94c0a15d91ea45d8fb6e3e41c7b4cd9
-DIST gcc-11.5.0-patches-1.tar.xz 13664 BLAKE2B 64fd9c2d074aca58ecd8c0035ccf2d2b84d83b93b46367f3e068a95651a094a07b9aad7635bb9c7d2e5ea20dc5957bc19217ca32cbd6cf6f0344f4a3d943a60a SHA512 55828751008575fe89760a224477ee9e5132c0780fbe232e0b80b16ecd9854f85ae54bdcd216ae04de67f3a8b417ee2aad4f8bf9d9df5318613d3efb55bd92df
+DIST gcc-11.5.0-patches-2.tar.xz 14372 BLAKE2B f8e032c9f016f636f20f014a8d6c70ea6fa8620fb6022351a44750c00288d78c6bfe565d19468f172ae7fc66c49eacf8448f028679fc36aaa6f63551faf47391 SHA512 c02c3c78896c4a700670240c6e2765c58abec20d6c2d9f7abfa10b17958193d69b9f81b48544923960de42b0ce9c0a71738574a2462c96589d1c821b0e49b7b5
 DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e2cac92a13cc7e285d08191dd4a117f41a8faac2359c0e2a16f954c7fef354dda9df8c63bff1c5cefda82602c SHA512 88f17d5a5e69eeb53aaf0a9bc9daab1c4e501d145b388c5485ebeb2cc36178fbb2d3e49ebef4a8c007a05e88471a06b97cf9b08870478249f77fbfa3d4abd9a8
 DIST gcc-12-20250528.tar.xz 79942548 BLAKE2B 3c500796a34ccd863da451de4084cc90d404c9b8d41caccde11a840bc25cf949669ea9b4d4ae58899962aeb37e14ec947068238787a0019bbf22e62135a001ca SHA512 aa4e0583b308b8ada43c209edee54f97606683e1e7dad8e0250a6c77591e8cb2520258973822a91f3a45261a46a0b2e3783214ae6e004eed90cdf3a2faec479c
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-musl-patches-3.tar.xz 3480 BLAKE2B ef230799427c10455b33e36fab1d8df4bb20d0964ca2ba05e0caaefae044ad57473eaa0bfdd499fb0eebde7f870abd9c94b04bd1234a2f4c01fe329dab25ffdb SHA512 b10c061aa135c568e404d23e3f7f14a28bb7d14cd9a5d6a60b13b93a53d7f1d4180c027326754adf3ef1aafb87758371d276435b324c41eac64440619d32922a
 DIST gcc-12.4.0-patches-3.tar.xz 14140 BLAKE2B cc73805b2c1f9f6a8d96b2a31d79ce0034ebc3ef1976e78e8ec4f2649c33cef48acee943773de5e03b891128f37e4d72c07d7f4c0bd6d473e484a4b6a9df9f25 SHA512 a93c6bc7d2bd1d7b80bfc6b16c042ac6d3cb6e15cada16041baa48b8023d857b4a1557f4620c46646136daece6566655523010366411aa9fad671398efb03b6f
+DIST gcc-12.4.0-patches-4.tar.xz 15648 BLAKE2B eec4a40233d396ef4d22901cd06b75a78800531e0c6f3d7d765b0b4ba0bbcf7d966112cfc73289245f209a931432c9d7c276c636c8c19ae79cfbf9b6d4a8fa17 SHA512 fb5d5a0433480dca0752e50448f9d2608c8df8579d9963a31bab15379e14cbc1ff2fcd37da8601b536b219f7b6b4f0364bc2cc8de07cbf468e81aae12910f862
 DIST gcc-12.5.0-RC-20250704.tar.xz 86030356 BLAKE2B 640429aac8340ca738ec84bc4eee24c1d2087927c81b7152c2a40fc083dd427ddcb7a639302ab851b5bdb4ac2edf22929bfd9c405ae1a3bc8bffdd7a2d50f415 SHA512 8b14e76acb5ccb20dd0d3480244e866e87dcf7fd92528679956e3b84470cc0e9c5e21f2f39139272a4a43a88536a4a07496a127cfb41cefd92195812c3aae858
 DIST gcc-12.5.0.tar.xz 85897368 BLAKE2B df2f87b407c5572d3590e9868a7597b98bc913669054e517fb2eb9ed82f635df6735a5cab0eab30ebec694e39e552806d837233f0ffe02aa90f5d8b61352c34f SHA512 c76020e4c844b53485502cb8a4e295221c9d37487d66c9f4559031fb14c85de20602e6387310005386cb0ef25e55067d2cfef141423bb445f3b77e7456a23533
 DIST gcc-13-20241220.tar.xz 84504500 BLAKE2B 60d6dcdcafa36399a0c0de7fef3a4eb4ca8e0b6780cd31c9eace2965c53115205bf64e8247b833a4375c1e3ad2d94820b5bdc97a4689be95d8ab55a676afa689 SHA512 10fe009dc3b8872b24350e4fb999f71b848bd5a03e48e8292f76e6eca3dbdef8383a3b13b813aada983ebdbe3ecab1642961b3210cd1e0063a86655a44493017
-DIST gcc-13-20250703.tar.xz 84586348 BLAKE2B 767826f6d4ab9ee1e2b7558ff7e32f5bf409e07283b7a103d42324f0df002a54d3e23066119fd85a30c0abc45bd108c8b63dfadf573b221fe9c3557f4998ec42 SHA512 518aaaec32bb381c4827f1984a87cd057980e0453aaa4b6083102548ec2d7fd9904c7b3a7b2e97bee4f771d46b9a79dc9b49eac5c9074f237d5779b5eaa59c85
-DIST gcc-13-20250710.tar.xz 84582400 BLAKE2B a5979c99d12f17b01dafde95a21490b74392e8fc17f12dddcb77ad883cb93928ef05a459303ed2ef2942fced560722d49ac657f34dee35546c8bfaa8a1e9c9e4 SHA512 0b831bed87e81edf95fab0905ed9209fcfd165881063ed43110a0be23696f6d3bc3199cc6ebfc60d3fe97ff6475512e7b1eb177d7e4949c39971cc69e4a14a2b
-DIST gcc-13-20250717.tar.xz 84570152 BLAKE2B 2f1c1602deaf34262a890d8eb65ae014be8c62bb2c088140a059b8ea0b0d1349a4d38d71babb319a4491215d8a485f8b2c0ada5f2b85b4f5c0c0b87f63907cc3 SHA512 a0fb8e81509889ce14add8656aafd4ce507ca1a201508cb189ddacca1840f91abc7c04fcf97ad2c64b4c98bc42543acc5693c351c502c8d35bcb7374601d527b
+DIST gcc-13-20250807.tar.xz 84575936 BLAKE2B cac8022c6c6d31fa1d741589b9a7c7fd60eb5fb9b44921b1be8beec1bed5846f769ecbdbd7950ed4de23de69c553b22944038edd92f0e76dc24154720a21f015 SHA512 2d5b59e2e18c02d49d8adadb3c62a45700016828a3dd170c276bfccebb6d15e05cf494fa523447a38e04e6b963c35467c8fb6a699da7cd39bb319f639cd9bf56
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
 DIST gcc-13.3.0-musl-patches-2.tar.xz 5176 BLAKE2B ab84c6f29cabb72d2f0cf477e6e8aa4450ffdee7fae59b0e66cbdd8c82b3046306b4aa3d5412d3fdb21362547f2f42e5acecc08c08f8acabf68b983898e8267c SHA512 01c92db81e7f757446516fd5544e134b4a7d6379af2d471efa50112fe38a7fb7dc3389b0a580f7f0fa418267e903824ddd8421772e6dc8f39b80c274bcc1d37e
 DIST gcc-13.3.0-patches-2.tar.xz 44440 BLAKE2B ebde73f6c3cd1a5fdc5bbce36414a59dda0925cba9d422d3689fc9c14fece44ee2391982a674411aa99bf47ffd49200f3ce51cc908beb8298adfff78e709a84c SHA512 eb56e0d7e69b5c3cca21f4cbff21c1204cf64ede7e66d689f45cf5ff37de8a59f24eb1f4b30d9c4222fd4126654fe4ffc146851f504761014995553c1202e8fd
 DIST gcc-13.3.0-patches-5.tar.xz 52820 BLAKE2B 73759dc576aab9e5f66dc7f9a1e8eb1b79a98bdb85bfdac9d611baa82c85a5f433d5031876c6e0ee2f02dd1d874da1661b0dd0f05906b118502f17bfaf16eb1a SHA512 4e6b626a562657f2d928324b412d5033464c09d283ad3a2ebfebbb5245bffb09c2532318325c4c16f4206df5cede6758fe1031c55e64dfb9b9ea08ef2c1e90af
+DIST gcc-13.3.0-patches-8.tar.xz 57472 BLAKE2B 85976f7313340ce7a2cd9e7fa67e6d69ca377741d435d113148d2b9083ce99ea720ecd0658149300c16a67ef368fcc8893756b86fcce31ba7ca899d509cbb2c9 SHA512 fd70e1309e4c8d321a81be1a228358db00369d1bd3e5d1fc6405c408b95494230cf70004cf1702e8c1e594f028aa35ffa67059f8f91a32699c69ff0de105e06a
 DIST gcc-13.4.0.tar.xz 88530720 BLAKE2B abbba220652d6e84c59554e754207be91d1250d7751c09163e3166a9da8c7eb4d538785697bb3aea65a8a433e8b82f9a969cf09bb0ecc5aa4a27c964f0acd7e8 SHA512 9b4b83ecf51ef355b868608b8d257b2fa435c06d2719cb86657a7c2c2a0828ff4ce04e9bac1055bbcad8ed5b4da524cafaef654785e23a50233d95d89201e35f
-DIST gcc-14-20250704.tar.xz 88301340 BLAKE2B db43d299aec1e402703db5c63a296065cdfdc94065ac3609c16e6594e80aae08e23448ef2405ade23c3d5fd38d2b79851b243807744f5b4f37eab71a0f526718 SHA512 7362674f80be46aa524a99b04a7d8130f02459a5d7bed430fe0dbf4d8ee3affe397c0689ba4d2ea60ad099788518da0ba1cba5bd54ddeb7b23d96137e6552f68
-DIST gcc-14-20250711.tar.xz 88322532 BLAKE2B 4d1b4a750125787d673d18ba3ce702c33f4c7b6836185c8942a4528ab7030ccc69c914b64bdead1d9c3baea857a806e490245d06c0ea5e06726de37681fa26ef SHA512 74ee2eafb543d1e9b77397d499939e3846a253ebc8015596bdf79e98038598751f21df21f8f1f675a90c3ebb844142f43ca2255cf0a0d3d2d1c51bc1cbb40062
-DIST gcc-14-20250718.tar.xz 88311396 BLAKE2B 7be5f5d27eb7311d496cee780ae40c18957a96b6301cbfa6c93d89687d9baba24a393acc86554252d655f7c1c2516fe37593db5b5bdc4cf9f65b5f6f8a21659a SHA512 2371880b7ceaf56ff8bd0819ea09017b5852d80f7496f81b1554d052114a945cc484d32026830fedccc27f6f60a9f8a521d756ca0b5884a8aca88b47c520726a
+DIST gcc-14-20250801.tar.xz 88323948 BLAKE2B 1d47af7340faeed133a1d55bed8a788e4a7e0d12741d80a4345053fae1e95aa57ba4a24361c130080539242e5e5a7f2076827fdd3f2be383ad8d739443c3c885 SHA512 4034c9cfc0eb64239fc2149709d2d9d5055cd11ee5ea2284c61ed3d230f812bc1d8899ead339940b579610b65e1939eaf8ec05a2e26a50cb2c2c5a802a3437ff
+DIST gcc-14-20250808.tar.xz 88335256 BLAKE2B 9d4a88792c4d37748fbd93c059bf88bf654c4507bcd75497c573b0792dd24ebff752f3fd7b529abcbbbbfa42d87b090f20121fd12da79c2619b616d9edc3525c SHA512 6a484676df0e3c87b418014608c34caa68bfbbd3d32f0d6a261f326344d9d34ef210b5799ac26aa7a7a8308b28e6a91b2fc4d99add31bb9f20c3d8eae461ac07
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
 DIST gcc-14.3.0-musl-patches-1.tar.xz 3468 BLAKE2B c576bc2b2c2ce742395ff32451a6a0737bc35ba02109f39249c449840e9cfda6ae709293b04e17ba85c9edc529114f7d77fe55f2ef559020af391c90885df054 SHA512 8b964188ac5cea5fe5ada35871268d836c4d4805affa8a06e43cc32c9a2c5386bf5eff2971ba311678eaa08885854aeda627dd15d292e67154c7691ce6fce49c
-DIST gcc-14.3.0-patches-1.tar.xz 14436 BLAKE2B a4679f87c67d4347a40e86a94f8a754e462a21761bb27494ccfce1d6bdd3a45bbeea64abed86a3ea1a116eab9a4d6e4faac9cba44fa0080e545a2a804e4921e7 SHA512 7d50eb5903f726b6a4f3179e88538583c0ad3ea32f9c49c0ef8ede0dbb2f3146e27ca7dd2d969a28e24550932843df6721bb465f0fcb26ba02def11c6136eaac
+DIST gcc-14.3.0-patches-4.tar.xz 28116 BLAKE2B 5804f10b40befad1cb9eab4e536377c08aed8c54d3de27f188ae2d52fa7c082a529ad9cb64f9574087afe74e64138c9fc918d653bd2c1d062b8b68d5c7ab640d SHA512 75ee4895efea0131107cf664a0f9fd10f38da0d0f93704e1920778e07f1a860d872a97e1e528f8e1ab754cca25948bb09c444b80cc04f5ae3a516336290bb99c
 DIST gcc-14.3.0.tar.xz 95212220 BLAKE2B 11c0e549b2e9b4bbbe4cd64782032d2ec783b3db8d4aa538ebd0a0c9760d8e521c32007891a608b081bc6dd353d4eb23030c5e2b9fe9a20c4894a8455dde47b6 SHA512 cb4e3259640721bbd275c723fe4df53d12f9b1673afb3db274c22c6aa457865dccf2d6ea20b4fd4c591f6152e6d4b87516c402015900f06ce9d43af66d3b7a93
 DIST gcc-15-20250705.tar.xz 92140172 BLAKE2B ac66bdda7beccab8b5b5565852e7f9743ba6f1cdeaa8ca7d15b14369251a0b592f92714c8c12e05df7d52d296a15843fe3301906e7e3c3574483be1e5485ffce SHA512 4a7304ed4ada55f5d37c191627de9f62e86c0a374987a3cdf43695ef436ab3eeeb7a143e5a11c3e5cac01c8c23c035f126d0c0a10dfd7686c8ec537dde61b9eb
-DIST gcc-15-20250712.tar.xz 92149428 BLAKE2B 106c53ed9bf68db9a637b4b59f1d7a7f4660f34eeaeb4839b7de005aef1ded893e9c62500a08d904402fa1c42d3ef2b1768a57717449984c752c2c4f939722c1 SHA512 122246196599b2ba4597a69ef733e2b36ed2a8fa757ed35eb9147e1ab3e62ec3fa5c8251aa0c4d5ba46cc9e44b7bc4072518bbd61820ba6df1acd9ab3d56c0fe
-DIST gcc-15-20250719.tar.xz 92169656 BLAKE2B 3b1e5ece557dee26830e080ab4add846b451da80b2d697c67aab93dbd168f83b56e2063b7ca74e4c2999cfd642ea5010a09f8bd1f37e93e2da17b5f5b0eff94d SHA512 a5e0082e492502385565479201bca3e9f5138a55d83540bff8b84a94d958c4d2afce474328656ee7d55fad910c04523c0068efe92382e68a327a65f6e641b88a
+DIST gcc-15-20250809.tar.xz 92336288 BLAKE2B 7b744d92a4ec23083c96e2a6e77df4e7f655e1d9ed55ebc5748c10177351f770ae7df5d78dd828173fd8498cf889de18d99cb7335a0bf38e008a4863cbc1cc70 SHA512 849cb5d2c8c0612f69c90f1662654028ebc0ceab738d707c4ef963063d7de7dd37fb70bd1a7a3275401105a604cbbdebfe0ee5855b8d3881dbd457002eadb38a
 DIST gcc-15.1.0-musl-patches-1.tar.xz 3036 BLAKE2B f7e8b794feb3c30252dd3e35b990c8a134d337e285a2778ad5575b04667cf01040bf4187252151cd57097cd6d440851843156c9631736f4f065ca8b7ce2f0678 SHA512 4d3f1660d89484f63ad6c238884415673cdfdabb8833cce2fe114193b52f11b3518b034881024527f6553de93936d15ed707d4d2b1e8221908a08ec67810464b
 DIST gcc-15.1.0-patches-1.tar.xz 18628 BLAKE2B ee5fc9d6a06374ccc8d85cd1e269514fde8fed9b1810867a199ac747c09fc166e11e54ba531d42ee2ffbab3ca80277f9ad3c873fbaa3530ff60e5f2bc25c41ba SHA512 72992f0698f632c98abd6d8c7a7a38a109b2f064775a0c5029e44dc29cd88ae061cddd603d47eabced5af5f8571e0b73c9778080873c69dd4dc4766c60339b28
 DIST gcc-15.1.0-patches-2.tar.xz 19340 BLAKE2B ea8be3f2a79cfbc69583dd7b96590ebfb74a3ccb90a5f36700c66369c44b349d69f5e9903d83e1db1807dcbe77e6fd46221964c52fd0a594e6853c6e01d638f0 SHA512 954ddca48ebe44e1e93bf938b493d347592a4a0cb255a980a893cf5ff5378c6ac333389f0fcdff6fa4cefbd40212f0a32c64cdefc9e9874df44a2db904fdc5f6
-DIST gcc-15.1.0-patches-3.tar.xz 18664 BLAKE2B 8b6c04bb011122a8a748e8c6de59d5d4998bc02cc02667a48b3d7754721bf59d22bb3e31ab07c7ab26ece2f2ad3d7bcd319c84d58d0361ae6621bed6bebc53a0 SHA512 3c6d79449f44f9229ef0b5994933fdaece97eb78dd6c6497d6277ea34e5f02af7ce60902c452d0ce9db8d560e73703e7f32becf35a822dd6ac46496711969287
+DIST gcc-15.1.0-patches-5.tar.xz 17476 BLAKE2B 82d08ac11358d9199989a5ee5a9327a6beab07ac309ae024125f0c1bf9a120ed0799bc15730b099aa631166735151bbd5385aa0fdc68958b3e97ee0379764036 SHA512 e218ba883a6be70a4b0a8e987b2b2e165ebc9bf9c295b15399710ed295ca4ea86372b18c3a87e227ef287642c6edbda0d0f9e769ab6c5bbd5975c2d8597deb90
 DIST gcc-15.1.0.tar.xz 98268344 BLAKE2B a902ce99db4e93615879e435bcd0b96d5a16ea0af42598ca0e6d12913b2ce3651a98574c3264b2717b848e6b5a823b403ccca0adde463938d5b41aa3f1da0d34 SHA512 ddd35ca6c653dffa88f7c7ef9ee4cd806e156e0f3b30f4d63e75a8363361285cd566ee73127734cde6a934611de815bee3e32e24bfd2e0ab9f7ff35c929821c1
-DIST gcc-16-20250706.tar.xz 94122820 BLAKE2B ec48e2eef32aa2dfebff8264b943f344f8e06d6f2175ba75850a14d5019060800cfc94984ea7649483661c62818210259a22d0e33e60bfb32db02d372ce6b12a SHA512 a194f808ce19b66dc0786b62e23bc75e29e3d79779b2176c0f7e8bda564d937e2f0e83fb2337d3b8b5230bb22d1a053b371276418fd537d7ccc9e5242496037c
-DIST gcc-16-20250713.tar.xz 94187924 BLAKE2B 72381c90481e854f90358f98be3d3face062bbb9627c0a8810e8d8c325974abaa651396d20e249f6133b6fbae09bac2c521349809532160ecf9a545c422e9a62 SHA512 a76965f94b59eb931215ed763df44dc1e91683711b704b5b375ecddfda8c23c0d33b932788580de430040ccf58b3db193ebbe0a0ef6dd23391b15edebd043dc1
-DIST gcc-16-20250720.tar.xz 94259592 BLAKE2B bbfb90cd4ce556fdfde1bd80eb1255b57ef986b6c545d8a54a18e4868f5d25a299b0d39267d364b5ca267613d50bbcd432f507948db5a970cfd3d019eb3c3712 SHA512 91548580191b645a9b322bc1559d20ca81e70361b8ac2e5a4abf09fc03681c169c5846a22f149b9ff035301ff2ed1999d883a85c080a5e4319d1754657df0a72
+DIST gcc-15.2.0.tar.xz 101056276 BLAKE2B e270320978ca690e6e8f5ef06414dc13caf561f16403a3783c76fbf3dcee57e755a2d5bba922bf7fcae0bb6120443755d819b003791ae823d54589dd799804de SHA512 89047a2e07bd9da265b507b516ed3635adb17491c7f4f67cf090f0bd5b3fc7f2ee6e4cc4008beef7ca884b6b71dffe2bb652b21f01a702e17b468cca2d10b2de
+DIST gcc-16-20250803.tar.xz 95270732 BLAKE2B e63ada078704b0ff2a2646ed725db61d89aa3f27808cfe4ac0bacd86d9c08904a71b72e669b8b714b00db28196f6c6e1bf1aabef6459800f9fbc4d709356b6f1 SHA512 c5e74c95db89a38abc74711beb7ce14c8305962c4f98bae107b313ffec43de5e69853fb0f1f3b9ebbf75ee18e6ac6aea3c6f075e8aa509ef94ea7467a0f73cb4
+DIST gcc-16-20250810.tar.xz 95341000 BLAKE2B 6ccc5cac9a3c396c2b96658325186adf7866712af7c51732a515f400414570e1e4bb01c10dd509c5d38521f98abc1f257cf95ab68327e04d847b49f186253ef0 SHA512 ec037341f7e3b4c22bc0269cf99b779daddb3fb288969651d508e691d8360baed39939ceeb707c4b4cd094283aef446cbb538213c64ff08f15581682f4a65139
 DIST gcc-16.0.0-musl-patches-1.tar.xz 3040 BLAKE2B 18b16357699780eb470cf44a10710281955140103198e0bd55b75e1efe3dbec233689edb11e1b9a62f782f3d97293af4906c18c2c41613b422eda085ee819467 SHA512 5ba580c7c7bb9e62935a5162d44d357cc31185a113acff7498ed7b1ac43fd0a35de7c3de0c87f02fe0be46b5e55b49bb35d1f5cd470058d21a9ea4096a37e13d
-DIST gcc-16.0.0-patches-5.tar.xz 23960 BLAKE2B 216e4d2b669043f2bd50fa69099388475b81129a9c96884f5ee1846dedd926e5243217d361ad840537c503e3af429d4930dbda92becbd4575fd6d5f4e3b3f47e SHA512 7aa48f5b979ee8feaa722d718d94497f7ae2d51b1793f7f7717befd7d8c5f379557e03d8af14c33b4483e64ad2e702ae6ae34a127a082abeb7e65acaa4999a3f
-DIST gcc-16.0.0-patches-6.tar.xz 22984 BLAKE2B 8766217760bf6397c5d929866e52f26b3b1c3004095ed6e35ed79196d6bac64635a90a68f677c8536748d7169116d6db50b7b851bd6ba8d7a25110127c86b933 SHA512 763394ee2aa3d3038a6dbbc8b30441b674f1d309a3a5ae3e33bdc850b26b4d579e44254d9fcd0f69f0f98aaa375b89c10524626c79a25df91f07f1f8959d68bb
-DIST gcc-16.0.0-patches-7.tar.xz 18380 BLAKE2B d537c65169e1dd7f68efa06875eb8b1558309a850dfab2ed175f36a62adbeb246eda019c39ff853af2826c7699c9e994c755bfb2ce744e5db9e106568c220bda SHA512 f66838ee282ef41ddc4199e9209688321804fb07c90359b161f7a608e98c1e4c02b03ab5f5d2a5827dab438f2a4bfee4d384e9b63067b7c52cd15678bd936df3
-DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
+DIST gcc-16.0.0-patches-9.tar.xz 18504 BLAKE2B b51c4547a12c04db2f37f26cf5c9cf1d6fa003fe4dde657c179e13e4b0e52b8e847efbaf139b1a418687259321dc350c98f01ba17501a1330f0dc3b68516b3f8 SHA512 67e4fadca36d0562586aac4c86673c918072642c7e7589c7b47643f35336bcc3e2adaea40b332cddd24821d1d1876c6a902763827dbb62e8d9b08161c3dbe49a
+DIST gcc-8.5.0-patches-5.tar.xz 20188 BLAKE2B 45b29161105edc6344bb48f5bdf17e1aad6e8d9edb4d9434816425996c1b12c10f1303963776adad9db866d845f864d80d198a30e35ee6c204ca3659cf7a1401 SHA512 f22ab5d8e3116e2e896a5dcbbf5cef67dc5090182af364ef64fc22d2b28c029da5ed39f126f446721e388e7b6848239d01f5fc0346e49b96d5c04068b557f8f8
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
-DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
+DIST gcc-9.5.0-patches-3.tar.xz 17888 BLAKE2B f2be05f32f4ecca41ebf4f402bf8fb3c11a36a8b7bd912ee9fe6baea980929774b629e12df7afb3405f1f5d044766a437b3eca5433f4af6c757f4a9dbb2e77eb SHA512 d31bb1964cdb2376572e4981b22c7ffa6fa695259c27af5d0d12aebc334cd1122c2f75739033f25f1e672300adeab2b3772622cb16099d002f3f8c5a8fe694f9
 DIST gcc-9.5.0.tar.xz 72462752 BLAKE2B 69e39314ee6bb46e3be491ba9c3cbc4914cb716f732c6d3f2b14d9382750b40c4f14b5d3051225b81f936ef8297b0ba8cb5439512e961dae5815d3bee2b0bfdb SHA512 cdd144ce4f747e051480410afc8506c90a57cb45da89071ddae377b1453bca3014422455ade9fe4563ebe51f4b6348cbc0c61905a9b8801cd597d51ad0ec62b3
 DIST gcc-validate-failures-a447cd6dee206facb66720bdacf0c765a8b09f33.py 27537 BLAKE2B 96c7474de0bc50ab890a91551412398c979396c43aa237a4b6d8baa98ce7fda2cc9f5a755a03fd9d055d885ee2fb40ba29644a0649c24398361ce75a20fae634 SHA512 409434953351cf1f2287f1e4a4fbde5b28a27add35ddd284080acec71b33cb4ec5e1c07f41a79fac060bd6f1eedd198812495141923e410ded907429fe515f83
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch
deleted file mode 100644
index 1a9c9747c4c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120358-qt-pta.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-https://bugs.gentoo.org/956308
-https://gcc.gnu.org/PR120358
-https://gcc.gnu.org/cgit/gcc/commit/?id=aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7
-
-From aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7 Mon Sep 17 00:00:00 2001
-Message-ID: <aa5ae523e84a97bf3a582ea0fa73d959afa9b9c7.1751999489.git.sam@gentoo.org>
-From: Richard Biener <rguenther@suse.de>
-Date: Mon, 7 Jul 2025 15:13:38 +0200
-Subject: [PATCH] tree-optimization/120358 - bogus PTA with structure access
-
-When we compute the constraint for something like
-MEM[(const struct QStringView &)&tok2 + 32] we go and compute
-what (const struct QStringView &)&tok2 + 32 points to and then
-add subvariables to its dereference that possibly fall in the
-range of the access according to the original refs size.  In
-doing that we disregarded that the subvariable the starting
-address points to might not be aligned to it and thus the
-access might start at any point within that variable.  The following
-conservatively adjusts the pruning of adjacent sub-variables to
-honor this.
-
-	PR tree-optimization/120358
-	* tree-ssa-structalias.cc (get_constraint_for_1): Adjust
-	pruning of sub-variables according to the imprecise
-	known start offset.
----
- gcc/tree-ssa-structalias.cc | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/gcc/tree-ssa-structalias.cc b/gcc/tree-ssa-structalias.cc
-index deca44ae0bf3..0215243d5be9 100644
---- a/gcc/tree-ssa-structalias.cc
-+++ b/gcc/tree-ssa-structalias.cc
-@@ -3690,7 +3690,10 @@ get_constraint_for_1 (tree t, vec<ce_s> *results, bool address_p,
- 		    size = -1;
- 		  for (; curr; curr = vi_next (curr))
- 		    {
--		      if (curr->offset - vi->offset < size)
-+		      /* The start of the access might happen anywhere
-+			 within vi, so conservatively assume it was
-+			 at its end.  */
-+		      if (curr->offset - (vi->offset + vi->size - 1) < size)
- 			{
- 			  cs.var = curr->id;
- 			  results->safe_push (cs);
--- 
-2.50.0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch
deleted file mode 100644
index 4d1ee50d801..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-16.0.0_p20250706-PR120949-clang-algorithm.patch
+++ /dev/null
@@ -1,166 +0,0 @@
-https://gcc.gnu.org/PR120949
-https://bugs.gentoo.org/959695
-https://bugs.gentoo.org/959697
-https://bugs.gentoo.org/959700
-https://bugs.gentoo.org/959704
-
-From ed912b1ee5ad0f241f968d5fd1a54a7e9e0e20dd Mon Sep 17 00:00:00 2001
-Message-ID: <ed912b1ee5ad0f241f968d5fd1a54a7e9e0e20dd.1751999555.git.sam@gentoo.org>
-From: Jonathan Wakely <jwakely@redhat.com>
-Date: Fri, 4 Jul 2025 21:19:52 +0100
-Subject: [PATCH] libstdc++: Fix attribute order on __normal_iterator friends
- [PR120949]
-
-In r16-1911-g6596f5ab746533 I claimed to have reordered some attributes
-for compatibility with Clang, but it looks like I got the Clang
-restriction backwards and put them all in the wrong order. Clang trunk
-accepts either order (probably since the llvm/llvm-project#133107 fix)
-but released versions still require a particular order.
-
-There were also some cases where the attributes were after the friend
-keyword, which Clang trunk still rejects.
-
-libstdc++-v3/ChangeLog:
-
-	PR libstdc++/120949
-	* include/bits/stl_iterator.h (__normal_iterator): Fix order of
-	always_inline and nodiscard attributes for Clang compatibility.
----
- libstdc++-v3/include/bits/stl_iterator.h | 30 +++++++++++++-----------
- 1 file changed, 16 insertions(+), 14 deletions(-)
-
-diff --git a/libstdc++-v3/include/bits/stl_iterator.h b/libstdc++-v3/include/bits/stl_iterator.h
-index a7188f46f6db..75e794f6c020 100644
---- a/libstdc++-v3/include/bits/stl_iterator.h
-+++ b/libstdc++-v3/include/bits/stl_iterator.h
-@@ -1211,7 +1211,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- #else
-        // Forward iterator requirements
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1220,7 +1220,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() == __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1229,7 +1229,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() == __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1238,7 +1238,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() != __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1248,15 +1248,16 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 
-       // Random access iterator requirements
-       template<typename _Iter>
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD _GLIBCXX_CONSTEXPR
-+	_GLIBCXX_CONSTEXPR
- 	inline bool
- 	operator<(const __normal_iterator& __lhs,
- 		  const __normal_iterator<_Iter, _Container>& __rhs)
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() < __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX20_CONSTEXPR
-       bool
-@@ -1265,15 +1266,16 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() < __rhs.base(); }
- 
-       template<typename _Iter>
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD _GLIBCXX_CONSTEXPR
-+	_GLIBCXX_CONSTEXPR
- 	bool
- 	operator>(const __normal_iterator& __lhs,
- 		  const __normal_iterator<_Iter, _Container>& __rhs)
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() > __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1282,7 +1284,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() > __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1291,7 +1293,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() <= __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1300,7 +1302,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
-       { return __lhs.base() <= __rhs.base(); }
- 
-       template<typename _Iter>
--	__attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+	_GLIBCXX_NODISCARD __attribute__((__always_inline__))
- 	friend
- 	_GLIBCXX_CONSTEXPR
- 	bool
-@@ -1309,7 +1311,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
- 	{ return __lhs.base() >= __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       bool
-@@ -1341,7 +1343,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- #endif
- 	{ return __lhs.base() - __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       difference_type
-@@ -1349,7 +1351,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
- 	_GLIBCXX_NOEXCEPT
-       { return __lhs.base() - __rhs.base(); }
- 
--      __attribute__((__always_inline__)) _GLIBCXX_NODISCARD
-+      _GLIBCXX_NODISCARD __attribute__((__always_inline__))
-       friend
-       _GLIBCXX_CONSTEXPR
-       __normal_iterator
--- 
-2.50.0
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 77bed7c34b1..a8c26a52401 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="10.5.0"
-PATCH_VER="6"
+PATCH_VER="7"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 8ba8ef1f813..ddd706aca5a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="11.5.0"
-PATCH_VER="1"
+PATCH_VER="2"
 MUSL_VER="3"
 MUSL_GCC_VER="11.5.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
index a635f1a21b3..2dede09b939 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
-PATCH_VER="3"
+PATCH_VER="4"
 MUSL_VER="3"
 MUSL_GCC_VER="12.4.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild
deleted file mode 100644
index 37101ec35c2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250703.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="13.3.0"
-MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
-MUSL_VER="2"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild
deleted file mode 100644
index 37101ec35c2..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250717.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="13.3.0"
-MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
-MUSL_VER="2"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
index 37101ec35c2..eb284e6784d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250710.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.1_p20250807.ebuild
@@ -10,7 +10,7 @@ TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
 MUSL_GCC_VER="13.3.0"
-PATCH_VER="5"
+PATCH_VER="8"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{11..14} )
 
@@ -42,7 +42,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild
deleted file mode 100644
index 11a03187dca..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250718.ebuild
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
-MUSL_VER="1"
-MUSL_GCC_VER="14.3.0"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# m68k doesnt build (ICE, bug 932733)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
index 11a03187dca..141c5143b38 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250704.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250801.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.3.0"
 PYTHON_COMPAT=( python3_{11..14} )
@@ -30,7 +30,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# m68k doesnt build (ICE, bug 932733)
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
index 11a03187dca..0995b00e4ed 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250711.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.1_p20250808.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.3.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.3.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
index c6f54a62069..4a055e721ec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250712.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.1.0"
-PATCH_VER="3"
+PATCH_VER="5"
 MUSL_VER="1"
 MUSL_GCC_VER="15.1.0"
 PYTHON_COMPAT=( python3_{11..14} )
@@ -30,7 +30,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=master
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
index c6f54a62069..89436290970 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.1_p20250719.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.2.1_p20250809.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.1.0"
-PATCH_VER="3"
+PATCH_VER="5"
 MUSL_VER="1"
 MUSL_GCC_VER="15.1.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.9999.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.1.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.3.9999.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild
deleted file mode 100644
index 0d09ce71547..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250706-r1.ebuild
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintenance notes and explanations of GCC handling are on the wiki:
-# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="16.0.0"
-PATCH_VER="5"
-MUSL_VER="1"
-MUSL_GCC_VER="16.0.0"
-PYTHON_COMPAT=( python3_{11..14} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply "${FILESDIR}"/${P}-PR120358-qt-pta.patch
-	eapply "${FILESDIR}"/${P}-PR120949-clang-algorithm.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
index b50da9e405f..1f65e7fb575 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250720.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250803.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
-PATCH_VER="7"
+PATCH_VER="9"
 MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
index f8f087f67ea..1f65e7fb575 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250713.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-16.0.0_p20250810.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="16.0.0"
-PATCH_VER="6"
+PATCH_VER="9"
 MUSL_VER="1"
 MUSL_GCC_VER="16.0.0"
 PYTHON_COMPAT=( python3_{11..14} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
index 55f5d05f73f..c106ad8f8ec 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
@@ -9,7 +9,7 @@ EAPI="8"
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_VER="4"
+PATCH_VER="5"
 PYTHON_COMPAT=( python3_{11..14} )
 
 inherit toolchain
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index 90cd6d31e3a..ac627099c96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -9,7 +9,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
-PATCH_VER="2"
+PATCH_VER="3"
 PYTHON_COMPAT=( python3_{11..14} )
 
 if [[ ${PV} == *.9999 ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
index 1f95d4cec96..88f60a9e2dc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
@@ -1 +1,2 @@
 DIST gnuconfig-20240728.tar.xz 82360 BLAKE2B 476cabe032305adc916dffa39f30f07ac8249449e79da06763f08af9b642399c5c08bd5cf6b7229d63ba36b55e0ca75692b5db058ae0aa75b6b6370f12209aba SHA512 a43067a6f2a7f8d055122aefef2b0d28314c16871455e9223b8429a428ec6b4383eefe8fb50ff00d7c4c39710c6fb9fa81c3c84f3e6f5f58cbd1cf475896135e
+DIST gnuconfig-20250710.tar.xz 83388 BLAKE2B 3ae8bbec15255cfba57fbc1598228f90ff9ad82da6e1e1687c6937e9f1aa6a5ca56becf787308135cbb87eedf3eee51b20a8733c165e06613a0f9acd5fdf9cb9 SHA512 21d370bb917b91c393aebf17ecb446c5b9a93d88b29e021b85d28813de979e86053ef7af770fef0713093461268a439a17b573ce0e507dac04d089c058f7887f
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild
new file mode 100644
index 00000000000..02e93cc2904
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20250710.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 99999999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/r/config.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	S="${WORKDIR}"
+fi
+
+DESCRIPTION="Updated config.sub and config.guess file from GNU"
+HOMEPAGE="https://savannah.gnu.org/projects/config"
+
+LICENSE="GPL-3+-with-autoconf-exception"
+SLOT="0"
+
+maint_pkg_create() {
+	cd "${S}" || die
+
+	emake ChangeLog
+	local ver=$(gawk '{ gsub(/-/, "", $1); print $1; exit }' ChangeLog)
+	[[ ${#ver} != 8 ]] && die "invalid version '${ver}'"
+
+	local tar="${T}/gnuconfig-${ver}.tar.xz"
+	tar -Jcf "${tar}" ./* || die "creating tar failed"
+	einfo "Packaged tar now available:"
+	einfo "$(du -b "${tar}")"
+}
+
+src_unpack() {
+	if [[ ${PV} == 99999999 ]] ; then
+		git-r3_src_unpack
+		maint_pkg_create
+	else
+		unpack ${A}
+	fi
+}
+
+src_install() {
+	insinto /usr/share/${PN}
+	doins config.{sub,guess}
+	fperms +x /usr/share/${PN}/config.{sub,guess}
+	dodoc ChangeLog
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
index 75ae882382d..22e25e29aa5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202202.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}"
 # TODO: the binary 202105 package currently lacks the preseeded
 #       OVMF_VARS.secboot.fd file (that we typically get from fedora)
 
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
index e2582a3f091..6e11f9cc811 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202408.ebuild
@@ -12,7 +12,7 @@ DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
 HOMEPAGE="https://github.com/tianocore/edk2"
 SRC_URI=$(printf "https://dev.gentoo.org/~chewi/distfiles/${BINPKG}-%s.xpak\n" ${ARCHES})
 S="${WORKDIR}"
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
index de2d5e2553a..636670d43c7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/edk2-bin-202411.ebuild
@@ -12,7 +12,7 @@ DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
 HOMEPAGE="https://github.com/tianocore/edk2"
 SRC_URI=$(printf "https://dev.gentoo.org/~chewi/distfiles/${BINPKG}-%s.xpak\n" ${ARCHES})
 S="${WORKDIR}"
-LICENSE="BSD-2 MIT"
+LICENSE="BSD-2-with-patent MIT"
 SLOT="0"
 KEYWORDS="amd64 arm64 ~loong ~ppc ppc64 ~riscv x86"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
index 817e5f8061d..e35551b2182 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.8.0.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/${P/_/-}
 LICENSE="GPL-2+"
 SLOT="0/12" # libcryptsetup.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
index 41f1fa12637..6443a88d1a1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/Manifest
@@ -2,3 +2,4 @@ DIST dracut-060_pre20240104.tar.gz 499965 BLAKE2B 935e0e5da348426d69c6dab6b91078
 DIST dracut-103.tar.gz 567713 BLAKE2B 7781c0b7fc83a2c0c461f6398687e053226b489fb5405b3132b30d8e7a4f3cea2bb73aa0fe6e4c4b27187d6270ba623f403916ec38025a912930ae347a7e25ce SHA512 ba0dbefbcbecb09c44ce240664bc4f4ee25dfb8be7bc060028ae3b1ccf7d70410491c105e64fcef3d6f44d2794cb6162bcea9404125906be46bf3dff098e0277
 DIST dracut-106.tar.gz 527743 BLAKE2B 837621da329500b88b0c81a724990702a9f4e816a4818c26622b2bc5e3885c908f0bbba682a262f967d9a08a912cfd63a33270143560a30e3d067dc4217c5262 SHA512 ab17f9440129e2db7c2902115459309132ce7f7b29bbb3172002b7a8ea8ab54799d62d89fbf3f84581a5c14196f6754d33669b583b9d758ab4686a3443a3c4ad
 DIST dracut-107.tar.gz 536435 BLAKE2B 8ff85073853f874b31b659b73abfafe27bb0da59c8e77039bd1739d266dffe26616f6c96eceb2cb36319801d0fb3df53ea4153bf426f081e7e5b73c11522018b SHA512 3f8e79fbfd40c0d384e856cbabe9257c5cbafbb4a3fe4b56da27832c36844dbbf9c59f12155d165d9343bc7341eda2b90c215148eb46ae873c219fbc93992944
+DIST dracut-108.tar.gz 552724 BLAKE2B fa5efd4039be8d2d30564a0768d2dec8c3d72b3721391d3a02bde8445cd7a5766d4b119594ebbca86dbd59bd71b64353febaaa7e2257f02d0075333dc29e9047 SHA512 ed06844b65003c1f75373309dbdc10a3036958f413b05b608510142fa78bb34dd9fb1e622242b02b2e9e4063bfa916fd755f5131a77fb3249f77d3f08eca2283
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r1.ebuild
new file mode 100644
index 00000000000..7e8564719b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-108-r1.ebuild
@@ -0,0 +1,246 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+CARGO_OPTIONAL=1
+
+inherit cargo flag-o-matic bash-completion-r1 edo optfeature systemd toolchain-funcs
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/dracut-ng/dracut-ng"
+else
+	if [[ "${PV}" != *_rc* ]]; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+	SRC_URI="https://github.com/dracut-ng/dracut-ng/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${PN}-ng-${PV}"
+fi
+
+DESCRIPTION="Generic initramfs generation tool"
+HOMEPAGE="https://github.com/dracut-ng/dracut-ng/wiki"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+dracut-cpio selinux test"
+RESTRICT="test"
+PROPERTIES="test? ( test_privileged test_network )"
+
+RDEPEND="
+	app-alternatives/cpio
+	>=app-shells/bash-4.0:0
+	sys-apps/coreutils[xattr(-)]
+	>=sys-apps/kmod-23[tools]
+	|| (
+		>=sys-apps/sysvinit-2.87-r3
+		sys-apps/openrc[sysv-utils(-),selinux?]
+		sys-apps/systemd[sysv-utils]
+		sys-apps/s6-linux-init[sysv-utils(-)]
+	)
+	>=sys-apps/util-linux-2.21
+	virtual/pkgconfig[native-symlinks(+)]
+	virtual/udev
+
+	elibc_musl? ( sys-libs/fts-standalone )
+	selinux? (
+		sec-policy/selinux-dracut
+		sys-libs/libselinux
+		sys-libs/libsepol
+	)
+"
+DEPEND="
+	>=sys-apps/kmod-23
+	elibc_musl? ( sys-libs/fts-standalone )
+"
+
+BDEPEND="
+	|| (
+		dev-ruby/asciidoctor
+		app-text/asciidoc
+	)
+	app-text/docbook-xml-dtd:4.5
+	>=app-text/docbook-xsl-stylesheets-1.75.2
+	>=dev-libs/libxslt-1.1.26
+	virtual/pkgconfig
+	dracut-cpio? ( ${RUST_DEPEND} )
+	test? (
+		net-nds/rpcbind
+		net-fs/nfs-utils
+		sys-block/open-iscsi
+		sys-fs/btrfs-progs
+		sys-fs/dmraid
+		sys-fs/lvm2[lvm,thin]
+		sys-fs/mdadm
+		sys-fs/multipath-tools
+		alpha? ( app-emulation/qemu[qemu_softmmu_targets_alpha] )
+		amd64? ( app-emulation/qemu[qemu_softmmu_targets_x86_64] )
+		arm? ( app-emulation/qemu[qemu_softmmu_targets_arm] )
+		arm64? ( app-emulation/qemu[qemu_softmmu_targets_aarch64] )
+		hppa? ( app-emulation/qemu[qemu_softmmu_targets_hppa] )
+		loong? ( app-emulation/qemu[qemu_softmmu_targets_loongarch64] )
+		mips? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_mips]
+			app-emulation/qemu[qemu_softmmu_targets_mips64]
+			app-emulation/qemu[qemu_softmmu_targets_mips64el]
+		) )
+		ppc? ( app-emulation/qemu[qemu_softmmu_targets_ppc] )
+		ppc64? ( app-emulation/qemu[qemu_softmmu_targets_ppc64] )
+		riscv? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_riscv32]
+			app-emulation/qemu[qemu_softmmu_targets_riscv64]
+		) )
+		sparc? ( || (
+			app-emulation/qemu[qemu_softmmu_targets_sparc]
+			app-emulation/qemu[qemu_softmmu_targets_sparc64]
+		) )
+		x86? ( app-emulation/qemu[qemu_softmmu_targets_i386] )
+	)
+"
+
+QA_MULTILIB_PATHS="usr/lib/dracut/.*"
+
+PATCHES=(
+	"${FILESDIR}"/gentoo-ldconfig-paths-r1.patch
+	# Gentoo specific acct-user and acct-group conf adjustments
+	"${FILESDIR}"/${PN}-108-acct-user-group-gentoo.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1447
+	"${FILESDIR}"/${PN}-108-respect-objcopy-and-objdump.patch
+	# https://github.com/dracut-ng/dracut-ng/pull/1538
+	"${FILESDIR}"/${PN}-108-elf-parsing-fixes.patch
+)
+
+pkg_setup() {
+	use dracut-cpio && rust_pkg_setup
+}
+
+src_configure() {
+	local myconf=(
+		--prefix="${EPREFIX}/usr"
+		--sysconfdir="${EPREFIX}/etc"
+		--bashcompletiondir="$(get_bashcompdir)"
+		--systemdsystemunitdir="$(systemd_get_systemunitdir)"
+		--disable-dracut-cpio
+	)
+
+	if ! has_version dev-ruby/asciidoctor; then
+		myconf+=( --disable-asciidoctor )
+	fi
+
+	# this emulates what the build system would be doing without us
+	append-cflags -D_FILE_OFFSET_BITS=64
+
+	tc-export CC PKG_CONFIG
+
+	edo ./configure "${myconf[@]}"
+	if use dracut-cpio; then
+		cargo_gen_config
+		cargo_src_configure
+	fi
+}
+
+src_compile() {
+	default
+	if use dracut-cpio; then
+		pushd src/dracut-cpio >/dev/null || die
+		cargo_src_compile
+		popd >/dev/null || die
+	fi
+}
+
+src_test() {
+	addwrite /dev/kvm
+	# Translate ARCH so run-qemu can find the correct qemu-system-ARCH
+	local qemu_arch
+	if use amd64; then
+		qemu_arch=x86_64
+	elif use arm64; then
+		qemu_arch=aarch64
+	elif use loong; then
+		qemu_arch=loongarch64
+	elif use x86; then
+		qemu_arch=i386
+	else
+		qemu_arch=$(tc-arch)
+	fi
+	ARCH=${qemu_arch} emake -C test check
+}
+
+src_install() {
+	local DOCS=(
+		AUTHORS
+		NEWS.md
+		README.md
+	)
+	default
+	if use dracut-cpio; then
+		exeinto /usr/lib/dracut
+		doexe "src/dracut-cpio/$(cargo_target_dir)/dracut-cpio"
+	fi
+
+	# Use our own from sys-kernel/installkernel[dracut]
+	rm -r "${ED}/usr/lib/kernel" || die
+}
+
+pkg_preinst() {
+	# Remove directory/symlink conflicts
+	# https://bugs.gentoo.org/943007
+	local save_nullglob=$(shopt -p nullglob)
+	shopt -s nullglob
+	local module
+	for module in "${EROOT}"/usr/lib/dracut/modules.d/{80test,80test-makeroot,80test-root}; do
+		if [[ ! -L ${module} && -d ${module} ]]; then
+			rm -rv "${module}" || die
+		fi
+		local backups=( "${module}".backup.* )
+		if [[ ${#backups[@]} -gt 0 ]]; then
+			rm -v "${backups[@]}" || die
+		fi
+	done
+	eval "${save_nullglob}"
+}
+
+pkg_postinst() {
+	optfeature "Networking support" net-misc/networkmanager
+	optfeature "Legacy networking support" net-misc/curl "net-misc/dhcp[client]" \
+		sys-apps/iproute2 "net-misc/iputils[arping]"
+	optfeature "Scan for Btrfs on block devices"  sys-fs/btrfs-progs
+	optfeature "Load kernel modules and drop this privilege for real init" \
+		sys-libs/libcap
+	optfeature "Support CIFS" net-fs/cifs-utils
+	optfeature "Decrypt devices encrypted with cryptsetup/LUKS" \
+		"sys-fs/cryptsetup[-static-libs]"
+	optfeature "Support for GPG-encrypted keys for crypt module" \
+		app-crypt/gnupg
+	optfeature \
+		"Allows use of dash instead of default bash (on your own risk)" \
+		app-shells/dash
+	optfeature \
+		"Allows use of busybox instead of default bash (on your own risk)" \
+		sys-apps/busybox
+	optfeature "Support iSCSI" sys-block/open-iscsi
+	optfeature "Support Logical Volume Manager" sys-fs/lvm2[lvm]
+	optfeature "Support MD devices, also known as software RAID devices" \
+		sys-fs/mdadm sys-fs/dmraid
+	optfeature "Support Device Mapper multipathing" sys-fs/multipath-tools
+	optfeature "Plymouth boot splash"  '>=sys-boot/plymouth-0.8.5-r5'
+	optfeature "Support network block devices" sys-block/nbd
+	optfeature "Support NFS" net-fs/nfs-utils net-nds/rpcbind
+	optfeature \
+		"Install ssh and scp along with config files and specified keys" \
+		virtual/openssh
+	optfeature "Enable logging with rsyslog" app-admin/rsyslog
+	optfeature "Support Squashfs" sys-fs/squashfs-tools
+	optfeature "Support TPM 2.0 TSS" app-crypt/tpm2-tools
+	optfeature "Support Bluetooth (experimental)" net-wireless/bluez
+	optfeature "Support BIOS-given device names" sys-apps/biosdevname
+	optfeature "Support network NVMe" sys-apps/nvme-cli app-misc/jq
+	optfeature \
+		"Enable rngd service to help generating entropy early during boot" \
+		sys-apps/rng-tools
+	optfeature "building Unified Kernel Images with dracut (--uefi)" \
+		"sys-apps/systemd[boot]" "sys-apps/systemd-utils[boot]"
+	optfeature "automatically generating an initramfs on each kernel installation" \
+		"sys-kernel/installkernel[dracut]"
+	optfeature "automatically generating an UKI on each kernel installation" \
+		"sys-kernel/installkernel[dracut,uki]"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
index 624115e9cc8..95c80b5dac1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/dracut-9999.ebuild
@@ -54,7 +54,10 @@ DEPEND="
 "
 
 BDEPEND="
-	app-text/asciidoc
+	|| (
+		dev-ruby/asciidoctor
+		app-text/asciidoc
+	)
 	app-text/docbook-xml-dtd:4.5
 	>=app-text/docbook-xsl-stylesheets-1.75.2
 	>=dev-libs/libxslt-1.1.26
@@ -115,6 +118,10 @@ src_configure() {
 		--disable-dracut-cpio
 	)
 
+	if ! has_version dev-ruby/asciidoctor; then
+		myconf+=( --disable-asciidoctor )
+	fi
+
 	# this emulates what the build system would be doing without us
 	append-cflags -D_FILE_OFFSET_BITS=64
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch
new file mode 100644
index 00000000000..52c15205c63
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-acct-user-group-gentoo.patch
@@ -0,0 +1,13 @@
+diff --git a/modules.d/73tpm2-tss/module-setup.sh b/modules.d/73tpm2-tss/module-setup.sh
+index 4441f5528..4b5654d56 100755
+--- a/modules.d/73tpm2-tss/module-setup.sh
++++ b/modules.d/73tpm2-tss/module-setup.sh
+@@ -30,7 +30,7 @@ installkernel() {
+ 
+ # Install the required file(s) and directories for the module in the initramfs.
+ install() {
+-    inst_sysusers tpm2-tss.conf
++    inst_sysusers tss.conf
+ 
+     inst_multiple -o \
+         "$tmpfilesdir"/tpm2-tss-fapi.conf \
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch
new file mode 100644
index 00000000000..b23030efbfb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-elf-parsing-fixes.patch
@@ -0,0 +1,122 @@
+From 88e375f89c11c989737f6d00b0cfe6309f7447d7 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 12:50:12 +0100
+Subject: [PATCH 1/3] fix(dracut-install): the -n short option for --dry-run
+
+I forgot to update the getopt call.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -1638,7 +1638,7 @@ static int parse_argv(int argc, char *argv[])
+                 {NULL, 0, NULL, 0}
+         };
+ 
+-        while ((c = getopt_long(argc, argv, "madfhlL:oD:Hr:Rp:P:s:S:N:v", options, NULL)) != -1) {
++        while ((c = getopt_long(argc, argv, "madfhlL:oD:Hr:Rp:P:s:S:N:vn", options, NULL)) != -1) {
+                 switch (c) {
+                 case ARG_VERSION:
+                         puts(PROGRAM_VERSION_STRING);
+-- 
+2.50.1
+
+
+From 06e95cc602d0c6df99f4a54b2ade7deb59343a40 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 12:52:23 +0100
+Subject: [PATCH 2/3] fix(dracut-install): the RUNPATH expansion returning
+ empty strings
+
+The input was not initially copied into the result, so the result would
+start with a null pointer and be treated as an empty string. Expansion
+will not occur in most cases, leading to a straight copy of input being
+returned, so just do that in the first place.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -770,7 +770,7 @@ static char *search_via_ldconf(const char *conf_pattern, const char *soname, con
+    expands to the directory of the given src path. $LIB expands to lib if
+    match64 is NULL or lib64 otherwise. Returns a newly allocated string even if
+    no expansion was necessary. */
+-static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *match64)
++static char *expand_runpath(const char *input, const char *src, const Elf64_Ehdr *match64)
+ {
+         regex_t regex;
+         regmatch_t rmatch[3]; /* 0: full match, 1: without brackets, 2: with brackets */
+@@ -780,11 +780,15 @@ static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *matc
+                 return NULL;
+         }
+ 
+-        char *result = NULL, *current = input;
++        char *result = strdup(input);
++        if (!result)
++                goto oom;
++
++        const char *current = input;
+         int offset = 0;
+ 
+         while (regexec(&regex, current + offset, 3, rmatch, 0) == 0) {
+-                char *varname = NULL;
++                const char *varname = NULL;
+                 _cleanup_free_ char *varval = NULL;
+                 size_t varname_len, varval_len;
+ 
+@@ -823,7 +827,7 @@ static char *expand_runpath(char *input, const char *src, const Elf64_Ehdr *matc
+         }
+ 
+         regfree(&regex);
+-        return result ?: strdup(current);
++        return result;
+ 
+ oom:
+         log_error("Out of memory");
+-- 
+2.50.1
+
+
+From 9f2f306fa971ee00cee0ae307479bc8a8dbc5263 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 8 Aug 2025 13:18:07 +0100
+Subject: [PATCH 3/3] fix(dracut-install): the handling of absolute paths in
+ sonames
+
+If the soname is an absolute path, expand it like the RUNPATH, and
+return it (with the sysroot) without further checks like glibc and musl
+do.
+
+They also support relative paths, but we cannot feasibly support them.
+Such paths are relative to the current directory of the calling process
+at runtime, which we cannot know in this context.
+
+This was observed with Neovim.
+
+Bug: https://bugs.gentoo.org/961101
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/src/install/dracut-install.c
++++ b/src/install/dracut-install.c
+@@ -894,6 +894,21 @@ oom:
+ static char *find_library(const char *soname, const char *src, size_t src_len, const Elf64_Ehdr *match64,
+                           const Elf32_Ehdr *match32)
+ {
++        /* If the soname is an absolute path, expand it like the RUNPATH, and
++           return it (with the sysroot) without further checks like glibc and
++           musl do. They also support relative paths, but we cannot feasibly
++           support them. Such paths are relative to the current directory of the
++           calling process at runtime, which we cannot know in this context. */
++        if (soname[0] == '/') {
++                _cleanup_free_ char *expanded = expand_runpath(soname, src, match64);
++                if (!expanded)
++                        return NULL;
++
++                char *sysroot_expanded = NULL;
++                _asprintf(&sysroot_expanded, "%s%s", sysrootdir ?: "", expanded);
++                return sysroot_expanded;
++        }
++
+         if (match64)
+                 FIND_LIBRARY_RUNPATH_FOR_BITS(64, match64);
+         else if (match32)
+-- 
+2.50.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch
new file mode 100644
index 00000000000..5ab73d1a8e8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/dracut/files/dracut-108-respect-objcopy-and-objdump.patch
@@ -0,0 +1,89 @@
+diff --git a/dracut-functions.sh b/dracut-functions.sh
+index 84a34fafd..617ccf91c 100755
+--- a/dracut-functions.sh
++++ b/dracut-functions.sh
+@@ -1042,7 +1042,7 @@ get_dev_module() {
+ pe_file_format() {
+     if [[ $# -eq 1 ]]; then
+         local magic
+-        magic=$(objdump -p "$1" \
++        magic=$("${OBJDUMP:-objdump}" -p "$1" \
+             | awk '{if ($1 == "Magic"){print $2}}')
+         # 010b (PE32), 020b (PE32+)
+         [[ $magic == "020b" || $magic == "010b" ]] && return 0
+@@ -1055,7 +1055,7 @@ pe_get_header_data() {
+     local data_header
+     [[ $# -ne "2" ]] && return 1
+     [[ $(pe_file_format "$1") -eq 1 ]] && return 1
+-    data_header=$(objdump -p "$1" \
++    data_header=$("${OBJDUMP:-objdump}" -p "$1" \
+         | awk -v data="$2" '{if ($1 == data){print $2}}')
+     echo "$data_header"
+ }
+diff --git a/dracut.sh b/dracut.sh
+index 45373efb7..b53d72924 100755
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -1649,7 +1649,7 @@ if [[ ! $print_cmdline ]]; then
+     fi
+ 
+     if [[ $uefi == yes ]]; then
+-        if ! command -v objcopy &> /dev/null; then
++        if ! command -v "${OBJCOPY:-objcopy}" &> /dev/null; then
+             dfatal "Need 'objcopy' to create a UEFI executable"
+             exit 1
+         fi
+@@ -2638,7 +2638,7 @@ clean_sbat_string() {
+ get_sbat_string() {
+     local inp=$1
+     local out=$uefi_outdir/$2
+-    objcopy -O binary --only-section=.sbat "$inp" "$out"
++    "${OBJCOPY:-objcopy}" -O binary --only-section=.sbat "$inp" "$out"
+     clean_sbat_string "$out"
+ }
+ 
+@@ -2656,7 +2656,7 @@ if [[ $uefi == yes ]]; then
+         fi
+     fi
+ 
+-    offs=$(($(objdump -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=$3;
++    offs=$(($("${OBJDUMP:-objdump}" -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=$3;
+                 offset=$4} END {print "16#"size" + 16#"offset}')))
+     if [[ $offs -eq 0 ]]; then
+         dfatal "Failed to get the size of $uefi_stub to create UEFI image file"
+@@ -2719,7 +2719,7 @@ if [[ $uefi == yes ]]; then
+ 
+     tmp_uefi_stub=$uefi_outdir/elf.stub
+     cp "$uefi_stub" "$tmp_uefi_stub"
+-    objcopy --remove-section .sbat "$tmp_uefi_stub" &> /dev/null
++    "${OBJCOPY:-objcopy}" --remove-section .sbat "$tmp_uefi_stub" &> /dev/null
+ 
+     if command -v ukify &> /dev/null; then
+         dinfo "*** Using ukify to create UKI ***"
+@@ -2749,7 +2749,7 @@ if [[ $uefi == yes ]]; then
+             exit 1
+         fi
+     else
+-        if objcopy \
++        if "${OBJCOPY:-objcopy}" \
+             ${SOURCE_DATE_EPOCH:+--enable-deterministic-archives --preserve-dates} \
+             ${uefi_osrelease:+--add-section .osrel="$uefi_osrelease" --change-section-vma .osrel=$(printf 0x%x "$uefi_osrelease_offs")} \
+             ${uefi_cmdline:+--add-section .cmdline="$uefi_cmdline" --change-section-vma .cmdline=$(printf 0x%x "$uefi_cmdline_offs")} \
+diff --git a/lsinitrd.sh b/lsinitrd.sh
+index 86b2c5a67..fd0633dfa 100755
+--- a/lsinitrd.sh
++++ b/lsinitrd.sh
+@@ -358,11 +358,11 @@ unpack_files() {
+ 
+ read -r -N 2 bin < "$image"
+ if [ "$bin" = "MZ" ]; then
+-    command -v objcopy > /dev/null || {
++    command -v "${OBJCOPY:-objcopy}" > /dev/null || {
+         echo "Need 'objcopy' to unpack an UEFI executable."
+         exit 1
+     }
+-    objcopy \
++    "${OBJCOPY:-objcopy}" \
+         --dump-section .linux="$TMPDIR/vmlinuz" \
+         --dump-section .initrd="$TMPDIR/initrd.img" \
+         --dump-section .cmdline="$TMPDIR/cmdline.txt" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
index 1df682a4cf0..e2b75bd14e1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
@@ -13,6 +13,7 @@ DIST gentoo-headers-6.12-1.tar.xz 1164 BLAKE2B 87b1f0e5bbc7e7a04dc05a12c8ac0e1a2
 DIST gentoo-headers-6.13-1.tar.xz 1164 BLAKE2B 92c2b223c597b1aa94be129932902253308ceb66a0f4b8f9d1a79582a241c5e50d75363c6ebfc8266141f5d576dacc42acb7f6c09fe2c374b98f70c2210f4a08 SHA512 6885e725f17e07e565512dfaeb248fba01822a8836e4d6a8d3f84436ffe9290df2d0450de282efb4a18af893111e4258f69a5c6581d1783aebaee999c7e6db02
 DIST gentoo-headers-6.14-1.tar.xz 1164 BLAKE2B 2c72d180953c450158690549fb2e852310bba07cb9e81646b841348eb9327d82b5a203760c7f5b50a1a82bcca21968926a085024b36ac75f077a2fc957fa0e51 SHA512 962b7670c563f886bddbd04b49652d3a6af282a162c00a27f5ec95ca2c6a55227cfbf2819b8b754a53fd54d5106a5ea72da8f34411cfc16c7fe2cf4b700d670a
 DIST gentoo-headers-6.15-1.tar.xz 1168 BLAKE2B 2a48bece7181e24ebaf4c206823406fbeca44b13757b7dd1f63c1c3d4585e3d808e71bb503fda3b8461fb4b8eaa39ea6fcff7cebc1b97734afdeb9ed87293246 SHA512 3aee6d4327ab8414d35cda0a826b1d0068807525d12041e2c49141986ab8835f135418a9736640d8836581af90fa8fdf4c15c54eee1f0b18ae86413e3eb81d34
+DIST gentoo-headers-6.16-1.tar.xz 1168 BLAKE2B 01e016fd7fbe35c03e9be3df8c0bc4f4d885ae783dcec0631957c9f8d4cc4e294afc0fee6eda7a16526f10503aaed333685b18f3266025170ed28fe51b7ef3ae SHA512 1460a2c1a8589059e2df61c8cdd4da5ddada08d0889485cd3daf688f0274780bc0be46c9691df9039c77919c364cc85f08a0db899d014bdf4b79d9f853876791
 DIST gentoo-headers-6.6-1.tar.xz 1172 BLAKE2B 626bb33b42f48bceca2ba6a0a9c0b043a8607bb391d3b541e98d2af42eacfabeda3a5a3d48b7bee1fd0a2a8ad0b6173bde49d3827ea087e501eb0e91d18c4ab7 SHA512 09bcda97d9d17ee3f66ee46d9c00b8ac4fba5b9662fa24e4e2754bd9e4e7b3f097e5f2d52281eeb7a671dfe303aabe15c8fd66f117fddf29fb094e28d8c603b3
 DIST gentoo-headers-6.8-1.tar.xz 1164 BLAKE2B 43283b61fc35057c7f703108d6e4aead901329106e4c297cdfc261e8f9cb1f2ec9370b7367432b9eabe9fcc4358da745170b1f4ec6079d373f50de1fde148778 SHA512 c43e18ce1b39a60e163c2e0f824b1402bcbda84f20b2ae38d53681ff517713c42fd876954fab0ab8044b66e28e32f9ee93fc61ecbbc9c2bb5a9932a0616e570c
 DIST gentoo-headers-6.9-1.tar.xz 1164 BLAKE2B fd385a2c39e9528f60dee582f153485842e76a8a9ad87fd8a11179b8ad2558df23e3c7fb7476f3f1011536e26da50f625a660d2a8ae01954300085f8b3f1bb01 SHA512 3fad4602e453a9aae24cc640ee6c70b06f221c78262f5befe794ca5eb48c352aff335715b5033760ca690bdef55e6a6acb5d3d2351bae885f3023098b5c6ecb1
@@ -31,6 +32,7 @@ DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581
 DIST linux-6.13.tar.xz 148523052 BLAKE2B 9f617ecb3f2393b57ba03c654fea62a7213f24c835989f333a1ef29492af551bfa7d9ad786d5ef1484854adc77c7c6af38fb09a72d994d305695f512c325e77f SHA512 1137e6440132b0958f89165440e99208f82b204e7245ae69dc9c808df97d13ce8f58136db92407e0e93394fa7f6283ec7a34597c6e92a5b6d9025e0960357957
 DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.15.tar.xz 151168812 BLAKE2B 465596c6dc053ff3a3966302a906d3edb4f7ee1ef82f8c20b96360196d3414f5b1deeafa67b8340fcdecd3617280ba9b756d7073ad15c707865e256397b4af53 SHA512 d03788ffa8d8ae1b84ef1286bb44a08fc01432e509dfec6cccae5c5a5a47201d378aec2bcd21e6f0bbd1e625b26f47780c06ee9c1cef3775358f98b160923f30
+DIST linux-6.16.tar.xz 152620004 BLAKE2B 87bc4da7e89cc8265aebffea7ec6c09f711be24fee87cb1c03a264c03fd5a538d66aa806640835aa5103926e612cdfbc52d7c861d7f7065f1a8bb11d893b0921 SHA512 55a00f89ad6db6db2e26ff5dc5cfc96bbf6654e5bd5d17d2a3b944a47640367e54139716d230923187bebc6cb7756edc9511a620fb8abc6f32c50a658a734784
 DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
 DIST linux-6.9.tar.xz 144034416 BLAKE2B 4cf86c3cfe6e6534745d42dfaeca59b17ea1168c4e8b615c80e6d8aac735f11283cd85fa992b440b5d4452917e94b9f08397a64af0be5894e3df23c68892377e SHA512 fed3b4cd1fbfb4d94618587c1934273d2ecc8b6e42a3d586ff8a5f24980be930f2ef803aa2923ca3bfa5e4e619f967f3af315368f24fa76f610b10443624a579
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild
new file mode 100644
index 00000000000..2296d0506c4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.16.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+ETYPE="headers"
+H_SUPPORTEDARCH="alpha amd64 arc arm arm64 csky hexagon hppa loong m68k microblaze mips nios2 openrisc ppc ppc64 riscv s390 sh sparc x86 xtensa"
+inherit kernel-2
+detect_version
+
+PATCH_PV=${PV} # to ease testing new versions against not existing patches
+PATCH_VER="1"
+PATCH_DEV="sam"
+SRC_URI="
+	${KERNEL_URI}
+	${PATCH_VER:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/sys-kernel/linux-headers/gentoo-headers-${PATCH_PV}-${PATCH_VER}.tar.xz}
+"
+S="${WORKDIR}/linux-${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+"
+
+src_unpack() {
+	# Avoid kernel-2_src_unpack
+	default
+}
+
+src_prepare() {
+	local PATCHES=()
+	[[ -n ${PATCH_VER} ]] && PATCHES+=( "${WORKDIR}"/${PATCH_PV} )
+
+	# TODO: May need forward porting to newer versions
+	use elibc_musl && PATCHES+=(
+		"${FILESDIR}"/${PN}-5.15-remove-inclusion-sysinfo.h.patch
+	)
+
+	# Avoid kernel-2_src_prepare
+	default
+}
+
+src_install() {
+	kernel-2_src_install
+
+	find "${ED}" \( -name '.install' -o -name '*.cmd' \) -delete || die
+	# Delete empty directories
+	find "${ED}" -empty -type d -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
index d28c78db2d1..9adc46f37f6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
@@ -18,6 +18,7 @@ DIST binutils-2.42-patches-6.tar.xz 50664 BLAKE2B f13b65a761cfba80caf2e4740c6383
 DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5a019badefda25abeb6275997b16f0891e7ff3424c4b82bbfae92e8992669826920dd53df61cd48469d8f7cd5bd1 SHA512 155f3ba14cd220102f4f29a4f1e5cfee3c48aa03b74603460d05afb73c70d6657a9d87eee6eb88bf13203fe6f31177a5c9addc04384e956e7da8069c8ecd20a6
 DIST binutils-2.43-patches-3.tar.xz 62692 BLAKE2B a189a01a6a99c4fdff124cf90ecc18f874812c17fc735376c855469c487b6a71489ad5c2f86c518d2e029cc83d65757144ff9abddbe7ec3fc06e22f9501c62f4 SHA512 99a30e18fdfd7bdce85bb903f8d61837cfbb639ead8a680ff1a85ad1d615b658e696bdf196c4a002d029f952d34aa441e09e861b22f5400c65f07cce5934cd8f
 DIST binutils-2.43.tar.xz 28175768 BLAKE2B 28b0a04a28273b76eab2d00e00160be889f155f77f5a9d8759ef8dce505c97e97641bf7ec70b92b731b520570a02b06e04e8215b068fcb1bb2573e9ef24732d9 SHA512 93e063163e54d6a6ee2bd48dc754270bf757a3635b49a702ed6b310e929e94063958512d191e66beaf44275f7ea60865dbde138b624626739679fcc306b133bb
-DIST binutils-2.44-patches-1.tar.xz 9156 BLAKE2B c72a7d0ffdb852f8de9c18e187b5768085b3a070744a4fadef508ab0e865d3a3967ec12a0ee7a325b6b689f39e5243aacd9d3f73ceb723d53592ec6ca640161b SHA512 053de98536e92837d0a08fac26bb0f057431747fe6e82f8b9ac54dd9aed65d8de379d653c0e8a8cd31267b9769825a420db5f40957f8c4eb54a7e4a9d76fadb8
 DIST binutils-2.44-patches-4.tar.xz 83612 BLAKE2B caa71849dbbfe1181072c84985c786284f5111bbaa638a44e828c6cc4c19e005793d045dc116c772cf7ffed4898f6f6c935d04f94a76c26e59fb3c4f5adf03d1 SHA512 4dd8e6c36a0423ab29a1f4b227c90a05eb61cab380c809a2f49bba27e84d621e6a5eefe4ec510a7c1c60ba93720f92159ac477c02f9e720e1bbcd6aaf6097d26
 DIST binutils-2.44.tar.xz 27285788 BLAKE2B 0eb031ace9fb5a7047b81b5a05b1760f7d332c8ed67f98899f153a45f181b83e661a484551af05c0a9b2adc422da84619103c7b1f3c9fad5327872832b5446aa SHA512 b85d3bbc0e334cf67a96219d3c7c65fbf3e832b2c98a7417bf131f3645a0307057ec81cd2b29ff2563cec53e3d42f73e2c60cc5708e80d4a730efdcc6ae14ad7
+DIST binutils-2.45-patches-1.tar.xz 15588 BLAKE2B b88c62a6483807dfb24c97c534aadc1f930ea2d6cd8ad86734c40458a0e3ac4d149c0ee47c6ba541c462ce0e619dfaa5328c3dd5ffbd94511c487956866c7a38 SHA512 05c890a71d465539b3d066c2fd92930e4d6c9003147395a4c2cb9cc514f412fa392892e2c3b8887493a56b00453ac383612d0cac42e4cacce983e65886537149
+DIST binutils-2.45.tar.xz 27868232 BLAKE2B 1ce72346b1f531c89feb86b407e2c649151b506ffbd1a02d413411d36f7ede98fa9a1adf75dd941c01df5fe7e6bf151828b269eeb7c278315ca8004bff22eb7f SHA512 c7b10a7466d9fd398d7a0b3f2a43318432668d714f2ec70069a31bdc93c86d28e0fe83792195727167743707fbae45337c0873a0786416db53bbf22860c16ce7
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
deleted file mode 100644
index 3265100b04c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44.ebuild
+++ /dev/null
@@ -1,225 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic libtool toolchain-funcs multilib-minimal
-
-DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
-HOMEPAGE="https://sourceware.org/binutils/"
-
-LICENSE="|| ( GPL-3 LGPL-3 )"
-IUSE="64-bit-bfd cet multitarget nls static-libs test"
-
-# Variables that can be set here  (ignored for live ebuilds)
-# PATCH_VER          - the patchset version
-#                      Default: empty, no patching
-# PATCH_BINUTILS_VER - the binutils version in the patchset name
-#                    - Default: PV
-# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
-#                      for the patchsets
-
-PATCH_VER=1
-PATCH_DEV=dilfridge
-
-MY_PN=binutils
-MY_P=${MY_PN}-${PV}
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	SLOT="0/${PV}"
-elif [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	SLOT="0/$(ver_cut 1-2)"
-else
-	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-	PATCH_DEV=${PATCH_DEV:-dilfridge}
-	SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-	SLOT="0/${PV}"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-fi
-
-BDEPEND="
-	nls? ( sys-devel/gettext )
-	test? ( dev-util/dejagnu )
-"
-DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
-# Need a newer binutils-config that'll reset include/lib symlinks for us.
-RDEPEND="${DEPEND}
-	>=sys-devel/binutils-config-5
-"
-
-RESTRICT="!test? ( test )"
-
-MY_BUILDDIR=${WORKDIR}/build
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/bfd.h
-)
-
-src_unpack() {
-	if [[ ${PV} == *9999 ]] ; then
-		EGIT_REPO_URI="
-			https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git
-			https://github.com/gentoo/binutils-patches
-		"
-		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
-		git-r3_src_unpack
-		mv patches-git/9999 patch || die
-
-		if [[ ${PV} != 9999 ]] ; then
-			EGIT_BRANCH=binutils-$(ver_cut 1)_$(ver_cut 2)-branch
-		fi
-		EGIT_REPO_URI="
-			https://sourceware.org/git/binutils-gdb.git
-			https://git.sr.ht/~sourceware/binutils-gdb
-			https://gitlab.com/x86-binutils/binutils-gdb.git
-		"
-		S=${WORKDIR}/binutils
-		EGIT_CHECKOUT_DIR=${S}
-		git-r3_src_unpack
-	else
-		unpack ${MY_P}.tar.xz
-
-		cd "${WORKDIR}" || die
-		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
-
-		# _p patch versions are Gentoo specific tarballs ...
-		local dir=${MY_P}
-		dir=${dir/-hppa64/}
-
-		S=${WORKDIR}/${dir}
-	fi
-
-	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
-}
-
-src_prepare() {
-	if [[ -n ${PATCH_VER} ]] ; then
-		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
-		eapply "${WORKDIR}/patch"/*.patch
-	fi
-
-	# Fix cross-compile relinking issue, bug #626402
-	elibtoolize
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# somehow libtool/configure is messed up and (custom patch at
-		# upstream?) and misdetects (basically assumes) nm can be called
-		# with -B arg -- can't run eautoreconf (fails), so patch up
-		# manually, this would break any target that needs -B to nm
-		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
-			libctf/configure || die
-	fi
-
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	default
-}
-
-pkgversion() {
-	printf "Gentoo ${PVR}"
-	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
-}
-
-multilib_src_configure() {
-	# bug #814326
-	filter-lto
-
-	local myconf=(
-		# portage's econf() does not detect presence of --d-d-t
-		# because it greps only top-level ./configure. But not
-		# libiberty's or bfd's configure.
-		--disable-dependency-tracking
-		--disable-silent-rules
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		# Newer versions (>=2.24) make this an explicit option. #497268
-		--enable-install-libiberty
-		--disable-werror
-		--with-bugurl="https://bugs.gentoo.org/"
-		--with-pkgversion="$(pkgversion)"
-		$(use_enable static-libs static)
-		# The binutils eclass enables this flag for all bi-arch builds,
-		# but other tools often don't care about that support.  Put it
-		# beyond a flag if people really want it, but otherwise leave
-		# it disabled as it can slow things down on 32bit arches. #438522
-		$(use_enable 64-bit-bfd)
-		# This only disables building in the zlib subdir.
-		# For binutils itself, it'll use the system version. #591516
-		--without-zlib
-		--with-system-zlib
-		# We only care about the libs, so disable programs. #528088
-		--disable-{binutils,etc,ld,gas,gprof,gprofng}
-		# Disable modules that are in a combined binutils/gdb tree. #490566
-		--disable-{gdb,gdbserver,libbacktrace,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# We pull in all USE-flags that change ABI in an incompatible
-		# way. #666100
-		# USE=multitarget change size of global arrays
-		# USE=64-bit-bfd changes data structures of exported API
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
-
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		# Revisit if it's useful, we do have binutils[zstd] though
-		--without-zstd
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-	)
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	use nls \
-		&& myconf+=( --without-included-gettext ) \
-		|| myconf+=( --disable-nls )
-
-	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
-		# fix underlinking in opcodes
-		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
-			"${S}"/opcodes/Makefile.in || die
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running as we don't build docs here.
-	# bug #622652
-	sed -i \
-		-e '/^MAKEINFO/s:=.*:= true:' \
-		Makefile || die
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	# Provided by dev-debug/gdb instead
-	if [[ ${PV} != 9999 ]] ; then
-		rm "${ED}"/usr/share/info/sframe-spec.info || die
-	fi
-
-	# Provide libiberty.h directly.
-	dosym libiberty/libiberty.h /usr/include/libiberty.h
-}
-
-multilib_src_install_all() {
-	use static-libs || find "${ED}"/usr -name '*.la' -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
index 6d25065050a..5c677ffd910 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.44-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.45.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit dot-a libtool toolchain-funcs multilib-minimal
+inherit dot-a flag-o-matic libtool toolchain-funcs multilib-minimal
 
 DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
 HOMEPAGE="https://sourceware.org/binutils/"
@@ -208,9 +208,37 @@ multilib_src_configure() {
 }
 
 multilib_src_test() {
-	# Without this, the default `src_test` check for the 'check' target
-	# with `-n` may fail with parallel make and silently skip tests (bug #955595)
-	emake check
+	(
+		# Tests don't expect LTO
+		filter-lto
+
+		# If we have e.g. -mfpmath=sse -march=pentium4 in CFLAGS,
+		# we'll get lto1 warnings for some tests which cause
+		# spurious failures because -mfpmath isn't passed at
+		# link-time. Filter accordingly.
+		#
+		# Alternatively, we could pass C{C,XX}_FOR_TARGET with
+		# some (ideally not all, surely would break some tests)
+		# stuffed in.
+		filter-flags '-mfpmath=*'
+
+		# lto-wrapper warnings which confuse tests
+		filter-flags '-Wa,*'
+
+		# bug #637066
+		filter-flags -Wall -Wreturn-type
+
+		# Note that we need 'check' explicitly if ever cleaning this
+		# up: the default `src_test` check for the 'check' target
+		# with `-n` may fail with parallel make and silently skip tests (bug #955595)
+		emake -k check \
+			CFLAGS_FOR_TARGET="${CFLAGS_FOR_TARGET:-${CFLAGS}}" \
+			CXXFLAGS_FOR_TARGET="${CXXFLAGS_FOR_TARGET:-${CXXFLAGS}}" \
+			LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}" \
+			CFLAGS="${CFLAGS}" \
+			CXXFLAGS="${CXXFLAGS}" \
+			LDFLAGS="${LDFLAGS}"
+	)
 }
 
 multilib_src_install() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
index 166446d0756..741bae376ae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/Manifest
@@ -2,3 +2,5 @@ DIST gdbm-1.24.tar.gz 1195931 BLAKE2B 79f49adbb455c2e1b91f3450037b71165fa8de8265
 DIST gdbm-1.24.tar.gz.sig 95 BLAKE2B 3a66c2a256d9601db57df20feb5d72d1e94d23b7a92e3099f121549c8aa2c57b05a3021d88f97291819378462a68664af958de4c9de65887d2cca6642d172bc3 SHA512 a54595e0fd23724f5e30c2ff1b9656dbb6da3b448f4ab6a2579a523c11bae53e47d3843327a1e4499b312ab947ac73b5a9aa6e78fe5e932c55a1be0cdab4e63d
 DIST gdbm-1.25.tar.gz 1224180 BLAKE2B 6abf5f77823dda7ebcaa775d58f7a311c8f73c7521fe223398b5cb4b4831ad177cfd87fd42f2b24ca2fc5984af7d51abcc5e509ceb6aab2746a52aecb550654b SHA512 1785598665d7323eed052a55708903c6abaeafcfb66a9ceb69293f57c3fdbf49cd8a821ef23715a40bf7030d0067d1340d12279ed07afe040f912e53078e47f5
 DIST gdbm-1.25.tar.gz.sig 566 BLAKE2B 7740ca7be87eb3f33ff2fd330e35dd900786d9d6a589d466202a121e0e943d3037a75daf584f0b8c99cf10ffac388b1de732c19e43af62bb8da969980c7f65b7 SHA512 0abf5198f0e5ca9678d7741181724389be2289263d2a91c07a979c03f976e7cc494f39a5fbc4d8dbb8acacba463accf28ba0eba4907f1bfe2bac0ab2f4f5eede
+DIST gdbm-1.26.tar.gz 1226591 BLAKE2B 9423ea16ee3e8f1ce57ea32371f49919e2a3819a206a61ce927676a08a71a6a495d3949714bff7be789dfce75bf0ab0ac76f07ec673b71a84ae32bd8cd483781 SHA512 44aafe254f0950a8f5215d8f1337674f07b19f2a375f6eb19a7e39690028c80c3774b705c2b76b470ae74042b21f2ca77d02f6f57aa2ee50296db801220a3352
+DIST gdbm-1.26.tar.gz.sig 566 BLAKE2B b15fdc78010a9fc020d9aad5c92394d00ebce846ac0468fee90701b19295f51df4ccbb22e7af4bde75b0e2b52e46c96dd511c6f3552d2151a828422033d1bc26 SHA512 ba126e81a660c6658bdb5aac65c12546cf4d7721da88f3767808c9c94e4082cf48eaf9655b502898603af22a52032d9cba40f94db4170e4f5878e7a2b8ec9922
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
index ef4eb0f7602..e56d75019b5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.24.ebuild
@@ -13,7 +13,7 @@ SRC_URI="
 	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
 "
 
-LICENSE="GPL-3"
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
 SLOT="0/6" # libgdbm.so version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
index 618e0844b4c..80091df0d8b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.25.ebuild
@@ -13,7 +13,7 @@ SRC_URI="
 	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
 "
 
-LICENSE="GPL-3"
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
 SLOT="0/6" # libgdbm.so version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+berkdb nls +readline static-libs test"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild
new file mode 100644
index 00000000000..70110857093
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/gdbm/gdbm-1.26.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gdbm.asc
+inherit libtool multilib-minimal multiprocessing verify-sig
+
+DESCRIPTION="Standard GNU database libraries"
+HOMEPAGE="https://www.gnu.org/software/gdbm/"
+SRC_URI="
+	mirror://gnu/gdbm/${P}.tar.gz
+	verify-sig? ( mirror://gnu/gdbm/${P}.tar.gz.sig )
+"
+
+LICENSE="GPL-3+ GPL-2+ FDL-1.3+"
+SLOT="0/6" # libgdbm.so version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+berkdb nls +readline static-libs test"
+RESTRICT="!test? ( test )"
+
+DEPEND="readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	test? ( dev-util/dejagnu )
+	verify-sig? ( >=sec-keys/openpgp-keys-gdbm-20250323 )
+"
+
+src_prepare() {
+	default
+
+	# gdbm ships with very old libtool files, regen to avoid
+	# errors when cross-compiling.
+	elibtoolize
+}
+
+multilib_src_configure() {
+	# gdbm doesn't appear to use either of these libraries
+	export ac_cv_lib_dbm_main=no ac_cv_lib_ndbm_main=no
+
+	local myeconfargs=(
+		--includedir="${EPREFIX}"/usr/include/gdbm
+		$(use_enable berkdb libgdbm-compat)
+		$(use_enable nls)
+		$(use_enable static-libs static)
+		$(use_with readline)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	emake -Onone check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use static-libs ; then
+		find "${ED}" -name '*.la' -delete || die
+	fi
+
+	mv "${ED}"/usr/include/gdbm/gdbm.h "${ED}"/usr/include/ || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
index fd9bfed0dfd..0c18ac20b2c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/Manifest
@@ -25,8 +25,10 @@ DIST glibc-2.39-patches-11.tar.xz 192784 BLAKE2B fef42e0bd2a3341f41cac56dc878dcc
 DIST glibc-2.39.tar.xz 18520988 BLAKE2B 9d98459a2d58401e07c081e0d841935b23998da75a7eb5a7ebd23a1f9ebab99dee623fe166397c1b6c926960c570f62dbca5cb3b5ce84a918adff6b7a15e16bb SHA512 818f58172a52815b4338ea9f2a69ecaa3335492b9f8f64cbf8afb24c0d737982341968ecd79631cae3d3074ab0ae4bc6056fc4ba3ffe790849dc374835cd57e2
 DIST glibc-2.40-patches-11.tar.xz 227044 BLAKE2B 2a8c799a88596f3fc28bc45fc206f231f628ff83aae242d69e216b65983def35d3aaab282287f1d77cb9d37d10bb71c483815ea83dfb2e47670a4cfcfbd1d92f SHA512 e984e4842951c24cf079e9a6f88771ede0709949402dd9f734cbfdf21ff40ca3d7380c0b9cc0c0d89943b6481adf8c7db2ab4b0ffe57e2e1fa514d925f0db395
 DIST glibc-2.40.tar.xz 18752204 BLAKE2B 8593cab5b2549b77159b6866fbb40b917e491fd5bc0814f7f85b6529166d78d4583436450c479b86cdfe468304fc4d2a9ba8294230a55dbc4c15e89c3ab6c000 SHA512 33caf91dbfddde6480b7cdf7a68b36aff8c522bfee56160af26af297f1b768668edb08bc4e1a7ff61c64721e3c1d49c347a5dd01c5edd3b914ee6479c8b27885
-DIST glibc-2.41-patches-6.tar.xz 83980 BLAKE2B ca689782db9f78751d5b5004ee9bf7bd6daf4cf071bb25507e53e4408fdd0331a9f4c82bbe7579e38540fc4d416bd858f76e5655f4e8a87048067fbc5e3c7a17 SHA512 bce972f5e036712e178d0adc97bef17b83a5c5cc3139d689bfc2847bc5e8126ee01250ce41033bc78919a7638965740d54eb431b240a9a32460c433335da968f
+DIST glibc-2.41-patches-7.tar.xz 96232 BLAKE2B 0d4d22eb467370e9e902278b223545c5a225c990a87b4c2f39db48677301d126d7e69ea2823822ced5c472a9abdf7679c6c0ede88b87e50123a7ac146a98249e SHA512 00fc6f83a28dfae8f17ed50ba19f322d267f3f6d80e5545c317694ce1e2e0e4ebfb922b4fa1d7c854d035a457e968bf8281ccedca8e5347e380fa54b6755aedd
 DIST glibc-2.41.tar.xz 19344868 BLAKE2B 4da62f489ba7a95bb069c2cfea8cf78e4d37e3a5f7e1736239670ba1dca12b69aa77bd00ced078c27d91b1e622c58cbd70258161a9d18c5b3bcc95863b8d744d SHA512 894a3e5a796bc13df30c26a5bfbe4d60b5dbdaac54e7763432235124b547070c7dda88c50584536870cab79183d8cad73a3ac6ed09bfe54fa8482aad07253169
+DIST glibc-2.42-patches-2.tar.xz 25856 BLAKE2B 26a5a3bdc7985c2193533e883445acac29ea695df30d72b6d9409aa9ec94d39a086eb6c41eb9adfc39e0de78f7ae84e0fa64a955f9866de262179ee40ce4a6b5 SHA512 1526613855b9ca65002c6853f88d77990a1fe9e6f4cc01aca51d67fc4592ed985da8c74a661d304eb8a27c6afc8592da259fe40fa08a824942a9b700942086e6
+DIST glibc-2.42.tar.xz 19930508 BLAKE2B 6ffabfe7942034a5a4fb5097679cb47bc3431eb2a3864af07cea0cb6aa5db63fbaf6f026b3c9299e00268058a6762eb21e92499f012d552ed87d65c7ffbd0bbe SHA512 73a617db8e0f0958c0575f7a1c5a35b72b7e070b6cbdd02a9bb134995ca7ca0909f1e50d7362c53d2572d72f1879bb201a61d5275bac16136895d9a34ef0c068
 DIST glibc-systemd-20210729.tar.gz 1480 BLAKE2B 37722c7579df782d890e44dbab99c3de52ab466eb9de80d82405e9bb5620bf39ffc8c5f466a435bdb86ef6d36dd7019c0736573916bda6c67d02a2581e0ec979 SHA512 efd75af58b50522c28cdac7abd1fc56555bc1bb042512c90d8340c1ec09c5791b3872a305bf83723252bbde5855b75d958c041083457765c4cfd170732d09238
 DIST glibc-systemd-20210814.tar.gz 1469 BLAKE2B 10fa7bcb46d4fdce9c0ab353cbd30871e9b09a347a13a9c9a3b5777f931aa3c826c158d2e49532c604d4a834f2fab4089b67495fb88d0398945dc50d45ad9ef1 SHA512 5346a9ea459a1e6ccf665389f2a294de1e16f1e3e05cdf07e3dd99ed0e4f6f8b52cc333d4bff3c75ac90ab6ce70cd4ab2b3e126f920ce7979abd6dda56315efc
 DIST locale-gen-2.00.tar.gz 7738 BLAKE2B cde6de5ba3400aea24d0d5f1b79471f89f09fb747c8e371e38316c7ada92f967e0865f573f23cb353d82419c234724143c0aeca9eb70eb945dfc581cc7491eb1 SHA512 b609fddb9ec5e567c008841fef3390eddb5d6e7699a8271b3b8c0ade1b44b0ac2e5d1daa8b9acabf3432e3b88110b538a96f209b1ad0f9e988b7efce66606dff
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
index 7d492b72364..275cfa3d70e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.19-r3.ebuild
@@ -1036,16 +1036,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local locale_list="${root%/}/etc/locale.gen"
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	local prefix=$1 user_config config
+	local -a localegen_args
+
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
+
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
 	fi
 
-	locale-gen --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
+
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
+	fi
+
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1219,7 +1233,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen "${ED}"
+		if ! run_locale_gen "${ED}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 }
 
@@ -1311,8 +1327,10 @@ pkg_postinst() {
 		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
 	fi
 
-	if ! is_crosscompile && [[ -n ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
index 7df8f581644..8ec824d2fdc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.31-r7.ebuild
@@ -1174,30 +1174,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1392,7 +1392,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1491,7 +1493,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
index 656ad5161a2..c44f933c4c8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.32-r8.ebuild
@@ -1203,30 +1203,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1404,7 +1404,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1509,7 +1511,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	# Check for sanity of /etc/nsswitch.conf, take 2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
index 5e23df0069e..19294871446 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.33-r14.ebuild
@@ -1225,30 +1225,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1453,7 +1453,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1574,7 +1576,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
index e23b9ae35e9..93da806cc97 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.34-r14.ebuild
@@ -1246,30 +1246,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1474,7 +1474,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1595,7 +1597,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
index 0c2aec0025e..b61d907c813 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.35-r11.ebuild
@@ -1254,30 +1254,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1482,7 +1482,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1603,7 +1605,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
index cb6ddba38eb..5df7eb487f1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.36-r8.ebuild
@@ -1284,30 +1284,30 @@ src_test() {
 }
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
-	fi
+	config="${prefix}/usr/share/i18n/SUPPORTED"
+	user_config="${prefix}/etc/locale.gen"
 
-	local locale_list="${root%/}/etc/locale.gen"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		# For USE=compile-locales, all locales should be built.
+		mkdir -p -- "${prefix}/usr/lib/locale" || die
+	elif locale-gen --list --config "${user_config}" | read -r; then
+		config=${user_config}
+	fi
 
-	pushd "${ED}"/$(get_libdir) >/dev/null
+	localegen_args=( --config "${config}" --destdir "${prefix}" )
 
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1523,7 +1523,9 @@ glibc_do_src_install() {
 
 	# Generate all locales if this is a native build as locale generation
 	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+		if ! run_locale_gen "${ED%/}"; then
+			die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 		sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die
 	fi
 }
@@ -1644,7 +1646,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT%/}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
index e323ee8ae32..14ea48d6eef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.37-r10.ebuild
@@ -1295,38 +1295,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1539,8 +1537,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1663,7 +1661,9 @@ pkg_postinst() {
 	fi
 
 	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
index 5bba661e9e9..4bee7a911ae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.38-r13.ebuild
@@ -1314,38 +1314,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1558,8 +1556,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1708,7 +1706,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
index 4b46bc6f4e3..b34df92b725 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.39-r11.ebuild
@@ -1322,38 +1322,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1568,8 +1566,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1719,7 +1717,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 	fi
 
 	upgrade_warning
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
index 07f8c01de0e..3e94d2cd321 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.40-r11.ebuild
@@ -1302,38 +1302,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1548,8 +1546,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1699,7 +1697,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
index 373c2958ca3..2c01722eb4f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.41-r5.ebuild
@@ -12,7 +12,7 @@ TMPFILES_OPTIONAL=1
 EMULTILIB_PKG="true"
 
 # Gentoo patchset (ignored for live ebuilds)
-PATCH_VER=6
+PATCH_VER=7
 PATCH_DEV=dilfridge
 
 # gcc mulitilib bootstrap files version
@@ -972,14 +972,14 @@ src_prepare() {
 		einfo "Done."
 	fi
 
-        case ${CTARGET} in
-                m68*-aligned-*)
+	case ${CTARGET} in
+		m68*-aligned-*)
 			einfo "Applying utmp format fix for m68k with -maligned-int"
 			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
 			;;
-                *)
+		*)
 			;;
-        esac
+	esac
 
 	default
 
@@ -1316,38 +1316,36 @@ src_test() {
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1562,8 +1560,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1713,7 +1711,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild
new file mode 100644
index 00000000000..703f08dd696
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42.ebuild
@@ -0,0 +1,1776 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Bumping notes: https://wiki.gentoo.org/wiki/Project:Toolchain/sys-libs/glibc
+# Please read & adapt the page as necessary if obsolete.
+
+PYTHON_COMPAT=( python3_{10..13} )
+TMPFILES_OPTIONAL=1
+
+EMULTILIB_PKG="true"
+
+# Gentoo patchset (ignored for live ebuilds)
+PATCH_VER=2
+PATCH_DEV=dilfridge
+
+# gcc mulitilib bootstrap files version
+GCC_BOOTSTRAP_VER=20201208
+
+# systemd integration version
+GLIBC_SYSTEMD_VER=20210729
+
+# Minimum kernel version that glibc requires
+MIN_KERN_VER="3.2.0"
+
+# Minimum pax-utils version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_PAX_UTILS_VER="1.3.3"
+
+# Minimum systemd version needed (which contains any new syscall changes for
+# its seccomp filter!). Please double check this!
+MIN_SYSTEMD_VER="254.9-r1"
+
+inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfig \
+	multilib systemd multiprocessing tmpfiles eapi9-ver
+
+DESCRIPTION="GNU libc C library"
+HOMEPAGE="https://www.gnu.org/software/libc/"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	SRC_URI="mirror://gnu/glibc/${P}.tar.xz"
+	SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz"
+fi
+
+SRC_URI+=" multilib-bootstrap? ( https://dev.gentoo.org/~dilfridge/distfiles/gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz )"
+SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git/snapshot/glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz )"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+SLOT="2.2"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux sframe +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+#
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+# Note [Disable automatic stripping]
+# Disabling automatic stripping for a few reasons:
+# - portage's attempt to strip breaks non-native binaries at least on
+#   arm: bug #697428
+# - portage's attempt to strip libpthread.so.0 breaks gdb thread
+#   enumeration: bug #697910. This is quite subtle:
+#   * gdb uses glibc's libthread_db-1.0.so to enumerate threads.
+#   * libthread_db-1.0.so needs access to libpthread.so.0 local symbols
+#     via 'ps_pglobal_lookup' symbol defined in gdb.
+#   * 'ps_pglobal_lookup' uses '.symtab' section table to resolve all
+#     known symbols in 'libpthread.so.0'. Specifically 'nptl_version'
+#     (unexported) is used to sanity check compatibility before enabling
+#     debugging.
+#     Also see https://sourceware.org/gdb/wiki/FAQ#GDB_does_not_see_any_threads_besides_the_one_in_which_crash_occurred.3B_or_SIGTRAP_kills_my_program_when_I_set_a_breakpoint
+#   * normal 'strip' command trims '.symtab'
+#   Thus our main goal here is to prevent 'libpthread.so.0' from
+#   losing it's '.symtab' entries.
+# - similarly, valgrind requires knowledge about symbols in ld.so:
+#	bug #920753
+# As Gentoo's strip does not allow us to pass less aggressive stripping
+# options and does not check the machine target we strip selectively.
+
+# We need a new-enough binutils/gcc to match upstream baseline.
+# Also we need to make sure our binutils/gcc supports TLS,
+# and that gcc already contains the hardened patches.
+# Lastly, let's avoid some openssh nastiness, bug 708224, as
+# convenience to our users.
+
+IDEPEND="
+	!compile-locales? ( sys-apps/locale-gen )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	sys-devel/bison
+	compile-locales? ( sys-apps/locale-gen )
+	doc? (
+		dev-lang/perl
+		sys-apps/texinfo
+	)
+	sframe? ( >=sys-devel/binutils-2.45 )
+	test? (
+		dev-lang/perl
+		>=net-dns/libidn2-2.3.0
+		sys-apps/gawk[mpfr]
+	)
+"
+COMMON_DEPEND="
+	gd? ( media-libs/gd:2= )
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-debug/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+"
+RDEPEND="${COMMON_DEPEND}
+	!<app-misc/pax-utils-${MIN_PAX_UTILS_VER}
+	!<sys-apps/systemd-${MIN_SYSTEMD_VER}
+	perl? ( dev-lang/perl )
+"
+
+RESTRICT="!test? ( test )"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	BDEPEND+=" !headers-only? (
+		>=${CATEGORY}/binutils-2.27
+		>=${CATEGORY}/gcc-6.2
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	BDEPEND+="
+		>=sys-devel/binutils-2.27
+		>=sys-devel/gcc-6.2
+	"
+	DEPEND+=" virtual/os-headers "
+	RDEPEND+="
+		>=net-dns/libidn2-2.3.0
+		vanilla? ( !sys-libs/timezone-data )
+	"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+# Ignore tests whitelisted below
+GENTOO_GLIBC_XFAIL_TESTS="${GENTOO_GLIBC_XFAIL_TESTS:-yes}"
+
+# The following tests fail due to the Gentoo build system and are thus
+# executed but ignored:
+XFAIL_TEST_LIST=(
+	# buggy test, assumes /dev/ and /dev/null on a single filesystem
+	# 'mount --bind /dev/null /chroot/dev/null' breaks it.
+	# https://sourceware.org/PR25909
+	tst-support_descriptors
+
+	# The following tests fail only inside portage
+	# https://bugs.gentoo.org/831267
+	tst-system
+	tst-strerror
+	tst-strsignal
+
+	# Fails with certain PORTAGE_NICENESS/PORTAGE_SCHEDULING_POLICY
+	tst-sched1
+	tst-sched_setattr
+
+	# Fails regularly, unreliable
+	tst-valgrind-smoke
+
+	# https://sourceware.org/bugzilla/show_bug.cgi?id=31877 (bug #927973)
+	tst-shstk-legacy-1g
+)
+
+XFAIL_NSPAWN_TEST_LIST=(
+	# These tests need to be adapted to handle EPERM/ENOSYS(?) properly
+	# upstream, as systemd-nspawn's default seccomp whitelist is too strict.
+	# https://sourceware.org/PR30603
+	test-errno-linux
+	tst-aarch64-pkey
+	tst-bz21269
+	tst-mlock2
+	tst-ntp_gettime
+	tst-ntp_gettime-time64
+	tst-ntp_gettimex
+	tst-ntp_gettimex-time64
+	tst-pkey
+	tst-process_mrelease
+	tst-adjtime
+	tst-adjtime-time64
+	tst-clock2
+	tst-clock2-time64
+
+	# These fail if --suppress-sync and/or low priority is set
+	tst-sync_file_range
+	test-errno
+)
+
+#
+# Small helper functions
+#
+
+dump_build_environment() {
+	einfo ==== glibc build environment ========================================================
+	local v
+	for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX CPP LD \
+		{AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM AR AS STRIP RANLIB OBJCOPY \
+		STRINGS OBJDUMP READELF; do
+		einfo " $(printf '%15s' ${v}:)   ${!v}"
+	done
+	einfo =====================================================================================
+}
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+just_headers() {
+	is_crosscompile && use headers-only
+}
+
+alt_prefix() {
+	is_crosscompile && echo /usr/${CTARGET}
+}
+
+# This prefix is applicable to CHOST when building against this
+# glibc. It is baked into the library at configure time.
+host_eprefix() {
+	is_crosscompile || echo "${EPREFIX}"
+}
+
+# This prefix is applicable to CBUILD when building against this
+# glibc. It determines the destination path at install time.
+build_eprefix() {
+	is_crosscompile && echo "${EPREFIX}"
+}
+
+alt_headers() {
+	echo $(alt_prefix)/usr/include
+}
+alt_libdir() {
+	echo $(alt_prefix)/$(get_libdir)
+}
+alt_usrlibdir() {
+	echo $(alt_prefix)/usr/$(get_libdir)
+}
+
+builddir() {
+	echo "${WORKDIR}/build-${ABI}-${CTARGET}-$1"
+}
+
+do_compile_test() {
+	local ret save_cflags=${CFLAGS}
+	CFLAGS+=" $1"
+	shift
+
+	pushd "${T}" >/dev/null
+
+	rm -f glibc-test*
+	printf '%b' "$*" > glibc-test.c
+
+	# We assume CC is already set up.
+	nonfatal emake glibc-test
+	ret=$?
+
+	popd >/dev/null
+
+	CFLAGS=${save_cflags}
+	return ${ret}
+}
+
+do_run_test() {
+	local ret
+
+	if [[ ${MERGE_TYPE} == "binary" ]] ; then
+		# ignore build failures when installing a binary package #324685
+		do_compile_test "" "$@" 2>/dev/null || return 0
+	else
+		ebegin "Performing simple compile test for ABI=${ABI}"
+		if ! do_compile_test "" "$@" ; then
+			ewarn "Simple build failed ... assuming this is desired #324685"
+			eend 1
+			return 0
+		else
+			eend 0
+		fi
+	fi
+
+	pushd "${T}" >/dev/null
+
+	./glibc-test
+	ret=$?
+	rm -f glibc-test*
+
+	popd >/dev/null
+
+	return ${ret}
+}
+
+setup_target_flags() {
+	# This largely mucks with compiler flags.  None of which should matter
+	# when building up just the headers.
+	just_headers && return 0
+
+	case $(tc-arch) in
+		x86)
+			# -march needed for #185404 #199334
+			# TODO: When creating the first glibc cross-compile, this test will
+			# always fail as it does a full link which in turn requires glibc.
+			# Probably also applies when changing multilib profile settings (e.g.
+			# enabling x86 when the profile was amd64-only previously).
+			# We could change main to _start and pass -nostdlib here so that we
+			# only test the gcc code compilation.  Or we could do a compile and
+			# then look for the symbol via scanelf.
+			if ! do_compile_test "" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+				local t=${CTARGET_OPT:-${CTARGET}}
+				t=${t%%-*}
+				filter-flags '-march=*'
+				export CFLAGS="-march=${t} ${CFLAGS}"
+				einfo "Auto adding -march=${t} to CFLAGS #185404"
+			fi
+			# For compatibility with older binaries at slight performance cost.
+			use stack-realign && export CFLAGS+=" -mstackrealign"
+		;;
+		amd64)
+			# -march needed for #185404 #199334
+			# TODO: See cross-compile issues listed above for x86.
+			if [[ ${ABI} == x86 ]]; then
+				if ! do_compile_test "${CFLAGS_x86}" 'void f(int i, void *p) {if (__sync_fetch_and_add(&i, 1)) f(i, p);}\nint main(){return 0;}\n'; then
+					local t=${CTARGET_OPT:-${CTARGET}}
+					t=${t%%-*}
+					# Normally the target is x86_64-xxx, so turn that into the -march that
+					# gcc actually accepts. #528708
+					[[ ${t} == "x86_64" ]] && t="x86-64"
+					filter-flags '-march=*'
+					# ugly, ugly, ugly.  ugly.
+					CFLAGS_x86=$(CFLAGS=${CFLAGS_x86} filter-flags '-march=*'; echo "${CFLAGS}")
+					export CFLAGS_x86="${CFLAGS_x86} -march=${t}"
+					einfo "Auto adding -march=${t} to CFLAGS_x86 #185404 (ABI=${ABI})"
+				fi
+				# For compatibility with older binaries at slight performance cost.
+				use stack-realign && export CFLAGS_x86+=" -mstackrealign"
+			fi
+		;;
+		mips)
+			# The mips abi cannot support the GNU style hashes. #233233
+			filter-ldflags -Wl,--hash-style=gnu -Wl,--hash-style=both
+		;;
+		ppc|ppc64)
+			# Many arch-specific implementations do not work on ppc with
+			# cache-block not equal to 128 bytes. This breaks memset:
+			#   https://sourceware.org/PR26522
+			#   https://bugs.gentoo.org/737996
+			# Use default -mcpu=. For ppc it means non-multiarch setup.
+			filter-flags '-mcpu=*'
+		;;
+		sparc)
+			# Both sparc and sparc64 can use -fcall-used-g6.  -g7 is bad, though.
+			filter-flags "-fcall-used-g7"
+			append-flags "-fcall-used-g6"
+
+			local cpu
+			case ${CTARGET} in
+			sparc64-*)
+				cpu="sparc64"
+				case $(get-flag mcpu) in
+				v9)
+					# We need to force at least v9a because the base build doesn't
+					# work with just v9.
+					# https://sourceware.org/bugzilla/show_bug.cgi?id=19477
+					append-flags "-Wa,-xarch=v9a"
+					;;
+				esac
+				;;
+			sparc-*)
+				case $(get-flag mcpu) in
+				v8|supersparc|hypersparc|leon|leon3)
+					cpu="sparcv8"
+					;;
+				*)
+					cpu="sparcv9"
+					;;
+				esac
+			;;
+			esac
+			[[ -n ${cpu} ]] && CTARGET_OPT="${cpu}-${CTARGET#*-}"
+		;;
+	esac
+}
+
+setup_flags() {
+	# Make sure host make.conf doesn't pollute us
+	if is_crosscompile || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+
+	# Store our CFLAGS because it's changed depending on which CTARGET
+	# we are building when pulling glibc on a multilib profile
+	CFLAGS_BASE=${CFLAGS_BASE-${CFLAGS}}
+	CFLAGS=${CFLAGS_BASE}
+	CXXFLAGS_BASE=${CXXFLAGS_BASE-${CXXFLAGS}}
+	CXXFLAGS=${CXXFLAGS_BASE}
+	ASFLAGS_BASE=${ASFLAGS_BASE-${ASFLAGS}}
+	ASFLAGS=${ASFLAGS_BASE}
+
+	# Allow users to explicitly avoid flag sanitization via
+	# USE=custom-cflags.
+	if ! use custom-cflags; then
+		# Over-zealous CFLAGS can often cause problems.  What may work for one
+		# person may not work for another.  To avoid a large influx of bugs
+		# relating to failed builds, we strip most CFLAGS out to ensure as few
+		# problems as possible.
+		strip-flags
+
+		# Allow -O2 and -O3, but nothing else for now.
+		# TODO: Test -Os, -Oz.
+		if ! is-flagq '-O@(2|3)' ; then
+			# Lock glibc at -O2. We want to be conservative here.
+			filter-flags '-O?'
+			append-flags -O2
+		fi
+	fi
+
+	strip-unsupported-flags
+	filter-lto
+	filter-flags -m32 -m64 '-mabi=*'
+
+	# glibc aborts if rpath is set by LDFLAGS
+	filter-ldflags '-Wl,-rpath=*'
+
+	# ld can't use -r & --relax at the same time, bug #788901
+	# https://sourceware.org/PR27837
+	filter-ldflags '-Wl,--relax'
+
+	# Flag added for cross-prefix, but causes ldconfig to segfault. Not needed
+	# anyway because glibc already handles this by itself.
+	filter-ldflags '-Wl,--dynamic-linker=*'
+
+	# Fails to link (bug #940709) in some cases but even if it manages to,
+	# subtle runtime breakage will occur because the linker scripts need
+	# adaptation. Mentioned in PR21557#c0.
+	filter-ldflags '-Wl,--gc-sections'
+
+	# some weird software relies on sysv hashes in glibc, bug 863863, bug 864100
+	# we have to do that here already so mips can filter it out again :P
+	if use hash-sysv-compat ; then
+		append-ldflags '-Wl,--hash-style=both'
+	fi
+
+	# #492892
+	filter-flags -frecord-gcc-switches
+
+	# #898098
+	filter-flags -fno-builtin
+
+	# #798774
+	filter-flags -fno-semantic-interposition
+
+	# #829583
+	filter-lfs-flags
+
+	unset CBUILD_OPT CTARGET_OPT
+	if use multilib ; then
+		CTARGET_OPT=$(get_abi_CTARGET)
+		[[ -z ${CTARGET_OPT} ]] && CTARGET_OPT=$(get_abi_CHOST)
+	fi
+
+	setup_target_flags
+
+	if [[ -n ${CTARGET_OPT} && ${CBUILD} == ${CHOST} ]] && ! is_crosscompile; then
+		CBUILD_OPT=${CTARGET_OPT}
+	fi
+
+	# glibc's headers disallow -O0 and fail at build time:
+	#  include/libc-symbols.h:75:3: #error "glibc cannot be compiled without optimization"
+	# https://sourceware.org/glibc/wiki/FAQ#Why_do_I_get:.60.23error_.22glibc_cannot_be_compiled_without_optimization.22.27.2C_when_trying_to_compile_GNU_libc_with_GNU_CC.3F
+	replace-flags -O0 -O1
+
+	# Similar issues as with SSP. Can't inject yourself that early.
+	filter-flags '-fsanitize=*'
+
+	# See end of bug #830454; we handle this via USE=cet
+	filter-flags '-fcf-protection=*'
+
+	# When bootstrapping, we may have a situation where
+	# CET-enabled gcc from seed is used to build CET-disabled
+	# glibc. As such, gcc implicitly enables CET if no
+	# -fcf-protection flag is passed. For a typical package it
+	# should not be a problem, but for glibc it matters as it is
+	# dealing with CET in ld.so. So if CET is supposed to be
+	# disabled for glibc, be explicit about it.
+	if ! use cet; then
+		case ${ABI}-${CTARGET} in
+			amd64-x86_64-*|x32-x86_64-*-*-gnux32)
+				append-flags '-fcf-protection=none'
+				;;
+			arm64-aarch64*)
+				append-flags '-mbranch-protection=none'
+				;;
+		esac
+	fi
+}
+
+use_multiarch() {
+	# Allow user to disable runtime arch detection in multilib.
+	use multiarch || return 1
+	# Make sure binutils is new enough to support indirect functions,
+	# #336792. This funky sed supports gold and bfd linkers.
+	local bver nver
+	bver=$($(tc-getLD ${CTARGET}) -v | sed -n -r '1{s:[^0-9]*::;s:^([0-9.]*).*:\1:;p}')
+	case $(tc-arch ${CTARGET}) in
+	amd64|x86) nver="2.20" ;;
+	arm)       nver="2.22" ;;
+	hppa)      nver="2.23" ;;
+	ppc|ppc64) nver="2.20" ;;
+	# ifunc support was added in 2.23, but glibc also needs
+	# machinemode which is in 2.24.
+	s390)      nver="2.24" ;;
+	sparc)     nver="2.21" ;;
+	*)         return 1 ;;
+	esac
+	ver_test ${bver} -ge ${nver}
+}
+
+# Setup toolchain variables that had historically been defined in the
+# profiles for these archs.
+setup_env() {
+	# silly users
+	unset LD_RUN_PATH
+	unset LD_ASSUME_KERNEL
+
+	if is_crosscompile || tc-is-cross-compiler ; then
+		multilib_env ${CTARGET_OPT:-${CTARGET}}
+
+		if ! use multilib ; then
+			MULTILIB_ABIS=${DEFAULT_ABI}
+		else
+			MULTILIB_ABIS=${MULTILIB_ABIS:-${DEFAULT_ABI}}
+		fi
+
+		# If the user has CFLAGS_<CTARGET> in their make.conf, use that,
+		# and fall back on CFLAGS.
+		local VAR=CFLAGS_${CTARGET//[-.]/_}
+		CFLAGS=${!VAR-${CFLAGS}}
+		einfo " $(printf '%15s' 'Manual CFLAGS:')   ${CFLAGS}"
+	fi
+
+	setup_flags
+
+	export ABI=${ABI:-${DEFAULT_ABI:-default}}
+
+	if just_headers ; then
+		# Avoid mixing host's CC and target's CFLAGS_${ABI}:
+		# At this bootstrap stage we have only binutils for
+		# target but not compiler yet.
+		einfo "Skip CC ABI injection. We can't use (cross-)compiler yet."
+		return 0
+	fi
+
+	# glibc does not work with non-bfd (for various reasons):
+	# * gold (bug #269274)
+	# * mold (bug #860900)
+	tc-ld-force-bfd
+
+	if use doc ; then
+		export MAKEINFO=makeinfo
+	else
+		export MAKEINFO=/dev/null
+	fi
+
+	# Reset CC and CXX to the value at start of emerge
+	export CC=${glibc__ORIG_CC:-${CC:-$(tc-getCC ${CTARGET})}}
+	export CXX=${glibc__ORIG_CXX:-${CXX:-$(tc-getCXX ${CTARGET})}}
+	export CPP=${glibc__ORIG_CPP:-${CPP:-$(tc-getCPP ${CTARGET})}}
+
+	# and make sure glibc__ORIG_CC and glibc__ORIG_CXX is defined now.
+	export glibc__ORIG_CC=${CC}
+	export glibc__ORIG_CXX=${CXX}
+	export glibc__ORIG_CPP=${CPP}
+
+	if tc-is-clang && ! use custom-cflags && ! is_crosscompile ; then
+		export glibc__force_gcc=yes
+		# once this is toggled on, it needs to stay on, since with CPP manipulated
+		# tc-is-clang does not work correctly anymore...
+	fi
+
+	if [[ ${glibc__force_gcc} == "yes" ]] ; then
+		# If we are running in an otherwise clang/llvm environment, we need to
+		# recover the proper gcc and binutils settings here, at least until glibc
+		# is finally building with clang. So let's override everything that is
+		# set in the clang profiles.
+		# Want to shoot yourself into the foot? Set USE=custom-cflags, that's always
+		# a good start into that direction.
+		# Also, if you're crosscompiling, let's assume you know what you are doing.
+		# Hopefully.
+		# Last, we need the settings of the *build* environment, not of the
+		# target environment...
+
+		local current_binutils_path=$(env CHOST="${CBUILD}" ROOT="${BROOT}" binutils-config -B "${CTARGET}")
+		local current_gcc_path=$(env ROOT="${BROOT}" gcc-config -B)
+		einfo "Overriding clang configuration, since it won't work here"
+
+		export CC="${current_gcc_path}/${CTARGET}-gcc"
+		export CPP="${current_gcc_path}/${CTARGET}-cpp"
+		export CXX="${current_gcc_path}/${CTARGET}-g++"
+		export LD="${current_binutils_path}/ld.bfd"
+		export AR="${current_binutils_path}/ar"
+		export AS="${current_binutils_path}/as"
+		export NM="${current_binutils_path}/nm"
+		export STRIP="${current_binutils_path}/strip"
+		export RANLIB="${current_binutils_path}/ranlib"
+		export OBJCOPY="${current_binutils_path}/objcopy"
+		export STRINGS="${current_binutils_path}/strings"
+		export OBJDUMP="${current_binutils_path}/objdump"
+		export READELF="${current_binutils_path}/readelf"
+		export ADDR2LINE="${current_binutils_path}/addr2line"
+
+		# do we need to also do flags munging here? yes! at least...
+		filter-flags '-fuse-ld=*'
+		filter-flags '-D_FORTIFY_SOURCE=*'
+
+	else
+
+		# this is the "normal" case
+
+		export CC="$(tc-getCC ${CTARGET})"
+		export CXX="$(tc-getCXX ${CTARGET})"
+		export CPP="$(tc-getCPP ${CTARGET})"
+
+		# Always use tuple-prefixed toolchain. For non-native ABI glibc's configure
+		# can't detect them automatically due to ${CHOST} mismatch and fallbacks
+		# to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup().
+		export NM="$(tc-getNM ${CTARGET})"
+		export READELF="$(tc-getREADELF ${CTARGET})"
+
+	fi
+
+	# We need to export CFLAGS with abi information in them because glibc's
+	# configure script checks CFLAGS for some targets (like mips).  Keep
+	# around the original clean value to avoid appending multiple ABIs on
+	# top of each other. (Why does the comment talk about CFLAGS if the code
+	# acts on CC?)
+	export glibc__GLIBC_CC=${CC}
+	export glibc__GLIBC_CXX=${CXX}
+	export glibc__GLIBC_CPP=${CPP}
+
+	export glibc__abi_CFLAGS="$(get_abi_CFLAGS)"
+
+	# CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760
+	# To build .S (assembly) files with the same ABI-specific flags
+	# upstream currently recommends adding CFLAGS to CC/CXX:
+	#    https://sourceware.org/PR23273
+	# Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS
+	# and breaks multiarch support. See 659030#c3 for an example.
+	# The glibc configure script doesn't properly use LDFLAGS all the time.
+	export CC="${glibc__GLIBC_CC} ${glibc__abi_CFLAGS} ${CFLAGS} ${LDFLAGS}"
+
+	# Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548
+	export CXX="${glibc__GLIBC_CXX} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	export CPP="${glibc__GLIBC_CPP} ${glibc__abi_CFLAGS} ${CFLAGS}"
+
+	if is_crosscompile; then
+		# Assume worst-case bootstrap: glibc is built for the first time
+		# with ${CTARGET}-g++ not available yet. We avoid
+		# building auxiliary programs that require C++: bug #683074
+		# It should not affect final result.
+		export libc_cv_cxx_link_ok=no
+		# The line above has the same effect. We set CXX explicitly
+		# to make build logs less confusing.
+		export CXX=
+	fi
+}
+
+foreach_abi() {
+	setup_env
+
+	local ret=0
+	local abilist=""
+	if use multilib ; then
+		abilist=$(get_install_abis)
+	else
+		abilist=${DEFAULT_ABI}
+	fi
+	local -x ABI
+	for ABI in ${abilist:-default} ; do
+		setup_env
+		einfo "Running $1 for ABI ${ABI}"
+		$1
+		: $(( ret |= $? ))
+	done
+	return ${ret}
+}
+
+glibc_banner() {
+	local b="Gentoo ${PVR}"
+	[[ -n ${PATCH_VER} ]] && ! use vanilla && b+=" (patchset ${PATCH_VER})"
+	echo "${b}"
+}
+
+# The following Kernel version handling functions are mostly copied from portage
+# source. It's better not to use linux-info.eclass here since a) it adds too
+# much magic, see bug 326693 for some of the arguments, and b) some of the
+# functions are just not provided.
+
+g_get_running_KV() {
+	uname -r
+	return $?
+}
+
+g_KV_major() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	echo "${KV%%.*}"
+}
+
+g_KV_minor() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.}
+	echo "${KV%%.*}"
+}
+
+g_KV_micro() {
+	[[ -z $1 ]] && return 1
+	local KV=$@
+	KV=${KV#*.*.}
+	echo "${KV%%[^[:digit:]]*}"
+}
+
+g_KV_to_int() {
+	[[ -z $1 ]] && return 1
+	local KV_MAJOR=$(g_KV_major "$1")
+	local KV_MINOR=$(g_KV_minor "$1")
+	local KV_MICRO=$(g_KV_micro "$1")
+	local KV_int=$(( KV_MAJOR * 65536 + KV_MINOR * 256 + KV_MICRO ))
+
+	# We make version 2.2.0 the minimum version we will handle as
+	# a sanity check ... if its less, we fail ...
+	if [[ ${KV_int} -ge 131584 ]] ; then
+		echo "${KV_int}"
+		return 0
+	fi
+	return 1
+}
+
+g_int_to_KV() {
+	local version=$1 major minor micro
+	major=$((version / 65536))
+	minor=$(((version % 65536) / 256))
+	micro=$((version % 256))
+	echo ${major}.${minor}.${micro}
+}
+
+get_kheader_version() {
+	printf '#include <linux/version.h>\nLINUX_VERSION_CODE\n' | \
+	$(tc-getCPP ${CTARGET}) -I "${ESYSROOT}$(alt_headers)" - | \
+	tail -n 1
+}
+
+# We collect all sanity checks here. Consistency is not guranteed between
+# pkg_ and src_ phases, so we call this function both in pkg_pretend and in
+# src_unpack.
+sanity_prechecks() {
+	# Prevent native builds from downgrading
+	if [[ ${MERGE_TYPE} != "buildonly" ]] && \
+	   [[ -z ${ROOT} ]] && \
+	   [[ ${CBUILD} == ${CHOST} ]] && \
+	   [[ ${CHOST} == ${CTARGET} ]] ; then
+
+		# The high rev # is to allow people to downgrade between -r#
+		# versions. We want to block 2.20->2.19, but 2.20-r3->2.20-r2
+		# should be fine. Hopefully we never actually use a r# this
+		# high.
+		if has_version ">${CATEGORY}/${P}-r10000" ; then
+			eerror "Sanity check to keep you from breaking your system:"
+			eerror " Downgrading glibc is not supported and a sure way to destruction."
+			[[ ${I_ALLOW_TO_BREAK_MY_SYSTEM} = yes ]] || die "Aborting to save your system."
+		fi
+
+		if ! do_run_test '#include <unistd.h>\n#include <sys/syscall.h>\nint main(){return syscall(1000)!=-1;}\n' ; then
+			eerror "Your old kernel is broken. You need to update it to a newer"
+			eerror "version as syscall(<bignum>) will break. See bug 279260."
+			die "Old and broken kernel."
+		fi
+	fi
+
+	if [[ ${CTARGET} == i386-* ]] ; then
+		eerror "i386 CHOSTs are no longer supported."
+		eerror "Chances are you don't actually want/need i386."
+		eerror "Please read https://www.gentoo.org/doc/en/change-chost.xml"
+		die "Please fix your CHOST"
+	fi
+
+	if [[ -e /proc/xen ]] && [[ $(tc-arch) == "x86" ]] && ! is-flag -mno-tls-direct-seg-refs ; then
+		ewarn "You are using Xen but don't have -mno-tls-direct-seg-refs in your CFLAGS."
+		ewarn "This will result in a 50% performance penalty when running with a 32bit"
+		ewarn "hypervisor, which is probably not what you want."
+	fi
+
+	# ABI-specific checks follow here. Hey, we have a lot more specific conditions that
+	# we test for...
+	if ! is_crosscompile ; then
+		if use amd64 && use multilib && [[ ${MERGE_TYPE} != "binary" ]] ; then
+			ebegin "Checking if the system can execute 32-bit binaries"
+			echo 'int main(){return 0;}' > "${T}/check-ia32-emulation.c"
+			local STAT
+			if ${CC-${CHOST}-gcc} ${CFLAGS_x86} "${T}/check-ia32-emulation.c" -o "${T}/check-ia32-emulation.elf32"; then
+				"${T}/check-ia32-emulation.elf32"
+				STAT=$?
+			else
+				# Don't fail here to allow single->multi ABI switch
+				# or recover from breakage like bug #646424
+				ewarn "Failed to compile the ABI test. Broken host glibc?"
+				STAT=0
+			fi
+			rm -f "${T}/check-ia32-emulation.elf32"
+			eend $STAT
+			if [[ $STAT -ne 0 ]]; then
+				eerror "Ensure that CONFIG_IA32_EMULATION is enabled in the kernel."
+				eerror "Seek support otherwise."
+				die "Unable to execute 32-bit binaries"
+			fi
+		fi
+
+	fi
+
+	# When we actually have to compile something...
+	if ! just_headers && [[ ${MERGE_TYPE} != "binary" ]] ; then
+		if [[ -d "${ESYSROOT}"/usr/lib/include ]] ; then
+			# bug #833620, bug #643302
+			eerror "Found ${ESYSROOT}/usr/lib/include directory!"
+			eerror "This is known to break glibc's build."
+			eerror "Please backup its contents then remove the directory."
+			die "Found directory (${ESYSROOT}/usr/lib/include) which will break build (bug #833620)!"
+		fi
+
+		if [[ ${CTARGET} == *-linux* ]] ; then
+			local run_kv build_kv want_kv
+
+			run_kv=$(g_get_running_KV)
+			build_kv=$(g_int_to_KV $(get_kheader_version))
+			want_kv=${MIN_KERN_VER}
+
+			if ! is_crosscompile && ! tc-is-cross-compiler ; then
+				# Building fails on an non-supporting kernel
+				ebegin "Checking running kernel version (${run_kv} >= ${want_kv})"
+				if ! [[ $(g_KV_to_int ${run_kv}) -ge $(g_KV_to_int ${want_kv}) ]] ; then
+					eend 1
+					echo
+					eerror "You need a kernel of at least ${want_kv}!"
+					die "Kernel version too low!"
+				fi
+				eend 0
+			fi
+
+			# Do not run this check for pkg_pretend, just pkg_setup and friends (if we ever get used there).
+			# It's plausible (seen it in the wild) that Portage will (correctly) schedule a linux-headers
+			# upgrade before glibc, but because pkg_pretend gets run before any packages are merged at all (not
+			# just glibc), the whole emerge gets aborted without a good reason. We probably don't
+			# need to run this check at all given we have a dependency on the right headers,
+			# but let's leave it as-is for now.
+			if [[ ${EBUILD_PHASE_FUNC} != pkg_pretend ]] ; then
+				ebegin "Checking linux-headers version (${build_kv} >= ${want_kv})"
+				if ! [[ $(g_KV_to_int ${build_kv}) -ge $(g_KV_to_int ${want_kv}) ]] ; then
+					eend 1
+					echo
+					eerror "You need linux-headers of at least ${want_kv}!"
+					die "linux-headers version too low!"
+				fi
+				eend 0
+			fi
+		fi
+	fi
+}
+
+upgrade_warning() {
+	is_crosscompile && return
+
+	if [[ ${MERGE_TYPE} != buildonly && -n ${REPLACING_VERSIONS} && -z ${ROOT} ]]; then
+		if ver_replacing -lt $(ver_cut 1-2 ${PV}); then
+			ewarn "After upgrading glibc, please restart all running processes."
+			ewarn "Be sure to include init (telinit u) or systemd (systemctl daemon-reexec)."
+			ewarn "Alternatively, reboot your system."
+			ewarn "(See bug #660556, bug #741116, bug #823756, etc)"
+		fi
+	fi
+}
+
+#
+# the phases
+#
+
+# pkg_pretend
+
+pkg_pretend() {
+	upgrade_warning
+}
+
+# pkg_setup
+
+pkg_setup() {
+	# see bug 682570
+	[[ -z ${BOOTSTRAP_RAP} ]] && python-any-r1_pkg_setup
+}
+
+# src_unpack
+
+src_unpack() {
+	setup_env
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
+
+	if [[ ${PV} == *9999 ]] ; then
+		EGIT_REPO_URI="
+			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
+			https://github.com/gentoo/glibc-patches.git
+		"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patches || die
+		EGIT_REPO_URI="
+			https://sourceware.org/git/glibc.git
+			https://git.sr.ht/~sourceware/glibc
+			https://gitlab.com/x86-glibc/glibc.git
+		"
+		EGIT_CHECKOUT_DIR=${S}
+		[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH=release/${PV%.*}/master
+		git-r3_src_unpack
+	else
+		unpack ${P}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack ${P}-patches-${PATCH_VER}.tar.xz
+	fi
+
+	cd "${WORKDIR}" || die
+	use systemd && unpack glibc-systemd-${GLIBC_SYSTEMD_VER}.tar.gz
+}
+
+# src_prepare
+
+src_prepare() {
+	local patchsetname
+	if ! use vanilla ; then
+		if [[ ${PV} == 9999* ]] ; then
+			patchsetname="from git master"
+		else
+			patchsetname="${PV}-${PATCH_VER}"
+		fi
+		einfo "Applying Gentoo Glibc patchset ${patchsetname}"
+		eapply "${WORKDIR}"/patches
+		einfo "Done."
+	fi
+
+	case ${CTARGET} in
+		m68*-aligned-*)
+			einfo "Applying utmp format fix for m68k with -maligned-int"
+			eapply "${FILESDIR}/glibc-2.41-m68k-malign.patch"
+			;;
+		*)
+			;;
+	esac
+
+	default
+
+	gnuconfig_update
+
+	cd "${WORKDIR}" || die
+	find . -name configure -exec touch {} +
+
+	# Fix permissions on some of the scripts.
+	chmod u+x "${S}"/scripts/*.sh
+
+	cd "${S}" || die
+}
+
+# src_configure
+
+glibc_do_configure() {
+	dump_build_environment
+
+	local myconf=()
+
+	# Use '=strong' instead of '=all' to protect only functions
+	# worth protecting from stack smashes.
+	myconf+=( --enable-stack-protector=$(usex ssp strong no) )
+
+	# Keep a whitelist of targets supporting IFUNC. glibc's ./configure
+	# is not robust enough to detect proper support:
+	#    https://bugs.gentoo.org/641216
+	#    https://sourceware.org/PR22634#c0
+	case $(tc-arch ${CTARGET}) in
+		# Keep whitelist of targets where autodetection mostly works.
+		amd64|x86|sparc|ppc|ppc64|arm|arm64|s390|riscv|loong) ;;
+		# Blacklist everywhere else
+		*) myconf+=( libc_cv_ld_gnu_indirect_function=no ) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|x32-x86_64-*-*-gnux32) myconf+=( $(use_enable cet) ) ;;
+		*) ;;
+	esac
+
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|arm64-aarch64-*) myconf+=( $(use_enable sframe) ) ;;
+		*) ;;
+	esac
+
+	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
+
+	myconf+=( --enable-kernel=${MIN_KERN_VER} )
+
+	# Since SELinux support is only required for nscd, only enable it if:
+	# 1. USE selinux
+	# 2. only for the primary ABI on multilib systems
+	# 3. Not a crosscompile
+	if ! is_crosscompile && use selinux ; then
+		if use multilib ; then
+			if is_final_abi ; then
+				myconf+=( --with-selinux )
+			else
+				myconf+=( --without-selinux )
+			fi
+		else
+			myconf+=( --with-selinux )
+		fi
+	else
+		myconf+=( --without-selinux )
+	fi
+
+	# Force a few tests where we always know the answer but
+	# configure is incapable of finding it.
+	if is_crosscompile ; then
+		export \
+			libc_cv_c_cleanup=yes \
+			libc_cv_forced_unwind=yes
+	fi
+
+	myconf+=(
+		--disable-werror
+		--enable-bind-now
+		--enable-fortify-source
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		$(use_enable profile)
+		$(use_with gd)
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		--sysconfdir="$(host_eprefix)/etc"
+		--localstatedir="$(host_eprefix)/var"
+		--libdir='$(prefix)'/$(get_libdir)
+		--mandir='$(prefix)'/share/man
+		--infodir='$(prefix)'/share/info
+		--libexecdir='$(libdir)'/misc/glibc
+		--with-bugurl=https://bugs.gentoo.org/
+		--with-pkgversion="$(glibc_banner)"
+		$(use_multiarch || echo --disable-multi-arch)
+		$(use_enable systemtap)
+		$(use_enable nscd)
+
+		# /usr/bin/mtrace has a Perl shebang. Gentoo Prefix QA checks fail if
+		# Perl hasn't been installed inside the prefix yet and configure picks
+		# up a Perl from outside the prefix instead. configure will fail to
+		# execute Perl during configure if we're cross-compiling a prefix, but
+		# it will just disable mtrace in that case.
+		# Note: mtrace is needed by the test suite.
+		ac_cv_path_PERL="$(usex perl "${EPREFIX}"/usr/bin/perl $(usex test "${EPREFIX}"/usr/bin/perl $(usex doc "${EPREFIX}"/usr/bin/perl no)))"
+
+		# locale data is arch-independent
+		# https://bugs.gentoo.org/753740
+		libc_cv_complocaledir='${exec_prefix}/lib/locale'
+
+		# On aarch64 there is no way to override -mcpu=native, and if
+		# the current cpu does not support SVE configure fails.
+		# Let's boldly assume our toolchain can always build SVE instructions.
+		libc_cv_aarch64_sve_asm=yes
+
+		${EXTRA_ECONF}
+	)
+
+	# We rely on sys-libs/timezone-data for timezone tools normally.
+	myconf+=( $(use_enable vanilla timezone-tools) )
+
+	# These libs don't have configure flags.
+	ac_cv_lib_audit_audit_log_user_avc_message=$(usex audit || echo no)
+	ac_cv_lib_cap_cap_init=$(usex caps || echo no)
+
+	# There is no configure option for this and we need to export it
+	# since the glibc build will re-run configure on itself
+	export libc_cv_rootsbindir="$(host_eprefix)/sbin"
+	export libc_cv_slibdir="$(host_eprefix)/$(get_libdir)"
+
+	local builddir=$(builddir nptl)
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+	set -- "${S}"/configure "${myconf[@]}"
+	echo "$@"
+	"$@" || die "failed to configure glibc"
+
+	# If we're trying to migrate between ABI sets, we need
+	# to lie and use a local copy of gcc.  Like if the system
+	# is built with MULTILIB_ABIS="amd64 x86" but we want to
+	# add x32 to it, gcc/glibc don't yet support x32.
+	#
+	if [[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib-bootstrap ; then
+		echo 'int main(void){}' > "${T}"/test.c || die
+		if ! $(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS} "${T}"/test.c -Wl,-emain -lgcc 2>/dev/null ; then
+			sed -i -e '/^CC = /s:$: -B$(objdir)/../'"gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}/${ABI}:" config.make || die
+		fi
+	fi
+}
+
+glibc_headers_configure() {
+	export ABI=default
+
+	local builddir=$(builddir "headers")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+
+	# if we don't have a compiler yet, we can't really test it now ...
+	# hopefully they don't affect header generation, so let's hope for
+	# the best here ...
+	local v vars=(
+		ac_cv_header_cpuid_h=yes
+		libc_cv_{386,390,alpha,arm,hppa,mips,{powerpc,sparc}{,32,64},sh,x86_64}_tls=yes
+		libc_cv_asm_cfi_directives=yes
+		libc_cv_broken_visibility_attribute=no
+		libc_cv_c_cleanup=yes
+		libc_cv_compiler_powerpc64le_binary128_ok=yes
+		libc_cv_forced_unwind=yes
+		libc_cv_gcc___thread=yes
+		libc_cv_mlong_double_128=yes
+		libc_cv_mlong_double_128ibm=yes
+		libc_cv_ppc_machine=yes
+		libc_cv_ppc_rel16=yes
+		libc_cv_predef_fortify_source=no
+		libc_cv_target_power8_ok=yes
+		libc_cv_visibility_attribute=yes
+		libc_cv_z_combreloc=yes
+		libc_cv_z_execstack=yes
+		libc_cv_z_initfirst=yes
+		libc_cv_z_nodelete=yes
+		libc_cv_z_nodlopen=yes
+		libc_cv_z_relro=yes
+		libc_mips_abi=${ABI}
+		libc_mips_float=$([[ $(tc-is-softfloat) == "yes" ]] && echo soft || echo hard)
+		# These libs don't have configure flags.
+		ac_cv_lib_audit_audit_log_user_avc_message=no
+		ac_cv_lib_cap_cap_init=no
+	)
+
+	einfo "Forcing cached settings:"
+	for v in "${vars[@]}" ; do
+		einfo " ${v}"
+		export ${v}
+	done
+
+	local headers_only_arch_CPPFLAGS=()
+
+	# Blow away some random CC settings that screw things up. #550192
+	if [[ -d ${S}/sysdeps/mips ]]; then
+		pushd "${S}"/sysdeps/mips >/dev/null
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=32:' mips32/Makefile mips64/n32/Makefile || die
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=64:' mips64/n64/Makefile || die
+
+		# Force the mips ABI to the default.  This is OK because the set of
+		# installed headers in this phase is the same between the 3 ABIs.
+		# If this ever changes, this hack will break, but that's unlikely
+		# as glibc discourages that behavior.
+		# https://crbug.com/647033
+		sed -i -e 's:abiflag=.*:abiflag=_ABIO32:' preconfigure || die
+
+		popd >/dev/null
+	fi
+
+	local myconf=()
+
+	case ${CTARGET} in
+	aarch64*)
+		# The configure checks fail during cross-build, so disable here
+		# for headers-only
+		myconf+=(
+			--disable-mathvec
+		) ;;
+	riscv*)
+		# RISC-V interrogates the compiler to determine which target to
+		# build.  If building the headers then we don't strictly need a
+		# RISC-V compiler, so the built-in definitions that are provided
+		# along with all RISC-V compiler might not exist.  This causes
+		# glibc's RISC-V preconfigure script to blow up.  Since we're just
+		# building the headers any value will actually work here, so just
+		# pick the standard one (rv64g/lp64d) to make the build scripts
+		# happy for now -- the headers are all the same anyway so it
+		# doesn't matter.
+		headers_only_arch_CPPFLAGS+=(
+			-D__riscv_xlen=64
+			-D__riscv_flen=64
+			-D__riscv_float_abi_double=1
+			-D__riscv_atomic=1
+		) ;;
+	esac
+
+	myconf+=(
+		--disable-sanity-checks
+		--enable-hacker-mode
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		--with-headers="${ESYSROOT}$(alt_headers)"
+		--prefix="$(host_eprefix)/usr"
+		${EXTRA_ECONF}
+	)
+
+	# Nothing is compiled here which would affect the headers for the target.
+	# So forcing CC/CFLAGS is sane.
+	local headers_only_CC=$(tc-getBUILD_CC)
+	local headers_only_CFLAGS="-O1 -pipe"
+	local headers_only_CPPFLAGS="-U_FORTIFY_SOURCE ${headers_only_arch_CPPFLAGS[*]}"
+	local headers_only_LDFLAGS=""
+	set -- "${S}"/configure "${myconf[@]}"
+	echo \
+		"CC=${headers_only_CC}" \
+		"CFLAGS=${headers_only_CFLAGS}" \
+		"CPPFLAGS=${headers_only_CPPFLAGS}" \
+		"LDFLAGS=${headers_only_LDFLAGS}" \
+		"$@"
+	CC=${headers_only_CC} \
+	CFLAGS=${headers_only_CFLAGS} \
+	CPPFLAGS=${headers_only_CPPFLAGS} \
+	LDFLAGS="" \
+	"$@" || die "failed to configure glibc"
+}
+
+do_src_configure() {
+	if just_headers ; then
+		glibc_headers_configure
+	else
+		glibc_do_configure nptl
+	fi
+}
+
+src_configure() {
+	foreach_abi do_src_configure
+}
+
+# src_compile
+
+do_src_compile() {
+	emake -C "$(builddir nptl)"
+}
+
+src_compile() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi do_src_compile
+}
+
+# src_test
+
+glibc_src_test() {
+	cd "$(builddir nptl)"
+
+	local myxfailparams=""
+	if [[ "${GENTOO_GLIBC_XFAIL_TESTS}" == "yes" ]] ; then
+		local virt=$(systemd-detect-virt 2>/dev/null)
+		if [[ ${virt} == systemd-nspawn ]] ; then
+			ewarn "Skipping extra tests because in systemd-nspawn container"
+			XFAIL_TEST_LIST+=( "${XFAIL_NSPAWN_TEST_LIST[@]}" )
+		fi
+		if [[ "$(nice)" == "19" ]] ; then
+			# Expects to be able to increase niceness, which it can't do if
+			# already at the highest nice value
+			XFAIL_TEST_LIST+=( "tst-nice" )
+		fi
+
+		for myt in ${XFAIL_TEST_LIST[@]} ; do
+			myxfailparams+="test-xfail-${myt}=yes "
+		done
+	fi
+
+	# sandbox does not understand unshare() and prevents
+	# writes to /proc/, which makes many tests fail
+
+	# we give the tests a bit more time to avoid spurious
+	# bug reports on slow arches
+
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 nonfatal emake ${myxfailparams} check
+}
+
+src_test() {
+	if just_headers ; then
+		return
+	fi
+
+	# glibc_src_test uses nonfatal so that we can run tests for all ABIs
+	# and fail at the end instead.
+	foreach_abi glibc_src_test || die "tests failed"
+}
+
+# src_install
+
+run_locale_gen() {
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
+
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
+	fi
+
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
+	fi
+
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
+	fi
+
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
+}
+
+glibc_do_src_install() {
+	local builddir=$(builddir nptl)
+	cd "${builddir}"
+
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install
+
+	# This version (2.26) provides some compatibility libraries for the NIS/NIS+ support
+	# which come without headers etc. Only needed for binary packages since the
+	# external net-libs/libnsl has increased soversion. Keep only versioned libraries.
+	find "${D}" -name "libnsl.a" -delete
+	find "${D}" -name "libnsl.so" -delete
+
+	# Normally upstream_pv is ${PV}. Live ebuilds are exception, there we need
+	# to infer upstream version:
+	# '#define VERSION "2.26.90"' -> '2.26.90'
+	local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h)
+
+	# Avoid stripping binaries not targeted by ${CHOST}. Or else
+	# ${CHOST}-strip would break binaries build for ${CTARGET}.
+	is_crosscompile && dostrip -x /
+
+	# gdb thread introspection relies on local libpthreads symbols. stripping breaks it
+	# See Note [Disable automatic stripping]
+	dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so
+	# valgrind requires knowledge about ld.so symbols.
+	dostrip -x $(alt_libdir)/ld-*.so*
+
+	if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then
+		# Move versioned .a file out of libdir to evade portage QA checks
+		# instead of using gen_usr_ldscript(). We fix ldscript as:
+		# "GROUP ( /usr/lib64/libm-<pv>.a ..." -> "GROUP ( /usr/lib64/glibc-<pv>/libm-<pv>.a ..."
+		sed -i "s@\(libm-${upstream_pv}.a\)@${P}/\1@" \
+			"${ED}"/$(alt_usrlibdir)/libm.a || die
+		dodir $(alt_usrlibdir)/${P}
+		mv "${ED}"/$(alt_usrlibdir)/libm-${upstream_pv}.a \
+			"${ED}"/$(alt_usrlibdir)/${P}/libm-${upstream_pv}.a || die
+	fi
+
+	# We configure toolchains for standalone prefix systems with a sysroot,
+	# which is prepended to paths in ld scripts, so strip the prefix from these.
+	# Before: GROUP ( /foo/lib64/libc.so.6 /foo/usr/lib64/libc_nonshared.a  AS_NEEDED ( /foo/lib64/ld-linux-x86-64.so.2 ) )
+	# After: GROUP ( /lib64/libc.so.6 /usr/lib64/libc_nonshared.a  AS_NEEDED ( /lib64/ld-linux-x86-64.so.2 ) )
+	if [[ -n $(host_eprefix) ]] ; then
+		local file
+		grep -lZIF "ld script" "${ED}/$(alt_usrlibdir)"/lib*.{a,so} 2>/dev/null | while read -rd '' file ; do
+			sed -i "s|$(host_eprefix)/|/|g" "${file}" || die
+		done
+	fi
+
+	# We'll take care of the cache ourselves
+	rm -f "${ED}"/etc/ld.so.cache
+
+	# Everything past this point just needs to be done once ...
+	is_final_abi || return 0
+
+	# Make sure the non-native interp can be found on multilib systems even
+	# if the main library set isn't installed into the right place.  Maybe
+	# we should query the active gcc for info instead of hardcoding it ?
+	local i ldso_abi ldso_name
+	local ldso_abi_list=(
+		# x86
+		amd64   /lib64/ld-linux-x86-64.so.2
+		x32     /libx32/ld-linux-x32.so.2
+		x86     /lib/ld-linux.so.2
+		# mips
+		o32     /lib/ld.so.1
+		n32     /lib32/ld.so.1
+		n64     /lib64/ld.so.1
+		# powerpc
+		ppc     /lib/ld.so.1
+		# riscv
+		ilp32d  /lib/ld-linux-riscv32-ilp32d.so.1
+		ilp32   /lib/ld-linux-riscv32-ilp32.so.1
+		lp64d   /lib/ld-linux-riscv64-lp64d.so.1
+		lp64    /lib/ld-linux-riscv64-lp64.so.1
+		# s390
+		s390    /lib/ld.so.1
+		s390x   /lib/ld64.so.1
+		# sparc
+		sparc32 /lib/ld-linux.so.2
+		sparc64 /lib64/ld-linux.so.2
+	)
+	case $(tc-endian) in
+	little)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64.so.1
+			# ELFv2 (glibc does not support ELFv1 on LE)
+			ppc64   /lib64/ld64.so.2
+		)
+		;;
+	big)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64_be.so.1
+			# ELFv1 (glibc does not support ELFv2 on BE)
+			ppc64   /lib64/ld64.so.1
+		)
+		;;
+	esac
+	if [[ ${SYMLINK_LIB} == "yes" ]] && [[ ! -e ${ED}/$(alt_prefix)/lib ]] ; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) $(alt_prefix)/lib
+	fi
+	for (( i = 0; i < ${#ldso_abi_list[@]}; i += 2 )) ; do
+		ldso_abi=${ldso_abi_list[i]}
+		has ${ldso_abi} $(get_install_abis) || continue
+
+		ldso_name="$(alt_prefix)${ldso_abi_list[i+1]}"
+		if [[ ! -L ${ED}/${ldso_name} && ! -e ${ED}/${ldso_name} ]] ; then
+			dosym ../$(get_abi_LIBDIR ${ldso_abi})/${ldso_name##*/} ${ldso_name}
+		fi
+	done
+
+	# In the LSB 5.0 definition, someone had the excellent idea to "standardize"
+	# the runtime loader name, see also https://xkcd.com/927/
+	# Normally, in Gentoo one should never come across executables that require this.
+	# However, binary commercial packages are known to adhere to weird practices.
+	# https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-AMD64/LSB-Core-AMD64.html#BASELIB
+	local lsb_ldso_name native_ldso_name lsb_ldso_abi
+	local lsb_ldso_abi_list=(
+		# x86
+		amd64	ld-linux-x86-64.so.2	ld-lsb-x86-64.so.3
+	)
+	for (( i = 0; i < ${#lsb_ldso_abi_list[@]}; i += 3 )) ; do
+		lsb_ldso_abi=${lsb_ldso_abi_list[i]}
+		native_ldso_name=${lsb_ldso_abi_list[i+1]}
+		lsb_ldso_name=${lsb_ldso_abi_list[i+2]}
+		has ${lsb_ldso_abi} $(get_install_abis) || continue
+
+		if [[ ! -L ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} && ! -e ${ED}/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name} ]] ; then
+			dosym ${native_ldso_name} "$(alt_prefix)/$(get_abi_LIBDIR ${lsb_ldso_abi})/${lsb_ldso_name}"
+		fi
+	done
+
+	# With devpts under Linux mounted properly, we do not need the pt_chown
+	# binary to be setuid.  This is because the default owners/perms will be
+	# exactly what we want.
+	if ! use suid ; then
+		find "${ED}" -name pt_chown -exec chmod -s {} +
+	fi
+
+	#################################################################
+	# EVERYTHING AFTER THIS POINT IS FOR NATIVE GLIBC INSTALLS ONLY #
+	#################################################################
+
+	# Make sure we install some symlink hacks so that when we build
+	# a 2nd stage cross-compiler, gcc finds the target system
+	# headers correctly.  See gcc/doc/gccinstall.info
+	if is_crosscompile ; then
+		# We need to make sure that /lib and /usr/lib always exists.
+		# gcc likes to use relative paths to get to its multilibs like
+		# /usr/lib/../lib64/.  So while we don't install any files into
+		# /usr/lib/, we do need it to exist.
+		keepdir $(alt_prefix)/lib
+		keepdir $(alt_prefix)/usr/lib
+
+		dosym usr/include $(alt_prefix)/sys-include
+		return 0
+	fi
+
+	# Files for Debian-style locale updating
+	dodir /usr/share/i18n
+	sed \
+		-e "/^#/d" \
+		-e "/SUPPORTED-LOCALES=/d" \
+		-e "s: \\\\::g" -e "s:/: :g" \
+		"${S}"/localedata/SUPPORTED > "${ED}"/usr/share/i18n/SUPPORTED \
+		|| die "generating /usr/share/i18n/SUPPORTED failed"
+
+	cd "${S}" || die
+
+	# Install misc network config files
+	insinto /etc
+	doins posix/gai.conf
+
+	if use systemd ; then
+		doins "${WORKDIR}/glibc-systemd-${GLIBC_SYSTEMD_VER}/gentoo-config/nsswitch.conf"
+	else
+		doins nss/nsswitch.conf
+	fi
+
+	# Gentoo-specific
+	newins "${FILESDIR}"/host.conf-1 host.conf
+
+	if use nscd ; then
+		doins nscd/nscd.conf
+
+		newinitd "$(prefixify_ro "${FILESDIR}"/nscd-1)" nscd
+
+		local nscd_args=(
+			-e "s:@PIDFILE@:$(strings "${ED}"/usr/sbin/nscd | grep nscd.pid):"
+		)
+
+		sed -i "${nscd_args[@]}" "${ED}"/etc/init.d/nscd
+
+		use systemd && systemd_dounit nscd/nscd.service
+		newtmpfiles nscd/nscd.tmpfiles nscd.conf
+	fi
+
+	echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00glibc
+	doenvd "${T}"/00glibc
+
+	for d in BUGS ChangeLog CONFORMANCE FAQ NEWS NOTES PROJECTS README* ; do
+		[[ -s ${d} ]] && dodoc ${d}
+	done
+	dodoc -r ChangeLog.old
+
+	# Prevent overwriting of the /etc/localtime symlink.  We'll handle the
+	# creation of the "factory" symlink in pkg_postinst().
+	rm -f "${ED}"/etc/localtime
+
+	# Generate all locales if this is a native build as locale generation
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+	fi
+}
+
+glibc_headers_install() {
+	local builddir=$(builddir "headers")
+	cd "${builddir}"
+	emake install_root="${D}/$(build_eprefix)$(alt_prefix)" install-headers
+
+	insinto $(alt_headers)/gnu
+	doins "${S}"/include/gnu/stubs.h
+
+	# Make sure we install the sys-include symlink so that when
+	# we build a 2nd stage cross-compiler, gcc finds the target
+	# system headers correctly.  See gcc/doc/gccinstall.info
+	dosym usr/include $(alt_prefix)/sys-include
+}
+
+src_install() {
+	if just_headers ; then
+		export ABI=default
+		glibc_headers_install
+		return
+	fi
+
+	foreach_abi glibc_do_src_install
+
+	if ! use static-libs ; then
+		einfo "Not installing static glibc libraries"
+		find "${ED}" -name "*.a" -and -not -name "*_nonshared.a" -delete
+	fi
+}
+
+# Simple test to make sure our new glibc isn't completely broken.
+# Make sure we don't test with statically built binaries since
+# they will fail.  Also, skip if this glibc is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+glibc_sanity_check() {
+	cd / #228809
+
+	# We enter ${ED} so to avoid trouble if the path contains
+	# special characters; for instance if the path contains the
+	# colon character (:), then the linker will try to split it
+	# and look for the libraries in an unexpected place. This can
+	# lead to unsafe code execution if the generated prefix is
+	# within a world-writable directory.
+	# (e.g. /var/tmp/portage:${HOSTNAME})
+	pushd "${ED}"/$(get_libdir) >/dev/null
+
+	# first let's find the actual dynamic linker here
+	# symlinks may point to the wrong abi
+	local newldso=$(find . -maxdepth 1 -name 'ld*so.?' -type f -print -quit)
+
+	einfo Last-minute run tests with ${newldso} in /$(get_libdir) ...
+
+	local x striptest
+	for x in cal date env free ls true uname uptime ; do
+		x=$(type -p ${x})
+		[[ -z ${x} || ${x} != ${EPREFIX}/* ]] && continue
+		striptest=$(LC_ALL="C" file -L ${x} 2>/dev/null) || continue
+		case ${striptest} in
+		*"statically linked"*) continue;;
+		*"ASCII text"*) continue;;
+		esac
+		# We need to clear the locale settings as the upgrade might want
+		# incompatible locale data.  This test is not for verifying that.
+		LC_ALL=C \
+		${newldso} --library-path . ${x} > /dev/null \
+			|| die "simple run test (${x}) failed"
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	einfo "Checking general environment sanity."
+	sanity_prechecks
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	# Default /etc/hosts.conf:multi to on for systems with small dbs.
+	if [[ $(wc -l < "${EROOT}"/etc/hosts) -lt 1000 ]] ; then
+		sed -i '/^multi off/s:off:on:' "${ED}"/etc/host.conf
+		einfo "Defaulting /etc/host.conf:multi to on"
+	fi
+
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}/$(get_libdir) ]] || return 0
+	[[ -z ${BOOTSTRAP_RAP} ]] && glibc_sanity_check
+
+	if [[ -L ${EROOT}/usr/lib/locale ]]; then
+		# Help portage migrate this to a directory
+		# https://bugs.gentoo.org/753740
+		rm "${EROOT}"/usr/lib/locale || die
+	fi
+
+	# Keep around libcrypt so that Perl doesn't break when merging libxcrypt
+	# (libxcrypt is the new provider for now of libcrypt.so.{1,2}).
+	# bug #802207
+	if has_version "${CATEGORY}/${PN}[crypt]" && ! has preserve-libs ${FEATURES}; then
+		PRESERVED_OLD_LIBCRYPT=1
+		cp -p "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" \
+			"${T}/libcrypt$(get_libname 1)" || die
+	else
+		PRESERVED_OLD_LIBCRYPT=0
+	fi
+}
+
+glibc_refresh_ldconfig() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+
+	# Version check could be added to avoid unnecessary work, but ldconfig
+	# should finish quickly enough to not matter.
+	ebegin "Refreshing ld.so.cache"
+	ldconfig -i
+	if ! eend $?; then
+		ewarn "Failed to refresh the ld.so.cache for you. Some programs may be broken"
+		ewarn "before you manually do so (ldconfig -i)."
+	fi
+}
+
+pkg_postinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	if ! tc-is-cross-compiler && [[ -x ${EROOT}/usr/sbin/iconvconfig ]] ; then
+		# Generate fastloading iconv module configuration file.
+		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}/"
+	fi
+
+	if ! is_crosscompile && [[ -z ${ROOT} ]] ; then
+		# glibc-2.38+ on loong has ldconfig support added, but the ELF e_flags
+		# handling has changed as well, which means stale ldconfig auxiliary
+		# cache entries and failure to lookup libgcc_s / libstdc++ (breaking
+		# every C++ application) / libgomp etc., among other breakages.
+		#
+		# To fix this, simply refresh the ld.so.cache without using the
+		# auxiliary cache if we're natively installing on loong. This should
+		# be done relatively soon because we want to minimize the breakage
+		# window for the affected programs.
+		use loong && glibc_refresh_ldconfig
+
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
+
+		# If fixincludes was/is active for a particular GCC slot, we
+		# must refresh it. See bug #933282 and GCC's documentation:
+		# https://gcc.gnu.org/onlinedocs/gcc/Fixed-Headers.html
+		#
+		# TODO: Could this be done for cross? Some care would be needed
+		# to pass the right arguments.
+		while IFS= read -r -d $'\0' slot ; do
+			local mkheaders_path="${BROOT}"/usr/libexec/gcc/${CBUILD}/${slot##*/}/install-tools/mkheaders
+			local pthread_h="${BROOT}"/usr/lib/gcc/${CBUILD}/${slot##*/}/include-fixed/pthread.h
+			if [[ -x ${mkheaders_path} ]] ; then
+				ebegin "Refreshing fixincludes for ${CBUILD} with gcc-${slot##*/}"
+				${mkheaders_path} -v
+				eend $?
+			elif [[ -f ${pthread_h} ]] ; then
+				# fixincludes might have been enabled in the past for this
+				# GCC slot but not since we fixed toolchain.eclass to install
+				# mkheaders, so we need to manually delete pthread.h at least.
+				ebegin "Deleting stale fixincludes'd pthread.h for ${CBUILD} with gcc-${slot##*/}"
+				mv -v "${pthread_h}" "${pthread_h}.bak"
+				eend $?
+			fi
+		done < <(find "${BROOT}"/usr/libexec/gcc/${CBUILD}/ -mindepth 1 -maxdepth 1 -type d -print0)
+	fi
+
+	upgrade_warning
+
+	# Check for sanity of /etc/nsswitch.conf, take 2
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then
+		local entry
+		for entry in passwd group shadow; do
+			if grep -E -q "^[ \t]*${entry}:.*nis" "${EROOT}"/etc/nsswitch.conf; then
+				ewarn ""
+				ewarn "Your ${EROOT}/etc/nsswitch.conf uses NIS. Support for that has been"
+				ewarn "removed from glibc and is now provided by the package"
+				ewarn "  sys-auth/libnss-nis"
+				ewarn "Install it now to keep your NIS setup working."
+				ewarn ""
+			fi
+		done
+	fi
+
+	if [[ ${PRESERVED_OLD_LIBCRYPT} -eq 1 ]] ; then
+		cp -p "${T}/libcrypt$(get_libname 1)" "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" || die
+		preserve_old_lib_notify /$(get_libdir)/libcrypt$(get_libname 1)
+
+		elog "Please ignore a possible later error message about a file collision involving"
+		elog "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1). We need to preserve this file for the moment to keep"
+		elog "the upgrade working, but it also needs to be overwritten when"
+		elog "sys-libs/libxcrypt is installed. See bug 802210 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
index 2f7f58fcccd..0e65d86c790 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-9999.ebuild
@@ -38,7 +38,7 @@ inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfi
 DESCRIPTION="GNU libc C library"
 HOMEPAGE="https://www.gnu.org/software/libc/"
 
-if [[ ${PV} == 9999* ]]; then
+if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
 else
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
@@ -51,7 +51,7 @@ SRC_URI+=" systemd? ( https://gitweb.gentoo.org/proj/toolchain/glibc-systemd.git
 
 LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
 SLOT="2.2"
-IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
+IUSE="audit caps cet compile-locales custom-cflags doc gd hash-sysv-compat headers-only +multiarch multilib multilib-bootstrap nscd perl profile selinux sframe +ssp stack-realign +static-libs suid systemd systemtap test vanilla"
 
 # Here's how the cross-compile logic breaks down ...
 #  CTARGET - machine that will target the binaries
@@ -115,6 +115,7 @@ BDEPEND="
 		dev-lang/perl
 		sys-apps/texinfo
 	)
+	sframe? ( >=sys-devel/binutils-2.45 )
 	test? (
 		dev-lang/perl
 		>=net-dns/libidn2-2.3.0
@@ -930,7 +931,7 @@ src_unpack() {
 
 	use multilib-bootstrap && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
 
-	if [[ ${PV} == 9999* ]] ; then
+	if [[ ${PV} == *9999 ]] ; then
 		EGIT_REPO_URI="
 			https://anongit.gentoo.org/git/proj/toolchain/glibc-patches.git
 			https://github.com/gentoo/glibc-patches.git
@@ -944,12 +945,13 @@ src_unpack() {
 			https://gitlab.com/x86-glibc/glibc.git
 		"
 		EGIT_CHECKOUT_DIR=${S}
+		[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH=release/${PV%.*}/master
 		git-r3_src_unpack
 	else
 		unpack ${P}.tar.xz
 
 		cd "${WORKDIR}" || die
-		unpack glibc-${PV}-patches-${PATCH_VER}.tar.xz
+		unpack ${P}-patches-${PATCH_VER}.tar.xz
 	fi
 
 	cd "${WORKDIR}" || die
@@ -1020,6 +1022,11 @@ glibc_do_configure() {
 		*) ;;
 	esac
 
+	case ${ABI}-${CTARGET} in
+		amd64-x86_64-*|arm64-aarch64-*) myconf+=( $(use_enable sframe) ) ;;
+		*) ;;
+	esac
+
 	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
 
 	myconf+=( --enable-kernel=${MIN_KERN_VER} )
@@ -1301,7 +1308,7 @@ glibc_src_test() {
 	# we give the tests a bit more time to avoid spurious
 	# bug reports on slow arches
 
-	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 emake ${myxfailparams} check
+	SANDBOX_ON=0 LD_PRELOAD= TIMEOUTFACTOR=16 nonfatal emake ${myxfailparams} check
 }
 
 src_test() {
@@ -1309,44 +1316,44 @@ src_test() {
 		return
 	fi
 
+	# glibc_src_test uses nonfatal so that we can run tests for all ABIs
+	# and fail at the end instead.
 	foreach_abi glibc_src_test || die "tests failed"
 }
 
 # src_install
 
 run_locale_gen() {
-	# if the host locales.gen contains no entries, we'll install everything
-	local root="$1"
-	local inplace=""
+	local prefix=$1 user_config config
+	local -a hasversion_opts localegen_args
 
-	if [[ "${root}" == "--inplace-glibc" ]] ; then
-		inplace="--inplace-glibc"
-		root="$2"
+	if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+		hasversion_opts=( -b )
 	fi
 
-	local locale_list="${root%/}/etc/locale.gen"
-
-	pushd "${ED}"/$(get_libdir) >/dev/null
-
-	if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
-		[[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
-		locale_list="${root%/}/usr/share/i18n/SUPPORTED"
+	if has_version "${hasversion_opts[@]}" '>=sys-apps/locale-gen-3'; then
+		localegen_args=( --prefix "${prefix}" )
+	else
+		config="${prefix}/usr/share/i18n/SUPPORTED"
+		user_config="${prefix}/etc/locale.gen"
+		if [[ ${EBUILD_PHASE_FUNC} == src_install ]]; then
+			# For USE=compile-locales, all locales should be built.
+			mkdir -p -- "${prefix}/usr/lib/locale" || die
+		elif locale-gen --list --config "${user_config}" | read -r; then
+			config=${user_config}
+		fi
+		localegen_args=( --config "${config}" --destdir "${prefix}" )
 	fi
 
-	# bug 736794: we need to be careful with the parallelization... the number of
-	# processors saved in the environment of a binary package may differ strongly
-	# from the number of processes available during postinst
-	local mygenjobs="$(makeopts_jobs)"
-	if [[ "${EMERGE_FROM}" == "binary" ]] ; then
-		mygenjobs="$(nproc)"
+	# bug 736794: we need to be careful with the parallelization... the
+	# number of processors saved in the environment of a binary package may
+	# differ strongly from the number of processes available during postinst
+	if [[ ${EMERGE_FROM} != binary ]]; then
+		localegen_args+=( --jobs "$(makeopts_jobs)" )
 	fi
 
-	set -- locale-gen ${inplace} --jobs "${mygenjobs}" --config "${locale_list}" \
-		--destdir "${root}"
-	echo "$@"
-	"$@"
-
-	popd >/dev/null
+	printf 'Executing: locale-gen %s\n' "${localegen_args[*]@Q}" >&2
+	locale-gen "${localegen_args[@]}"
 }
 
 glibc_do_src_install() {
@@ -1561,8 +1568,8 @@ glibc_do_src_install() {
 	rm -f "${ED}"/etc/localtime
 
 	# Generate all locales if this is a native build as locale generation
-	if use compile-locales && ! is_crosscompile ; then
-		run_locale_gen --inplace-glibc "${ED}/"
+	if use compile-locales && ! is_crosscompile && ! run_locale_gen "${ED}"; then
+		die "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
 	fi
 }
 
@@ -1712,7 +1719,9 @@ pkg_postinst() {
 		# window for the affected programs.
 		use loong && glibc_refresh_ldconfig
 
-		use compile-locales || run_locale_gen "${EROOT}/"
+		if ! use compile-locales && ! run_locale_gen "${EROOT}"; then
+			ewarn "locale-gen(1) unexpectedly failed during the ${EBUILD_PHASE_FUNC} phase"
+		fi
 
 		# If fixincludes was/is active for a particular GCC slot, we
 		# must refresh it. See bug #933282 and GCC's documentation:
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
index 846d01d34e0..6978f9425ef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/metadata.xml
@@ -18,6 +18,7 @@
 		<flag name="multilib-bootstrap">Provide prebuilt libgcc.a and crt files if missing. Only needed for ABI switch.</flag>
 		<flag name="nscd">Build, and enable support for, the Name Service Cache Daemon</flag>
 		<flag name="perl">Install additional scripts written in Perl</flag>
+		<flag name="sframe">enable building with sframe backtrace support</flag>
 		<flag name="ssp">protect stack of glibc internals</flag>
 		<flag name="stack-realign">Realign the stack in the 32-bit build for compatibility with older binaries at some performance cost</flag>
 		<flag name="static-pie">Enable static PIE support (runtime files for -static-pie gcc option).</flag>
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
index bdff2e8cbcc..b83ad80003d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.71.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
index bdff2e8cbcc..b83ad80003d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.76.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
index b81da91b612..aeb560184a5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit multilib-minimal toolchain-funcs pam
+inherit dot-a multilib-minimal toolchain-funcs pam
 
 if [[ ${PV} == *9999 ]]; then
 	inherit git-r3
@@ -59,6 +59,7 @@ run_emake() {
 }
 
 src_configure() {
+	use static-libs && lto-guarantee-fat
 	tc-export_build_env BUILD_CC
 	multilib-minimal_src_configure
 }
@@ -75,7 +76,9 @@ multilib_src_install() {
 	# no configure, needs explicit install line #444724#c3
 	run_emake DESTDIR="${D}" install
 
-	if ! use static-libs ; then
+	if use static-libs ; then
+		strip-lto-bytecode
+	else
 		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
index d66e68308c8..d4b518e2890 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/Manifest
@@ -2,3 +2,4 @@ DIST libnvme-1.11.1.gh.tar.gz 740327 BLAKE2B eb9a731ce4886e7a76170d4be916e850548
 DIST libnvme-1.12.gh.tar.gz 775030 BLAKE2B b6c9da012c39ec0b5ce671f498fd55b904ea9f0c34f8358eed166e08f9ef12c760707aa693a0123267cfb256812650f0afb5d017f4c8a940b61e18f9998d8b9e SHA512 6681f476c36d077d1481336ca66327cfed9b910e75309334a1eb1fa8ccfba7982d96c7b3ae5d587f306923247a716c5d70f4b71c26716e6be6020b470f9c1077
 DIST libnvme-1.13.gh.tar.gz 776674 BLAKE2B a0b9190a2350e28ccbe4bed69eb23140bf6863688c977a023333309cdcca8398d6c024197429454c003ebbc642d492f88737d27cea368345768cf181fad8ce8d SHA512 7c56cb4a531c77e7024126c3dde4ffe629944be93a3102b09bc7a16031bdd64dac5cb19834c586609c5e3c186f805532d739f960abc4ba22114f36c6bc710264
 DIST libnvme-1.14.gh.tar.gz 805970 BLAKE2B a7d4acd4f28d2bca223fc788962fc62ab31e2f60010bd05254c44e3c59a60e42ecfe25c6aea13ac99341695340084d3c3034d8a3f822df7c51551c839d41fe95 SHA512 96a1bbd6cea1e77381254e242e781b023416abfbf44c82a0aa6eb0b316b30316d32d0b91f441089a317cbae5b511f6b3eaab570624cbda2178f9dce4cb5dd288
+DIST libnvme-1.15.gh.tar.gz 811291 BLAKE2B 6b1f8f873eb173ac5e8593fed7825cd39a3fe501c5d51f23e8bf3ae4f403709d35a0d893e5f190cced73426bf6fa532f8c0a75f8f9c34834f6a1aa849be7673f SHA512 7357685b3f47eda445387965420e7885a326a6b60b3da5af4a8bb942d4f924534babbde3d4aae8468c8a2f0ee4971f2896fadc133f4c387d59f9f620ed2450aa
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild
new file mode 100644
index 00000000000..3558cff4039
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.15.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} )
+DISTUTILS_OPTIONAL=1
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=meson-python
+inherit distutils-r1 meson
+
+DESCRIPTION="C Library for NVM Express on Linux"
+HOMEPAGE="https://github.com/linux-nvme/libnvme"
+SRC_URI="https://github.com/linux-nvme/libnvme/archive/refs/tags/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="dbus examples io-uring +json keyutils python ssl test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+DEPEND="
+	json? ( dev-libs/json-c:= )
+	keyutils? ( sys-apps/keyutils:= )
+	dbus? ( sys-apps/dbus:= )
+	python? ( ${PYTHON_DEPS} )
+	ssl? ( >=dev-libs/openssl-1.1:= )
+	io-uring? ( sys-libs/liburing:= )
+"
+RDEPEND="
+	${DEPEND}
+"
+BDEPEND="
+	python? (
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+		dev-python/meson-python[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+src_prepare() {
+	default
+	use python && distutils-r1_src_prepare
+}
+
+src_configure() {
+	local emesonargs=(
+		-Dpython=disabled
+		$(meson_use test tests)
+		$(meson_use examples)
+		$(meson_feature json json-c)
+		$(meson_feature dbus libdbus)
+		$(meson_feature keyutils)
+		$(meson_feature ssl openssl)
+		$(meson_feature io-uring liburing)
+	)
+	meson_src_configure
+	use python && distutils-r1_src_configure
+}
+
+python_compile() {
+	local emesonargs=(
+		-Dpython=enabled
+	)
+	meson_src_configure --reconfigure
+	distutils-r1_python_compile
+}
+
+src_compile() {
+	meson_src_compile
+
+	use python && distutils-r1_src_compile
+}
+
+src_test() {
+	meson_src_test
+	use python && distutils-r1_src_test
+}
+
+python_test() {
+	local -A test_args=(
+		["test-nbft.py"]="--filename=${S}/libnvme/tests/NBFT"
+	)
+	pushd "${BUILD_DIR}" >/dev/null || die
+	local testfile
+	for testfile in "${S}"/libnvme/tests/*.py; do
+		PYTHONPATH="${BUILD_DIR}" "${EPYTHON}" "${testfile}" \
+			${test_args[${testfile##*/}]} \
+			|| die "test ${testfile##*/} failed with ${EPYTHON}"
+	done
+	popd >/dev/null || die
+}
+
+src_install() {
+	meson_src_install
+	use python && distutils-r1_src_install
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
index 84e1cb687ab..2d599afbef0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
@@ -1,144 +1,3 @@
-DIST ncurses-6.4-20230107.patch.gz 196232 BLAKE2B 8751142f825a4b79413986e45bc160d49cc9ccef23ae542c59a74435e251de82bdc8f450df14db0867b8679b5ecb81f0fb9abda662a82fb033a7eb5e079ee308 SHA512 970670d8eee50d44b8c7f29daf4c6a575beff3b4fafe12fff786cbd7ac03edeb1e7dae99c8064de99c166e9b3d7811f035ecf75c0eaffb382127cc9df5388d9b
-DIST ncurses-6.4-20230107.patch.gz.asc 729 BLAKE2B 483156747c88de46d131cf1f4e460972f95f689baaec0fb4c7c9966bec6e53d41285261761af17cbd8a9543108095587e598e3fe2fe21d76dc4fedde85a3eb0a SHA512 e14d0a27dae59e95f503bf1a569b0cc3115755043eb0cb4fa481e90bf24d097fae675e08c1247c0746fbb5c03c363dc88e6a60c0e9d6abb278df4e8d581749b1
-DIST ncurses-6.4-20230114.patch.gz 179019 BLAKE2B 8e7290f41133177275249c084c93a5fe6cb1dcd75e4deea0e44dbdd79774a364705bcd20b30b735996e19e861b5cde2216b5ce7c8d89066095d7c06ce38e5454 SHA512 202c02b09bf21d5c8341fc0e8a30a2c906f0e260a4d536f1332f978ebbe4d93250b832c6449a81ffdc9e030802f064237f39fd0f473e75e61cc77e15232c9a01
-DIST ncurses-6.4-20230114.patch.gz.asc 729 BLAKE2B dbb676160938bf5a65780a446bdffc8521410d216609d38817ea8977ea0f244dc221ec33a0475e05542fba4be7349f0948e9fa32be7fd439e57721b6a6e08fe3 SHA512 bfa1b6856fdf503aa17bac83ba0170009242ac950d46bb8789fb0e0f68c406fed364104565351df70ab58b12bbf8aedd4e587df3bd7ee69a6a0c287f67fd0c3b
-DIST ncurses-6.4-20230121.patch.gz 44888 BLAKE2B 355b2f283b978a2aadee0f4e1bc1694eb8d4ef559014d86b1ef05ab818a8852192b09976336ecd73f2610e87a8a3ccd4f799e6e0585ec4a2a8e85abbbae2f467 SHA512 7bee1b23afff48b5319a60f9e90cfd7593c0a107bcd5606da8e765b4d38904a6f732fe8077ecfac45ee2daceed301026ef3fb67435cae1d94ef5fec01440c100
-DIST ncurses-6.4-20230121.patch.gz.asc 729 BLAKE2B ddd69de4d17066b79ed9c99dfafcd051ebfb32cc31b5ea88fe013b991ca91e3bf4d00fbb36bd73b5d2ff0d4fdf33525b14bbe6ccb5216af5459e276e161a716b SHA512 f0a6eb2c81782c2d2da6d15b82a3167e4209887b868efe2e36708ffba93c987f358828d353a4b211f5fe6c1abce90b42e7d6dd2cb6ad322de78bbe2ceb04e1ad
-DIST ncurses-6.4-20230128.patch.gz 119721 BLAKE2B e91942151653415ba09e384c683a2d13854c6a751fbb4b60ee74245e71207f98d7a89b000e93cc3555f302dba2c5ca55d8313cab2197dc4074251044ef7b4eae SHA512 fffc86e953213ddc9bbe5c6a51bd60725ef75655452d03a53a38bfd5ca318d4801bb9ae4244e7e14ca8c77a9aa6fba298f45a01ae26a964cfc3300268f87c479
-DIST ncurses-6.4-20230128.patch.gz.asc 729 BLAKE2B 0faa8eb037867b99e7ea6f23c99d487426986cf9e5bc5a89179bd1ad4f363c5621d7c81214f4e38eed4ddbce9cd2cb569ff700325585e56ba706c7f1b56cabd6 SHA512 9cc84a4e32b7a67965106e8f414f87a160b632d49a5489880cd4f3f43daa7043d33894b22a16efdef5cd04914cf69019a1abefc8b9234ba2a92d1dc7c46f72fa
-DIST ncurses-6.4-20230211.patch.gz 13004 BLAKE2B 1935bee908c20f065f93100745755177012a49709bca3b14edb0414aa1493dbd6c52313a16ed04b58dff635fb6e853c39e3e3fe2b47ac5662fc274d59976ae94 SHA512 f70ad2605dfe867d8cdcbd6516c759bbf5422bf297d1ee0fb20b2b4262177cb018b7612c735efeccf8794a6fde55e388e4c9ef0bed41e9c467902835c6bf678e
-DIST ncurses-6.4-20230211.patch.gz.asc 729 BLAKE2B 42a64222042021f85a70d88555cdb6854abcc0202fd3580fff0984aee1d6154bb995d6357ed45cbb90ba92c17c32d8fd573ba0c59d37e9add2d7ece68044ac52 SHA512 27930c85a4ff2cb83c54def0fdf8f1765c4d1ca36935b26022bfe48ab6e87f39c6e45b8d1427d448e0a7b2bae864b00811ac9f1f1ab9f97d4c8f4b001dc2cb01
-DIST ncurses-6.4-20230218.patch.gz 146502 BLAKE2B 571cf7f5df5eeef21ab719ea2e941a431751ffd973de11783b96bea1ff6162f9fbbd3c3616d4c63906135cb4a6f16f8ee1a566743760c20bf026c2f378d57ce6 SHA512 7c8cec6437bef737235cf0a684646d3b6bf38c66314c14d5f07ec5dc2ca20e3036ffbd9900bb5c45e48929b1454711de412b77e527a7df643dd4403a5abfc787
-DIST ncurses-6.4-20230218.patch.gz.asc 729 BLAKE2B ca55b37bf6e647c5e39eaba1174c9c9699ffa77fc7ec1b53771586303184cf4b64cf5def844fc87d563a847109d7b00beac17e758a9803350831ebe14d36b0d9 SHA512 5471a2c8389742c0c8b74f1c27e9b97012c5d5eb0256fbd4bb904daab685614fe2506b5a204d958273eb66b56c5ff4b5e5aba8e28f59e2fe0cba392dde59b473
-DIST ncurses-6.4-20230225.patch.gz 68561 BLAKE2B ab80ea189f975e6fc0c2a1dd22898e2d4dde6bf2767ed47000c534430af09948266188cf54a527aabdfa6f4b5df4946c8bc3afdd7869bcccc75429b3e828b48a SHA512 fed222bbdb5d3c472ec7283f5612e12d6b1806c49ca5d1dc7dde68bbf72e8b1fe9c31a4737b6bbcf721d97babc9156a524d127f9e3d6c41547813bef70fb247d
-DIST ncurses-6.4-20230225.patch.gz.asc 729 BLAKE2B f7b4ff7fe78a69ec20c79225cce7bee628476663600129e5eee0c0f1ef2f0783e46485f57a774847851e6e192231610405ff923dcafd68c1dcc3d2ec622f0b78 SHA512 937a4bb33acf0c86b201145f2abe65e5b7defe63c064aeb2b7cb8869494c02a5d50af3f048dd758ea39b828b8cdd0dac54004dc41cd609afcf3de71454195135
-DIST ncurses-6.4-20230311.patch.gz 15262 BLAKE2B b3ca38dc63d64dd59af08b4c642c5b081eb137db6d7590a92f29c55be7148b26032553e1b72b0977394608ac144a12dfa0f919d943d41fd6ff419f8e568c655d SHA512 17662557194e81668dac748bce1240276d48e09df2416934da9660861154137024aee989287e9aac17b884e9707cf1c86c438cbcc583902af8a5ecc5a5e08140
-DIST ncurses-6.4-20230311.patch.gz.asc 729 BLAKE2B c5f513390bae7cbd5cf9d6a6f67c00161cb7c1712ebfa7ee9b27b391dbdb8f9386fc55daaa25b34c55955cc0362191256a2288b85d2d1dd9ff945561a2850449 SHA512 2b0f9ec58e011bb969397018258519b09a5af42ac49b7609677f983c1d69543aaeb052fb762d358b3fcfba7a3d40c01f61f3a680102d10f76958750b531a89d2
-DIST ncurses-6.4-20230401.patch.gz 5172 BLAKE2B bf4a9d9bcecc2fa91191139a4f1aa39aa4f08346986fe14f43b7dc4cbdaed767d198f426c8517024c5d4fe481a45c6d7e0a0b62d35cd72250e08da47edcbe86e SHA512 dd3d89cabec528c95c4b065a32d3496210571b0baaab079c2b381563f374072630aab0ec919c26e10ea476b7aebf1eab45ea25f8b4dfcd8172f44270d03c9cc9
-DIST ncurses-6.4-20230401.patch.gz.asc 729 BLAKE2B 18588b7cc4e3f256a4e9aa9e6221e54b1a29711df01784397b1055d9fea8ae5f1bb544a8acfd660ef1b7d72ccae1ab94b61f38ba19159e4efc7563a79e93fbb3 SHA512 bf9da77a0da1640d883e0a6ac7f807995f3678eaa054255e8591dbe9a2c4cebb43d8d2781b8ddf7c7432a38f63eb72d519445edcc2721a01d7a785964adee8a1
-DIST ncurses-6.4-20230408.patch.gz 15680 BLAKE2B 7d1fa16a79e317be3c2746f7117559a9cc65b7ca20aca86a314591d376db59f8a151d739bfbc502691808f16130b89a9d5b4ee8bcd357a01ef033ac2ad7277d1 SHA512 036d4b08c0d17656c75f89625d5b5a253e70458bc9f2303269b4c72349ad62c719951b9ebd65385d6d8ad4be9e89a36090fa842fbb62713d9b8fa6a359170a88
-DIST ncurses-6.4-20230408.patch.gz.asc 729 BLAKE2B 7648e24297dc66dc4d5f08bf592b2db628a5962b0d6d34c1f0725257c3a04d2430897edd99d741ba837196e9a6f2c138e4826f40f80ea88e9d5dc04a41c11986 SHA512 eabe6e49b94969fbba7bf8de3bef803a8151e6d3bb0e9d1f0d4b11d27c7156be37f623e6785a205b7b8acaef2a2d646099aef8c410a6addb7592a9af2ec930c4
-DIST ncurses-6.4-20230415.patch.gz 23979 BLAKE2B d89402d39bd71e23021d1ad28a27965239409b8d29397a9a9f3172178dd060cc42f736224b6438e7048cd05f38c24e4d229f83fc87fc207d5d2cb3b9577e1bcc SHA512 63a6368745c2c418fa263cec4da69a06e981fb8cb466f0694163fd324ef328251acb38ca3ace02f18b8b6b44dcaf414f74335a2239ae7af2b0c8ed916ca6644d
-DIST ncurses-6.4-20230415.patch.gz.asc 729 BLAKE2B c7ad19d4ae544c64eed538e7c6fd03959988e80140cbc185c6eebb932d026fa316df1d53f9e049e82fec811860e3a0a32b6af76f980fe1603684ce2678dd4fd9 SHA512 4637e09e4620da328d163bdd100756760b0f5469304ef7963a93346d263039ea608fd510fba0079feb094a37fa857b7fcdcb938d2ff5d93aa809cb9c74cf4d5b
-DIST ncurses-6.4-20230418.patch.gz 32130 BLAKE2B 912efedd3a615ce383b09218031ffc49f87e0bfc7fe8aec37330394b9235fd61337fa707898c308cbfd7426fc6f06b3639e533138ca390d42139583c58ac06c0 SHA512 4952d56a3fd54be512dcfabe48d967af43c7c51b9e49fbdf575301861940f00fd5e88b994a2088baf4a0e551338b978e47c6ac232bc9ae4e8ee417bd17405288
-DIST ncurses-6.4-20230418.patch.gz.asc 729 BLAKE2B 59d8ca3ab665e1bbfa7a1602b2856de79289c42eda33f8f517f419e41f7eebd57dbcfd73c292d6a2debd08f02cb39a6b6b47b389a15b1ab845a5fd4b4f73432f SHA512 d8be7ff7c1ba083f1c7e10dcb9fd88d7be661201534922d1a136e24081767702b6cac897a3cf5b7d96bc65687690998e4a9a3c57ed39a146df5d6be95080704f
-DIST ncurses-6.4-20230423.patch.gz 115574 BLAKE2B 72a98086f00f02cf0ea018392373f7ce0a741674e61835e66b2a211c63047716c2aa41fec937ccda13cd01f2f3943c7670f4f8d5be4ab3bf6902c92c2ee95a26 SHA512 a5ebe239b9a6a4a99a1afe0b1a6f7a09058402927077c4c2ca537f3a9f13606573af4ebbe4e0aa5715bd4e71d5bd67d9c95fb4e9d700ac1e7edd809c71667a3a
-DIST ncurses-6.4-20230423.patch.gz.asc 729 BLAKE2B 74a5e9cdc519788bb3c501a37061fe5f9ebbed531d274f252f21d293d4687b5767f7935f4bf1cf209980d9c2690959bac1ceb883bcb17d49ba012afe9bcda139 SHA512 3f840f5f8dcf2d901077d7b717431c3f6146e7ad895102b2af46d8b329e428baf15225d905f46027c7e9c4796be40d95b7322e764cc8d56afc357657e019f1cf
-DIST ncurses-6.4-20230424.patch.gz 4488 BLAKE2B faebd76ba1f868b8637b4a72b427123c08b33871fc366b989fccb107898702f089c2014c453fecbb12dc260816e5acf97212f3fa2b9a7ace9fa384c31b6ba1f2 SHA512 bdaa63e0494b981443f07e9ce134785b2420dff3d561eef7a8041e7df5d04e9c9242cdd1cd9e4592fa0724f073b829bff36e74e480235f4eacf37bb639d914ef
-DIST ncurses-6.4-20230424.patch.gz.asc 729 BLAKE2B 6eab548bea6fb01f6845ec03a41bb0ab3969b5982baed9458910d207542a480e911d53e3bfd968f485aaf754f94fb166b910bf8965646c3de035b255489dcb1f SHA512 91645fb4997f0e276468aca9a702d79b487d7018b56665e0fda8e37e8fadb6cda7f8b1e653eb3c1cd0ad563360b410d8143102d2ba3bb6d1c7b18ba1657a86dc
-DIST ncurses-6.4-20230429.patch.gz 9195 BLAKE2B 6ed8c3cac11d3c3e52b7dce20be5b7695967622aa517c364d0f1af7f4a813befe5cfe200eb3097fba610e63e22092100066968f55eba499c9fc21a95bced7524 SHA512 f37164116ed9f09c51a62d90e28dbef68b19a4444c4aa7e2ccdafa3cfa2c7530bcac65b421910a273d0e34b91382bf4f7957f0116af30e13856710199dd266e3
-DIST ncurses-6.4-20230429.patch.gz.asc 729 BLAKE2B 2e063a7818ac443182ec4f4d8da13884accd563ab66e04297ca0bd4b9610f974efd3ca29dfcf13939cd9ee369c5e5799eb13a55050249036ebbc375e6ef8d6d1 SHA512 55167510e21aa3ad6d4a57fa37ae82308424ae9141e6e4756b4b335d30136675add5c00ee102d74ed93eccfc2d752eff5045d88e708928df3cecde3c0be77c79
-DIST ncurses-6.4-20230506.patch.gz 52834 BLAKE2B 55d2351a507a60aa5baeb9e7e392fbbf714a6bffcf4729e9b195aabc2dc81372336d0dc3501f95abda04491013220060983d2186531471694f40b35d4ef3196d SHA512 04967b96d9723b2939fe64eff4388ceee0adf478f659b58cac8601770dd7763fa192d673e78b33c267e00f4ecbfc2863bc49b12fcdeaa8ce24df39126f20b4e1
-DIST ncurses-6.4-20230506.patch.gz.asc 729 BLAKE2B 5ccb09f5b48a4a9c98ad4224cde68df659a365aca12210ec14a6519216e32b10531b1dfc4184bd12e62e1f0fdd9f06974b59866bba6115407d52712f5adff6f8 SHA512 2f63a62e37a15aa6a276a5d9a2c4b86a4e50af037ee5b1c339bccb02200d3e477b5b93ce5833a4d3933a952970caec3b38639412281c1df7c30d7b241bc3a2ab
-DIST ncurses-6.4-20230514.patch.gz 42963 BLAKE2B c2d27883884ebb2f14c523b5558d575b84fe8aa6b110a4f246f529d29288118d8393a955d8401aee675a764d52e76495d47487f52c3edb8548dc3419371def49 SHA512 0346fae238637c6a69024982485672e6b1447f5902d9cc6b9deff8296220a381b5b41b23b30d053881b09242a4e8ad728618342300c1dee63770286b81e362df
-DIST ncurses-6.4-20230514.patch.gz.asc 729 BLAKE2B 10ee649be87b46a03d1cb1c31a57ec9cb20da425604900540d04f806cc2c9e9a1e73009f62a96fafdbd81d66c7d47878e256d02cf5b9de9ee6f26621b73a4705 SHA512 57875d11844efbb23052e5cee32aa41a0bddb290069e33504e57613e4ab131efddc9c85f92af82b1d6bfa00182bcb9f1e86812538f5f209096b3ee84c67de280
-DIST ncurses-6.4-20230520.patch.gz 3090 BLAKE2B 93e376bc6250509c1a83e799efc2d4766354451931115d300b74c14af93dda4f3aefdd59f97467eb88e6ea29804595e84cb62c62733022b255d5368a74a38729 SHA512 bf854e4d6f8ed643b8841c9265057f06186699a083edb489e970d1cc8e752fdf49ecaa36518340a2b00a5c6ebf548b7651361b1bd2abb80467d2ce3f9861d28d
-DIST ncurses-6.4-20230520.patch.gz.asc 729 BLAKE2B 08db3a1a8152c4cc29fcc11b24ec3d1a6d3c425eed9a54f33bc370b86f26a13a9cdd273652c448e6e4dd179f5ca41ae653f7ef44902a10eaa18828e2be3a6247 SHA512 7bf2aa9442bc5041ce316af7edc2ff5c5da2ab1bf941c26c6592c8785dc0e47539da3bc2c1e570daafb6a293812f55b8b3b327f90ff9908984eba37e89d5eb7d
-DIST ncurses-6.4-20230527.patch.gz 9787 BLAKE2B 951a53b87056f2b3b530f03d0bab5a06ecf6bae0bf2fb580af8c0d96ae169e4813ed2063bf1696fd0fcc1cb0f7da03348904818de7ce454cbcb9a42bb939b6b8 SHA512 f600d7bdbde1f0752d3d530ceb98e9ba51a246a3bd898cc0d0d65bb8b51dab68fa5668789f5f86473c28eb890ec62cecf8e4dc901ac96fccf162c1a5f161f897
-DIST ncurses-6.4-20230527.patch.gz.asc 729 BLAKE2B 472421bd7c9093a293e99ec0f343ed471a77e7aa7f705cd99bb61f907c7059b134158c176fb232c542842ba042a1a88ca8e192df81d2d760a70f26a4d76ae624 SHA512 74a0ae5123b339c00f786d4d15a6c100d5d323731b7534e495dd396c9fd03b7ebc61d3fdf6eb71f2fa106160e15da5d093af6e4d53b4a6cfc53c436045a5a614
-DIST ncurses-6.4-20230603.patch.gz 95019 BLAKE2B b6523f5218b819fd53af288e9adc54001a86bfb683f3b956b2e2237ed233b12607116a10c2dcbf4c627dfc52bf0c915ab506fe9693e8695908110524ac4ae216 SHA512 c71863e458a312dd37205d2087e4bce4d3a6abb2c07b15ec90796953c3f422fc30d3094e3ffd176befd1de9eef1067153f8c5be682475cdacdb5b7c83c99363a
-DIST ncurses-6.4-20230603.patch.gz.asc 729 BLAKE2B ed072a6a00031bd4814f195913030ab597c5547f240309cb0fe95460e4c5d6d45477dfb054b2f09cbfc34c4eb583499902146fc498e58811417ca61e7a4787f9 SHA512 95bc59ecdce1bd7499c819e692a2d44f90c9734b20b3903034f94c7ee5efeb7b9f3f31ec1327ea00907c99c6783702af91d648d61b362e56abed5e60e7e11b97
-DIST ncurses-6.4-20230610.patch.gz 22125 BLAKE2B 2004558a329c8a6827818b782f4c7b68bb8c24cb93b22e1259363432c6cc5ebfeb716d81b4f14fd82ca22f70e4591877c9836b3a0dba58099f9fc6bbe5190947 SHA512 b11e7638ae237e0f9e8ebb9c7657759be8d9504775757ff71d2efafe589e4a81969b5e6229c171b5008a5788cdf16e19fa544f2d4b2fd24f122f8cd66ed25d61
-DIST ncurses-6.4-20230610.patch.gz.asc 729 BLAKE2B 2f7159fdac2a3d946ab787ce294704bde8da6cb7482c527edcde91ac9369b349c16b7d267e05d785acdc9447d3aa3e1f231ebfc616aed4cf452fd4c31a2e66f8 SHA512 3e2b6bf42e3b2f82eb51213b58d962ed7d11cb582fad5f710bd3067b2ccb52e1d4a27aff24cecf68a01b2bbe88f0e85c43e2edc6c57353926f60152a9b4095b3
-DIST ncurses-6.4-20230615.patch.gz 3562 BLAKE2B e20de7ca077ce7ce37c59beb731408be16beff9656ab115b23c46d94f95b2b6a92bc8d0ccef253403dd3d7e493b0cb067054b93e06e5cfbb73bdf1485484b89b SHA512 22779515ac54e19cfc9e84ef851dc15bbb8d818cae8e0fd2b866ee1ba20caf4168c30a72c7cb206434cf4db6a9bb09c016210a2fdcc2dcdcf9892f7a6e0bf3da
-DIST ncurses-6.4-20230615.patch.gz.asc 729 BLAKE2B a1fb16d1483ca895ea7db7ffd4992cd1939e9f2e682508dbb0af38d78edaec11f2fe10b547d801783e2c61a33252f24be94c9eb4a2367a19ef73a65f926dadbc SHA512 71055081b458dc285856c9916124025023b59005a2568d252ecc93ba21c7fe8edb8bbe933ae1675a0d3f606602bc19b2fbbbfb5df42fe40c84227547183d2b20
-DIST ncurses-6.4-20230617.patch.gz 29168 BLAKE2B e15a2a1fadfc64ddb64f26b4b267f4ed58ea5fa9b43e8664315caa6858787af61501710ba273ff12a914327b451a0aa329459d48487f9edb882ff9b218f8fc9f SHA512 29e5d387382d38a2297fe3f642441019bf829ff6e94d938eba85067ab455863283a50bd8856e4cba406c840a5ecfa381eeae2d6406b548927320ac2e99b89adc
-DIST ncurses-6.4-20230617.patch.gz.asc 729 BLAKE2B 3338b8020f37c6c19cb1819db9e2b9f9257702603757e7e107b74ab0e7bf1696c0a91e79fde1aa404dc706ba3bbd0e6014ae753147838d5bfc917df302daf408 SHA512 db5ec7182b070db9079978c05130f53659b3bd5108ad246b7f7d6696d1c739149508d1c5f3b9091bf4862d8bfa43bec29f5ecd7787d5840625e99437fe7dcbe7
-DIST ncurses-6.4-20230624.patch.gz 8748 BLAKE2B f61800ebdaa4f982694d38f51ad0478207b928f81b87db3d837bbfc53ba265a89f10add92f5f27a03c54e829a490a8c39a4bf3cd84a0c43bb2cf70ee7795e0ec SHA512 9592247f9eec8d5ce7cffb3e4f7f3a39e4c3c83c96d11db7bd8cdcff54a8fec936651a7c2aece559d0573ac244b59d1ef0b4d2e46368605b9f8e8b4a436e9baf
-DIST ncurses-6.4-20230624.patch.gz.asc 729 BLAKE2B 6f522f12c45de2824cdf6014edf6bc3f377d97a784d3344eae2dc66c4adf1a4043c1982224fdb6a4eea7a582b80c60f8556e8ae645338078638f14a6080864eb SHA512 fbb70541f028813a6815a37c258d7accc6711faef19e41c36b7953880bac645188e101a34109e3db2f263e9ec736fdf91f035431b6e2b84f6e591198f1fd6e1f
-DIST ncurses-6.4-20230625.patch.gz 3517 BLAKE2B d287c8ffb5f6314b9deb9c3954d833167eeaf32560dac674bfaa5c5230179e929dfffeb8d3d2a4310be7821a26a677886139e549b5d4376992eec9db9a0e8ae7 SHA512 bf71c7a5368d6eb4e676d57c720314f01b25d4a51108ba2018b3e1d4fbab736e18a7a39e2a662b611ee272a2a2afc0c267e05807255ab7f07d8b557b7895fc9a
-DIST ncurses-6.4-20230625.patch.gz.asc 729 BLAKE2B 58d5d4415cb61ca15de15f79d6f5ae16e28a372676ed26754e27d7cfc70b9aac1a23696b174ce9069beea0263fab9ca565879b2e9cdf6a150f7c0ca4448e1439 SHA512 9512bdb1eabe4bee0910969c2219748a4f88b9ed1338ce1709d61e3cd0173dfa583c050fea18a69f8b3fb504b4915ef40a5f0b9c61fd3acc96512c262dfabd2a
-DIST ncurses-6.4-20230701.patch.gz 62047 BLAKE2B ac4719825504f20195ef4ba229b1ee29649eaff66d63ffb226553050a1727f7b08f9e7d93bb5a7f042218afa2834c1663943cf3a64b6da6a10348f5637b8cc21 SHA512 e027eee228ab3473fcbae0786c0cf6b6f8533e861c5475acce3af2162f55b8ba6612e292d046864857a600ac3f59d2d6001a3a30a3d1b1a4239936f147eb5083
-DIST ncurses-6.4-20230701.patch.gz.asc 729 BLAKE2B 1ee18e5ff3782c2f271dbe857da94fd6ee4c994b1faa81b9b218b665e1e4e61d9b62d41c5439cc681da1b2a7b6fb3f3ea284387748680b483db473553b46e4eb SHA512 a53699f5c5d34464616e11d8c21f5d5e5b0f567fc145a4ad6abdf397807cc1215b9cb769deab9533873dc9779e267522fa6403ba1b56ef7fc058befb2a37e19d
-DIST ncurses-6.4-20230708.patch.gz 6669 BLAKE2B 4c662af33d9ee679abeedd275835ec786e2099de7e87d447539655147bafd08fb28eda64bc6f7d3daca2200abd6e351e5bad18a7592c1bbd7eb15fb8cbed194f SHA512 551ae4c5a0edb9d0e830b3c87c8ffcfb45c35537d60971bff72ab4d479cffcd7b5fb1db4dfdaec4b5eb2a06b0a4ec17074fe4007f2cec441be28dde02805174c
-DIST ncurses-6.4-20230708.patch.gz.asc 729 BLAKE2B fb54428fb1f43ce3505f1a6c719aea357471e5a488497ac15595d97201ebd6fbc109630e5927e1bfc53635f40c4cf2a8305c89d60cc8c570e1e4849e50a2512d SHA512 dd62ed66b315a350a12dff03175eb7a61ff1f86aa9b66683cb0c940a27cd30542492005338a7c099d81bfcdc0c6b0139b139f2e12f194b655caa6e985658343a
-DIST ncurses-6.4-20230715.patch.gz 53780 BLAKE2B 71216e305cb55efc55ce18b40bfb2390d3d23211192450f22a06bd35b8dd3460a0cd6bfbffa012f08632d34d4d5030b70446cd1466b717196949db345724bcf4 SHA512 c145dd5f5dd59e8cdf80b37cff427ff6f0af1597c4d550f8fe2a09a395b57cc5d37968d0cd84868539215d1750537a7f5e554410abba600e26bbde51f9fb6c15
-DIST ncurses-6.4-20230715.patch.gz.asc 729 BLAKE2B af309534f6ed38596cca07d278a6e40addb6198f26bedbec5e3a17d5225be7be5efde3a6b1aa9e32d085edec347686c9771677b6b37633b45f4492598c24f881 SHA512 2610bd6b77d68cee82f5a295200d3d2459805e101e91a28a42b3a8badb230ee29963736a4320060ce59b4c9ed40a69cc9111a49ebf24e12114d03bf5a836ad01
-DIST ncurses-6.4-20230722.patch.gz 59087 BLAKE2B 16e94b44300010930a55ea3cf0a9950aa74e9937acc09246b3943addac07dcb98c0a0bf59eff0bd6ab2347670ea0f25dba3a19504c00a5b4a0fa988026080911 SHA512 63f067d289c807830b1dd327491a43669563710f6f5b1d631c62d75d654cfa9cd5767e0bfe0bdec65777e4c92e045177ea864d370007c9f4cbff4b73e3a0a0ec
-DIST ncurses-6.4-20230722.patch.gz.asc 729 BLAKE2B 8f915ff9d447bb2b68bee18fa40bc7aa08fb695aa873f983bac4f162c7ab355bf59a8cfdd03a377ce55e1128b4215c1265fe572674f420fc410d07ee1b4e3d98 SHA512 3c45f818e6bff4c6e9aecc57d4a236bdcdeffda6e8d342cf0bbd523cbff3af61bb27f8249789208540df4702bfbf6c7473b165c00ba770408b0f2d2547c39ed3
-DIST ncurses-6.4-20230729.patch.gz 54267 BLAKE2B 3c3b6fc5e24bf39b4c0308254f86a53cc470fd79d42c0b4377346642633fb04329ea4e7ed167bee4b590e9ea66f6e59fd73663ef83e4a711ec6fc4ebf8ab1427 SHA512 84ec8e0429364a25d0b284a19d8cca2d14e6308f0a3ff07d1a214e4cdc93430bf3d249471518c675bd040cf113da3b760337d7f268a776318b94b56c10264856
-DIST ncurses-6.4-20230729.patch.gz.asc 729 BLAKE2B 0aeab7b90c4919d97df1fd7c717a8b27a0d506a4d04d4b73023089298f0975cb1905c9f6ea0884bd83fa63769d9b27d84b6b26ecb46a84b3cae87a5b3fb8c4cd SHA512 eadac56f03b8630a21971dc37e5a9c9afeb0402d9f784cf1886d7a5f737ff4fdd5d4caf37f7bc96d2ea13e517809b71324c850ab21854ce918f81cae061d78cf
-DIST ncurses-6.4-20230805.patch.gz 7681 BLAKE2B 1eba96968b7835555c22299c59f678dc912f03c0a3c55dca87f796e590f37e96442664174ad609005e2d6affa011654a4729f1489d0bbda6188216e83c500d82 SHA512 604a098bb5888209213254d195da8bee6b16ecadf5cc843cd50cf504c9e9dd4b8e0115a4ed512dc64e57567270fc35cc10aab3dbb81f1d033e928ada8a4d3610
-DIST ncurses-6.4-20230805.patch.gz.asc 729 BLAKE2B dd8fa046eb07fef7b60b6854fc0c8ae5917abc9ad1793ad3dfb699f1d0537cd17ed3196af7a795525d85fa5164156e4dd33af4c13934909eb9dd11d3c37dc097 SHA512 59db184440e47d1a702cfc5ee1eaffc1c54664015f727f31fa5eb5a1cf6f86b15592c7918401b69b633bcdb6534be6f29dd20c823fc98a934dd857628f6e0b53
-DIST ncurses-6.4-20230812.patch.gz 21242 BLAKE2B 0ad1068e92016726fc56c51843897bf2eeb85ef19236c149265feaeb7a2bc512b1f897695e1675d58d8866fe75f7bed3b9731c079587a6c02c3a5d420b6e76f3 SHA512 e5f2ff264afa44f632a45e050bbeab59d2f7e27885f9afa72db32cfd7a672f95de998906df3687dffab5ab3a09b50e24bdd3f546e7c81a6d521ebccf3a868749
-DIST ncurses-6.4-20230812.patch.gz.asc 729 BLAKE2B c2551ef9da2fb12a9c4a8acbb253dba7d5a026c295ce43164e892dc0149438a5c67313fb8f18ea3702bf250dbc296a658557ca14d4357e7ca44b64a6e008d05f SHA512 61f81ad20584a20e2c15ed2609406f31017102bcf692d3cb05af4de1bf48be7f68b0880c249f33b0480dd64307b0ea97ba1774f321edec10fc0692c1e8372094
-DIST ncurses-6.4-20230819.patch.gz 24761 BLAKE2B d7b8b3a375d7168f83c904e0ab350455ba51add882bdd916dbe5fd65a1e51a1603df79349474cc86245a15fd3e2b3831e093b271c9db4d5629bffb793b9ff5b7 SHA512 30c1a98a46dbede109f741dbecd379d9bedd42a365be4d8b935ef745f03add48dbb44defb2ed7c102ed45a68853183d0e38a08cf355cc4f4bb82aa29203a339f
-DIST ncurses-6.4-20230819.patch.gz.asc 729 BLAKE2B bf5eb879b781b8373d3f9dab69b3c6c027217af5e67734de01e292ffba58ab386b7b9f939ad5253fd330918b3d799e9c054ddcf9b454d2e84e4cff4262e62ecf SHA512 0e4ae793efff9c019858d9a0821402025510a4ec3716ff394258758665022b639cfff6e9c5fba698acc7b3bb74c039475a41511f62141e570da3f19aec045eaa
-DIST ncurses-6.4-20230826.patch.gz 6017 BLAKE2B e20ae640651f24b71c720a71538e8bf89b61fc63ca2ddea04725f66b83587d2c6d26c70ba25489d9e268793678a8599eeb7f0865ce47d9a89a46d8e9ef57f784 SHA512 1af5953e241606b9cb2d3b12f45da9f2348a3bb40c1839850e3364639ea5067bdb083f6b9518669aa42b8a624d87b2546947a2aa8e74ad2c6c8f1c3fd15db5f3
-DIST ncurses-6.4-20230826.patch.gz.asc 729 BLAKE2B 147e368afe357716a70c520e0a2e92dc134f8d6d5f387e8f00ed3d3e9b416b5e3ba15ee6a02e91abebc41c8798df3258f44a561f79d8b19837bca5f9e23f6050 SHA512 84184f7b0e30dc44b01f4556aef488100e2bee730d19531a918b5de536414e814820bcca59c25b79c14befc5049d76fdc0f8048889ba16590d96edb7e902420e
-DIST ncurses-6.4-20230902.patch.gz 51844 BLAKE2B bbb6d896e2717feaf30ef4f3945441b9fd80cadd96e0319b27dd17c0de845f50721380f0b5d054aef0413b42e596778306fd9590b6552839888cd7dce94fd197 SHA512 1d849f4447066e180bc5f0c3c62f6694a32b4b254d732e4304fc7b8eeed276f790b6e87846eff625d8a739c77fd38304a33e1b3dc8c16824adeed9c51c6357ac
-DIST ncurses-6.4-20230902.patch.gz.asc 729 BLAKE2B 3a20532b223263dae2c7a6c657983c113b465d74d8b690946c46e70187d17c4ab743bf837fcab5aa6bed7f2ea9d604c7a3b8cb37ebdfc19b66683d12f839020b SHA512 aa3de6f6bc15d76fe867bcf0d8b8e307863ea5fa935659f0e2a5e7925acc1eed6e02b70f072e6d3250f549879d41d29038814b3a5483425af5e4c4eca524a443
-DIST ncurses-6.4-20230909.patch.gz 19653 BLAKE2B ca11d7df796d2f1a294309db49cfb9f8c158f2d3db2ee6e632e8f171a737d5948ee239f4d2f5fc7fd88d68871f70bbd3589cf53d677eda2420235f475d6d96a3 SHA512 340f685e1d7a495ea07c7c492b2dae4e91005ba6596d4590e28eb3067a3485aab4d4b390856837577730a0a3ce7cc7523fe19ede50d5d6906c407a576b2bf401
-DIST ncurses-6.4-20230909.patch.gz.asc 729 BLAKE2B 213018592dd38ab9b8493cf45a2253be44ad2497412af19c5e93aa6d940896fbae4cccd0ea49a8efae36ac72b592a371c1b517fbf3bf6f07563dcfb9d0a857e4 SHA512 a0fb4b1f9c2df404a792e71f29f2397de0f14a695adbc38e379278e9a1c4ee50ece3fe3f18ac85217fe6ac5ec6daf06738548f8af6d8db2a1fc3db54244c3500
-DIST ncurses-6.4-20230917.patch.gz 153988 BLAKE2B 6df37b08266c350de4dcfa28cdf67a546a64675414d133899c48181aa8aec5ae8f73dbe7932733a406cdc1a3fc7933f4bc7884c744087f057c923f3f3d7224ea SHA512 75b4363c1ecdeebd20aae2a2289e0834ba7ce2e0ac104f7b47179ef651efc0d9255174a0bc2a374d3e03255098715c97b84d917d0268801288ae5e1d9df59ed4
-DIST ncurses-6.4-20230917.patch.gz.asc 729 BLAKE2B ecb3c166924454271a49f17d8f1f84f181cf490bf486b0618b1d7b2c7bf0d4aaea4da5cc648e4965e5f8f3c12d9cae0f88fcde8958b7b7c7854e19196c3ff6e2 SHA512 f6d81df216d2cb8e2e741ca0bfebe164c96fc8bbd88d17bab79629a74965b416ded77067dfe6beb751e6b9ea0f2807d7b345aa093b1e0f2c352a439c3d34f621
-DIST ncurses-6.4-20230918.patch.gz 1772 BLAKE2B 2c5b08699b1171c51940693c253d40580fcf34fd3053ee0146acc82da575c2b08b0a43b794b8425c08edffcf3cca37dd6826b1d20d4bcf8109e1a675b405ec22 SHA512 e8f9d325278ec87b3971b954968a061d5fb2345d2c1035348a07834bc1135c6480bd90c9d0111925729c7000c44c2b45853faa1db784f230ce99c156779487f9
-DIST ncurses-6.4-20230918.patch.gz.asc 729 BLAKE2B b590981a91a23b98273b8e4c1d0d12f6eadfda00e4a8f77d7031de10a21bacd049de9c440bebfbb29be9eb5d99b2dd43f2068a1af6dd7d50c9389173aab5fd8e SHA512 bb1a800a7a5eacdab7e95816c035ebac8dc190c55ceb41351b1a0169d5a63a2fb7d26c93738367ff7ca95c9769e06d26c67a0f2df04c6b3a93c924c35181253a
-DIST ncurses-6.4-20230923.patch.gz 61673 BLAKE2B 5501e262a9495f30ac79c327fc95d0f5e54e8e246db7c3acb329ff08e17a2e7502f35f8b8496386b13054471927d52494dd8e6b534ddbaf555c11b312b520ae9 SHA512 3892a8e3fcc3c048b20676931b6be02158537db3afba87d63262cfcb2871eea978bb84879bf5f8fbc20ec52f411a397de50bc83a35de8ba5bfbd22f247dca5c3
-DIST ncurses-6.4-20230923.patch.gz.asc 729 BLAKE2B 327687ccfe242f4bd82631c5b92e0146181b2ce795394b44119eb64a7b88739362502f61fffaad780c031cd9f98da7406f3d2bc1818f6fe779b25bfe1bd63a05 SHA512 2671b781ae1fdb5d6573ef14d5113c656c7125be1745d2d94487e44031d39438aef56c992fa2d59cbd3a0e20265e552eb3b0a9b25fd8ee37af2de5d9189a3768
-DIST ncurses-6.4-20231001.patch.gz 101411 BLAKE2B 25d644b708901027f443c6d93e30860bdc2af2d41995034871fa9a33931bc7ef9c6d62ceaaa96c139bd46a4198e7b727e7c0fc1c130cd495fa8501d45fac993f SHA512 901f391634fed7bf7e46db8a2242d9c4f7503e84ad31d9068e9bb7fffaeb0380eeffb60992686bd8442a033205ac9f27688612be1d26c1ceb30708c62ac551c3
-DIST ncurses-6.4-20231001.patch.gz.asc 729 BLAKE2B 92e50014775ef7b096983c2375884464b299c56aa49622ee095ee13b5cac598c77540319644f9c04e5a57adb57d9d01d38f5e8122e027030855789b06b766024 SHA512 051b62b3550d2a78799214f08e3e61b0d3bcd964d4df5cf320c44861a812033805fb9a5e5f079cd9ab6e75c5552c7a4b3a3a64211f05b94d602c5d8a8ef041d3
-DIST ncurses-6.4-20231007.patch.gz 67626 BLAKE2B 81cacf8b01215844ceac5d5e8e4b8b7c8df9b4d8fcf07646745b6d8f97af6261f4999261afcbf9d7ec4ebd333853350cdc7dfeef84a33eeea2b0729977a2724f SHA512 f3ecf1592fc72906e3a2f9586061a9d7c6dce31d604e5da9bf83c9d90147fa747c2bffe006121d14e318eafa0701c2f834f9a24968244cd86aaf65b3bf863ff6
-DIST ncurses-6.4-20231007.patch.gz.asc 729 BLAKE2B fdfe7216e44b1b5dc4bc10d495a575ebdfbd611a85540b3be3aff4be8580d10b7a5b335d854d8e0d85d5c811e9360de6ed35437cd8977091d847014d03bd20b0 SHA512 d73163070853034a23d893619fed151757dd153da7aa579421a48deb4f82179e69f2ad0e090a7c6facb43709fb07ed5cf515436a201ee40400d16e9bbd131dc0
-DIST ncurses-6.4-20231014.patch.gz 189356 BLAKE2B b974507e8f5f873c57dc8d9a2a008cc577b47717d7a1f472e52ed06c5c4c182fdb9baa3a86f023dec3d63b3e00102d6b0d1ce2a0df6ab97140dae93f76e8c12f SHA512 195e220f76d227b7233551ca05d5368f8bb3ca58b0a3dc26774831ced6b4c69cba8051bbcb9099f474d7a86e12bedafb913aae285441fc51e760edd0550a8697
-DIST ncurses-6.4-20231014.patch.gz.asc 729 BLAKE2B ce6b6da4fa06d6b6f9e0674f4b64221f88c5477ed59fa57c5065934cec388d91b8b3a90e0259b477c4eb5b2fdc946207916cd3a566180faa35b169c53ca48db5 SHA512 70f36abf69221bdaadd36797a2c846dfa623a4eb7c27fee1079a1fa4c95e6c5ebc1ff7a3ac6c0d2e4761b96967c1c6afc736f593d93a0388c09c3c3b94f33af0
-DIST ncurses-6.4-20231016.patch.gz 91957 BLAKE2B 31564200abebea4d904a428fb6ea5e1bf9d100f67e2cd5db7683c4cbf9ed2aa0aeaccd390f4c0871da5a5a60911e4ed4e97a08149244bea0a2910a0248f4bca8 SHA512 c09407f16263f2dcb49cd70ef05adc039f28da7124e46a09241f9be03b729a80352afe693ad8f9013d18b0bd78698ba588582aaa0759b7ca74f445312ebb9879
-DIST ncurses-6.4-20231016.patch.gz.asc 729 BLAKE2B b659353515fc77d04e0aef074e243362041907fb96ed15fccd819205edb12760004c2e434f98c014bc996455da608942b29cffcf090802da44da2fb9cb466652 SHA512 9a50d06b351ace9893fc9a5d08c14968cc79e6eec99c5914a545e6912d1e518db6cc33a725f5a6839261bfd03bd2d4c27403b7cbe53101115e11189ba8225899
-DIST ncurses-6.4-20231021.patch.gz 104022 BLAKE2B 84985c8b1bb3b3cf0181fff3ddc50a378e144aed5a3896e44d0fa56fd8807ec8c37a381a22d87d0aa7e693a0a0363e3e32614a0ccc3519f89aba6fac755f2c55 SHA512 0435ada2640ec65894b47a3f07d4efa1c5a15d46927cee3f57458e0d440b94d81a2869dfc34f1a271b6b0a0b9556e9860dd67806159e75265d875bfd96d58064
-DIST ncurses-6.4-20231021.patch.gz.asc 729 BLAKE2B 4a1a2ce1b8b237c8e67f4a98f604a390917c87e9ec96ecdb990413f631cc5bb62af1e4ff8677c51f32ad6a5d8358321c33958f4d6cbcb8d56c58b1d609802992 SHA512 7ddf107ba2b2f59daa639e5f763ccef97a066dc5e19f5014f1b295db2627c300d2b4a528f1cb3621796944fd63ad11dd3aaacc234addb794d6a494978bb32b1b
-DIST ncurses-6.4-20231028.patch.gz 113875 BLAKE2B 16ce1507ed43830840068ce5fbc0777af46a71a14fa547bc73d0e42e6de5062e83475b432f8e849121d56371a7150f223a37b9d76c85d932e60bc33e4131d7c8 SHA512 9b91df0d75315a7aae8c5189ad91dea1d9d45864694494c3cf9644ac341caba8217b931d4082ba89090ff0f2ce9f06d75cef7c3fd9e45db49f708ea88ae4f947
-DIST ncurses-6.4-20231028.patch.gz.asc 729 BLAKE2B 5d500540a1e108f6a56d24fe3e9ab6843a6cf9f5dc330f4b0146d53c9e5cfb64c647f21031bec31353bf989050a4b7ec835eb928a34ff6a75b8e26ed4f40b606 SHA512 732222068452d3caea4e67edd459dedcc5bed7ac35a8db98ec319278dd0b8a65c05729c8a095d0756579b90a80f9f2580f6c71d2dd4804445f7a54b5872e192f
-DIST ncurses-6.4-20231104.patch.gz 6145 BLAKE2B 458fedf34df29affda1970efdb9d8acef28d5f469335d78b62e6ce25da7cd05e21905ae3a7de8ffd067b64d07ed8e76f53f6f7aeb94926165e1b94191d441874 SHA512 35ef3056d168db5e031a18c497ee8d5a9f71b760ad517aded3319829e722804d62685dc49f74063551663e11e0a400584ea455fdc3f0a7bc06bf5a24515fb0f5
-DIST ncurses-6.4-20231104.patch.gz.asc 729 BLAKE2B e7858261fe5de878d37a2c052723b7889e14be6ef5c6efe75859beb89b68ba96eed3c0691bc9465273aa277d17927ff7dea60d81c0b2f96053742733fdb64d0f SHA512 900bb9fd5ba729f76788fa273f4b9d04747a8c7fd627d358621222f9965864b59c1d989f55775b766d099a1a0081a6e195ea6a16216faa77c892154304da58d5
-DIST ncurses-6.4-20231111.patch.gz 31095 BLAKE2B 12ec2d5a693a9ba34abeb1b5863f9549594734138b01a698ff9a55c9cc0519fa9777045e22f3623171724ff4ed841f8ee373cc2eca540aea19a325e0c63d24d0 SHA512 3170ac79bea59a1de9f91b647ac41a7f2df3c93943bad1573322cc3911337c16db2e55563198f6dd5c963c31800636fef98ea7c02316f049071b2a41b6b15c14
-DIST ncurses-6.4-20231111.patch.gz.asc 729 BLAKE2B 2b3e510d826905afe5cf23c4737874cb2a569bc6fd3f081a0eb16777d2791d7fad46d7620f1f229dd5ba9652095199c684e5e5d6e8f38947226664021746c24e SHA512 bfb5d15779ed7088bedd7ffc26d16af69fe8b83706088a5171daa955425e1f0697429f3e29a5d286055790bd2e8512d6507e85e2b541564f349f8c3dcf274221
-DIST ncurses-6.4-20231118.patch.gz 15202 BLAKE2B a8cd152e11da3eb4b7687e1ce05afb86c11d519f0a798099c459bd50a7e019353c71ba55ba7872b57131948e945786d3821f431a3a0d5279ca0bc111f080a5e5 SHA512 d3ecbbf17b9ce8d899fe2a77fe884ebd95ed091d0f194ad6fed98aa9897a59642242b2a3a04b0fda786251d7f584b3ee2fc402d88f3c1a4ff8ba600cb8e20d01
-DIST ncurses-6.4-20231118.patch.gz.asc 729 BLAKE2B 76767bba1425ea00cb06415c1011bd235e95ee8b360138d237224972802800a90c582506e121c2da63f6ccd90ff98193229522672f6c66bd68af9cba3988a271 SHA512 fa3e4fdef23e2ea258ce1068fd18afbf68b5406aff6bc37d78556f2337f9e0341290641dc106c862596e8fb62606ed13e2013afc66c5fb90c13618ad561e21be
-DIST ncurses-6.4-20231121.patch.gz 2725 BLAKE2B 8acdf10bbc3db2236e6088591c19a4c4996e8ce337b7155828d82474b2dc1f00bac68bdd530356e7e30c44c8aa0b9eb5a0504848b58b2406bfd5371e42c28dfb SHA512 673b445f4393d3705cb497232ae58f7a5dd07143a10973a319f40411b946bc0b2b22ba8ae979ce3380fe104077dc63823562349163c266799b777e7f3ba9f716
-DIST ncurses-6.4-20231121.patch.gz.asc 729 BLAKE2B f91437a508906e28bdc9b0b897150db6144280b965bd2c669656a84dc4cf180a04b0711b8025f536bded39ea3af02487d5067fe8b1add76a7695778c58ec590e SHA512 1c52a1d935ca7ec367e0229face73c522d232ab1ae0d3ac33b7d2d5398823fb6b7dd232c7d3d3bc08026b9454367a9e9fa86e8a2a0a2de754bf638e594dabe83
-DIST ncurses-6.4-20231125.patch.gz 221965 BLAKE2B a02689cb8f5ff85cac11a31559c261573221f64e55e25ac55ce17d648cc56e3db55abd8742fd08de8c9192c51fcc83bd95c877cce8cf5d18493e7f3567cbe581 SHA512 c838aa74fd81463dcc99bc2ef50bfc382b0bd0e277f46ef996a1d7bbbec2ca9588b4dde626965170b083cd385b7c34ee1e7bfd25fb0af1abdb83da0da9d05d7b
-DIST ncurses-6.4-20231125.patch.gz.asc 729 BLAKE2B ea13453856f8b4c1565a3b708253ec7a35d921e6a6f162022370cee17b261a7fdda861655bbee87aac09f481f3b36c8b6181654d5c5d7e8468ee9a0d87399973 SHA512 e7174e87d338d35e487dd1f9af22fdc71d48f2ab2ac1f8e8158f08994b35395f6f5a36b75d0a803af40e59d91fc47e1c064851c2cf1ec02bc8f64a8f5a0f4f96
-DIST ncurses-6.4-20231202.patch.gz 50653 BLAKE2B 20d9973db850d0d19003204308c052806af6a44d1c2a03f233b0a8c25a3668b1fa650de91ee2f6083eef15bfb711bbb792f410feb918afa94d75e612f52678c8 SHA512 08ae960c00fe1137986bb5f19e3ba2ec96fdbf6203fc37636c95bc8aee3ec204158a8b28119c9476df41999ecd77aed5f45df25c9bcf1e681f0404329f14afa0
-DIST ncurses-6.4-20231202.patch.gz.asc 729 BLAKE2B 25f07e646f17b6083c0cf6d57fd9bf1cd8a68e00f310c3ab68659cc0412bead62dd1428223b7390dd5dda0695f2803b15456462d2c275da84ec79742662a7208 SHA512 a28fd17268c12dd1b395523bd307aad98ad91ac6aca0e6557d74b56256dc673d1dfe10665dd465d96ff0b44eb891565ff3003e7f7bbf7d72b52c09c8adab5f8b
-DIST ncurses-6.4-20231209.patch.gz 81338 BLAKE2B cc8bbef3e8ae839f67625e2e7c69f853a838e1be7642db36b0768c37980b069d5b5a685756251b6a74fd07e44ea94644b745e1f4fbf2195d9a7c132797d84ebf SHA512 40057fbf43fe26debc139f47fb39474843e296fac120a9a8a17e2da7a7957b15cd73ef7a97d553ebac901cac3f8de2f3b31d7d14503ffc2c61c9b9b4049800ff
-DIST ncurses-6.4-20231209.patch.gz.asc 729 BLAKE2B 8738944f8138139d701de123253d63d1f61c1c8f92c63e6d6e5c28516d338db693151aa295700128cd56e53f0c28a2ad08006473d4e164290b1340663d35bda5 SHA512 647589e2d820ae9ede81e7119b08e9215de63f145cf51c24c337bd86983a7b2029c6d51f53cef6fe97962f5a507f3b64f4512c15af8bbf041796bf5beaab275b
-DIST ncurses-6.4-20231217.patch.gz 189513 BLAKE2B 26c0158ae6b82576f2c7f79f881417655551ed208cb1af18fe54cf0939d2a9f5c3f109b07d0eeed0791c6b332bc7b3dd4a5bbd07f59f4ba83389b3800c0c78b9 SHA512 cc59856be71ae35c8c297c19d1f4ea39484258089c95b72b2a41b150edfc54fcf59dc5c4e6b155c1d09f556263af56e3d0cc9678515081a5608c8d9289051a58
-DIST ncurses-6.4-20231217.patch.gz.asc 729 BLAKE2B 70a4d98a71d5346b311e8b5a3fc3c30520e0c5d244f42b219eb0eeaee7dc51fd7282c650058c2145af6603cd25f3e24346a6c21dc5fb4e15d0e0fdd863e9f4fe SHA512 b4e18ebf39f4591a22228da60d9ba95d108c087d7744daa4b33c65ca702b6723e44c240e2e8d508606da6a11f1c94fa70f23a9aa2066ca38c1ddfbff2a0141b7
-DIST ncurses-6.4-20231223.patch.gz 107172 BLAKE2B caf812ee111a6de68a4958748bb78c1ac640c94ed975527ba682578951d75d10004dd50ec0cfdab5eeb76bce2207083abc04842fa26db9395064f72304b2856c SHA512 c6de7bd56566ca3bd5b789bfcaa1188573400110ae35ce5ca9d4ea230671a13296360fe3a4862a097d436b9e5e422f115867a8879745d5486393a9bb829889ec
-DIST ncurses-6.4-20231223.patch.gz.asc 729 BLAKE2B bd4d83e2c102cdb899854ab203a675f02a82ab21501e7dfcf656bbec19d813c0fc2f1a8d0cc126b20703bda9b7a057200ebf813444b5dd18e35beb50e80f87c2 SHA512 374c56304eadc88eec577741e884c0313e3419e9179a128bb92d5e622f4ead3dc3e78ec25421f6ce813b38598a699a8bf7527933c95cad1f2ca181911b0c39b2
-DIST ncurses-6.4-20231230.patch.gz 75387 BLAKE2B 730aebf19c91cf02ba7f28672271734e266913e49ea83c36aca10ba7c7932c335898c8ef294d881f5ae7f263a29886083eb90ebc5f2b9f9e1e60471b0d97a9bb SHA512 6ff39e65fa674dde1aa377db47d66d6143b107199a41e6497c8633125d3713d063ac699435f9bbbf2c7f8a40a5b06433d5083b0069337ccce51ebccf5e54bfcc
-DIST ncurses-6.4-20231230.patch.gz.asc 729 BLAKE2B 490fc8f5673f2efed7e62bfd89d1d8ce7a7bc11d3fa7a59f68720a694a19bb5bb44d8eac86695c5173044c1128f95dd1d1ce341554e498e6fe429cbc4857c968 SHA512 abc3f3dff374067ab5c2ca26e752bff8148b658efb3507f59ada10143714b8b70710f691afbdc7b231bca0b4ab4db2fc74c7c9cffac8e758a8d22d0f696d5a4e
-DIST ncurses-6.4-20240106.patch.gz 77283 BLAKE2B 50234e8452ac53212271f2a17d1dbb2308fa2c9b68ebb51c272b018dd5c6a4b9769adcca9b718b28fc7289698c01f15f60497bf99a9102e855cc1d8fc44c0412 SHA512 66ae87b463d9239c6953305b4bfb69434d50c89fc0ce3877f1e9dea54fda427e0c8ebbda85275726c7ee1c07b97d9163c73d351fa8fc7c6adf30361c89780b88
-DIST ncurses-6.4-20240106.patch.gz.asc 729 BLAKE2B ad5867bee1ff817718a9540624eda20b6ef62a63b7a19728c5ff0b988b65ae64fc412e196badf29b7c27b629a756f2899c88e29b9f5cb15b90a424ea65a0ca59 SHA512 805a3d86cea8b099d3d45be5d794de73c01e533427bedbf8ad86d965bd3c84e23e9937c1c0ca9898c3b2a97ddb063e53d88481d36d288c6aa554d85c5db697f2
-DIST ncurses-6.4-20240113.patch.gz 212108 BLAKE2B 8cff40c4612e0633e1938cfa82e255b99efdd4c6383928c59cc0a46922b76ed758881b7ec280ec6984336ef2bcb6ac0bedf85fd1844add9337c9a6905e06d3d6 SHA512 38a59a574d53008cc3b298a45b08b86cb873dbc130dbeb8842f3fefbfab6a280e291bde187cd2e50b7b221afdafa087889a6b5faf305fefcc5444402bcd0b0fe
-DIST ncurses-6.4-20240113.patch.gz.asc 729 BLAKE2B a62a912a0b4d4d08a6b319e3beb0ba17c5359875376e920a0a31c8697c82b7a9e2bc2547ccf95fffe1def3f299c1d1379ea14a34ff86b3fff91adb9c2317d53f SHA512 473a9aabe87dcabd19677b8da1dd060212757fa50dd06008bbb188c76a53ad147c15c7796df5a643d26621bb2dc440dc8d69554198fd1e3478394cc15d55af76
-DIST ncurses-6.4-20240120.patch.gz 150509 BLAKE2B 89bdc8a958582269b48116a2484015087fbf53bdf2e52bd80cc2fe9be01dcd317f83c1c5dd9e6a9e6ac9f06717f7900ab1828bd2d69db891361c5fde8ea44592 SHA512 5c1fbe8fbcf375d6392afa53904a747e7bea1976fab63fda35db92411a4770ca4f71f3d4020fb51494d543a1a33ea743a590a473107e38b92202882bb17e4903
-DIST ncurses-6.4-20240120.patch.gz.asc 729 BLAKE2B 5c8a59cff6de9a00ce82d05be7462a9baa5c01cad6cd3173fd10224ca3081c0f7eed9b6b451bf3921b1ad4a7c94379848f8dcc3e676a0f6071516f64150c374d SHA512 def46080c3511258d6ea4df09dde6b4588d9c59298f938afd0f48507c4b12b75140c8801eb6e937f265328613174d0237f02871a52af68b57dd8b13f85620767
-DIST ncurses-6.4-20240127.patch.gz 24225 BLAKE2B 571acc6b1f0c194f88f76b4fbc0f76a03db4ffdb41acf813a847770c3642e3ccdddc21ef2c26a40de347ee3752749f3d8f9834c4418b96268cd69c0d3d780aff SHA512 0d97e7e4837804b2daad92240300bb4267ba7a845271adbee9c8e2173a973086180101365fc77fd21f61aae1ab7549764cb37b5bd8edaabfdc6deea2baa11379
-DIST ncurses-6.4-20240127.patch.gz.asc 729 BLAKE2B 0378d7c11395fd27ce4366668c69dbef84a0399cb3bb43673bd16334b04fa4b5dce321ff2543b1c79d67c2bda6cdbf795eeda994a03c02060bacbbd0ab4107b6 SHA512 293371e914b5577e66a9efa775a6409ea19a65ccb3086b277a7ec083ae26c00154c7fd15e1d30b86c5bdf04c72245c7f21da463a5d29f109f4c7e4f6b7945e97
-DIST ncurses-6.4-20240203.patch.gz 3868 BLAKE2B 3859b1e5ea907a0340ab4c1f0f211c4264d6efa8a04f7ec21cfb4b4a8e8f956822fef926f24bfa25ad6c8c1b0467a05a96d5316dd7e06bf71ce894b6e897d21a SHA512 729ff4a076c5285deb8ef2a187ae4116826ac2f50aea6cab19271119035d13f93b6ff0fdd134e1066b1075eac5ffa3289cd3e20a32e0d07ec533e34818496885
-DIST ncurses-6.4-20240203.patch.gz.asc 729 BLAKE2B 9de1398c7ebe91a10b98364f12811daec8d1b9178514146704810202d8acc2aa30cb7f5b4ddf62c47794298fdd2832a4faab644d63cd07f6b60c7767d6cfd5ce SHA512 ded529f2f917f9b34db3fbdd221b91138b14fccf123e2a2a89115ec3159f3d2085a9f639604a9df085848837f41c437819e74cbdccb92c238c301f75f6308205
-DIST ncurses-6.4-20240210.patch.gz 3820 BLAKE2B c200bc74b5703093beb85e4ecbb49c8a7fe0e8377a28b01af5929ffbf44583d1d68add001de6e565010724d5a66c5a0e1735117753f7b8eb31050ffe2bc17de0 SHA512 8ac1b766fec97d1aa6bd61b02ed176acb70e59a7833f8ecfbb4c8b8d80529609a58f6f7ec6d410b7fcbae32f818af3f613ff571de7e4ae53e2f1ce7b0f93739e
-DIST ncurses-6.4-20240210.patch.gz.asc 729 BLAKE2B dd58d7dd963773b80b497b5fad439889922011dc293a9c09b43f40edff5abe5884e05691349e0991a348bd531920f1c5bbe6a0f5f7306b86a4eeb8234b187244 SHA512 7ace2db56b71e21d8c5ac5786cf5e3aefb97a767f08fcedf90e76d26bd5f3770200f89cf7321a9876870bfefa9cbf0f2ad344140131f5a2d3542f57de289b9ed
-DIST ncurses-6.4-20240217.patch.gz 13442 BLAKE2B 946d39849c815a3924aed7ba5ef96321b79310bc4822cf44426d340d2156c0977eb8ded858adbcb7bb6fdc08931d868b021572a5b28ed871493cd11967b302eb SHA512 cd486f12bb11d0e6a4d575902d22276be3bffeb66ca5e83d0eef05ea7474ef91fd174d6929e8e4b05625eee9bbcd06618ade71509c98d208f84bea031e372f77
-DIST ncurses-6.4-20240217.patch.gz.asc 729 BLAKE2B 69a3ce2018acd626babd44fd0b286d29d927baaa7b381b8feb2961b3c5a731905ddc0f0fe62252101497de7a49adb150fd8e0feb04db2d5c2f78ef768d9cf593 SHA512 81f4f4c9315ef1605459041d2a523c8751a926f72e93a513bd922ddc27c91a999a11ecffa79a21577739dc6a46f23317d8867a2a5b8ecd372c5c820211da71c3
-DIST ncurses-6.4-20240224.patch.gz 11576 BLAKE2B 0ba4a7d7d38fbb2a0a985f7114935f4effe7c12a138af1a9aab974f5a38beb7986f9f9e4cdb1ab5563de68d7a99b762338afab30b5ad0aef299e4c677719e317 SHA512 58eec6d77026d58488711d8805334f17474bf30f3cacc10abffbd5bc38c0dbb287a586af9c0fc918f9f98ff124532c95e4d92e0850117982ca5afe0dbe9dec2c
-DIST ncurses-6.4-20240224.patch.gz.asc 729 BLAKE2B 18ef11d2ed0f94199fe28e732ebf2460dec8a42705ae89fc339e76870c343b849a311d7915cfd042c761465ce5cb4f42acdc9a2bc57312138e4e6f51546fed23 SHA512 b8e096066947aa2a567a6374afe41fb4f96c869eb3fed179a24d1f3a51af24a0bce135a9a0cb2680218224812b1ff2762470c15292d4555bf9f4231571b573d2
-DIST ncurses-6.4-20240302.patch.gz 37371 BLAKE2B 5d4d5af8fc10cab3e7b6b14751406737396fb5c63b361186d5881ed08cf61cffff64df5a326e1114e4b423f575799bcd0b10fa2c29ed61d4c123a373087d185a SHA512 4eaf59d3ded356f21c891e0ca9dd323e869597489da7322f3ea7ade14a01b2b205b7cbdc9d9beb38abe6f76f2a287a1715f3006599dcb4cbe5e7eb6ca1430e3c
-DIST ncurses-6.4-20240302.patch.gz.asc 729 BLAKE2B 6650fcea22bbb9fa619a9796f29ab63c0622f0be27b093ff8e7ae582fb4072ded5797f2f06064f3f1b594d037d8e74a84a156f9f213580da208b1c896be9c911 SHA512 08030171f2eb9208805f55c0da741883472e31b0443ee1e9c2758780e29ee3da3bc88fc91db1015464c473a98e2bc7556080fb20e69a07678320a5116d0c4a33
-DIST ncurses-6.4-20240309.patch.gz 2631 BLAKE2B 4f101f8f263c378b3c76e2da1399b286a71d70a67d0b639a58d914e61a292b99d5d51d27fab16efc26ab6269bc3718ff89db357f351603d9ca931916675cbe9c SHA512 a0c8e90015f933169329796cf247cdee19a7e1a8b263cfdeba1376d4042dc02f33878eaf56860deebfd55888ccbedcf9b76db4adf70ee6fa92ea7c4f823fdb07
-DIST ncurses-6.4-20240309.patch.gz.asc 729 BLAKE2B fd1c4b7c9b208427be6280f2ea899d970250ff8e4251c437e6e6ec0d3f5f9c6539f68bb4735da2d968769660d6f81aa40c922cde97fe26c2b0bf3630fdba3e75 SHA512 d49ecd327d1bbcd566990a43b54e554ac7c73142ff21fa58d3402b2cc2e8eba3b45780835c58c7f9a8e1a596ffb9cef5e669487d6f56b873d03a91e16ba303f8
-DIST ncurses-6.4-20240323.patch.gz 143301 BLAKE2B f51c229985025950ebe0b35e1e9cb17d36c5277aac966a10c77bb6e60831a6a017431b83ca06a07a660ca42066bf2e5792a37dd39c4e32e55423fe4b66333732 SHA512 a8977192912666dee7e6e1ba4766db352691b647feca169d447b484e5975a40429a2390c2a99136c2f96166973433a0a8d569381560e9ab47f161c85da273de5
-DIST ncurses-6.4-20240323.patch.gz.asc 729 BLAKE2B 380eaa8b0f3faa3e2ff21a3847c6f2ba59019adec68391134bb68bdecfd13cb56589ad4ec062dd391ae3d7bd96a306d85e78ef0827300de594723d188272e7c4 SHA512 380675d04ad1db69a039001b109bea6e7ef3f9fa0059ebe8b17ad12d0b59b20dd18b90abedb63f95db2ed6ad770de77aacc85c24d70bb883b1851c72c5dada88
-DIST ncurses-6.4-20240330.patch.gz 63526 BLAKE2B 593823a358017e5f98e897ebd6e1a2f945b0329c51a76b0ea65458751d2486dc51a71c1d0fdfbc1741167c47ed0b8aedc52b1a923c4788f23293d7e7729885c7 SHA512 666c8f7a37bc2b93b9b0ff76f2a5fe412f1d5c0c9260b64a26665e7c3ba74a9f05ae3883a512425d901ab943948509792759297ea85b9642cd02b7b64455326e
-DIST ncurses-6.4-20240330.patch.gz.asc 729 BLAKE2B 159c110254d81b1c83d7cdb3250fce7ac12d1b4773e6c1a4a347bc7a5d96893504b1a7066d6a8997c3db467ba7d3705e043714000142fd2ebac6e9a008a62ae8 SHA512 1a0dcc56e79da6e0d615bd0a6571869e42aa6e31233e6cb01fe85c8816c82858c23e93a47650e1a4fd8cee2461e4900f7b78a4f9aa3149a0aec6cda704f9c163
-DIST ncurses-6.4-20240413.patch.gz 113122 BLAKE2B d8e5d011a8ab61dd30624c51d7917ecc66f388c8b0edcba25f35179031a16b5a41379d8c5f2c40a2b6af5e485b25ca8a3cb1c97301450b00c14e2640187f0054 SHA512 45c14df0fc4229667ae173cd4eb37fad2a3dbcb8906763a4d472fad7b563dbe72dbc0bc12e6070e6e7f2e64fc2f3a254bffe5d1e904dce9f5636fccdd2761750
-DIST ncurses-6.4-20240413.patch.gz.asc 729 BLAKE2B 3786f815cddf3f6ebbf89da47e3151c01d50f26c2fa713cb982c61b7190ca25a807b6f7264688a296d5d252c78f4737372f2c6f26d7713bc448c5228676e922f SHA512 c172fe7f308a01474d04b06919b43710abcdb9fe3961396cbc7731f619093ed18bc7deb9bb62075e3bd0bb88d345059c9bf485a4f9ef614dc1109d4549c95a34
-DIST ncurses-6.4-20240414.patch.gz 3007 BLAKE2B a4db0635df3b2669ae1ba0057c21f717db2512aa51545ea5157dbaf33c3db334cf8315ecd60a4c8a6406e6e7ba417e23f00f575af72c56b18046e3c4a34dab87 SHA512 348ffdbeb2b7350493957562a0af1a217590dd35cd9f8f27ff46adfb969018224e170b63581f5b3ad268293441db59878898bd23d1d1a4add77fc681344df526
-DIST ncurses-6.4-20240414.patch.gz.asc 729 BLAKE2B 8d579b2724245756947200a3e704c1ae534ba64e6986ad009a5ca9d33145fff82ddae9003a7c6ffe5b64b68f813661440afcac0a1321e5b80113d3ec94e1ea5a SHA512 0976a253d11fb10d52fee1cd2ad38e80b0b531f89efe94a62b9a0e2d69206bd1574140785776c7f6bd19775f6ca446c582da31cd9f51a8b0f12039d1e9695600
-DIST ncurses-6.4.tar.gz 3612591 BLAKE2B 47fd9c2d27f44fa9942552881a471e5067465dbace40bf68b28998dded0556127a1d8662b96de4de4fd76c1c8b98bdae796036553ab4b05ca9f160839d841ba3 SHA512 1c2efff87a82a57e57b0c60023c87bae93f6718114c8f9dc010d4c21119a2f7576d0225dab5f0a227c2cfc6fb6bdbd62728e407f35fce5bf351bb50cf9e0fd34
-DIST ncurses-6.4.tar.gz.sig 438 BLAKE2B e6a78b8d0cbce1577205b49b0260394094632cefd95294813c7e4e51a2908e8599a9f24b3b648e42ba16c015fb9424b2a82236f58aac3bf96f5400a50482e44e SHA512 f2a7859725b4d5d62f68006338d56598ac6b38a1448983108906e192f0ec922be287cc89bcc79c1ae49ebc80c967af3dd077427f35ae579b00d445c882414fed
-DIST ncurses-6.4_p20240413-patches.tar.xz 63760 BLAKE2B 6a91d453cca3705ca54b3a6f2ef00250d655168c1697726db4b581a1597cbc143479b8794e176d5e4154c794f99ea33c3fe1eb26605789930fc82649a2da3c93 SHA512 59239503a9400e054641428528799aa9c13b12669b31f32b2ff18cb60882698801e04dcdf75ece8357c7a4c3b899a729aa973090ec12a20de72cb80a916878b8
 DIST ncurses-6.5-20240504.patch.gz 16541 BLAKE2B 1b698b61fb738252eb8839f659b8670c743808058da9eaf39e6d288f5c00b3d1fbc4318daee8744fef37cdc42fa176fc41bbc5d4890295ad53a633207cd129a2 SHA512 6d72b5950dd55a2eb36f4c615c851a0879dcee5f97f9aa46eef68fc0f3c6996c7bf06d4646a05c455888a563ca673be3159e89db2266e81f0e72434cf4d3df29
 DIST ncurses-6.5-20240504.patch.gz.asc 729 BLAKE2B 6a9ff6b524bb8ade98d6259514b7d467aee38d12b915c7eb030f025f244a44cc0c2dac524bd2645c5f315f54ef47fe6791dffc1728320e0e4790032a838cbbcd SHA512 4f8a2c6be0471df7c25fc67f596753df48a2a4660c848263d10126bba96010c185d31208b2424c495f29bbed6c93cc9cc88b37b4cc252e00bb971364fe68d2d8
 DIST ncurses-6.5-20240511.patch.gz 85486 BLAKE2B 94a00b7013531509def2e17ec75421897f321763fba970a73813278826071e99dd9ddde815c3b4a6cad7c6a3f16eada3afb030f31ee72123dcf0de710c9bcc03 SHA512 c529f1bac7af6c774447027449ac59e41dee3fc30004f7c82113936cc3aed9b5536466d2ca91d99d13d1e1e0e9d7357b87ceb9cc6dc54b212c730d088835288c
@@ -249,9 +108,24 @@ DIST ncurses-6.5-20250524.patch.gz 3599 BLAKE2B 5e1da13964f10d846afb26f8759590fd
 DIST ncurses-6.5-20250524.patch.gz.asc 729 BLAKE2B ba0c26a977da6874fa9f005dd094527739357384626b86f40edb73f9e41b63f5f43953ef9ec67dcb0d82404f822f6599c38ef8b5d4bb0e3b20e6c8f04115cc27 SHA512 6fafad6288c3fd87efded4faed2f2a4de705bf207cdecb5759f13be9bc6e2f866a1eb7d47719388f974954e78ab8c70e9be8b558e8f2662a2c042d16662ea281
 DIST ncurses-6.5-20250531.patch.gz 3172 BLAKE2B 225875dcf8adaf785efc0137ee0cdd7affb378ad266aab0ec2dffd4197cd74daafcda5638f0e3c09720a41ba9506ce46ff7bbdfd51d13cda4096d6b7be1fadb5 SHA512 763a3ce3e26445f4b978a7305b135e2cf94f7973db22b7228ff1fe9eee93ffe82ed32aa0012c9b2916599ab3980e455140f5150af420d85b75f33a426542acf8
 DIST ncurses-6.5-20250531.patch.gz.asc 729 BLAKE2B 94e72ea10c99afecc97c39854522dab0e95d970e77c36b558003717cf4f8a9f32783a994c88f6e5f657310929c518a7b80e46fbaeaf51f48811b7980458b6621 SHA512 5b7e4b98e2127e914aa997b63b59b4e3e5281f7a453d456ea4a29e5ec84da8ab4c8c74a3723e61613e04e85a412f37488a5cd6f4ff5536a05e3d91033035ecc4
+DIST ncurses-6.5-20250614.patch.gz 43730 BLAKE2B e8f42867dcb03a70024dedd0a635c96b0c913f390cce719c6c0e0adab2c05c24c9aeddfafa5bc7c5b752c45a814ae216d89555485f2e3d9bd49353c4faaf4f8e SHA512 96e91602881c041ecd1d71728114d74066569c9b97908f7e04696f3106c95fa21dc67fed58577f013264aa01c24b647fa47fcf7bf76e734029fa68f99054710e
+DIST ncurses-6.5-20250614.patch.gz.asc 729 BLAKE2B bbda791fa23caa08c25df5eacb100c40bafae51921a757f010412c88b8c28e152fed414cc21079a70c0faf6cbd972bfbfba75dc1cdd8d5d9b43215248a428884 SHA512 7774c6b8215967ef6e9df4d89b16fa969941cd1330951c03b6026b919b90469dd4e801971bc45378239cfb44a3e82b8003ef3c8dbb483a1fef02da49f2a7a315
+DIST ncurses-6.5-20250621.patch.gz 12198 BLAKE2B b342b10304c4e3df42a0d4823b5b9a8c2174569e7e6ea3e34aef7dd15c5af623af05ba9ed2efc5cf38493a7e18f71f15627a1596660d086e5f9ffdf1c5a36cd6 SHA512 e3bfe7b6dbaf02455ccb53f6f178d4b409d26d47b5bb26fcbeffef078696d124aaee04faa8d8a291c8a9e10ccd9184c5177c8a5ecd60b26eb49f0d1ea43e3130
+DIST ncurses-6.5-20250621.patch.gz.asc 729 BLAKE2B 110a2190ca7f2fd902bbcd16d5d499d2cc8a6ed6c2246d36e2766627c66d1e0283fed9eff1152febdebf50d327bd3e3ec598fa4fcf25ebd2a78c559a3ab6d7ee SHA512 adeb65f38a698413451a0d5e626da09e5824ec2c44197ddfd607bb888167ccf239134774c1c363938761ffcd49047b999603aa76681262e73b11f9f1e3d52520
+DIST ncurses-6.5-20250628.patch.gz 3861 BLAKE2B 8707b14c4e9e309f414f8f2d70619f631dd531d3377050d2c331405cd350c28c2ba5579c328a6112f2c4e199f6a13c3c266e985ab33d977f538672798dc01526 SHA512 927838ddd0784ae192f2f43602715bb89f88b05b33f8bbf72275d9920bc4f50e060b1fc49f36b08025487d9cd2d2f7d4b3c38188029d33dd64a31efff38a6bcc
+DIST ncurses-6.5-20250628.patch.gz.asc 729 BLAKE2B e33aacfbdf9e41dc8b457ab213e26523fb11dfc2c9df8db6c128387798a7e18813e352c275aba8524d9d4d4be2c71db56973e725952ca361b418d1bb448e1513 SHA512 2fcccee11626df82508a01eaeb8bc9cb124333705adad7265ea8825aac384bbd774527efc6462184fb2b60fdb10f36cc2a81c4c484ee3239070385ece50e6887
+DIST ncurses-6.5-20250705.patch.gz 180212 BLAKE2B c41b7be224247e63ebb030924c2e5e54409e31713e307bbbfa7f97e10b368ae651dc0e2deb16833c5f2c58891f9558946231db40eabd5ad5e6a91111fdf3afbb SHA512 eeefc5d4247b3bf647d79b83eff7b36c51b543c8240d902afa005842be2322f526a67c9aa8a2acd877a0f41edbeb00018c31e879acde7e67d7a946285936f5f6
+DIST ncurses-6.5-20250705.patch.gz.asc 729 BLAKE2B 8fddbe23e3eac1fc9ef4b9857aaf514c82d5351c48de0fae90a2e16c138e50c69b77863bb66b076f20aa08ca1e8e222db6c8ac302fdb60aba604eb2aa414d53b SHA512 1bcedc2da8eb74bd6737ac1ed05fcb1bea363874d7780ae3b0d2fcf5a9c243bf49cea305ea7316995c5eecb41bb2adac0f25cc8be7ff7f85950403c64da7459f
+DIST ncurses-6.5-20250712.patch.gz 8310 BLAKE2B 20a8696895afe29d4a2c10a425315a87ca33005d629d8f87801dd9562963396b0230f87b6c62e7ba4af487cf9f9e1687cb346ef090a60623533ebd35838a261e SHA512 e49a3d807859be4c7842bdc91eccc393ec39fe04044b077203e978e68168bb251cd60d93176e32c49273e533f694dc858520baf3ae115b33bcb344fe9e0a2277
+DIST ncurses-6.5-20250712.patch.gz.asc 729 BLAKE2B 43bd707944676c871a5a5253b5898e3188d1301fb8ccf5e2fd81787476ba2947b93882996ee1e23f3c68dcd68ebf360e6d6372bf38212e06a2eadcf50bd604c6 SHA512 5c1a4c3a6fb615d8a8eaef30f7f25d996e8907ae23e23d288f9fc5d64827477dbfef36512fb123a2fe3baa13592978a2473621f62ca2e338eb9120ad4b505b5e
+DIST ncurses-6.5-20250720.patch.gz 126004 BLAKE2B 3898a4cadd1d7f903ef5437363208db8412b9de5c718315c73398cdb28daa7d90423aa9c4ba7e1c921b1e3cca9f9980f15d675b6a14ec114835b0766024ec465 SHA512 90a912748ac7cec005172929a9432c8b9f5338d690a863516c09b74e96a38c1390fd2ec4e60616feb0aeeec0d9e5bdf71bf525ed8872b116e309a87701a45a35
+DIST ncurses-6.5-20250720.patch.gz.asc 729 BLAKE2B 27cbd419eaa27199787dbbea8f2049f40d83633760f57520f2dde93f55a5d5fc3b7559d3767e32cfdcd930b2c5b018d5e13b301daef0c733d9ca6acaec7dc4f7 SHA512 d41ed183e64fef73621f7a9e9561a5b44ecaae452fc3bcb4e258099f1f7fb06283c6f7a0674c6c40ecca6a07bd3c10782e22ba3618b6153428265a5003d4def5
+DIST ncurses-6.5-20250726.patch.gz 47760 BLAKE2B 316109ff7e38c6ecdec115e7980d307d7e16f4f88eee096c620b5750158c288505c8f41de1ec9d9da49ff4e56839166ab994393075d2f5fadcbdfb3c7af2d9c9 SHA512 1c47b7db0fbf77c78b53fac1aeb09d75297c1f46fb9a26a50f7c350b70d1e18fd3995ca4856d67fa9664806d9d64759ad13894924ec7d583973791ac127e8b55
+DIST ncurses-6.5-20250726.patch.gz.asc 729 BLAKE2B 0317fe9d4251514a01848b804e1c0d89cbadf6645127bcdb5b854a4a60346de1ffc5464454ac9cb4e930eed566e65e3c5b9624b2e7b76b264f4bd9cbb6f5e70d SHA512 847d6de3cf0ba49ed6cafeae269966d1687e061eb546b0e05ab155af20309ab7fbe0eed6e4d226bc3859a8aa7c526d2781233bf06e9862120c57f2791c2e52f0
+DIST ncurses-6.5-20250802.patch.gz 4000 BLAKE2B 18c7855d0a16ad24947b8f9099729dde3d4bf5509d310ec6fe48e52436a8e9c151b963020c798484184989c9816266ef21f5545d73e5d931a8c07da318612e2d SHA512 ef29aeb611f7362343356b50f602298e52727df62dea661dd9b831f440dd9b3ca3b4e0a57011222db9e8016fa06413ef97b83936445353dbb11993f08936d95f
+DIST ncurses-6.5-20250802.patch.gz.asc 729 BLAKE2B 20bdd09573b76d1f37964f3af89e96fa481a8c3cd3872de5b8c1fdffc718c4777ef7a5a99046b17f06a92a9266f46ac29df5e21c473ed3fbaf1e03fc557157f3 SHA512 e2398af3d20db4fff9d724a8c7d6da32c094b95dc8156c46f6f5f3aaa3f53b9b0eb739bb6be8afab54863180ab56e16168056b0852ff3aefce0875a32f2770b8
 DIST ncurses-6.5.tar.gz 3688489 BLAKE2B d0a05c218b5f320ba9abe2f322787baef1d15d764e503c81d49772b54b2927d28ecbeb500c8e514996226b41f69445b4de44ff423cec25b61847307fe61682ec SHA512 fc5a13409d2a530a1325776dcce3a99127ddc2c03999cfeb0065d0eee2d68456274fb1c7b3cc99c1937bc657d0e7fca97016e147f93c7821b5a4a6837db821e8
 DIST ncurses-6.5.tar.gz.sig 438 BLAKE2B 5789b47932ec97d3863c7a65306369f0a36cb5b1a35c1e009b5174f50941edceafc22e6f07db3843a096773663a0ca602c0ecb9465e6042d9a78d76ae5008215 SHA512 96ce61a3d529e48e249acecbf4bb9eae2d9f2f67506e92ffa3182f5e98040c38babf0c2c15d92fc5d96e1181e72be1b29fdbff7bee859dfe2ae387f9b8883092
-DIST ncurses-6.5_p20241109-patches.tar.xz 63676 BLAKE2B 9981b740fcec18cc794074ccc93ae1dbe175e52449af2bddfd10a6fb1d5dfe9b545bd19fce5e601d2d85008425fd5cd6fc33042d7bcc854363b0642b9c880efe SHA512 076d2d39c46cf9236e5e65472e10182da2dffffa936c7567b11e23323d64f9739bb3818d4fdbdd75a14fd3f5b202dcdb7aaa6813afb5e303f81c094339824162
-DIST ncurses-6.5_p20250118-patches.tar.xz 64188 BLAKE2B 46ac7c8bcfb0ec4fb032ccff4ba0c57d15f925910eb4d108c626aba8fdecefd21660a05cf54a88a4668b50e489ce0a08526f978a0084c66b2105fc4d929fdfe5 SHA512 12ff29d5ec76487f8b368d481fc19d841e8ce6bc216ff614b6d6d543a1fa36020b403432c802665d99b7fb4f08ae863d7ac331e6e2d95ff86c719fdca383c3e2
 DIST ncurses-6.5_p20250301-patches.tar.xz 65224 BLAKE2B 9db65c728cc6d79e21b7673bb7700069cbf09287acfb65b23a65d607c3172835a9bf7df9a705d3a05b6197684bc7935e1cbed91bf18343c4fb8ebacf17e61dc1 SHA512 f5808f0c2fc1f6027678d8980a0cf598a64c9e85e1d72459dd712090c2dd24eb45261f35b025fd543aed56e903c658942c163b8fe8bace24a56fb8e9238da29e
 DIST ncurses-6.5_p20250531-patches.tar.xz 65304 BLAKE2B b696a473c34df2aa1fe8b03fcbd6dd4bffdc8620917c0651994037bf902526a0c0b2be843beee2dec543677a0289aea35dd7e9ba7161eaef2c5663b4f1e356a8 SHA512 cb638cd2fd7128a7245b95a686df0725cbe133b42d26bdebabe62f070eacc25545845ea09c44d6d73183776a0ad094ae7857e2079b6561f05d94b86730f355db
+DIST ncurses-6.5_p20250802-patches.tar.xz 64208 BLAKE2B a4e721225ac68590f6d5b492d5ec0a90b2637fe34bbe6bc3bf7eebfd6e295f430f71e63f36bb81db5864868e29d4acb62698dc01511048d929c745b752a95352 SHA512 40d9db23bc9b3baa0fac6bc380c47bc13bf2928796b6a0ab706f952dd6c39cba939e772f13b0323656b661f9006cd4d5dbde705db79a2bf28980c6f423ded374
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch
deleted file mode 100644
index 8df982c371e..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-1.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff '--color=auto' -ruN ncurses-6.4.orig/aclocal.m4 ncurses-6.4/aclocal.m4
---- ncurses-6.4.orig/aclocal.m4	2024-08-29 20:47:34.978057133 +0000
-+++ ncurses-6.4/aclocal.m4	2024-08-29 20:48:57.809473044 +0000
-@@ -10139,7 +10139,7 @@
- 	cf_xopen_source="-D_SGI_SOURCE"
- 	cf_XOPEN_SOURCE=
- 	;;
--(linux*gnu|linux*gnuabi64|linux*gnuabin32|linux*gnueabi|linux*gnueabihf|linux*gnux32|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
-+(linux*gnu*|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
- 	CF_GNU_SOURCE($cf_XOPEN_SOURCE)
- 	;;
- (minix*)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch
deleted file mode 100644
index 5abdd5c610d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/files/ncurses-6.4-t64-2.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff '--color=auto' -ruN ncurses-6.4.orig/configure ncurses-6.4/configure
---- ncurses-6.4.orig/configure	2024-08-29 20:50:18.321117225 +0000
-+++ ncurses-6.4/configure	2024-08-29 20:52:49.308328392 +0000
-@@ -10413,7 +10413,7 @@
- 	cf_xopen_source="-D_SGI_SOURCE"
- 	cf_XOPEN_SOURCE=
- 	;;
--(linux*gnu|linux*gnuabi64|linux*gnuabin32|linux*gnueabi|linux*gnueabihf|linux*gnux32|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
-+(linux*gnu*|uclinux*|gnu*|mint*|k*bsd*-gnu|cygwin|msys|mingw*|linux*uclibc)
- 
- cf_gnu_xopen_source=$cf_XOPEN_SOURCE
- 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
deleted file mode 100644
index bf4152a97a8..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.4_p20240413
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20230107
-		20230114
-		20230121
-		20230128
-		20230211
-		20230218
-		20230225
-		20230311
-		20230401
-		20230408
-		20230415
-		20230418
-		20230423
-		20230424
-		20230429
-		20230506
-		20230514
-		20230520
-		20230527
-		20230603
-		20230610
-		20230615
-		20230617
-		20230624
-		20230625
-		20230701
-		20230708
-		20230715
-		20230722
-		20230729
-		20230805
-		20230812
-		20230819
-		20230826
-		20230902
-		20230909
-		20230917
-		20230918
-		20230923
-		20231001
-		20231007
-		20231014
-		20231016
-		20231021
-		20231028
-		20231104
-		20231111
-		20231118
-		20231121
-		20231125
-		20231202
-		20231209
-		20231217
-		20231223
-		20231230
-		20240106
-		20240113
-		20240120
-		20240127
-		20240203
-		20240210
-		20240217
-		20240224
-		20240302
-		20240309
-		20240323
-		20240330
-		20240413
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-RESTRICT="!test? ( test )"
-
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-
-	# Avoid breakage with CHOST ending in t64
-	"${FILESDIR}"/ncurses-6.4-t64-1.patch
-	"${FILESDIR}"/ncurses-6.4-t64-2.patch
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-		--disable-term-driver
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=(
-			--without-{pthread,reentrant}
-
-			# XXX: Revisit on next ABI break (>6) (bug #928873)
-			--disable-opaque-curses
-			--disable-opaque-form
-			--disable-opaque-menu
-			--disable-opaque-panel
-		)
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild
deleted file mode 100644
index 373f1c811b3..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20241109.ebuild
+++ /dev/null
@@ -1,460 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20241109
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20240504
-		20240511
-		20240518
-		20240519
-		20240525
-		20240601
-		20240608
-		20240615
-		20240622
-		20240629
-		20240706
-		20240713
-		20240720
-		20240727
-		20240810
-		20240817
-		20240824
-		20240831
-		20240914
-		20240922
-		20240928
-		20241006
-		20241019
-		20241026
-		20241102
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-RESTRICT="!test? ( test )"
-
-# TODO: ncurses allows (and we take advantage of this, even) passing
-# the SONAME for dlopen() use, so only the header is needed at build time.
-# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
-# which would be far nicer UX-wise.
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		--enable-fvisibility
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-
-		# bug #930806
-		--disable-setuid-environ
-		# TODO: Maybe do these for USE=hardened
-		#--disable-root-access
-		#--disable-root-environ
-
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	case ${CHOST} in
-		*-mingw32*)
-			conf+=( --enable-term-driver )
-			;;
-		*)
-			conf+=( --disable-term-driver )
-			;;
-	esac
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=( --without-{pthread,reentrant} )
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild
deleted file mode 100644
index fd177aa7fa0..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250125.ebuild
+++ /dev/null
@@ -1,474 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
-# provide a configure option for the ABI version.
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
-inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
-
-MY_PV="${PV:0:3}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="Console display library"
-HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
-# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
-SRC_URI="
-	mirror://gnu/ncurses/${MY_P}.tar.gz
-	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
-	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
-"
-
-GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20250118
-GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
-
-# Populated below in a loop. Do not add patches manually here.
-UPSTREAM_PATCHES=()
-
-if [[ ${PV} == *_p* ]] ; then
-	# Sometimes, after releases, there's no megapatch available yet.
-	#
-	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
-	#
-	#	"At times (generally to mark a relatively stable point), I create a rollup
-	#	patch, which consists of all changes from the release through the current date."
-	#
-	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
-	# the patches are considered to be acceptable to use after some testing. They
-	# are both for development but also bug fixes.
-	#
-	# This array should contain a list of all the snapshots since the last
-	# release if there's no megapatch available yet.
-	PATCH_DATES=(
-		20240504
-		20240511
-		20240518
-		20240519
-		20240525
-		20240601
-		20240608
-		20240615
-		20240622
-		20240629
-		20240706
-		20240713
-		20240720
-		20240727
-		20240810
-		20240817
-		20240824
-		20240831
-		20240914
-		20240922
-		20240928
-		20241006
-		20241019
-		20241026
-		20241102
-		20241109
-		20241123
-		20241130
-		20241207
-		20241214
-		20241221
-		20241228
-		20250104
-		20250111
-		20250118
-
-		# Latest patch is just _pN = $(ver_cut 4)
-		$(ver_cut 4)
-	)
-
-	if [[ -z ${PATCH_DATES[@]} ]] ; then
-		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
-		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
-
-		# If we have a rollup patch, use that instead of the individual ones.
-		UPSTREAM_PATCHES+=( patch.sh )
-	else
-		# We use a mirror as well because we've had reports of 403 forbidden for some users.
-		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
-
-		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
-		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
-		# Suffix each with .patch.gz
-		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
-		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
-		# Repeat for .patch.gz.asc for verify-sig
-		SRC_URI+=" ${mangled_patches[@]}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
-
-		# For all of the URLs, chuck in invisible-island.net too:
-		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
-		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
-
-		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
-
-		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
-	fi
-fi
-
-SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="MIT"
-# The subslot reflects the SONAME.
-SLOT="0/6"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
-# In 6.5_p20250118, the C++ examples fail to link, but there's no automated
-# testsuite anyway. Controlling building examples isn't really what USE=test
-# is for. Just restrict them.
-RESTRICT="!test? ( test ) test"
-
-# TODO: ncurses allows (and we take advantage of this, even) passing
-# the SONAME for dlopen() use, so only the header is needed at build time.
-# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
-# which would be far nicer UX-wise.
-DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
-# Block the older ncurses that installed all files w/SLOT=5, bug #557472
-RDEPEND="
-	${DEPEND}
-	!<=sys-libs/ncurses-5.9-r4:5
-	!<sys-libs/slang-2.3.2_pre23
-	!<x11-terms/rxvt-unicode-9.06-r3
-	!<x11-terms/st-0.6-r1
-	!minimal? ( !<x11-terms/ghostty-1.1.0 )
-"
-BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
-
-PATCHES=(
-	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
-
-	# When rebasing Gentoo's patchset, please use git from a clean
-	# src_prepare with upstream patches already applied. git am --reject
-	# the existing patchset and rebase as required. This makes it easier
-	# to manage future rebasing & adding new patches.
-	#
-	# For the same reasons, please include the original configure.in changes,
-	# NOT just the generated results!
-	"${WORKDIR}"/${GENTOO_PATCH_NAME}
-)
-
-src_unpack() {
-	# Avoid trying to verify our own patchset tarball, there's no point
-	if use verify-sig ; then
-		local file
-		for file in ${A} ; do
-			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
-			else
-				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
-
-				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
-			fi
-		done
-	fi
-
-	default
-}
-
-src_configure() {
-	# bug #115036
-	unset TERMINFO
-
-	tc-export_build_env BUILD_{CC,CXX,CPP}
-
-	# bug #214642
-	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
-
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
-	# Order matters here -- we want unicode/thread versions to come last so that the
-	# binaries in /usr/bin support both wide and narrow.
-	# The naming is also important as we use these directly with filenames and when
-	# checking configure flags.
-	NCURSES_TARGETS=(
-		ncurses
-		ncursesw
-		ncursest
-		ncursestw
-	)
-
-	# When installing ncurses, we have to use a compatible version of tic.
-	# This comes up when cross-compiling, doing multilib builds, upgrading,
-	# or installing for the first time.  Build a local copy of tic whenever
-	# the host version isn't available. bug #249363, bug #557598
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		local lbuildflags="-static"
-
-		# some toolchains don't quite support static linking
-		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
-		case ${CHOST} in
-			*-darwin*)  dbuildflags=     ;;
-			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
-		esac
-		echo "int main() {}" | \
-			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
-			|| lbuildflags="${dbuildflags}"
-
-		# We can't re-use the multilib BUILD_DIR because we run outside of it.
-		BUILD_DIR="${WORKDIR}" \
-		CC=${BUILD_CC} \
-		CXX=${BUILD_CXX} \
-		CPP=${BUILD_CPP} \
-		CHOST=${CBUILD} \
-		CFLAGS=${BUILD_CFLAGS} \
-		CXXFLAGS=${BUILD_CXXFLAGS} \
-		CPPFLAGS=${BUILD_CPPFLAGS} \
-		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
-		do_configure cross --without-shared --with-normal --with-progs --without-ada
-	fi
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	if [[ ${ABI} == x86 ]] ; then
-		# For compatibility with older binaries at slight performance cost.
-		# bug #616402
-		use stack-realign && append-flags -mstackrealign
-	fi
-
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_configure "${t}"
-	done
-}
-
-do_configure() {
-	local target=$1
-	shift
-
-	mkdir "${BUILD_DIR}/${target}" || die
-	cd "${BUILD_DIR}/${target}" || die
-
-	local conf=(
-		# We need the basic terminfo files in /etc, bug #37026.  We will
-		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
-		# src_install() ...
-		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
-
-		# Enable installation of .pc files.
-		--enable-pc-files
-		# This path is used to control where the .pc files are installed.
-		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
-
-		# Now the rest of the various standard flags.
-		--with-shared
-		--enable-fvisibility
-		# (Originally disabled until bug #245417 is sorted out, but now
-		# just keeping it off for good, given nobody needed it until now
-		# (2022) and we're trying to phase out bdb.)
-		--without-hashed-db
-		$(use_with ada)
-		$(use_with cxx)
-		$(use_with cxx cxx-binding)
-		--with-cxx-shared
-		$(use_with debug)
-		$(use_with profile)
-		# The configure script uses ldd to parse the linked output which
-		# is flaky for cross-compiling/multilib/ldd versions/etc...
-		$(use_with gpm gpm libgpm.so.1)
-
-		# bug #930806
-		--disable-setuid-environ
-		# TODO: Maybe do these for USE=hardened
-		#--disable-root-access
-		#--disable-root-environ
-
-		--disable-termcap
-		--enable-symlinks
-		--with-manpage-format=normal
-		--enable-const
-		--enable-colorfgbg
-		--enable-hard-tabs
-		--enable-echo
-		$(use_enable !ada warnings)
-		$(use_with debug assertions)
-		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
-		$(multilib_native_with progs)
-		$(use_with test tests)
-		$(use_with trace)
-		$(use_with tinfo termlib)
-		--disable-stripping
-		--disable-pkg-ldflags
-	)
-
-	case ${CHOST} in
-		*-mingw32*)
-			conf+=( --enable-term-driver )
-			;;
-		*)
-			conf+=( --disable-term-driver )
-			;;
-	esac
-
-	if [[ ${target} == ncurses*w ]] ; then
-		conf+=( --enable-widec )
-	else
-		conf+=( --disable-widec )
-	fi
-	if [[ ${target} == ncursest* ]] ; then
-		conf+=( --with-{pthread,reentrant} )
-	else
-		conf+=( --without-{pthread,reentrant} )
-	fi
-
-	# Make sure each variant goes in a unique location.
-	if [[ ${target} == "ncurses" ]] ; then
-		# "ncurses" variant goes into "${EPREFIX}"/usr/include
-		# It is needed on Prefix because the configure script appends
-		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
-		conf+=( --enable-overwrite )
-	else
-		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
-	fi
-	# See comments in src_configure.
-	if [[ ${target} != "cross" ]] ; then
-		local cross_path="${WORKDIR}/cross"
-		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
-	fi
-
-	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
-}
-
-src_compile() {
-	# See comments in src_configure.
-	if ! has_version -b "~sys-libs/${P}:0" ; then
-		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
-	fi
-
-	multilib-minimal_src_compile
-}
-
-multilib_src_compile() {
-	local t
-	for t in "${NCURSES_TARGETS[@]}" ; do
-		do_compile "${t}"
-	done
-}
-
-do_compile() {
-	local target=$1
-	shift
-
-	cd "${BUILD_DIR}/${target}" || die
-
-	# A little hack to fix parallel builds ... they break when
-	# generating sources so if we generate the sources first (in
-	# non-parallel), we can then build the rest of the package
-	# in parallel.  This is not really a perf hit since the source
-	# generation is quite small.
-	emake -j1 sources
-
-	# For some reason, sources depends on pc-files which depends on
-	# compiled libraries which depends on sources which ...
-	# Manually delete the pc-files file so the install step will
-	# create the .pc files we want.
-	rm -f misc/pc-files || die
-	emake "$@"
-}
-
-multilib_src_install() {
-	local target
-	for target in "${NCURSES_TARGETS[@]}" ; do
-		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
-	done
-
-	# Move main libraries into /.
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a \
-			"${NCURSES_TARGETS[@]}" \
-			$(usex tinfo 'tinfow tinfo' '')
-	fi
-
-	# Don't delete '*.dll.a', needed for linking, bug #631468
-	if ! use static-libs; then
-		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
-	fi
-
-	# Build fails to create this ...
-	# -FIXME-
-	# Ugly hackaround for riscv having two parts libdir (bug #689240)
-	# Replace this hack with an official solution once we have one...
-	# -FIXME-
-	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
-		/usr/$(get_libdir)/terminfo
-
-	# Remove obsolete libcurses symlink that is created by the build
-	# system. Technically, this could be also achieved
-	# via --disable-overwrite but it also moves headers implicitly,
-	# and we do not want to do this yet.
-	# bug #836696
-	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
-}
-
-multilib_src_install_all() {
-	local terms=(
-		# Dumb/simple values that show up when using the in-kernel VT.
-		ansi console dumb linux
-		vt{52,100,102,200,220}
-		# [u]rxvt users used to be pretty common.  Probably should drop this
-		# since upstream is dead and people are moving away from it.
-		rxvt{,-unicode}{,-256color}
-		# xterm users are common, as is terminals re-using/spoofing it.
-		xterm xterm-{,256}color
-		# screen is common (and reused by tmux).
-		screen{,-256color}
-		screen.xterm-256color
-	)
-	if use split-usr ; then
-		local x
-		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
-		einfo "Installing basic terminfo files in /etc..."
-		for x in "${terms[@]}"; do
-			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
-			local basedir=$(basename "$(dirname "${termfile}")")
-
-			if [[ -n ${termfile} ]] ; then
-				dodir "/etc/terminfo/${basedir}"
-				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
-				dosym "../../../../etc/terminfo/${basedir}/${x}" \
-					"/usr/share/terminfo/${basedir}/${x}"
-			fi
-		done
-
-		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
-
-		use minimal && rm -r "${ED}"/usr/share/terminfo*
-		# Because ncurses5-config --terminfo returns the directory we keep it
-		# bug #245374
-		keepdir /usr/share/terminfo
-	elif use minimal ; then
-		# Keep only the basic terminfo files
-		find "${ED}"/usr/share/terminfo/ \
-			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
-			-type d -empty -delete || die
-	fi
-
-	cd "${S}" || die
-	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
-	if use doc ; then
-		docinto html
-		dodoc -r doc/html/
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /$(get_libdir)/libncurses.so.5
-	preserve_old_lib /$(get_libdir)/libncursesw.so.5
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
-	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
index d32df669b86..25d08e29b6e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250531-r1.ebuild
@@ -307,10 +307,10 @@ do_configure() {
 		--enable-hard-tabs
 		--enable-echo
 		$(use_enable !ada warnings)
-		$(use_with debug assertions)
+		$(use_enable debug assertions)
 		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
+		$(use_enable debug expanded)
+		$(use_enable !debug macros)
 		$(multilib_native_with progs)
 		$(use_with test tests)
 		$(use_with trace)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
index 78a75ac0c0e..fe59c3f8d65 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250308.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250802.ebuild
@@ -22,7 +22,7 @@ SRC_URI="
 "
 
 GENTOO_PATCH_DEV=sam
-GENTOO_PATCH_PV=6.5_p20250301
+GENTOO_PATCH_PV=6.5_p20250802
 GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
 
 # Populated below in a loop. Do not add patches manually here.
@@ -85,6 +85,26 @@ if [[ ${PV} == *_p* ]] ; then
 		20250216
 		20250222
 		20250301
+		20250308
+		20250315
+		20250322
+		20250329
+		20250405
+		20250412
+		20250419
+		20250426
+		20250503
+		20250510
+		20250517
+		20250524
+		20250531
+		20250614
+		20250621
+		20250628
+		20250705
+		20250712
+		20250720
+		20250726
 
 		# Latest patch is just _pN = $(ver_cut 4)
 		$(ver_cut 4)
@@ -189,9 +209,6 @@ src_configure() {
 	# bug #214642
 	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
 
-	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
-	append-cflags $(test-flags-CC -std=gnu17)
-
 	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
 	# Order matters here -- we want unicode/thread versions to come last so that the
 	# binaries in /usr/bin support both wide and narrow.
@@ -298,10 +315,10 @@ do_configure() {
 		--enable-hard-tabs
 		--enable-echo
 		$(use_enable !ada warnings)
-		$(use_with debug assertions)
+		$(use_enable debug assertions)
 		$(use_enable !debug leaks)
-		$(use_with debug expanded)
-		$(use_with !debug macros)
+		$(use_enable debug expanded)
+		$(use_enable !debug macros)
 		$(multilib_native_with progs)
 		$(use_with test tests)
 		$(use_with trace)
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
index a1b3b2bcb5c..b3b3fa5a55e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
@@ -3,6 +3,7 @@ DIST readline-8.2.tar.gz 3043952 BLAKE2B 7974322b9c092a756a79e537df08e8532f8e0fc
 DIST readline-8.2.tar.gz.sig 95 BLAKE2B dc510459c0c47782ca87364a6677b4d8f0b68a984143122c08bd15aef08a71bff59ac92d3c3ada518dad09f189c144748e840175041eb619f679e2d8b95dc2aa SHA512 0effd273689e5f7fe7e049c8f2c5f3c97149f198a90d053231ee4de34901560a465ab0d4fd71fd07c7d7e233caed7f42e5b668bffaf1e23a7eb373c8f9e150fe
 DIST readline-8.3.tar.gz 3419642 BLAKE2B 45d6fe7e34c56d309102a94aa776a7f5284201e844450e14ff818df9fa84a72154bdca70f11828c94954b080cbbe4666fa0b00ffa8460118ec8f3ea551b73dad SHA512 513002753dcf5db9213dbbb61d51217245f6a40d33b1dd45238e8062dfa8eef0c890b87a5548e11db959e842724fb572c4d3d7fb433773762a63c30efe808344
 DIST readline-8.3.tar.gz.sig 95 BLAKE2B 088be0a0dbcafc6e9643daac987bf09e37b919b28c87ffbd7d47ee798f71d5e2eb48a07ae040e7290465c95c32385b10b3a0c1285861d4c663e6e1fd28b091b6 SHA512 8f9d4adeb068016e61f76052fb38552db447fc461c7d48811d8af5f0436abce20277e08c475a1c48c99fa37f2b20ca549a94eb5cee0fe6f0d4c854699cc0988c
+DIST readline-8.4_alpha_pre20250805-488d7edc22894d30b6de7f2d4190bf7403f63ffd.tar.gz 3483136 BLAKE2B 0aade82ce2cb240d9c5e3039ac6ff5b674413a71318ec5e60ef2ee34725bf1dee5b24e7300b80c4cfb99f92f4e71c76b02598051eb2b5c558427e877a0321373 SHA512 cbfc17d9350452fdf9ea0a32472d2fde66a0d6e2ed7b2bf0d9ec000082ca5c61ebef3375ab8f95e3354a0df5fe6a47708163405af007f1fd9d55875fa02032bf
 DIST readline82-001 1198 BLAKE2B 2e8f3d2aa14c4c4c4f9621f80f4ffae9bbd6f46c3561e87aaf684c759ffd82e3c46843cf4c4224533b28a847d83f7b8b254813f8a306d438e9f7cb457516c4e0 SHA512 ea3800a62e992b3e594d78e77b6c4b662fb8c501b81010277e478656bb3b56db7747ba40c6c3d68c3ec5ab8e9e41be104788ec52268135d7e642ff40dea421a8
 DIST readline82-001.sig 94 BLAKE2B 542ac331a7da3702b47f4828b3264bc7bf996f473807d675044beeb9688c4ca3645bcba0898d3ea9447c1cde540eb8a6b1934008b0a11baef33235e43f44c6c7 SHA512 01ad9769fee42dc601b511c87bd39e15c74226e1747c4ae8914e303213706005780135add180dbfe538fe847533dc56cfe8f51a3ad9ec55d1fde2cb2e096bfb5
 DIST readline82-002 1134 BLAKE2B 799f089105be9931ba13d562d4579b4d1dbdd5440b625b8fe0f1cec6438a1623bf473944cb278b937ca5ab2b98eac2f5993d6e047b96368b5fcd5649fb536d96 SHA512 2d4058c5c886498486d8514c238c0a05c0a97409011a7da40745e842977f0a29754e8b678f7e6e7a47c00df7e2e4c522d34d473118a24524af3824eed912e74a
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild
new file mode 100644
index 00000000000..5d847c85a35
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.4_alpha_pre20250805.ebuild
@@ -0,0 +1,257 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# There's no standard way of versioning the point releases upstream
+# make anyway, so while this was added for RC versions, it's fine
+# in general.
+QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
+
+# Official patches
+# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+DESCRIPTION="Another cute console display library"
+HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	READLINE_COMMIT="488d7edc22894d30b6de7f2d4190bf7403f63ffd"
+	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
+	S="${WORKDIR}/${MY_P}"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/readline"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base
+	fi
+fi
+
+LICENSE="GPL-3+"
+SLOT="0/8"  # subslot matches SONAME major
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="static-libs +unicode utils"
+
+RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
+	"${FILESDIR}"/${PN}-7.0-headers.patch
+	"${FILESDIR}"/${PN}-8.0-headers.patch
+)
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	default
+
+	#(( PLEVEL < 0 )) && eautoreconf
+
+	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
+		# If we're bootstrapping, make a guess. We don't have pkg-config
+		# around yet. bug #818103.
+		# Incorrectly populating this leads to underlinked libreadline.
+		local ncurses_libs
+		local ncurses_libs_suffix=$(usex unicode w '')
+
+		ncurses_libs="-lncurses${ncurses_libs_suffix}"
+
+		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
+			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
+		fi
+	else
+		# Force ncurses linking, bug #71420.
+		# Use pkg-config to get the right values, bug #457558.
+		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
+	fi
+
+	sed -i \
+		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
+		support/shobj-conf || die
+	sed -i \
+		-e "/[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
+		examples/rlfe/configure || die
+
+	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
+	# objformat for years, so we don't want to rely on that.
+	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
+
+	# For local readline headers
+	ln -s ../.. examples/rlfe/readline || die
+}
+
+src_configure() {
+	# Fix implicit decls with widechar funcs
+	append-cppflags -D_GNU_SOURCE
+	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
+	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
+
+	# Make sure configure picks a better ar than `ar`, bug #484866
+	export ac_cv_prog_AR="$(tc-getAR)"
+
+	# Force the test since we used sed above to force it.
+	export bash_cv_termcap_lib=ncurses
+
+	# Control cross-compiling cases when we know the right answer.
+	# In cases where the C library doesn't support wide characters, readline
+	# itself won't work correctly, so forcing the answer below should be OK.
+	if tc-is-cross-compiler ; then
+		export bash_cv_func_sigsetjmp="present"
+		export bash_cv_func_ctype_nonascii="yes"
+		# bug #503312
+		export bash_cv_wcwidth_broken="no"
+	fi
+
+	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
+	# so we can re-use the config cache file between the two.
+	append-ldflags -L.
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--cache-file="${BUILD_DIR}"/config.cache
+		--with-curses
+		$(use_enable static-libs static)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		mkdir -p examples/rlfe || die
+		cd examples/rlfe || die
+
+		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
+	fi
+}
+
+multilib_src_compile() {
+	emake
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		cd examples/rlfe || die
+		local l
+		for l in readline history ; do
+			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
+			ln -s ../../lib${l}.a lib${l}.a || die
+		done
+		emake
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi ; then
+		if use utils && ! tc-is-cross-compiler; then
+			dobin examples/rlfe/rlfe
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
+
+	dodoc USAGE
+	docinto ps
+	dodoc doc/*.ps
+}
+pkg_preinst() {
+	# bug #29865
+	# Reappeared in bug #595324 with paludis so keeping this for now...
+	preserve_old_lib \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
index 8e400d1ef0b..06774a3bb92 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.4.ebuild
@@ -3,6 +3,8 @@
 
 EAPI=8
 
+inherit libtool
+
 MY_P="${P/-/_}"
 DESCRIPTION="Lists open files for running Unix processes"
 HOMEPAGE="https://github.com/lsof-org/lsof"
@@ -26,6 +28,11 @@ BDEPEND="
 # Needs fixing first for sandbox
 RESTRICT="test"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 src_configure() {
 	local myeconfargs=(
 		$(use_with rpc libtirpc)
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
index bcbab028781..1ce631f2a89 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/lsof/lsof-4.99.5.ebuild
@@ -3,6 +3,8 @@
 
 EAPI=8
 
+inherit libtool
+
 MY_P="${P/-/_}"
 DESCRIPTION="Lists open files for running Unix processes"
 HOMEPAGE="https://github.com/lsof-org/lsof"
@@ -26,6 +28,11 @@ BDEPEND="
 # Needs fixing first for sandbox
 RESTRICT="test"
 
+src_prepare() {
+	default
+	elibtoolize
+}
+
 src_configure() {
 	local myeconfargs=(
 		$(use_with rpc libtirpc)
diff --git a/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild
deleted file mode 100644
index 0143da2e56a..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/pkgconfig/pkgconfig-2-r1.ebuild
+++ /dev/null
@@ -1,10 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-DESCRIPTION="Virtual for the pkg-config implementation"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND=">=dev-util/pkgconf-1.3.7[pkg-config(+)]"
diff --git a/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
similarity index 62%
rename from sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild
rename to sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
index 4019dab4188..1961e41e11e 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/resolvconf/resolvconf-2.ebuild
@@ -1,14 +1,15 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="Virtual to select between different resolvconf providers"
+
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="systemd"
 
 RDEPEND="
-	|| (
-		net-dns/openresolv
-		>=sys-apps/systemd-239-r1[resolvconf]
-	)"
+	systemd? ( >=sys-apps/systemd-239-r1[resolvconf] )
+	!systemd? ( net-dns/openresolv )
+"
diff --git a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
deleted file mode 100644
index 0737723e43a..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Virtual for various service managers"
-
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	prefix-guest? ( >=sys-apps/baselayout-prefix-2.2 )
-	!prefix-guest? (
-		|| (
-			sys-apps/openrc
-			kernel_linux? (
-				|| (
-					sys-apps/s6-rc
-					sys-apps/systemd
-					sys-process/runit
-					virtual/daemontools
-				)
-			)
-		)
-	)"
diff --git a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild
deleted file mode 100644
index 91f3af84bf9..00000000000
--- a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r3.ebuild
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Virtual for various service managers"
-
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	!prefix-guest? (
-		|| (
-			sys-apps/openrc
-			kernel_linux? (
-				|| (
-					sys-apps/s6-rc
-					sys-apps/systemd
-					sys-process/runit
-				)
-			)
-		)
-	)"
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
index af4989fc1f3..44d4e84ddec 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/Manifest
@@ -1,63 +1,60 @@
-DIST NVIDIA-Linux-aarch64-535.247.01.run 269861217 BLAKE2B c72eb28472c6a5ee5344618b343efc3f8edac94a5d2c994b86d113f7258c0df228076462d3fb84791f8f1c666554d20116ebb6a7444b680128556a4b9e8b2b29 SHA512 a0bd487238d41fd907c7e87d8ce10b4e19a367c8faafafc914fe6d741b348619e7427a5ff22dd2a475e4dd5cf3148965934b746bcc34b3f572bc01e8a6429bda
 DIST NVIDIA-Linux-aarch64-535.261.03.run 269926298 BLAKE2B 78b696ed9ef01fdc4bec8b955c7f7acb7475f743c7483b5ab799d63f5917e12e97ea522865c1b4e2fa03586977ccefdc4518339c705ff9e8165ac9bd4af32e30 SHA512 3bc4a141fc159e88a3cda19519d325ddfc03fdcd328a50b5a0c6c9f06089ff2a97edb03dbfd1d23ec0e60a4fc549a8f0143e0c4d6beb98771ad8c243ef699faf
-DIST NVIDIA-Linux-aarch64-550.163.01.run 236409124 BLAKE2B 21c79346f6b739f44d7ed2d4955129613f51e1329ff15948ef50a9a06b82975ad890d6142e5dfb163e7b0da19bf5c26029cf507d120037f8a76abc177a286403 SHA512 0ef4ab4aae308ec0cfb5458cef34a1503ac1a85f0e1d0c9f061d8e28f939b15784e3862d96d83e93123d9eb56807a6804318ce230ee68917fb75e363011f8304
-DIST NVIDIA-Linux-aarch64-570.169.run 290106494 BLAKE2B b8b332c3b121063af061f1ab19f87db6c528da977847423f6d7f0b6c6d7d8bd118e6f0518fbd66c6c633647efb64a3a670cd5ecadffd41faf6271916446f2143 SHA512 551615d6ecc982acdbb52049c5afd11cd8ca69999d097f076884c3f632b3880f95c707ebadf66c3aabf5452aab52cd372894eff574382ed2d79444a65c368369
 DIST NVIDIA-Linux-aarch64-570.172.08.run 290144917 BLAKE2B 095a9362f8729f854e0a976d90456d2d061d1a21f3c110b94a4eef0264fda81078058d8e24a76eb7d13066feee8d17d9aee2de4f111debc361362d7a73d119b0 SHA512 291012513c2b9bff94a0892248207734b1d12a13ff994036045fd159f60bf410508fd66873d78388d0e289ded1b76f8d0980219c289fa2ba99303f2cf872e9d6
-DIST NVIDIA-Linux-aarch64-575.64.03.run 305150077 BLAKE2B 5b7a9e0ec90130f8009e9612102e87cc513fef04ffc34e47cc8eb3b787c4642d3445aef0a064005bb33972925a110d7f4716dccc71840e273010b519b019be55 SHA512 16f9fae89102ee1d9f587c8e85098e34e5cd84299766a97920ea4c23aae7e353837e4e69c4c067c27a85ce0d8f18df90c8cc368a100ddc846744d6bff09ad7da
+DIST NVIDIA-Linux-aarch64-570.181.run 292998832 BLAKE2B 259da795e0498b379b663fdff6b120a5bc1d7851b2f32803d87e8ee42e2c8e52158c7fd98aa0ecba2507512361d068e033305d383bcf0cb218dcec1dd9bd988c SHA512 ef49d7572eaca2c2bf2b8c5b53ca818499b9f622d4aa4d0601672173571fab6559bbbb9ffefbc2247f51ec33837d2a23e11bd9eca7279ba1402540ef6ad150ac
+DIST NVIDIA-Linux-aarch64-575.64.05.run 304943447 BLAKE2B 277aed01ab2be1cbbfe7780c4cb9dcbfaebc69824ba4b5a620113829f713d5407829769c7fab224f183656408944d9d6c4dcf6400a333c1116a89d072eb79223 SHA512 0b9b9c6b3316723fba4549fcd346215e5315a7b4c80196f0cd9ada9ecd6a23e8fc1691ae8bda5b246a3c44519cc7f503116023ff5427718fbffb67fe49a12a75
+DIST NVIDIA-Linux-aarch64-580.65.06.run 315886352 BLAKE2B 337c80f460a5ba215f52c201670ef9cc4de96100324e7c408136b57b81adfd0487cf380edd7e62ea22f34bffc4d2726ec5402379279ffc85f5873d270bc5538d SHA512 c4f2902412e9f47006e50c7f687e8f3cfc4580877c945b5da35c9e3a00f5e72eba8b0aaf250ff51d382fcf611177c9115f72f23b7858a520f0a7e1b27354d3e6
 DIST NVIDIA-Linux-x86-390.157.run 49417041 BLAKE2B 435b5e0e60468cc74b41cc5d9b5bb0105d29c11a2d408457835212a96519c9334ecf19278b36749d3ff7f498f5b0ae45a2efae2d428703dac21245c62f1efebe SHA512 dae9ac2c12f9ad90f7441e00e01a984147c577892421911d7f67f6a31e616ac1cb7d434bc9c7f58fbd9b8ae909521b5bece607a63c79588c0bb9d99c6bad5fb0
 DIST NVIDIA-Linux-x86_64-390.157.run 85835541 BLAKE2B 44b855cd11f3b2f231f9fb90492ae2e67a67ea3ea83c413e7c90956d38c9730a8bd0321281ae03c6afce633d102f5b499aed25622b9bfd31bdd2c98f0717e95b SHA512 4780503a4cff0180b1b1f37d20a6ba3438dd78b51fa7f69b98d35521835e5d61099129746929d51d63afa2d47b672b3e145e1e1897584dc3799e7f822c5b3a0a
 DIST NVIDIA-Linux-x86_64-470.256.02.run 272850014 BLAKE2B 0fdc867f92b82b2a60810c3b43751cad7ac2c39928c92c6c343c0c6044f4d7d923d93b8599db3f7c999c0ee7d16940e65d991a61cbb30e1d9e49c5639ac6bdc8 SHA512 a837946dd24d7945c1962a695f1f31965f3ceb6927f52cd08fd51b8db138b7a888bbeab69243f5c8468a7bd7ccd47f5dbdb48a1ca81264866c1ebb7d88628f88
-DIST NVIDIA-Linux-x86_64-535.247.01.run 341853459 BLAKE2B ef91097a36add821a623c8d1f19eca8ca9571fe4a08b8e25eb70f09923899bcb3bd2c0f408dd6ff045ffdccb192be3a46cec4fd7b7d8d7bc17449c436cc2cbde SHA512 f8e04e5f7cf8b7fdae9135cb5f0f2740d5eae0ef9a44a41dbf78996d3c2d4139bdbec99be14f73aa2d275d78658b4a91a274f20545e4325cef787548e3d073a6
 DIST NVIDIA-Linux-x86_64-535.261.03.run 341775057 BLAKE2B d72ed6d4d442c204721667302d300e8e8ec9b8288a0945ba090aa4e4666fb7fbd6bffe8a242c134e6ce8a7947954d7771ec142cf6b6cf1a32b773edf9119e71e SHA512 52ac6db0a057977652f56a279c6e5482fd602d1c637b22e7bb8ae5e5f5a9fbddb8492196371c2bdcacfbd9e7c1bf3954c22254e842f413cb6af1b3c79a6e7ec2
-DIST NVIDIA-Linux-x86_64-550.163.01.run 307143336 BLAKE2B 256106bcd3bace402289e60aca4cd3b447d0fd8ec3dabd50e2bb303c5e866f8da5c28f9b578d95775bf69158f100d68a91d20d9a91426285a8e799817f21db6b SHA512 676b1de35d21e80091528a49080c114e0870ea90b3f3721265ae8071abbc2183c851e6f11ba96a332c743fedfaf4ec9a014ad6ceed586fdbb03d94d33405e356
 DIST NVIDIA-Linux-x86_64-570.123.19.run 375997440 BLAKE2B bc96faaeeb3c52d3c54bc9c5b87d04503ca9d329ad6d4ddb0003d02b7f0ede81ad00ea812dcfe7158acfeb3b9e1714d363d19b7c89c25ec2d8fe239934ccd2d3 SHA512 f892a1fd621ee536a03a1114b69b2d512a4144651c3f146eeb22b70b6b4ad43feb7e5eaf0a8c023f889591c124778471a64ce6356320342b74b69eaef73fbe8e
-DIST NVIDIA-Linux-x86_64-570.169.run 375816796 BLAKE2B 1934cc5276433b6ee54b31358d85f88e3e81dd23732fa72848a6c60c455399b5217301e1c8aa1795dd8292bf4e604c6cbc144700775ec2661029b737ba2e3324 SHA512 79cf53770f11405ea416b4a3fe91edd34e8bc99e2f8e0d47dd2b01045b17f23998bfd3d60fc660c0826c69305ee928dec56fb251205e183ede9235e31d01d7d5
 DIST NVIDIA-Linux-x86_64-570.172.08.run 375905456 BLAKE2B 58418e039f378d78950345edac3c95fc9e4d5ed23419dfb7b256afdb918368ec15653744fcc4625c54cacdd7df00c0e57835ec4ffbf865384b27c623a351bd14 SHA512 8000f31575392ca8a575879f36b6e3e0fdee14e63efb856b77035e5aa434a02de0fd4ff5472d01984cbc541d40656ed6b7b77c78d00f6e1bc4341864bad725c5
-DIST NVIDIA-Linux-x86_64-575.64.03.run 387655074 BLAKE2B af4c42095bff2b195f46cb3472cde599e6b8cea7841110da75f7659c41cb83d8a4ee33b242aab44af606353456d9163bc9a73562be4693ac2d5a31621fb9af13 SHA512 ca705ad35dbb6e3e4872ec85dd78e70760e86b28d5d4b9bfe7b5d5ad0fca3bfdcf794e8708f3b1dfcea8edeabc208e820388af4a57dc9c6dcffb5d1761598779
-DIST NVIDIA-kernel-module-source-535.247.01.tar.xz 12517152 BLAKE2B b12497621ba32da4ca80ca6736d559bc98ba45974e06bbb63c08695c3b24c45752b3fd3dc2854ed64950e89e99b38d1006ce672096e35daced0ebe0a9dda77f6 SHA512 ed8e10d5245447fcdf348509ad62e9ac3d56a052d254b764e3a574a711cfa5c8831a759d425f42795c2db752f3d91d60b6097f6901c88654f242c94768faddb6
+DIST NVIDIA-Linux-x86_64-570.181.run 375778425 BLAKE2B e448f20117379c3428e1dd322e369e5d396c3471b0ed99b9c88492917e273f0f169d2f69bb380d2f7dec9244284e8612b2359f0f51efee51705fca5144f31bdf SHA512 5c6423554c634eb22c286689b28cec92262f36180bf264df83b0526df9923e4f9f9bc7b835a9082cbcfbf7b7a4621c0007b784bd79303bfd6c3fbb03dd3ce53e
+DIST NVIDIA-Linux-x86_64-575.64.05.run 386961985 BLAKE2B d8b5e5cdff3d2166c4fdf8328ae22bc4419509144ad0427b17636696e7398240a3601ded850893412198fc0d4ba76e72a64ed31d6ceaf58149d83a741ad62a05 SHA512 1f5ea98478c913b044cccb25934e12d58561643b83074e5967d84126baac9a5ddc092a6ea017956957abae174520718d747415d09c6fb2da110de51629df98a2
+DIST NVIDIA-Linux-x86_64-580.65.06.run 393832804 BLAKE2B 2e27d607f0a1fdf4112f4f9debbb3afa408ec5550fe6dee8737a3b319bda7e03ee7f67ede8b23823e01ce5006f7f41f772da1c9c439e8ae52cd24b0c390d0db2 SHA512 e9149873cc83c250f601be58ea919cbdc891773157587366d78f505ee1db96bf392bc5e689d39ce8fa339287699118897b8d6eba2b2a9caf163126a9bb2a6044
 DIST NVIDIA-kernel-module-source-535.261.03.tar.xz 12521372 BLAKE2B 214f52874a3cac43ad135e57577f8879b605d67d4cec1756ee2a5ee3986568ce621bae603637fdb9ff0be9295e262a1f14f9dee6d871737bce02ea163aff7505 SHA512 346b12fdcd1a7b5b8067e6cee6567f4ab2a89e8d246ebec4ad0eeb6dc91782c701b9b4d7ef4903c2492726fc8c242572a63a3cb8a06a9fb4a6039b65ce11b8ec
-DIST NVIDIA-kernel-module-source-550.163.01.tar.xz 13552400 BLAKE2B e1fd753127d10097c5f1d3c90d95c7eb0934c0d5e1df0a371aed2a0d7669960b67c46eed20eec3c42ca41c0f34bf6d7d3d2a77a94308c9f86d4f5d831da19363 SHA512 c9f4ce2890db3fdc66dd080da4d6802a8bc3b18feba96be5d33641b02cca637b1bcd2a3748f36f93a32f26ba57eb352156314f139688b0d3a102efdfde6c32ba
-DIST NVIDIA-kernel-module-source-570.169.tar.xz 17928016 BLAKE2B 4d68cbcbbb14f0b9741c09dedad5abf859f971676869d46e8a6749c04dfc39a6f24098aff9c55d8d33e1e5b1f67be16a99af702f29003354635019ff94ee683f SHA512 7d5a06e596235d90ba5b26a4b04b68623b501643ea8c6bcd7342add6563684486f32b6399335a853f03cb588dc57cdb1397e2705bce512a8be57d3b615b8eb22
 DIST NVIDIA-kernel-module-source-570.172.08.tar.xz 17948096 BLAKE2B 23220805e6555e556c99659d9e17f5ab822b0e221cdce2c2639377680fdda9267eea200f7ca579d28497c89fa2167d524497e4c53cdcfaa20a1b0d7eb3aa7522 SHA512 969158a46d70b23911f77d08832c6b307503988bf1cee0b2a0f75a49612d447c23ff1fefa3eac373b53b79475f87f3470de7df72a395fdb8cd57eefa51bc1ad8
-DIST NVIDIA-kernel-module-source-575.64.03.tar.xz 18219744 BLAKE2B 4207f768bdcd1c72a42a1030e5f8e38afb3f3e23ea368a19f0b01dbdaf66d552d4a2573cc4aba31f31f006f6c829e99ccbb3775bf629b41cc1ddf13632a4ea40 SHA512 2acd48d39e9aabc892ad0eb3d98bc9b723fd79a9b7f24b9f55b3e591e5d27445fe5ffc9d1bd8042e9741d56ca815c47065f36d88a3a008e635af2011eb07cf40
+DIST NVIDIA-kernel-module-source-570.181.tar.xz 17932976 BLAKE2B 56c77d3819388af54873bc6b8edcfcda97959996c1f3e61982a5143b5c84f3139af78a478d9f54dc96de719951c9e0b77294174b6aa6fc8af669de115cf72d4b SHA512 3180bb89eeb13ebd1a032bca545d7de4b800a61bb7e36f702f89b3c76f1612f4d13546f224574d343f72babd3e908f4922642bbdc26cf8baffd97b11e248b78c
+DIST NVIDIA-kernel-module-source-575.64.05.tar.xz 18198316 BLAKE2B 622781dfa93ab11993a4cabf14e2104ae7fffa0a16ca504a1257ab9eedd832128dfe73a0b9567a4401bbcf83416305794861cd18c393797ab8d43af0c26cbcc7 SHA512 4cbe2e2d78eab84a8a0153f68ab6b1fefa75225c145b3bd9db4fab9d0cb212a4202a89d0e6d0f2d0dedb5663389f7c9ed6cadb6a656eb32dbde0cf0f806652e2
+DIST NVIDIA-kernel-module-source-580.65.06.tar.xz 22167352 BLAKE2B a96dbadb18d3e4cbc4acced86c5fdcc4a57e1bb1088a70b9b22cb07d50e4c4501db6479dc4b2c8c6db390a99fe94b9087ab4f7955c67ab50c08966f7a1deb814 SHA512 c0e5c63529488eadaeb8added44aad8c0bd532c1aa9bfa1c3fa4e37251b225fb509ea7cef6526a5ae4b82c7f6d331ad7243d479c4cbac1510b333942a55171a2
 DIST nvidia-installer-390.157.tar.bz2 150323 BLAKE2B 8058ca87a6dea956d564af9f7eab9b1fc82b1f2382bd5cb2f6d97cbe2e19292533522d5f8f2eacbeb16520372715fcb72f8f9b0998962af5d4e75522c8d74524 SHA512 93a7ece648602157496c8e27a88864ede341a100f5328a4c1a25faf8f0b94d252060e5e2f71d0c302fd0566c10773c30b76b3b5f431d8039b71c90a7969f7d7e
 DIST nvidia-installer-470.256.02.tar.bz2 146269 BLAKE2B 4402e725c8fd0157eb84d4ec140a33f97e873014577487ef1e32fb8921cabe79c60ff46532e5bfaabb2b6ac894f7c80086dbab19e61906e2e27346fb85f98829 SHA512 c962dc17d9696256d1ebedcaeb3010994f2ce3895aedc47987599ebfec132a9b9a249d2ece6502b15bd4a93f9b0106aa13487a7da5f64199c274ce11eba27cfd
-DIST nvidia-installer-535.247.01.tar.bz2 148887 BLAKE2B 3455f064d3a5745971e8ca6574bfe16258544e669f05fa6e1f31cc88a7224f76cbf5d1ea26a62e70e908b7261c3264664e090209221a6e64030c6f486b9452b3 SHA512 be97915091e60c56b442dcec45f76380ab316e95b7417d99133419a7883e1cf547ac0c03d7e763574613dfe5bc27dbc6c887ed9870e528ae056b2400175044e4
 DIST nvidia-installer-535.261.03.tar.bz2 148694 BLAKE2B e113e3a548f5cb562b064f97f3f81dad952dbf8acc9158a79caf14d0868bbc673ed2b5038f51361243547792a044f8d7306c69f5ccaa36717fe6de0ae39a89d8 SHA512 4f899eec7ef869bf9b89732bc29a1198792a4b984d308908d3b17917d4824425640ac988bc04f0eb539ad4eace38e7462f204bdb9cc6a6ac583c2e8b6e06f8e5
-DIST nvidia-installer-550.163.01.tar.bz2 155861 BLAKE2B 662064b3ceb4aadebde419057d85c6b4e28b91944bd5bab241bcba9b3c9a105e507afc7651b17fff01e1cccb78d66fdc6789597ce059f882a6f322b08f28e832 SHA512 f8df7a0eccdecb7d4d4f47d96050cdbefff91289b29550b061358614845648451d4b161d9bdbfbf5a9a87ce650d272cb3b795e6d2ed4d0274844a56db097bd15
 DIST nvidia-installer-570.169.tar.bz2 169301 BLAKE2B 2676261d50cfe235d099475bcedcc96549d5140bf0c95b8f41b49d62eb0cd5fdf5c2ed53a59f79c778011b50e95ef440cc7a3a7a6673de7311e4508fa8f5960b SHA512 5864343b23a27cf994e414bb8a3b90e7b740df54188d43172456ea163162cea74e0b38a0b41717756818262d9f80b25cfc7566900bc682ea0546a825d52e3cfd
 DIST nvidia-installer-570.172.08.tar.bz2 169388 BLAKE2B 44d0650e1a7cef00a47b828dc60af5a76eddd6733cef4539ce0199136bcb490355d72a3bc52b6028333d270b950884997dbcbe7d50bceb7a52876f9394a03734 SHA512 e64913fd6c66ee4d33e3de047ff9d901dedee514501c12421688494c995e66d201e69bbf87877f1c8fabe0b2a1d47f0f5a6e7cf865a62b2557526c2030386cd5
-DIST nvidia-installer-575.64.03.tar.bz2 169433 BLAKE2B b7e5b7e064739eff7088f329446db56892f0b2d5c29895da097aced366e248ddc88ba3922b3e94bf12883a7551edee7c9229787d0748df202823f6399cb480a0 SHA512 e32cbb2bfd94769c6808218a939380afc9a2da98c528a195e838c11e807438a6adcdc757bcbdcf7859c54d72f60c69f96bc21008d4cd38b67ac274e193fb6b1f
+DIST nvidia-installer-570.181.tar.bz2 169408 BLAKE2B bc5d33bfd7b380e5612e264636b1efeec58479fe2de579a59136770cb766349bb91e6cf8d0a45e4f3e90bd76290b1c1f07f3bab1f6e11d0728c23a27eea2d85c SHA512 2e2a50933291ac40627c5b042473759e75c493e2634e2fefa6ad33d36f1393d2ad49732551048bf0c7a192b4b2cf1dde53842735924480d8bc3015e557fb1b17
+DIST nvidia-installer-575.64.05.tar.bz2 169369 BLAKE2B ccff48e41296d6682c72f3d25eb7d7816dc83b4c6f279a4f5213db141353772d78d8ff3e23f2fb21ff8ce81a326443d12c3f05792fe1971b1fb54da764140065 SHA512 5033e40762b499e9b04a080942656a0c9b49e8f56c4a8236da38a587f8e13b3935f75e8c8dbdffbd0ef895c537a69f51ce6df7e6beca7be583aab09ed62faf09
+DIST nvidia-installer-580.65.06.tar.bz2 169402 BLAKE2B 8787cd296fe691098aca20a798530b639f02f9a5dfd03209bcae4e549a269744754c6af3e47cb238c1752b339f736a73847ac71710f88cc12a3989b6e38c9f74 SHA512 76fda68916b650918df5d8118b642887cbe54dac8377dc597c3a1827ae8ea7532819527fed0aa7e786eb7bd40d4cc9dcf44d135135c83cdcb63683f04eef80c9
 DIST nvidia-modprobe-390.157.tar.bz2 35306 BLAKE2B 80d202b39c2f95ec0f909712c2e101483af50124092c32efb33bd98ff58ddfb97b737ff07f1ddc941f688c1b4c26a15f392566d522e18506771f10422fcd571c SHA512 109bbe24a3758b568ea65fe1e9d78f69fae6108ec0497b796c885a3912825fe04ffd7389a3e22987f1a10a2926bf6eaa384faabc59478aa3ee244dd3ac91c6d3
 DIST nvidia-modprobe-470.256.02.tar.bz2 38769 BLAKE2B 0db444b09b0b6d24c04877fae95249e781d82b3141f90eb05d869b64d2b6e65ad00bf44c4e427c64dbd4765fa99a8699f80a1d95b00c66137a54dc878d7ea298 SHA512 c1cbfa6c8e188e5a5eb5d390b9a903406cbff103d212fc30e611e4023be3fde896ad84e8bb45b030beb5d1bcd8155c9e55a8f9636c45ce1e2a5c03f672989a31
-DIST nvidia-modprobe-535.247.01.tar.bz2 40736 BLAKE2B 31172b50777fb0bcc7696af660fd4f8ddc42bb126ff42edcee12097fe37748727c6357ef46b65a96004345fdc501487f8b5ad89eccef991eeb3c83e958f41a09 SHA512 f28340f935804e3cb07d394ad103b296a5e4fbfadeef7905266b85afd7cd145de033d603a4bd7947348add23a866548605264c814b48f4f6a5a1f4254f82cdc1
 DIST nvidia-modprobe-535.261.03.tar.bz2 40757 BLAKE2B 96ecb65511ff1ca033768f1f86e10e553bf686ff42c7f995a43c0e111ad5ddf97bd7b6fe439e5fb207f9b765e2200807703489815dba76599adaa24e4fd1bebc SHA512 755ec96dcdad34472f884383d104aa015ac5b964cded12046316f4dbd033ca723d225026866b59d0637294ebc185706204f889403db37552dd7d716467aea37e
-DIST nvidia-modprobe-550.163.01.tar.bz2 41448 BLAKE2B 23e567d612e669ec6ae9f389651c9e1cebe7ba59ee95bb5961e5071952697860df77f02026040e29135338eb7cf96bba0015b3d94548297235fb5214f35bec48 SHA512 0f5b59468a6e5e95dcdef1d938ea78f4ce09a0c9784e3c70d83f1c3b1bd52e8055b6b332147316445c3be714abab3629320d6117878d50aa7a2d7d2d9b9b6485
 DIST nvidia-modprobe-570.169.tar.bz2 41618 BLAKE2B ce6967fea67a387ab177d75cf0bec4162127e7f440ffc971115b2307d68307fdbddcded8e932022088f1815d7208d4b7b8d1895125866d443750307c1353867a SHA512 e7f4d0ad9b29f13b2fccddd27570832d7a95925d82aac0ea0af8b8dcf80ba220c82352b0394eff2184b7f6da227df2462d5579ed75c1a952727820503f37ea7e
 DIST nvidia-modprobe-570.172.08.tar.bz2 41640 BLAKE2B 7055228ef51da259fc93bd2047b2ba89a4a4cf6a34dc0a3dfe3f2738aa64acc88ff2a3be6d9fa80428d6b6e389084955b2647da9fff91eac7caa751e1ac330c2 SHA512 f3e6f51adfc9eb528cc4ab2f99153f2355ae03bd0f4f49879f165564023603e7fc32598ea768f77f7f901175e03a49e97ceda25f434e6a05aa74e372560f3cde
-DIST nvidia-modprobe-575.64.03.tar.bz2 41690 BLAKE2B dc2811d4c4febba18e0e1dd6632c5f4c3b1e289a27aa2f3b44eaa1e8ef5fc2daf37f52046ac27da1126fd4732be1ad8fa47f11ecc0850a5ff22d606b64710650 SHA512 7b2f99ae0c796e5099b775bee3e7edee898ed504d7165a916ad8a9c289859482866800cf6954f04f5058eb60479c867936fc019b9d2bf6578375534a19482129
+DIST nvidia-modprobe-570.181.tar.bz2 41624 BLAKE2B 38dced2130273ca7f4509263a2a2c42136c504fe4c7d2e935a0d9631ca1cff8b93bbca25a48522d2ead8d11e144bc7b4ddc7df30850b4d722ba45b45c0c2ccee SHA512 a4bcd6f549a1b3b2fad0e984fb2e1de56c4f7ce007a0db851887857282cbbd58009988fe6d89f47334395417cf4408548999e8129f84bd240e92dffffeeb9c6a
+DIST nvidia-modprobe-575.64.05.tar.bz2 41721 BLAKE2B 9b8a6dda556389abe0c2bd81ed3edfa8142f773832b7d955385119b5fd525cbcfd3c01401f471ccf5dc7ce61100ba6a3c4504b8eaf86ea5b378d20a6046ff7ce SHA512 221a0469a974c7db3f3c489f2637b6eef68e614c5ccd3e94c8cbe1b8841a6e9a4f0e2f05642b6c9f7113efe3c211076ac31578e9587df26b76148a198d21cd49
+DIST nvidia-modprobe-580.65.06.tar.bz2 41680 BLAKE2B 20ef65477baf17c761b934176b3df4a8a0e67531c1710b693e1d0f0d2554fbd1560c07bbaba874ff953917ef8d0d053d447c6bf5ea8ce2eb3ccafab5d7203ef2 SHA512 a314a24402cdc49fd1932f7ec4f687aa29682d723bab185d770579f1a374dbebbdcbbda8c3bd33f53304b3c10e3402f1a58c16c00382ddc7a456ee64c9baf8a5
 DIST nvidia-persistenced-390.157.tar.bz2 48654 BLAKE2B 2cf6c92da90acff55e8c180a06b0c6a29d48be9fd8ca3c541202fd14f0697220fba6b66452942aa7ae7cc8821f5c5eb9fa8f7a31d2248624e5f9141d83a176b8 SHA512 70f0707ed6f2b877e69ef90cf782f66cbc9d2071db53ca09ceb7b89427b0fe176708517340621fa251539b7d481b238adeeb60261674eed74de1f62db6dbb72e
 DIST nvidia-persistenced-470.256.02.tar.bz2 46567 BLAKE2B 8f837322a3b88412fd2f6acf38721b49a6cb444fbd842d652519e5596f2e545d8f06bbdf017f46a22301ce87455f96147fab2829ca5fbf26131ec3e4a772e282 SHA512 4fd19258649b7d39945fb5c8578bf11ab118617dd14f3d11cdf15cb3fe77daf7b4719e4ae57af59031b1b809d02f4e8e8afed0ec60b9d0aed4d2488bd3013cd9
-DIST nvidia-persistenced-535.247.01.tar.bz2 48589 BLAKE2B 1b641fb85fb74e5314c0f525361cba23ac08d5f6570bcd9a6d89b376497bd0aa1cbbb52fe391a8f7bf41734e49d46d464440573b0298b5c0fd5db7fcf3100d58 SHA512 be23e7790d582a340e14c7df16f9ed09447ef8efb352d8b8e53e5be91b624953d8237c988ce0b0b0c90e1b15077af7efd6c6a0e628345f2188b6dbe09122373b
 DIST nvidia-persistenced-535.261.03.tar.bz2 48574 BLAKE2B 71e6be9fd37da2532219a025293a286d87efa31c7fb1d2827b859688f0ed433ffda848a8964980f08d61e74b888b81e694ef8622231642e46e800a346890eb9b SHA512 56d079434e18397516ecf7c398f242f5a3a48781f0ed8fcea30bf844c7bbf5b2618c5817f2df7032670a99cee4f93fe0e7798ef6bff7545e9824fb34919e38d5
-DIST nvidia-persistenced-550.163.01.tar.bz2 61450 BLAKE2B 1a11cb89981b88f8d14558227d9493f1f8a81ccb5502002c436e9311a38c9c8fe0402c65eac1517a2893985eec07699b2e7bc7a81aa14dc0d52198ac85a2cd1b SHA512 f17dbcafa917b5b450f7665f98fd24f06ad99e6bcd1fcf42ef95aa9337b55561b7b16eaad8fa408110d08ee7e6d812444792cccbb9c92865099891832da779ce
 DIST nvidia-persistenced-570.169.tar.bz2 61792 BLAKE2B 14568a42ee3473efe341bd9332081d2a1625f91662c58e75b1b218d5a3d19496071fcc5e9840fa1563aec2755c9d6810db531ed3616c825987311cf3690147f5 SHA512 c5e343be16719ba89f1a37ca8fdeb7f15a4fb028dbce554a7c524238ccb1ed1c1b0527a86a2e6dbdc01cd0b6f3a5d996a0895de4698a0ea98278cd93ef911d58
 DIST nvidia-persistenced-570.172.08.tar.bz2 61946 BLAKE2B e15575f73d94614912b5823b16bb64ac571ce5fe4e55bfb2d346ba9ebfdbb5c11562651518382638fe109bf7990bbcabd70d35916dfa0fd94dee317499d7487f SHA512 c43b18e01b46d99ebcd9b9760755984f96430d448f85421d2ad0ebad053aa7f6add6af2b03ebf76b5d5dea6e6958a6ee5baa30189e43ca1f2cc51e3487b41e27
-DIST nvidia-persistenced-575.64.03.tar.bz2 61943 BLAKE2B 745dc8114a0857d4ca0ebe928f4ebc82cf526c1b593717e0fa1148c3d62976e3c8b97b6a96ad9ca3abc10a7d0090fd8f8a9e135df498a4c2bb053db8faa273e2 SHA512 1872b34b4830984b5ea1b79dc328bcc2c013804fb8fbac549291750719a6493606e8d5580a857701fec12cd24e2319d1d1d6c124f2b129473bffa457f3a6ac9b
+DIST nvidia-persistenced-570.181.tar.bz2 61808 BLAKE2B 840e248505a199cc76bc091ae679196618eba3710a29eb7ea30249d22d12a91f62555be97ca3cae28ab0573d72b5e4b26d49c8202d0439d407260e4b98278d98 SHA512 6703b19d06f281bd4df01e64e8d1a17319f681a8826c32b1839363f5ebf53e64da625350f5bcf4887832f18a9f9127d1b749f2419650caa1ffbd68c85470f067
+DIST nvidia-persistenced-575.64.05.tar.bz2 61961 BLAKE2B fa40aea873a30e7c500c2abe85a0ed7e278e4e1cceb2be9fe370752b3e44bccfd94e15e42df2f10237bc02015545b5b31ecdfbfd84b4f0400d56484a69ed96b8 SHA512 77a6fe5665bee6225433e383fe3016a667241e0772223d978ad42df40c8bc77207185c47961859ca9d334bebc7422d1a825ddf58e77d4caa630fcee1ecc5fa54
+DIST nvidia-persistenced-580.65.06.tar.bz2 62200 BLAKE2B 729523f9b5c469949446d0852fef66d404b46251d51680adea9791d24ffc4484d8a8e46256c7dde7fb3c9cb2ab7ba078dec14245778952848562a544944040c9 SHA512 b0f8e329328eb80fd600c711f8f16f1d35dd3deeb1ca6c740b02c79aade0e5d0e4bfa98892a67d1306637b9998aa3ac423e479a5505b6b51d1270ee9b06f528f
 DIST nvidia-settings-390.157.tar.bz2 1108938 BLAKE2B d9ec1ab5d7f157d74627272adf752a671dd17e2ede02069437b6180b927fe315b15cc6416d584ab2f038b76fe01e5b64514a834f24d88ac16676e55205fdecdd SHA512 b16699009bf56a1ff3b623a528c58061c4f5a2c5c4a373756a07bcd667743a1df7c733a572d2d0baa835a904ac2fda8a5c85890dcc00c3a0f223e0467aea902d
 DIST nvidia-settings-470.256.02.tar.bz2 1062273 BLAKE2B 8e66201e7861469b12932595ef8f9fd29d4cfd570c2576ae7fbb7383f61c55ac71fe721cc431e79d6d69f86d998b5b4c3cafe531b573f439e6b499b0fc047a19 SHA512 626e66118ae2e62eacfdf44e37529c409b945a6f33637b9690d74abd87a2afb581aaca5f90328d280da99ceb659959d0e5dc5c22ef8013b2205b2b1c72e08007
-DIST nvidia-settings-535.247.01.tar.bz2 1094617 BLAKE2B 26a12ea76be9ab930553fcdd0f19db1de8e8fd41a5f180a09f418bdbec38aab6f05c019a85249de3fe523df4aba6ffd339ccce4758e739fe092ecaaf25fb5008 SHA512 9651cc907fa78139f4774764132f5a46c1feee016aae021905a463100f102e6321b79c2c4f5b1fe149cde481a5baac17017770244ad35c6d7f14e7975f23a7c9
 DIST nvidia-settings-535.261.03.tar.bz2 1094587 BLAKE2B 3be599e733be97e0a23182d9bfc2862a2ff1d386a8339a34f369ac3e7a29b951ef7c900424502b31d8a50b8a5571c440ba6fd1314874a5ca594657742ef0aca1 SHA512 418f078caed68e9d1feef10a3a772fb9a265fac5a74822e2637c0b8bdbdc43629a8ced83549ee1c237b327490783d7da59e749f3c284a17edea2bbab62462f68
-DIST nvidia-settings-550.163.01.tar.bz2 1099317 BLAKE2B 25419c1796deeea238b3e44fd8d648a8627272565be40cb0745132cef1c16e0c422242a1e6369745d577e674a68bf9dfc3c009e281a84ba58db5429d97ac9cff SHA512 5306ab05f284ba06852d7c96ff62ded7b8b615d3a002009cd5d781fdad716db37f53d1c8a43337ada60d524b4f7d183d98ad2673f40a5ca1ca4c5112bb913e74
 DIST nvidia-settings-570.169.tar.bz2 1123877 BLAKE2B df4309c9230352b88467537e9de9372e3e422a1b346c01ca807191aa322638ead912ffd80eeef8e404231f9d28ec9e45fddb1fe1a94777f6ca122e378c0c5b7b SHA512 34c25843c55e80efc987f344b3226e2715ccbf60e9d9f75f665c1a4199d69bef005f5c27d04f5d1cdf4fee38e4d44857d32f2dd97f84764e054d0050881a6377
 DIST nvidia-settings-570.172.08.tar.bz2 1124326 BLAKE2B 7f47c998b914d15af1612134ffd09ba2c01b649b23813c4170c3b3d529ace5e04322f201b5a80277439cb4ed20a84803eb225539d9c06b7cbe035ed886d3ab64 SHA512 2697ccce69c005550dda5c01a5da975d0dcfe67a32b7872b7c215392397a471152dfdd858920842388800c2f34f4d284735bf9ba34fcae1fd0ca426f10568f77
-DIST nvidia-settings-575.64.03.tar.bz2 1127787 BLAKE2B fc1d1748054261a6a9a86bfdad07955ddea9de1cabdf4a56fa714c2782a018215fd3a12690aaec16a50a7fabc5c3e24d2cb7f18eed2c41f7c9308fbb2cfd0ccf SHA512 fddfe256939f279e86f5ab8cbcee599b052d712be94b724003199c11a8d702742e03a0d9e473a6ae7671e8f56f10e2e86e7f216022dc45558412ae4d045aaeb0
+DIST nvidia-settings-570.181.tar.bz2 1124398 BLAKE2B 9f1df84900e763af0e88f0c2c475d0f9a96f7ef974e3fd2dfe702ee3cd9636fd7f6986e9779b3c083e9b979e8cca133b14bf5481ad1d3c16365ecc0c0f0000f6 SHA512 fcca18c216f6d8de1167f82cb0f170ef845f0a85d279a3e851cf5819c3afb4b18ae8f864a89009709d925ccb7a756e02307b67bf8aedd5cddd45de3f5b399be7
+DIST nvidia-settings-575.64.05.tar.bz2 1127714 BLAKE2B 935649b61361ff9b05f34ba9770704eb945134199edbb17d2581f74188f8b122009b6d4309b225c375fcb80f26fb6a82c9528bf22e5658c5856d1752bee309bb SHA512 3e3df016f1f6b34a802d872c67a9f1c0db6d38c8265343eb607c71c59bf5597c7378800641b1152af404ebc0515f8f79eff1ee0e81b87b84ff7a237c176526f6
+DIST nvidia-settings-580.65.06.tar.bz2 1130649 BLAKE2B b61ba9175db6bf25db878c40f5c2d41fa05f2422b6d93bbfa413e4e8a3edc2fd245fbd8431bbd9c573bd023dff7a2fac0bd1408ce50465aaf0d1c956cd5dbe46 SHA512 f32b2d667c7273fe4557da128e0bb26c4658f279f770e243c85081d572bb716a9809c3ad5fc9253f269619aa3b9cbf20afadbec290c02dd9bf621d25b23e662f
 DIST nvidia-xconfig-390.157.tar.bz2 107399 BLAKE2B 0cbb3b1ba508ddc3ba4a161c290b31bf7a67f67880bdbd01171a962c5fa97ca945b1ef17932403f8589309380743f1da632c728d8accb6d4e56dbd895e7486bb SHA512 50b390811c9bf091b14add41f886925b17496b41006b7d3981d2398caa65cf5db8a579c8cebed78278384bf3acc629befb07b54339c61abcc75852c0dcb8b8ca
 DIST nvidia-xconfig-470.256.02.tar.bz2 108698 BLAKE2B e468574e4bc57e7279d4120e2b08a201671b50d408be0c530eabe5da7d45daaf21cbf5c7fa31410d0d732fe8ea1551cbfb21d1ae193c1b3f5b5c50c764c9e236 SHA512 9dcec1e0c2b56b4d38a5f2c76086302f8bc0860cc15012cce29c3a5062f801a48b6a2bb78344361b07a2717b58502783441a2daf402d9973a17526175b1f15ca
-DIST nvidia-xconfig-535.247.01.tar.bz2 110621 BLAKE2B 3d567d30e19dfc449e23c80e6fe25536f02e2450bb82c4cdc2b508493cad6d6b4f58467d302fd64a8b37e8a129be4c04b365ec3e4e9f18966d25cd23c6adc91c SHA512 2748aa9997e84e0f39b52bc6f49e2b53ffa7181aaf0ce5b9d06d8e6e010ecd589ee77388807d922c3be4a847b8a4e9e1eeba42c905a32ebb5d3f9b93d6f30511
 DIST nvidia-xconfig-535.261.03.tar.bz2 110637 BLAKE2B aafefde5e5079401951432072f27f6500bf3a4390e01b83e46b7230c75b05cd5806fffbde98f8bd8a39afe1a27bec0f52e13920fa1fd156d083b6ef81e482edb SHA512 4c0ee56495dedb08d6ea0e452cadf02ebcfffb86e8649c9b7904285d5dd8959879a1e00396d1560253c755c9490643458e737afcc0613c0c36dcd37411c76607
-DIST nvidia-xconfig-550.163.01.tar.bz2 111149 BLAKE2B d19ef0427e3432798e674dc66447090e8fb8fcb549ebe27aaee19aa38294cf178e175a067b2da5313342c93ea2aebef35861d05cc4cc0ee2c3eae955b3ddbbb3 SHA512 35f95d85928c82bc5de8e462ca5e90a6d8fe03e5b5367b9cdaadddc1e956f0d26b6dc42e716ae7c88512afdfb98cc841fe9b22846f6d6acc578c5dba4d0a16e1
 DIST nvidia-xconfig-570.169.tar.bz2 111343 BLAKE2B ff9c00145277241a5acb290fddfa01a906ba26601c45f12d06ea8754be9d29c836f68640db411de6e904d608523bd9d10b644bf1976ef201c58d55db2fc16a47 SHA512 5db772f2cecb3436a42b0f5cad550afae3453d3b17897f457e8f6b48a9c2a71997a317b121837f68e7f23d9a3e141464485144ce362f33adf3d70b326205bbb8
 DIST nvidia-xconfig-570.172.08.tar.bz2 111153 BLAKE2B ac099f751dbd81c062667eb6fdd9b4007e38ee109fe1da125463e599f6c1e46eb45029a9499f0007c058601e620184affb5ede9f288532cb8d2d8fe52d90349d SHA512 4b2aa9f425380108cd534b68fc2b77ff43498fd18003f644a33f789aa4b9e898f4a02c7a0938e6862bebbb8bc0c1e450345f038a3e77ccbbc5c93814571fdcfa
-DIST nvidia-xconfig-575.64.03.tar.bz2 111258 BLAKE2B 9375391caf27760915417bb9beab02061def4b58a1e4bbd72ca95877931f9431258838f3db56000ddfa7684b3d3ac6d935d3aab790526d670d5ff0ddce7c0461 SHA512 9cc6a87f3ae9cc5dc3a07750c1f4d50b339a4eacee1ab320b47a339d191e0a150536563adaff265f5611a927fc4efc1f5009f22597489cf8521812c55ffc334f
+DIST nvidia-xconfig-570.181.tar.bz2 111274 BLAKE2B 864181bae415b0da164b7d229b25fe0fe963f2e0b89fb0f92c3d799823d6a961b55458e2c6ce80ee3a991b3af387286a0e3d25afb5a90fe1dce8abca77ee2c9c SHA512 44d1a17187f88570382073901b7e64332156cd99a916b5ab483850df496fcfb4f9980bc323df65f73cbe65c32ff70995d00865155ef05b28cba24378fc49accb
+DIST nvidia-xconfig-575.64.05.tar.bz2 111165 BLAKE2B 87b272e12b63e6d4a393b76e4ec4c47d1433caee1e73ab50c3da8b1b3cb4ece0d0adad3e6496df4a81c0efd8aff67f8afa5de192df24cbe4ae7f8a4b86d674ac SHA512 00dfe0cbf0fb1131391a38b2d1bd95e52ac90b77cf19b76cb6cd6d0a3ef83c5020ff5dd8e08f8d424a7b32338e7752675e1f700392df7efd2d9b96bbc8072541
+DIST nvidia-xconfig-580.65.06.tar.bz2 111555 BLAKE2B 0939b3e50a6c64ef8f436f7fa96aea1320a8b74b507feb18f0ec1062b07fe476ce46f121d985d03c10893a61e4f22caca218c69047b99f3a451b98bacd95439c SHA512 7a29708c548e8ad43d74550c579e603fa5936c1439a46afe97ab08d810a4d0d91527f26e55e03104bb351e765e3c2ee2905858e0b99d4b43d514c15992cb7d6a
 DIST open-gpu-kernel-modules-570.123.19.tar.gz 18685718 BLAKE2B 67503cefeb07be00ef16eb2d3ffb1287dc1f460f1ad908526046795cdaf2662fef01affcd23a957e97610560d8380d42c0a24d916a4cfd09d77d5b7f1ebfe7da SHA512 88bb3db9f8d38b03a92f60a56ff31b1c27695151fd6cd892d562fc9e31adc8303d54e35bfca59d368ca8d0fdb847674d3b4a240aabed476d6e89c8dcdbbf2d2c
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf
deleted file mode 100644
index 5f7f384c271..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf
+++ /dev/null
@@ -1,39 +0,0 @@
-# NVIDIA drivers options
-# See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
-
-# nvidia-drivers and nouveau / nova cannot be used at same time.
-# Comment out the following lines if you wish to allow either.
-blacklist nouveau
-blacklist nova_core
-
-# Kernel Mode Setting (notably needed for fbdev and wayland).
-# Enabling may possibly cause issues with SLI and Reverse PRIME.
-#options nvidia-drm modeset=1
-
-# Enable experimental framebuffer console support (requires modeset=1 above).
-# Replaces efifb, simpledrm, or similar once loaded (emphasis on being
-# experimental, "may" cause issues X mode switching, sleep, or more).
-#options nvidia-drm fbdev=1
-
-# Suspend options. Note that Allocations=1 requires suspend hooks currently
-# only used when either systemd or elogind is used to suspend. If using
-# neither or have issues, try Allocations=0 (revert if it does not help
-# as =0 is not recommended).
-options nvidia \
-	NVreg_PreserveVideoMemoryAllocations=1 \
-	NVreg_TemporaryFilePath=/var/tmp
-
-# !!! Security Warning !!!
-# Do not change the DeviceFile options unless you know what you are doing.
-# Only add trusted users to the 'video' group, these users may be able to
-# crash, compromise, or irreparably damage the machine.
-options nvidia \
-	NVreg_DeviceFileGID=@VIDEOGID@ \
-	NVreg_DeviceFileMode=432 \
-	NVreg_DeviceFileUID=0 \
-	NVreg_ModifyDeviceFiles=1
-
-# Should be no need to touch anything below.
-alias char-major-195 nvidia
-alias /dev/nvidiactl char-major-195
-remove nvidia modprobe -r --ignore-remove nvidia-drm nvidia-modeset nvidia-uvm nvidia
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild
deleted file mode 100644
index 814d02552b2..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.247.01-r1.ebuild
+++ /dev/null
@@ -1,575 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-MODULES_OPTIONAL_IUSE=+modules
-inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
-inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
-
-MODULES_KERNEL_MAX=6.14
-NV_URI="https://download.nvidia.com/XFree86/"
-
-DESCRIPTION="NVIDIA Accelerated Graphics Driver"
-HOMEPAGE="https://www.nvidia.com/"
-SRC_URI="
-	amd64? ( ${NV_URI}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
-	arm64? ( ${NV_URI}Linux-aarch64/${PV}/NVIDIA-Linux-aarch64-${PV}.run )
-	$(printf "${NV_URI}%s/%s-${PV}.tar.bz2 " \
-		nvidia-{installer,modprobe,persistenced,settings,xconfig}{,})
-	${NV_URI}NVIDIA-kernel-module-source/NVIDIA-kernel-module-source-${PV}.tar.xz
-"
-# nvidia-installer is unused but here for GPL-2's "distribute sources"
-S=${WORKDIR}
-
-LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
-SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
-IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
-REQUIRED_USE="kernel-open? ( modules )"
-
-COMMON_DEPEND="
-	acct-group/video
-	X? ( x11-libs/libpciaccess )
-	persistenced? (
-		acct-user/nvpd
-		net-libs/libtirpc:=
-	)
-	tools? (
-		>=app-accessibility/at-spi2-core-2.46:2
-		dev-libs/glib:2
-		dev-libs/jansson:=
-		media-libs/harfbuzz:=
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3[X]
-		x11-libs/libX11
-		x11-libs/libXext
-		x11-libs/libXxf86vm
-		x11-libs/pango
-	)
-"
-RDEPEND="
-	${COMMON_DEPEND}
-	dev-libs/openssl:0/3
-	sys-libs/glibc
-	X? (
-		media-libs/libglvnd[X,abi_x86_32(-)?]
-		x11-libs/libX11[abi_x86_32(-)?]
-		x11-libs/libXext[abi_x86_32(-)?]
-	)
-	powerd? ( sys-apps/dbus[abi_x86_32(-)?] )
-	wayland? (
-		gui-libs/egl-gbm
-		>=gui-libs/egl-wayland-1.1.10
-		media-libs/libglvnd
-	)
-"
-DEPEND="
-	${COMMON_DEPEND}
-	static-libs? (
-		x11-base/xorg-proto
-		x11-libs/libX11
-		x11-libs/libXext
-	)
-	tools? (
-		media-libs/libglvnd
-		sys-apps/dbus
-		x11-base/xorg-proto
-		x11-libs/libXrandr
-		x11-libs/libXv
-		x11-libs/libvdpau
-	)
-"
-BDEPEND="
-	sys-devel/m4
-	virtual/pkgconfig
-"
-
-# there is some non-prebuilt exceptions but rather not maintain a list
-QA_PREBUILT="lib/firmware/* usr/bin/* usr/lib*"
-
-PATCHES=(
-	"${FILESDIR}"/nvidia-kernel-module-source-515.86.01-raw-ldflags.patch
-	"${FILESDIR}"/nvidia-modprobe-390.141-uvm-perms.patch
-	"${FILESDIR}"/nvidia-settings-390.144-raw-ldflags.patch
-	"${FILESDIR}"/nvidia-settings-530.30.02-desktop.patch
-)
-
-pkg_setup() {
-	use modules && [[ ${MERGE_TYPE} != binary ]] || return
-
-	local CONFIG_CHECK="
-		PROC_FS
-		~DRM_KMS_HELPER
-		~SYSVIPC
-		~!LOCKDEP
-		~!PREEMPT_RT
-		~!SLUB_DEBUG_ON
-		!DEBUG_MUTEXES
-		$(usev powerd '~CPU_FREQ')
-	"
-
-	local ERROR_DRM_KMS_HELPER="CONFIG_DRM_KMS_HELPER: is not set but needed for Xorg auto-detection
-	of drivers (no custom config), and for wayland / nvidia-drm.modeset=1.
-	Cannot be directly selected in the kernel's menuconfig, and may need
-	selection of a DRM device even if unused, e.g. CONFIG_DRM_AMDGPU=m or
-	DRM_I915=y, DRM_NOUVEAU=m also acceptable if a module and not built-in."
-
-	local ERROR_X86_KERNEL_IBT="CONFIG_X86_KERNEL_IBT: is set and, if the CPU supports the feature,
-	this *could* lead to modules load failure with ENDBR errors, or to
-	broken CUDA/NVENC. Please ignore if not having issues, but otherwise
-	try to unset or pass ibt=off to the kernel's command line." #911142
-	use kernel-open || CONFIG_CHECK+=" ~!X86_KERNEL_IBT"
-
-	use amd64 && kernel_is -ge 5 8 && CONFIG_CHECK+=" X86_PAT" #817764
-
-	use kernel-open && CONFIG_CHECK+=" MMU_NOTIFIER" #843827
-	local ERROR_MMU_NOTIFIER="CONFIG_MMU_NOTIFIER: is not set but needed to build with USE=kernel-open.
-	Cannot be directly selected in the kernel's menuconfig, and may need
-	selection of another option that requires it such as CONFIG_KVM."
-
-	local ERROR_PREEMPT_RT="CONFIG_PREEMPT_RT: is set but is unsupported by NVIDIA upstream and
-	will fail to build unless the env var IGNORE_PREEMPT_RT_PRESENCE=1 is
-	set. Please do not report issues if run into e.g. kernel panics while
-	ignoring this."
-
-	linux-mod-r1_pkg_setup
-}
-
-src_prepare() {
-	# make patches usable across versions
-	rm nvidia-modprobe && mv nvidia-modprobe{-${PV},} || die
-	rm nvidia-persistenced && mv nvidia-persistenced{-${PV},} || die
-	rm nvidia-settings && mv nvidia-settings{-${PV},} || die
-	rm nvidia-xconfig && mv nvidia-xconfig{-${PV},} || die
-	mv NVIDIA-kernel-module-source-${PV} kernel-module-source || die
-
-	default
-
-	# prevent detection of incomplete kernel DRM support (bug #603818)
-	sed 's/defined(CONFIG_DRM/defined(CONFIG_DRM_KMS_HELPER/g' \
-		-i kernel{,-module-source/kernel-open}/conftest.sh || die
-
-	sed 's/__USER__/nvpd/' \
-		nvidia-persistenced/init/systemd/nvidia-persistenced.service.template \
-		> "${T}"/nvidia-persistenced.service || die
-
-	# use alternative vulkan icd option if USE=-X (bug #909181)
-	use X || sed -i 's/"libGLX/"libEGL/' nvidia_{layers,icd}.json || die
-
-	# enable nvidia-drm.modeset=1 by default with USE=wayland
-	cp "${FILESDIR}"/nvidia-470.conf "${T}"/nvidia.conf || die
-	use !wayland || sed -i '/^#.*modeset=1$/s/^#//' "${T}"/nvidia.conf || die
-
-	# makefile attempts to install wayland library even if not built
-	use wayland || sed -i 's/ WAYLAND_LIB_install$//' \
-		nvidia-settings/src/Makefile || die
-
-	# temporary option, nvidia will remove in the future
-	use !kernel-open ||
-		sed -i '/blacklist/a\
-\
-# Enable using kernel-open with workstation GPUs (experimental)\
-options nvidia NVreg_OpenRmEnableUnsupportedGpus=1' "${T}"/nvidia.conf || die
-}
-
-src_compile() {
-	tc-export AR CC CXX LD OBJCOPY OBJDUMP PKG_CONFIG
-	local -x RAW_LDFLAGS="$(get_abi_LDFLAGS) $(raw-ldflags)" # raw-ldflags.patch
-
-	# extra flags for the libXNVCtrl.a static library
-	local xnvflags=-fPIC #840389
-	tc-is-lto && xnvflags+=" $(test-flags-CC -ffat-lto-objects)"
-
-	NV_ARGS=(
-		PREFIX="${EPREFIX}"/usr
-		HOST_CC="$(tc-getBUILD_CC)"
-		HOST_LD="$(tc-getBUILD_LD)"
-		BUILD_GTK2LIB=
-		NV_USE_BUNDLED_LIBJANSSON=0
-		NV_VERBOSE=1 DO_STRIP= MANPAGE_GZIP= OUTPUTDIR=out
-		WAYLAND_AVAILABLE=$(usex wayland 1 0)
-		XNVCTRL_CFLAGS="${xnvflags}"
-	)
-
-	if use modules; then
-		local o_cflags=${CFLAGS} o_cxxflags=${CXXFLAGS} o_ldflags=${LDFLAGS}
-
-		# conftest.sh is broken with c23 due to func() changing meaning,
-		# and then fails later due to ealier misdetections
-		# TODO: try without now and then + drop modargs' CC= (bug #944092)
-		KERNEL_CC+=" -std=gnu17"
-
-		local modlistargs=video:kernel
-		if use kernel-open; then
-			modlistargs+=-module-source:kernel-module-source/kernel-open
-
-			# environment flags are normally unused for modules, but nvidia
-			# uses it for building the "blob" and it is a bit fragile
-			filter-flags -fno-plt #912949
-			filter-lto
-			CC=${KERNEL_CC} CXX=${KERNEL_CXX} strip-unsupported-flags
-		fi
-
-		local modlist=( nvidia{,-drm,-modeset,-peermem,-uvm}=${modlistargs} )
-		local modargs=(
-			CC="${KERNEL_CC}" # needed for above gnu17 workaround
-			IGNORE_CC_MISMATCH=yes NV_VERBOSE=1
-			SYSOUT="${KV_OUT_DIR}" SYSSRC="${KV_DIR}"
-
-			# kernel takes "x86" and "x86_64" as meaning the same, but nvidia
-			# makes the distinction (since 550.135) and is not happy with "x86"
-			# TODO?: it should be ok/better for tc-arch-kernel to do x86_64
-			$(usev amd64 ARCH=x86_64)
-		)
-
-		# temporary workaround for bug #914468
-		addpredict "${KV_OUT_DIR}"
-
-		linux-mod-r1_src_compile
-		CFLAGS=${o_cflags} CXXFLAGS=${o_cxxflags} LDFLAGS=${o_ldflags}
-	fi
-
-	emake "${NV_ARGS[@]}" -C nvidia-modprobe
-	use persistenced && emake "${NV_ARGS[@]}" -C nvidia-persistenced
-	use X && emake "${NV_ARGS[@]}" -C nvidia-xconfig
-
-	if use tools; then
-		# avoid noisy *very* noisy logs with deprecation warnings
-		CFLAGS="-Wno-deprecated-declarations ${CFLAGS}" \
-			emake "${NV_ARGS[@]}" -C nvidia-settings
-	elif use static-libs; then
-		# pretend GTK+3 is available, not actually used (bug #880879)
-		emake "${NV_ARGS[@]}" BUILD_GTK3LIB=1 \
-			-C nvidia-settings/src out/libXNVCtrl.a
-	fi
-}
-
-src_install() {
-	local libdir=$(get_libdir) libdir32=$(ABI=x86 get_libdir)
-
-	NV_ARGS+=( DESTDIR="${D}" LIBDIR="${ED}"/usr/${libdir} )
-
-	local -A paths=(
-		[APPLICATION_PROFILE]=/usr/share/nvidia
-		[CUDA_ICD]=/etc/OpenCL/vendors
-		[EGL_EXTERNAL_PLATFORM_JSON]=/usr/share/egl/egl_external_platform.d
-		[FIRMWARE]=/lib/firmware/nvidia/${PV}
-		[GBM_BACKEND_LIB_SYMLINK]=/usr/${libdir}/gbm
-		[GLVND_EGL_ICD_JSON]=/usr/share/glvnd/egl_vendor.d
-		[OPENGL_DATA]=/usr/share/nvidia
-		[VULKAN_ICD_JSON]=/usr/share/vulkan
-		[WINE_LIB]=/usr/${libdir}/nvidia/wine
-		[XORG_OUTPUTCLASS_CONFIG]=/usr/share/X11/xorg.conf.d
-
-		[GLX_MODULE_SHARED_LIB]=/usr/${libdir}/xorg/modules/extensions
-		[GLX_MODULE_SYMLINK]=/usr/${libdir}/xorg/modules
-		[XMODULE_SHARED_LIB]=/usr/${libdir}/xorg/modules
-	)
-
-	local skip_files=(
-		$(usev !X "libGLX_nvidia libglxserver_nvidia")
-		$(usev !wayland libnvidia-vulkan-producer)
-		libGLX_indirect # non-glvnd unused fallback
-		libnvidia-{gtk,wayland-client} nvidia-{settings,xconfig} # from source
-		libnvidia-egl-gbm 15_nvidia_gbm # gui-libs/egl-gbm
-		libnvidia-egl-wayland 10_nvidia_wayland # gui-libs/egl-wayland
-		libnvidia-pkcs11.so # using the openssl3 version instead
-	)
-	local skip_modules=(
-		$(usev !X "nvfbc vdpau xdriver")
-		$(usev !modules gsp)
-		$(usev !powerd powerd)
-		installer nvpd # handled separately / built from source
-	)
-	local skip_types=(
-		GLVND_LIB GLVND_SYMLINK EGL_CLIENT.\* GLX_CLIENT.\* # media-libs/libglvnd
-		OPENCL_WRAPPER.\* # virtual/opencl
-		DOCUMENTATION DOT_DESKTOP .\*_SRC DKMS_CONF SYSTEMD_UNIT # handled separately / unused
-	)
-
-	local DOCS=(
-		README.txt NVIDIA_Changelog supported-gpus/supported-gpus.json
-		nvidia-settings/doc/{FRAMELOCK,NV-CONTROL-API}.txt
-	)
-	local HTML_DOCS=( html/. )
-	einstalldocs
-
-	local DISABLE_AUTOFORMATTING=yes
-	local DOC_CONTENTS="\
-Trusted users should be in the 'video' group to use NVIDIA devices.
-You can add yourself by using: gpasswd -a my-user video\
-$(usev modules "
-
-Like all out-of-tree kernel modules, it is necessary to rebuild
-${PN} after upgrading or rebuilding the Linux kernel
-by for example running \`emerge @module-rebuild\`. Alternatively,
-if using a distribution kernel (sys-kernel/gentoo-kernel{,-bin}),
-this can be automated by setting USE=dist-kernel globally.
-
-Loaded kernel modules also must not mismatch with the installed
-${PN} version (excluding -r revision), meaning should
-ensure \`eselect kernel list\` points to the kernel that will be
-booted before building and preferably reboot after upgrading
-${PN} (the ebuild will emit a warning if mismatching).
-
-See '${EPREFIX}/etc/modprobe.d/nvidia.conf' for modules options.")\
-$(use amd64 && usev !abi_x86_32 "
-
-Note that without USE=abi_x86_32 on ${PN}, 32bit applications
-(typically using wine / steam) will not be able to use GPU acceleration.")
-
-For additional information or for troubleshooting issues, please see
-https://wiki.gentoo.org/wiki/NVIDIA/nvidia-drivers and NVIDIA's own
-documentation that is installed alongside this README."
-	readme.gentoo_create_doc
-
-	if use modules; then
-		linux-mod-r1_src_install
-
-		insinto /etc/modprobe.d
-		doins "${T}"/nvidia.conf
-
-		# used for gpu verification with binpkgs (not kept, see pkg_preinst)
-		insinto /usr/share/nvidia
-		doins supported-gpus/supported-gpus.json
-	fi
-
-	emake "${NV_ARGS[@]}" -C nvidia-modprobe install
-	fowners :video /usr/bin/nvidia-modprobe #505092
-	fperms 4710 /usr/bin/nvidia-modprobe
-
-	if use persistenced; then
-		emake "${NV_ARGS[@]}" -C nvidia-persistenced install
-		newconfd "${FILESDIR}"/nvidia-persistenced.confd nvidia-persistenced
-		newinitd "${FILESDIR}"/nvidia-persistenced.initd nvidia-persistenced
-		systemd_dounit "${T}"/nvidia-persistenced.service
-	fi
-
-	if use tools; then
-		emake "${NV_ARGS[@]}" -C nvidia-settings install
-
-		doicon nvidia-settings/doc/nvidia-settings.png
-		domenu nvidia-settings/doc/nvidia-settings.desktop
-
-		exeinto /etc/X11/xinit/xinitrc.d
-		newexe "${FILESDIR}"/95-nvidia-settings-r1 95-nvidia-settings
-	fi
-
-	if use static-libs; then
-		dolib.a nvidia-settings/src/out/libXNVCtrl.a
-		strip-lto-bytecode
-
-		insinto /usr/include/NVCtrl
-		doins nvidia-settings/src/libXNVCtrl/NVCtrl{Lib,}.h
-	fi
-
-	use X && emake "${NV_ARGS[@]}" -C nvidia-xconfig install
-
-	# mimic nvidia-installer by reading .manifest to install files
-	# 0:file 1:perms 2:type 3+:subtype/arguments -:module
-	local m into
-	while IFS=' ' read -ra m; do
-		! [[ ${#m[@]} -ge 2 && ${m[-1]} =~ MODULE: ]] ||
-			[[ " ${m[0]##*/}" =~ ^(\ ${skip_files[*]/%/.*|\\} )$ ]] ||
-			[[ " ${m[2]}" =~ ^(\ ${skip_types[*]/%/|\\} )$ ]] ||
-			has ${m[-1]#MODULE:} "${skip_modules[@]}" && continue
-
-		case ${m[2]} in
-			MANPAGE)
-				gzip -dc ${m[0]} | newman - ${m[0]%.gz}
-				pipestatus || die
-				continue
-			;;
-			GBM_BACKEND_LIB_SYMLINK) m[4]=../${m[4]};; # missing ../
-			VDPAU_SYMLINK) m[4]=vdpau/; m[5]=${m[5]#vdpau/};; # .so to vdpau/
-		esac
-
-		if [[ -v 'paths[${m[2]}]' ]]; then
-			into=${paths[${m[2]}]}
-		elif [[ ${m[2]} == EXPLICIT_PATH ]]; then
-			into=${m[3]}
-		elif [[ ${m[2]} == *_BINARY ]]; then
-			into=/usr/bin
-		elif [[ ${m[3]} == COMPAT32 ]]; then
-			use abi_x86_32 || continue
-			into=/usr/${libdir32}
-		elif [[ ${m[2]} == *_@(LIB|SYMLINK) ]]; then
-			into=/usr/${libdir}
-		else
-			die "No known installation path for ${m[0]}"
-		fi
-		[[ ${m[3]: -2} == ?/ ]] && into+=/${m[3]%/}
-		[[ ${m[4]: -2} == ?/ ]] && into+=/${m[4]%/}
-
-		if [[ ${m[2]} =~ _SYMLINK$ ]]; then
-			[[ ${m[4]: -1} == / ]] && m[4]=${m[5]}
-			dosym ${m[4]} ${into}/${m[0]}
-			continue
-		fi
-		[[ ${m[0]} =~ ^libnvidia-ngx.so|^libnvidia-egl-gbm.so ]] &&
-			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1 # soname not in .manifest
-
-		printf -v m[1] %o $((m[1] | 0200)) # 444->644
-		insopts -m${m[1]}
-		insinto ${into}
-		doins ${m[0]}
-	done < .manifest || die
-	insopts -m0644 # reset
-
-	# MODULE:installer non-skipped extras
-	: "$(systemd_get_sleepdir)"
-	exeinto "${_#"${EPREFIX}"}"
-	doexe systemd/system-sleep/nvidia
-	dobin systemd/nvidia-sleep.sh
-	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend}.service
-
-	dobin nvidia-bug-report.sh
-
-	# MODULE:powerd extras
-	if use powerd; then
-		newinitd "${FILESDIR}"/nvidia-powerd.initd nvidia-powerd #923117
-		systemd_dounit systemd/system/nvidia-powerd.service
-
-		insinto /usr/share/dbus-1/system.d
-		doins nvidia-dbus.conf
-	fi
-
-	# enabling is needed for sleep to work properly and little reason not to do
-	# it unconditionally for a better user experience
-	: "$(systemd_get_systemunitdir)"
-	local unitdir=${_#"${EPREFIX}"}
-	# not using relative symlinks to match systemd's own links
-	dosym {"${unitdir}",/etc/systemd/system/systemd-hibernate.service.wants}/nvidia-hibernate.service
-	dosym {"${unitdir}",/etc/systemd/system/systemd-hibernate.service.wants}/nvidia-resume.service
-	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-suspend.service
-	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-resume.service
-	# also add a custom elogind hook to do the equivalent of the above
-	exeinto /usr/lib/elogind/system-sleep
-	newexe "${FILESDIR}"/system-sleep.elogind nvidia
-	# <elogind-255.5 used a different path (bug #939216), keep a compat symlink
-	# TODO: cleanup after 255.5 been stable for a few months
-	dosym {/usr/lib,/"${libdir}"}/elogind/system-sleep/nvidia
-
-	# needed with >=systemd-256 or may fail to resume with some setups
-	# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072722
-	insinto "${unitdir}"/systemd-homed.service.d
-	newins - 10-nvidia.conf <<-EOF
-		[Service]
-		Environment=SYSTEMD_HOME_LOCK_FREEZE_SESSION=false
-	EOF
-	insinto "${unitdir}"/systemd-suspend.service.d
-	newins - 10-nvidia.conf <<-EOF
-		[Service]
-		Environment=SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=false
-	EOF
-	dosym -r "${unitdir}"/systemd-{suspend,hibernate}.service.d/10-nvidia.conf
-	dosym -r "${unitdir}"/systemd-{suspend,hybrid-sleep}.service.d/10-nvidia.conf
-	dosym -r "${unitdir}"/systemd-{suspend,suspend-then-hibernate}.service.d/10-nvidia.conf
-
-	# symlink non-versioned so nvidia-settings can use it even if misdetected
-	dosym nvidia-application-profiles-${PV}-key-documentation \
-		${paths[APPLICATION_PROFILE]}/nvidia-application-profiles-key-documentation
-
-	# don't attempt to strip firmware files (silences errors)
-	dostrip -x ${paths[FIRMWARE]}
-
-	# sandbox issues with /dev/nvidiactl (and /dev/char wrt bug #904292)
-	# are widespread and sometime affect revdeps of packages built with
-	# USE=opencl/cuda making it hard to manage in ebuilds (minimal set,
-	# ebuilds should handle manually if need others or addwrite)
-	insinto /etc/sandbox.d
-	newins - 20nvidia <<<'SANDBOX_PREDICT="/dev/nvidiactl:/dev/char"'
-
-	# dracut does not use /etc/modprobe.d if hostonly=no, but want to make sure
-	# our settings are used for bug 932781#c8 and nouveau blacklist if either
-	# modules are included (however, just best-effort without initramfs regen)
-	if use modules; then
-		echo "install_items+=\" ${EPREFIX}/etc/modprobe.d/nvidia.conf \"" >> \
-			"${ED}"/usr/lib/dracut/dracut.conf.d/10-${PN}.conf || die
-	fi
-}
-
-pkg_preinst() {
-	has_version "${CATEGORY}/${PN}[wayland]" && NV_HAD_WAYLAND=
-
-	use modules || return
-
-	# set video group id based on live system (bug #491414)
-	local g=$(egetent group video | cut -d: -f3)
-	[[ ${g} =~ ^[0-9]+$ ]] || die "Failed to determine video group id (got '${g}')"
-	sed -i "s/@VIDEOGID@/${g}/" "${ED}"/etc/modprobe.d/nvidia.conf || die
-
-	# try to find driver mismatches using temporary supported-gpus.json
-	for g in $(grep -l 0x10de /sys/bus/pci/devices/*/vendor 2>/dev/null); do
-		g=$(grep -io "\"devid\":\"$(<${g%vendor}device)\"[^}]*branch\":\"[0-9]*" \
-			"${ED}"/usr/share/nvidia/supported-gpus.json 2>/dev/null)
-		if [[ ${g} ]]; then
-			g=$((${g##*\"}+1))
-			if ver_test -ge ${g}; then
-				NV_LEGACY_MASK=">=${CATEGORY}/${PN}-${g}"
-				break
-			fi
-		fi
-	done
-	rm "${ED}"/usr/share/nvidia/supported-gpus.json || die
-}
-
-pkg_postinst() {
-	linux-mod-r1_pkg_postinst
-
-	readme.gentoo_print_elog
-
-	if [[ -r /proc/driver/nvidia/version &&
-		$(</proc/driver/nvidia/version) != *"  ${PV}  "* ]]; then
-		ewarn "Currently loaded NVIDIA modules do not match the newly installed"
-		ewarn "libraries and may prevent launching GPU-accelerated applications."
-		if use modules; then
-			ewarn "Easiest way to fix this is normally to reboot. If still run into issues"
-			ewarn "(e.g. API mismatch messages in the \`dmesg\` output), please verify"
-			ewarn "that the running kernel is ${KV_FULL} and that (if used) the"
-			ewarn "initramfs does not include NVIDIA modules (or at least, not old ones)."
-		fi
-	fi
-
-	if [[ $(</proc/cmdline) == *slub_debug=[!-]* ]]; then
-		ewarn "Detected that the current kernel command line is using 'slub_debug=',"
-		ewarn "this may lead to system instability/freezes with this version of"
-		ewarn "${PN}. Bug: https://bugs.gentoo.org/796329"
-	fi
-
-	if [[ -v NV_LEGACY_MASK ]]; then
-		ewarn
-		ewarn "***WARNING***"
-		ewarn
-		ewarn "You are installing a version of ${PN} known not to work"
-		ewarn "with a GPU of the current system. If unwanted, add the mask:"
-		if [[ -d ${EROOT}/etc/portage/package.mask ]]; then
-			ewarn "  echo '${NV_LEGACY_MASK}' > ${EROOT}/etc/portage/package.mask/${PN}"
-		else
-			ewarn "  echo '${NV_LEGACY_MASK}' >> ${EROOT}/etc/portage/package.mask"
-		fi
-		ewarn "...then downgrade to a legacy[1] branch if possible (not all old versions"
-		ewarn "are available or fully functional, may need to consider nouveau[2])."
-		ewarn "[1] https://www.nvidia.com/object/IO_32667.html"
-		ewarn "[2] https://wiki.gentoo.org/wiki/Nouveau"
-	fi
-
-	if use kernel-open; then
-		ewarn
-		ewarn "Open source variant of ${PN} was selected, be warned it is experimental"
-		ewarn "and only for modern GPUs (e.g. GTX 1650+). Try to disable if run into issues."
-		ewarn "Please also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
-	fi
-
-	if use wayland && use modules && [[ ! -v NV_HAD_WAYLAND ]]; then
-		elog
-		elog "With USE=wayland, this version of ${PN} sets nvidia-drm.modeset=1"
-		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. This feature is considered"
-		elog "experimental but is required for wayland."
-		elog
-		elog "If you experience issues, either disable wayland or edit nvidia.conf."
-		elog "Of note, may possibly cause issues with SLI and Reverse PRIME."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
index df56b447d8f..dca7f85afe0 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-535.261.03.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -24,7 +24,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* ~amd64 ~arm64"
+KEYWORDS="-* amd64 ~arm64"
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
index b4532b44929..dacf966f6b6 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.172.08.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -24,7 +24,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2025 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* ~amd64 ~arm64"
+KEYWORDS="-* amd64 ~arm64"
 # TODO: enable kernel-open by default to match nvidia upstream, but should
 # first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
 # surprises (should abort for legacy cards too, and have a bypass variable)
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
index 2562854dc50..21a1936158e 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.169.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-570.181.ebuild
@@ -7,13 +7,16 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
+# x86-64 .run was missing from the usual mirror, use us. until next bump
+# (note that it lacks some other files, thus the separate variable)
+[[ ${PV} == 570.181 ]] && NV_URI_TMP="https://us.download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
 HOMEPAGE="https://www.nvidia.com/"
 SRC_URI="
-	amd64? ( ${NV_URI}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
+	amd64? ( ${NV_URI_TMP}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
 	arm64? ( ${NV_URI}Linux-aarch64/${PV}/NVIDIA-Linux-aarch64-${PV}.run )
 	$(printf "${NV_URI}%s/%s-${PV}.tar.bz2 " \
 		nvidia-{installer,modprobe,persistenced,settings,xconfig}{,})
@@ -24,7 +27,7 @@ S=${WORKDIR}
 
 LICENSE="NVIDIA-2025 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
+KEYWORDS="-* ~amd64 ~arm64"
 # TODO: enable kernel-open by default to match nvidia upstream, but should
 # first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
 # surprises (should abort for legacy cards too, and have a bypass variable)
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
index 6e3b131d18d..7a41220cc28 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-550.163.01-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.05.ebuild
@@ -7,13 +7,17 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.14
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
+# x86-64 .run was missing from the usual mirror at bump time, while
+# aarch64's is missing from this one.. so fetch from different ones
+# for now and drop this next bump
+[[ ${PV} == 575.64.05 ]] && NV_URI_TMP="https://us.download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
 HOMEPAGE="https://www.nvidia.com/"
 SRC_URI="
-	amd64? ( ${NV_URI}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
+	amd64? ( ${NV_URI_TMP}Linux-x86_64/${PV}/NVIDIA-Linux-x86_64-${PV}.run )
 	arm64? ( ${NV_URI}Linux-aarch64/${PV}/NVIDIA-Linux-aarch64-${PV}.run )
 	$(printf "${NV_URI}%s/%s-${PV}.tar.bz2 " \
 		nvidia-{installer,modprobe,persistenced,settings,xconfig}{,})
@@ -22,9 +26,15 @@ SRC_URI="
 # nvidia-installer is unused but here for GPL-2's "distribute sources"
 S=${WORKDIR}
 
-LICENSE="NVIDIA-2023 Apache-2.0 BSD BSD-2 GPL-2 MIT ZLIB curl openssl"
+LICENSE="
+	NVIDIA-2025 Apache-2.0 Boost-1.0 BSD BSD-2 GPL-2 MIT ZLIB
+	curl openssl public-domain
+"
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* amd64 ~arm64"
+KEYWORDS="-* ~amd64 ~arm64"
+# TODO: enable kernel-open by default to match nvidia upstream, but should
+# first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
+# surprises (should abort for legacy cards too, and have a bypass variable)
 IUSE="+X abi_x86_32 abi_x86_64 kernel-open persistenced powerd +static-libs +tools wayland"
 REQUIRED_USE="kernel-open? ( modules )"
 
@@ -60,8 +70,9 @@ RDEPEND="
 	)
 	powerd? ( sys-apps/dbus[abi_x86_32(-)?] )
 	wayland? (
-		gui-libs/egl-gbm
-		>=gui-libs/egl-wayland-1.1.10
+		>=gui-libs/egl-gbm-1.1.1-r2[abi_x86_32(-)?]
+		>=gui-libs/egl-wayland-1.1.13.1[abi_x86_32(-)?]
+		X? ( gui-libs/egl-x11[abi_x86_32(-)?] )
 	)
 "
 DEPEND="
@@ -72,6 +83,7 @@ DEPEND="
 		x11-libs/libXext
 	)
 	tools? (
+		dev-util/vulkan-headers
 		media-libs/libglvnd
 		sys-apps/dbus
 		x11-base/xorg-proto
@@ -81,6 +93,7 @@ DEPEND="
 	)
 "
 BDEPEND="
+	app-alternatives/awk
 	sys-devel/m4
 	virtual/pkgconfig
 "
@@ -103,6 +116,7 @@ pkg_setup() {
 	local CONFIG_CHECK="
 		PROC_FS
 		~DRM_KMS_HELPER
+		~DRM_FBDEV_EMULATION
 		~SYSVIPC
 		~!LOCKDEP
 		~!PREEMPT_RT
@@ -128,6 +142,9 @@ pkg_setup() {
 	local ERROR_DRM_TTM_HELPER="CONFIG_DRM_TTM_HELPER: is not set but is needed to compile when using
 	kernel version 6.11.x or newer while DRM_FBDEV_EMULATION is set.
 	${drm_helper_msg}"
+	local ERROR_DRM_FBDEV_EMULATION="CONFIG_DRM_FBDEV_EMULATION: is not set but is needed for
+	nvidia-drm.fbdev=1 support, currently off-by-default and it could
+	be ignored, but note that is due to change in the future."
 	local ERROR_MMU_NOTIFIER="CONFIG_MMU_NOTIFIER: is not set but needed to build with USE=kernel-open.
 	Cannot be directly selected in the kernel's menuconfig, and may need
 	selection of another option that requires it such as CONFIG_KVM."
@@ -161,7 +178,7 @@ src_prepare() {
 	use X || sed -i 's/"libGLX/"libEGL/' nvidia_{layers,icd}.json || die
 
 	# enable nvidia-drm.modeset=1 by default with USE=wayland
-	cp "${FILESDIR}"/nvidia-545.conf "${T}"/nvidia.conf || die
+	cp "${FILESDIR}"/nvidia-570.conf "${T}"/nvidia.conf || die
 	use !wayland || sed -i '/^#.*modeset=1$/s/^#//' "${T}"/nvidia.conf || die
 
 	# makefile attempts to install wayland library even if not built
@@ -190,11 +207,6 @@ src_compile() {
 	if use modules; then
 		local o_cflags=${CFLAGS} o_cxxflags=${CXXFLAGS} o_ldflags=${LDFLAGS}
 
-		# conftest.sh is broken with c23 due to func() changing meaning,
-		# and then fails later due to ealier misdetections
-		# TODO: try without now and then + drop modargs' CC= (bug #944092)
-		KERNEL_CC+=" -std=gnu17"
-
 		local modlistargs=video:kernel
 		if use kernel-open; then
 			modlistargs+=-module-source:kernel-module-source/kernel-open
@@ -204,11 +216,12 @@ src_compile() {
 			filter-flags -fno-plt #912949
 			filter-lto
 			CC=${KERNEL_CC} CXX=${KERNEL_CXX} strip-unsupported-flags
+
+			LDFLAGS=$(raw-ldflags)
 		fi
 
 		local modlist=( nvidia{,-drm,-modeset,-peermem,-uvm}=${modlistargs} )
 		local modargs=(
-			CC="${KERNEL_CC}" # needed for above gnu17 workaround
 			IGNORE_CC_MISMATCH=yes NV_VERBOSE=1
 			SYSOUT="${KV_OUT_DIR}" SYSSRC="${KV_DIR}"
 
@@ -253,6 +266,7 @@ src_install() {
 		[GBM_BACKEND_LIB_SYMLINK]=/usr/${libdir}/gbm
 		[GLVND_EGL_ICD_JSON]=/usr/share/glvnd/egl_vendor.d
 		[OPENGL_DATA]=/usr/share/nvidia
+		[VULKANSC_ICD_JSON]=/usr/share/vulkansc
 		[VULKAN_ICD_JSON]=/usr/share/vulkan
 		[WINE_LIB]=/usr/${libdir}/nvidia/wine
 		[XORG_OUTPUTCLASS_CONFIG]=/usr/share/X11/xorg.conf.d
@@ -268,12 +282,14 @@ src_install() {
 		libnvidia-{gtk,wayland-client} nvidia-{settings,xconfig} # from source
 		libnvidia-egl-gbm 15_nvidia_gbm # gui-libs/egl-gbm
 		libnvidia-egl-wayland 10_nvidia_wayland # gui-libs/egl-wayland
+		libnvidia-egl-xcb 20_nvidia_xcb.json # gui-libs/egl-x11
+		libnvidia-egl-xlib 20_nvidia_xlib.json # gui-libs/egl-x11
 		libnvidia-pkcs11.so # using the openssl3 version instead
 	)
 	local skip_modules=(
 		$(usev !X "nvfbc vdpau xdriver")
 		$(usev !modules gsp)
-		$(usev !powerd powerd)
+		$(usev !powerd nvtopps)
 		installer nvpd # handled separately / built from source
 	)
 	local skip_types=(
@@ -313,6 +329,12 @@ $(use amd64 && usev !abi_x86_32 "
 Note that without USE=abi_x86_32 on ${PN}, 32bit applications
 (typically using wine / steam) will not be able to use GPU acceleration.")
 
+Be warned that USE=kernel-open may need to be either enabled or
+disabled for certain cards to function:
+- GTX 50xx (blackwell) and higher require it to be enabled
+- GTX 1650 and higher (pre-blackwell) should work either way
+- Older cards require it to be disabled
+
 For additional information or for troubleshooting issues, please see
 https://wiki.gentoo.org/wiki/NVIDIA/nvidia-drivers and NVIDIA's own
 documentation that is installed alongside this README."
@@ -401,8 +423,9 @@ documentation that is installed alongside this README."
 			dosym ${m[4]} ${into}/${m[0]}
 			continue
 		fi
-		[[ ${m[0]} =~ ^libnvidia-ngx.so|^libnvidia-egl-gbm.so ]] &&
-			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1 # soname not in .manifest
+		# avoid portage warning due to missing soname links in manifest
+		[[ ${m[0]} =~ ^libnvidia-ngx.so ]] &&
+			dosym ${m[0]} ${into}/${m[0]%.so*}.so.1
 
 		printf -v m[1] %o $((m[1] | 0200)) # 444->644
 		insopts -m${m[1]}
@@ -416,10 +439,13 @@ documentation that is installed alongside this README."
 	exeinto "${_#"${EPREFIX}"}"
 	doexe systemd/system-sleep/nvidia
 	dobin systemd/nvidia-sleep.sh
-	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend}.service
+	systemd_dounit systemd/system/nvidia-{hibernate,resume,suspend,suspend-then-hibernate}.service
 
 	dobin nvidia-bug-report.sh
 
+	insinto /usr/share/nvidia/files.d
+	doins sandboxutils-filelist.json
+
 	# MODULE:powerd extras
 	if use powerd; then
 		newinitd "${FILESDIR}"/nvidia-powerd.initd nvidia-powerd #923117
@@ -438,6 +464,8 @@ documentation that is installed alongside this README."
 	dosym {"${unitdir}",/etc/systemd/system/systemd-hibernate.service.wants}/nvidia-resume.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-suspend.service
 	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend.service.wants}/nvidia-resume.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-suspend-then-hibernate.service
+	dosym {"${unitdir}",/etc/systemd/system/systemd-suspend-then-hibernate.service.wants}/nvidia-resume.service
 	# also add a custom elogind hook to do the equivalent of the above
 	exeinto /usr/lib/elogind/system-sleep
 	newexe "${FILESDIR}"/system-sleep.elogind nvidia
@@ -552,18 +580,15 @@ pkg_postinst() {
 
 	if use kernel-open && [[ ! -v NV_HAD_KERNEL_OPEN ]]; then
 		ewarn
-		ewarn "Open source variant of ${PN} was selected, be warned it is experimental"
-		ewarn "and only for modern GPUs (e.g. GTX 1650+). Try to disable if run into issues."
-		ewarn "Please also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
+		ewarn "Open source variant of ${PN} was selected, note that it requires"
+		ewarn "Turing/Ampere+ GPUs (aka GTX 1650+). Try disabling if run into issues."
+		ewarn "Also see: ${EROOT}/usr/share/doc/${PF}/html/kernel_open.html"
 	fi
 
 	if use wayland && use modules && [[ ! -v NV_HAD_WAYLAND ]]; then
 		elog
-		elog "With USE=wayland, this version of ${PN} sets nvidia-drm.modeset=1"
-		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. This feature is considered"
-		elog "experimental but is required for wayland."
-		elog
-		elog "If you experience issues, either disable wayland or edit nvidia.conf."
-		elog "Of note, may possibly cause issues with SLI and Reverse PRIME."
+		elog "Note that with USE=wayland, nvidia-drm.modeset=1 will be enabled"
+		elog "in '${EROOT}/etc/modprobe.d/nvidia.conf'. *If* experience issues,"
+		elog "either disable wayland or edit nvidia.conf."
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild
rename to sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
index b39715d6e1e..5210c622488 100644
--- a/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-575.64.03.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-580.65.06.ebuild
@@ -7,7 +7,7 @@ MODULES_OPTIONAL_IUSE=+modules
 inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
-MODULES_KERNEL_MAX=6.15
+MODULES_KERNEL_MAX=6.16
 NV_URI="https://download.nvidia.com/XFree86/"
 
 DESCRIPTION="NVIDIA Accelerated Graphics Driver"
@@ -27,7 +27,8 @@ LICENSE="
 	curl openssl public-domain
 "
 SLOT="0/${PV%%.*}"
-KEYWORDS="-* ~amd64 ~arm64"
+# unkeyworded due to being a beta, feel free to opt-in if want to test
+#KEYWORDS="-* ~amd64 ~arm64"
 # TODO: enable kernel-open by default to match nvidia upstream, but should
 # first setup a supported-gpus.json "kernelopen" check to abort and avoid bad
 # surprises (should abort for legacy cards too, and have a bypass variable)
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
index 9ba461174a4..7cf364fd60e 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
@@ -1,4 +1,2 @@
-DIST pixman-0.44.2.tar.xz 650012 BLAKE2B 856aa35ae705de522d70250beee8acc872b54d2b5caa9cee6bc12ffde7c293b3db76f56c75858cc5ab1bc592fb1d4078485c2def2ae4bcd5a50b6dfc2eb477eb SHA512 b24907f9a0bf6a9aa3278d31986c562c5f2d68f8c178021497c8648aca9f91e4c6f1ecfacf93eb01ba4f03ce4cfc5970fc40bb0fe6724bac9210fc57da09cba4
 DIST pixman-0.46.0.tar.xz 660268 BLAKE2B 5fc9d0df2f685afc1931ac12757d7ec0369c1f90b51f79b696479a2edd0c13e0684938871166318ca5c78b4955195ba5517e98e4666803b9062f4ed2b6593afa SHA512 c7ef987b7db89c58278c537f862bc9eb17c19f8288a3b7e88f8501a0486662f1e2cb6a2c0b81d4bf0464310475192428d6e29d05a6ae3cfc1d2c0941fbb0b9a3
-DIST pixman-0.46.2.tar.xz 660260 BLAKE2B 6d51d4f33f48a1cc991085b5e62e7537b738df78c4efcbce15c37533f24a1d87263401550530d123de86bd72a856d3fd0b1543188c76f074ea3e44d384f1116f SHA512 9419e5a23f4b709e075c5dd33c46bb375d2407b6e90623fe3410a03171f4c5e0a511e8b4414557a39b68d46a4c1ac64f2ef0c9c6eab0b42a2be75d5d52a367fd
 DIST pixman-0.46.4.tar.xz 660536 BLAKE2B b00041009aeed3cd2548251489df6fcb5efb0415a8279451306558b2e736e2b012b11335b4ed3361e0126cad861873c0675dae24eb031b2434e45a7d39e087d8 SHA512 83b133e7969ba34f883f4e08dcc5d388c4397f43ce836c191c05945fe77c16ff501d531600780c12678a0d08105828a6bdeff2156b63f9c1a84087bc7f40ae9f
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild
deleted file mode 100644
index 08434b2ec36..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.44.2.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	local emesonargs=(
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild
deleted file mode 100644
index ef06454954b..00000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.46.2-r1.ebuild
+++ /dev/null
@@ -1,70 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit flag-o-matic ${GIT_ECLASS} meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	# Temporary workaround for a build failure (known gcc issue):
-	#
-	#  * https://bugs.gentoo.org/956715
-	#  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110812
-	#
-	use riscv && filter-lto
-
-	local emesonargs=(
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-		 # explicitly disable RVV due to https://bugs.gentoo.org/95938
-		-Drvv=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}