Merge pull request #3233 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-09-01

Weekly portage-stable package updates 2025-09-01
2025-09-25 15:41:04 +02:00 · 2025-09-05 11:56:00 +02:00 · 2025-09-05 11:56:00 +02:00 · 00f59e30db
commit 00f59e30db
parent 538a1a20e0 4af98fab13
526 changed files with 16969 additions and 10043 deletions
--- a/changelog/security/2025-09-03-weekly-updates.md
+++ b/changelog/security/2025-09-03-weekly-updates.md
@ -0,0 +1,6 @@
+- vim ([CVE-2025-53905](https://www.cve.org/CVERecord?id=CVE-2025-53905), [CVE-2025-53906](https://www.cve.org/CVERecord?id=CVE-2025-53906), [CVE-2025-9390](https://www.cve.org/CVERecord?id=CVE-2025-9390))
+- go ([CVE-2025-47906](https://www.cve.org/CVERecord?id=CVE-2025-47906), [CVE-2025-47907](https://www.cve.org/CVERecord?id=CVE-2025-47907))
+- glib ([CVE-2025-7039](https://www.cve.org/CVERecord?id=CVE-2025-7039))
+- gnutls ([CVE-2025-32988](https://www.cve.org/CVERecord?id=CVE-2025-32988), [CVE-2025-32989](https://www.cve.org/CVERecord?id=CVE-2025-32989), [CVE-2025-32990](https://www.cve.org/CVERecord?id=CVE-2025-32990), [CVE-2025-6395](https://www.cve.org/CVERecord?id=CVE-2025-6395))
+- iperf ([CVE-2025-54349](https://www.cve.org/CVERecord?id=CVE-2025-54349), [CVE-2025-54350](https://www.cve.org/CVERecord?id=CVE-2025-54350), [CVE-2025-54351](https://www.cve.org/CVERecord?id=CVE-2025-54351))
+- glibc ([CVE-2025-8058](https://www.cve.org/CVERecord?id=CVE-2025-8058))
--- a/changelog/updates/2025-09-03-weekly-updates.md
+++ b/changelog/updates/2025-09-03-weekly-updates.md
@ -0,0 +1,29 @@
+- SDK: gnu-efi ([4.0.2](https://github.com/ncroxon/gnu-efi/releases/tag/4.0.2))
+- SDK: go ([1.24.6](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: rust ([1.88.0](https://blog.rust-lang.org/2025/06/26/Rust-1.88.0/))
+- SDK: sbsigntools ([0.9.5](https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/commit/?h=v0.9.5&id=9cfca9fe7aa7a8e29b92fe33ce8433e212c9a8ba))
+- base, dev: azure-vm-utils ([0.7.0](https://github.com/Azure/azure-vm-utils/releases/tag/v0.7.0))
+- base, dev: cryptsetup ([2.8.0](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.0/docs/v2.8.0-ReleaseNotes))
+- base, dev: curl ([8.15.0](https://curl.se/ch/8.15.0.html))
+- base, dev: e2fsprogs ([1.47.3](https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.3))
+- base, dev: glib ([2.84.4](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.4))
+- base, dev: gnutls ([3.8.10](https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html))
+- base, dev: kmod ([34.2](https://lwn.net/Articles/1011365/))
+- base, dev: libsodium ([1.0.20_p20250606](https://raw.githubusercontent.com/jedisct1/libsodium/7e024fbf096c84bef866b21f521c516591908bef/ChangeLog))
+- base, dev: lsof ([4.99.5](https://github.com/lsof-org/lsof/releases/tag/4.99.5))
+- base, dev: ncurses ([6.5_p20250531](https://invisible-island.net/ncurses/NEWS.html#t20250531))
+- base, dev: nettle ([3.10.2](https://git.lysator.liu.se/nettle/nettle/-/raw/nettle_3.10.2_release_20250626/ChangeLog))
+- base, dev: nvidia-drivers-service (arm64) (570.172.08)
+- base, dev: openssl ([3.4.2](https://github.com/openssl/openssl/releases/tag/openssl-3.4.2))
+- base, dev: pciutils ([3.14.0](https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/plain/ChangeLog?h=v3.14.0))
+- base, dev: pkgconf ([2.5.1](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-2.5.1/NEWS) (includes [2.5.0](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-2.5.0/NEWS)))
+- base, dev: selinux ([2.20250213](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250213))
+- base, dev: sudo ([1.9.17_p2](https://github.com/sudo-project/sudo/releases/tag/v1.9.17p2))
+- base, dev: vim ([9.1.1652](https://github.com/vim/vim/commits/v9.1.1652/))
+- dev: gnuconfig ([20250710](https://cgit.git.savannah.gnu.org/cgit/config.git/log/?id=a2287c3041a3f2a204eb942e09c015eab00dc7dd))
+- dev: iperf ([3.19.1](https://github.com/esnet/iperf/releases/tag/3.19.1))
+- sysext-incus, sysext-podman, vmware: fuse ([3.17.3](https://raw.githubusercontent.com/libfuse/libfuse/refs/tags/fuse-3.17.3/ChangeLog.rst))
+- sysext-incus: cowsql ([1.15.9](https://github.com/cowsql/cowsql/commits/v1.15.9/))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers (570.181)
+- sysext-python: rich ([14.1.0](https://github.com/Textualize/rich/releases/tag/v14.1.0))
+- sysext-python: truststore ([0.10.4](https://raw.githubusercontent.com/sethmlarson/truststore/refs/tags/v0.10.4/CHANGELOG.md))
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
@ -1,4 +1,4 @@
-From b4725fecc9298279266ecfd842536b1b1c03cdb0 Mon Sep 17 00:00:00 2001
+From 9398464fe4d29cb3e9ad3c04c2c749747438fb65 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@ -55,7 +55,7 @@ index 63d2f9cb8..62dff5f94 100644
 dev_read_rand(traceroute_t)
 dev_read_urand(traceroute_t)
 diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.in b/refpolicy/policy/modules/kernel/corenetwork.if.in
-index bc1535469..d057c4031 100644
+index 1f0ad3df4..6a1cdba0e 100644
 --- a/refpolicy/policy/modules/kernel/corenetwork.if.in
 +++ b/refpolicy/policy/modules/kernel/corenetwork.if.in
@@ -877,6 +877,32 @@ interface(`corenet_sctp_bind_generic_node',`
@ -115,10 +115,10 @@ index b1649ec3a..ca612de44 100644
 # Infiniband
 corenet_ib_access_all_pkeys(corenet_unconfined_type)
 diff --git a/refpolicy/policy/modules/kernel/files.if b/refpolicy/policy/modules/kernel/files.if
-index 778e82713..d1bd353e0 100644
+index 709a1b71b..73b17285e 100644
 --- a/refpolicy/policy/modules/kernel/files.if
 +++ b/refpolicy/policy/modules/kernel/files.if
-@@ -8065,3 +8065,48 @@ interface(`files_relabel_all_pidfiles',`
+@@ -8118,3 +8118,48 @@ interface(`files_relabel_all_pidfiles',`
 	relabel_files_pattern($1, pidfile, pidfile)
 	relabel_lnk_files_pattern($1, pidfile, pidfile)
 ')
@ -168,10 +168,10 @@ index 778e82713..d1bd353e0 100644
 +	relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
 +')
 diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
-index b791ebc71..c80159473 100644
+index 6d8ec0f77..df620faef 100644
 --- a/refpolicy/policy/modules/kernel/kernel.te
 +++ b/refpolicy/policy/modules/kernel/kernel.te
-@@ -377,6 +377,131 @@ files_mounton_default(kernel_t)
+@@ -374,6 +374,131 @@ files_mounton_default(kernel_t)
 
 mcs_process_set_categories(kernel_t)
 
@ -321,7 +321,7 @@ index f98e68ba0..045b1b5b2 100644
 /run/containers(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 /run/crun(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 diff --git a/refpolicy/policy/modules/services/container.te b/refpolicy/policy/modules/services/container.te
-index 8fcd88e1e..ab16ff8b7 100644
+index c71ae54f4..a231f7664 100644
 --- a/refpolicy/policy/modules/services/container.te
 +++ b/refpolicy/policy/modules/services/container.te
@@ -58,6 +58,52 @@ gen_tunable(container_use_dri, false)
@ -386,7 +386,7 @@ index 8fcd88e1e..ab16ff8b7 100644
 
 ## <desc>
 ##	<p>
-@@ -1247,3 +1293,125 @@ optional_policy(`
+@@ -1249,3 +1295,125 @@ optional_policy(`
        unconfined_domain_noaudit(spc_user_t)
        domain_ptrace_all_domains(spc_user_t)
 ')
@ -513,12 +513,12 @@ index 8fcd88e1e..ab16ff8b7 100644
 +#
 +allow container_t tmp_t:file { read };
 diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
-index 796426508..e1761f8fd 100644
+index 1320f7aae..61ead9795 100644
 --- a/refpolicy/policy/modules/system/init.te
 +++ b/refpolicy/policy/modules/system/init.te
-@@ -1686,3 +1686,11 @@ optional_policy(`
- 	userdom_dontaudit_rw_all_users_stream_sockets(systemprocess)
+@@ -1728,3 +1728,11 @@ optional_policy(`
 	userdom_dontaudit_write_user_tmp_files(systemprocess)
+ 	userdom_dontaudit_use_user_terminals(systemprocess)
 ')
 +
 +#
@ -529,14 +529,14 @@ index 796426508..e1761f8fd 100644
 +require { type unconfined_t; }
 +allow init_t unconfined_t:file exec_file_perms;
 diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
-index 9534db006..e60eb7b59 100644
+index 995c80be2..933278d2f 100644
 --- a/refpolicy/policy/modules/system/locallogin.te
 +++ b/refpolicy/policy/modules/system/locallogin.te
@@ -34,7 +34,14 @@ role system_r types sulogin_t;
 
 allow local_login_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config };
 dontaudit local_login_t self:capability net_admin;
-allow local_login_t self:process { getcap setcap setexec setrlimit setsched };
+-allow local_login_t self:process { getcap setcap setexec setrlimit setsched signal };
 +#
 +# FLATCAR:
 +#
@ -544,12 +544,12 @@ index 9534db006..e60eb7b59 100644
 +#
 +# TODO: What AVC does this fix?
 +#
-+allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched };
+allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched signal };
 allow local_login_t self:fd use;
 allow local_login_t self:fifo_file rw_fifo_file_perms;
 allow local_login_t self:sock_file read_sock_file_perms;
 diff --git a/refpolicy/policy/modules/system/logging.te b/refpolicy/policy/modules/system/logging.te
-index ed01f0e4a..9504b6e72 100644
+index 14d3132be..ce40abc52 100644
 --- a/refpolicy/policy/modules/system/logging.te
 +++ b/refpolicy/policy/modules/system/logging.te
@@ -507,6 +507,15 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t)
@ -569,5 +569,5 @@ index ed01f0e4a..9504b6e72 100644
 	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
 	allow syslogd_t self:capability2 audit_read;
 -- 
-2.34.1
+2.49.1

--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@ -32,16 +32,15 @@ app-crypt/azure-keyvault-pkcs11
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =app-crypt/clevis-19-r1 **

-# Needed to address CVE-2025-1215, CVE-2025-22134, CVE-2025-24014, GHSA-63p5-mwg2-787v, CVE-2025-27423, CVE-2025-29768
-=app-editors/vim-9.1.1436 ~amd64 ~arm64
-=app-editors/vim-core-9.1.1436 ~amd64 ~arm64
+# Needed to address the ever-growing list of CVEs
+=app-editors/vim-9.1.1652 ~amd64 ~arm64
+=app-editors/vim-core-9.1.1652 ~amd64 ~arm64

 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *

 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
-=dev-build/meson-1.7.2 ~arm64

 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
@ -51,21 +50,18 @@ dev-cpp/azure-identity
 dev-cpp/azure-security-keyvault-certificates
 dev-cpp/azure-security-keyvault-keys

-# CVE-2025-4674
-=dev-lang/go-1.24.5-r1 ~arm64 ~amd64
-
 # Keep versions on both arches in sync.
 =dev-lang/yasm-1.3.0-r1 ~arm64
-=dev-libs/cowsql-1.15.8 ~arm64
+=dev-libs/cowsql-1.15.9 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64

+# CVE-2025-7039
+=dev-libs/glib-2.84.4 ~amd64 ~arm64
+
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 =dev-libs/luksmeta-9-r1 **

-# CVE-2025-49794, CVE-2025-49795, CVE-2025-49796
-=dev-libs/libxml2-2.13.8-r2 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =dev-libs/raft-0.22.1 ~arm64

@ -75,8 +71,9 @@ dev-cpp/azure-security-keyvault-keys
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64

-# Keep versions on both arches in sync.
-=dev-util/xdelta-3.0.11-r1 ~arm64
+# CVE-2025-7039
+=dev-util/gdbus-codegen-2.84.4 ~amd64 ~arm64
+=dev-util/glib-utils-2.84.4 ~amd64 ~arm64

 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
@ -87,7 +84,9 @@ dev-cpp/azure-security-keyvault-keys
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
-=net-misc/curl-8.14.1 ~arm64
+
+# CVE-2025-54349, CVE-2025-54350, CVE-2025-54351
+=net-misc/iperf-3.19.1 ~amd64 ~arm64

 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
@ -101,8 +100,6 @@ sys-apps/azure-vm-utils
 =sys-boot/mokutil-0.7.2 **

 # Enable ipvsadm for arm64.
-=sys-fs/zfs-2.3.3 ~arm64
-=sys-fs/zfs-kmod-2.3.3 ~arm64
 =sys-cluster/ipvsadm-1.31-r1 ~arm64

 # Keep versions on both arches in sync.
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@ -25,3 +25,4 @@
 # mask a specific version in hope that the future update may be smaller,
 # who knows.
 =sys-firmware/intel-microcode-20250512_p20250513
+=sys-firmware/intel-microcode-20250812_p20250813
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
@ -14,3 +14,7 @@ dev-util/source-highlight-3.1.9-r2
 # Pulled in by bpftool[-clang], We never provided co-re in bpftool and
 # for now continue to do so.
 sys-devel/bpf-toolchain-14.2.0_p1
+
+# Pulled by app-crypt/sbsigntools - we never needed it and it pulls a
+# ton of other packages.
+dev-perl/Locale-gettext-1.70.0_p20181130
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-570.172.08.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-570.172.08.ebuild
--- a/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
@ -34,7 +34,7 @@ else
 	"

 	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 	fi

 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"
--- a/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r3.ebuild
@ -1,278 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit fcaps toolchain-funcs flag-o-matic gnuconfig
-
-MY_P="${P/_alpha/a}"
-
-DESCRIPTION="A set of tools for CD/DVD reading and recording, including cdrecord"
-HOMEPAGE="https://sourceforge.net/projects/cdrtools/"
-SRC_URI="https://downloads.sourceforge.net/${PN}/$([[ -z ${PV/*_alpha*} ]] && echo 'alpha')/${MY_P}.tar.bz2"
-
-S=${WORKDIR}/${P/_alpha[0-9][0-9]}
-
-LICENSE="GPL-2 LGPL-2.1 CDDL-Schily"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
-IUSE="acl caps nls unicode selinux"
-
-BDEPEND="
-	nls? ( >=sys-devel/gettext-0.18.1.1 )
-	x11-misc/makedepend
-"
-RDEPEND="
-	acl? ( virtual/acl )
-	caps? ( sys-libs/libcap )
-	nls? ( virtual/libintl )
-	selinux? ( sec-policy/selinux-cdrecord )
-"
-DEPEND="
-	${RDEPEND}
-"
-
-FILECAPS=(
-	cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
-	cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --
-	cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep usr/bin/readcd
-)
-
-cdrtools_os() {
-	local os="linux"
-	[[ ${CHOST} == *-darwin* ]] && os="mac-os10"
-	echo "${os}"
-}
-
-src_prepare() {
-	default
-
-	gnuconfig_update
-
-	# Remove profiled make files.
-	find -name '*_p.mk' -delete || die "delete *_p.mk"
-
-	# Adjusting hardcoded paths.
-	sed -i -e "s|opt/schily|usr|" \
-		$(find ./ -type f -name \*.[0-9ch] -exec grep -l 'opt/schily' '{}' '+') \
-		|| die "sed opt/schily"
-
-	sed -i -e "s|\(^INSDIR=\t\tshare/doc/\)|\1${PF}/|" \
-		$(find ./ -type f -exec grep -l '^INSDIR.\+doc' '{}' '+') \
-		|| die "sed doc"
-
-	# Respect libdir.
-	sed -i -e "s|\(^INSDIR=\t\t\)lib|\1$(get_libdir)|" \
-		$(find ./ -type f -exec grep -l '^INSDIR.\+lib\(/siconv\)\?$' '{}' '+') \
-		|| die "sed multilib"
-
-	# Do not install static libraries.
-	sed -i -e "s|include\t\t.*rules.lib||" \
-		$(find ./ -type f -exec grep -l '^include.\+rules\.lib' '{}' '+') \
-		|| die "sed rules"
-
-	# Enable verbose build.
-	sed -i -e '/@echo.*==>.*;/s:@echo[^;]*;:&set -x;:' \
-		RULES/*.rul RULES/rules.prg RULES/rules.inc \
-		|| die "sed verbose rules"
-
-	# Respect CC/CXX variables.
-	cd "${S}"/RULES || die
-	local tcCC="$(tc-getCC)"
-	local tcCXX="$(tc-getCXX)"
-	# fix RISC-V build err, bug 811375
-	ln -s i586-linux-cc.rul riscv-linux-cc.rul || die
-	ln -s i586-linux-cc.rul riscv64-linux-cc.rul || die
-
-	sed -i -e "/cc-config.sh/s|\$(C_ARCH:%64=%) \$(CCOM_DEF)|${tcCC} ${tcCC}|" \
-		rules1.top || die "sed rules1.top"
-	sed -i -e "/^CC_COM_DEF=/s|gcc|${tcCC}|" \
-		-e "/^CC++_COM_DEF=/s|g++|${tcCXX}|" \
-		-e "/COPTOPT=/s|-O||" \
-		-e 's|$(GCCOPTOPT)||' \
-		cc-gcc.rul || die "sed cc-gcc.rul"
-	sed -i -e "s|^#\(CONFFLAGS +=\).*|\1\t-cc=${tcCC}|" \
-		rules.cnf || die "sed rules.cnf"
-
-	# Schily make setup.
-	cd "${S}"/DEFAULTS || die
-	local os=$(cdrtools_os)
-
-	sed -i \
-		-e "s|^\(DEFLINKMODE=\).*|\1\tdynamic|" \
-		-e "s|^\(LINUX_INCL_PATH=\).*|\1|" \
-		-e "s|^\(LDPATH=\).*|\1|" \
-		-e "s|^\(RUNPATH=\).*|\1|" \
-		-e "s|^\(INS_BASE=\).*|\1\t${ED}/usr|" \
-		-e "s|^\(INS_RBASE=\).*|\1\t${ED}|" \
-		-e "s|^\(DEFINSGRP=\).*|\1\t0|" \
-		-e '/^DEFUMASK/s,002,022,g' \
-		Defaults.${os} || die "sed Schily make setup"
-	# re DEFUMASK above:
-	# bug 486680: grsec TPE will block the exec if the directory is
-	# group-writable. This is painful with cdrtools, because it makes a bunch of
-	# group-writable directories during build. Change the umask on their
-	# creation to prevent this.
-}
-
-ac_cv_sizeof() {
-	cat <<-EOF >"${T}"/test.c
-	#include <inttypes.h>
-	#include <stddef.h>
-	#include <stdint.h>
-	#include <sys/types.h>
-	int main () {
-		static int test_array [1 - 2 * !((sizeof(TYPE)) == LEN)];
-		test_array [0] = 0;
-		return test_array [0];
-	}
-	EOF
-
-	local i=1
-	while [[ ${i} -lt 20 ]] ; do
-		if ${CC} ${CPPFLAGS} ${CFLAGS} -c "${T}"/test.c -o /dev/null -DTYPE="$1" -DLEN=$i 2>/dev/null; then
-			echo ${i}
-			return 0
-		fi
-		: $(( i += 1 ))
-	done
-	return 1
-}
-
-src_configure() {
-	use acl || export ac_cv_header_sys_acl_h="no"
-	use caps || export ac_cv_lib_cap_cap_get_proc="no"
-	export ac_cv_header_pulse_pulseaudio_h="no"
-	export ac_cv_header_alsa_asoundlib_h="no"
-	export ac_cv_lib_asound_snd_pcm_open="no"
-
-	# skip obsolete configure script
-	if tc-is-cross-compiler ; then
-		# Cache known values for targets. #486680
-
-		tc-export CC
-		local var val t types=(
-			char "short int" int "long int" "long long"
-			"unsigned char" "unsigned short int" "unsigned int"
-			"unsigned long int" "unsigned long long"
-			float double "long double" size_t ssize_t ptrdiff_t
-			mode_t uid_t gid_t pid_t dev_t time_t wchar_t
-			"char *" "unsigned char *"
-		)
-		for t in "${types[@]}" ; do
-			var="ac_cv_sizeof_${t// /_}"
-			var=${var//[*]/p}
-			val=$(ac_cv_sizeof "${t}") || die "could not compute ${t}"
-			export "${var}=${val}"
-			einfo "Computing sizeof(${t}) as ${val}"
-		done
-		# We don't have these types.
-		export ac_cv_sizeof___int64=0
-		export ac_cv_sizeof_unsigned___int64=0
-		export ac_cv_sizeof_major_t=${ac_cv_sizeof_dev_t}
-		export ac_cv_sizeof_minor_t=${ac_cv_sizeof_dev_t}
-		export ac_cv_sizeof_wchar=${ac_cv_sizeof_wchar_t}
-
-		export ac_cv_type_prototypes="yes"
-		export ac_cv_func_mlock{,all}="yes"
-		export ac_cv_func_{e,f,g}cvt=$(usex elibc_glibc)
-		export ac_cv_func_dtoa_r="no"
-		export ac_cv_func_sys_siglist{,_def}="no"
-		export ac_cv_func_printf_{j,ll}="yes"
-		export ac_cv_realloc_null="yes"
-		export ac_cv_no_user_malloc="no"
-		export ac_cv_var_timezone="yes"
-		export ac_cv_var___progname{,_full}="yes"
-		export ac_cv_fnmatch_igncase="yes"
-		export ac_cv_file__dev_{fd_{0,1,2},null,std{err,in,out},tty,zero}="yes"
-		export ac_cv_file__usr_src_linux_include="no"
-
-		case $(cdrtools_os) in
-		linux)
-			export ac_cv_func_bsd_{g,s}etpgrp="no"
-			export ac_cv_hard_symlinks="yes"
-			export ac_cv_link_nofollow="yes"
-			export ac_cv_access_e_ok="no"
-
-			export ac_cv_dev_minor_noncontig="yes"
-			case ${ac_cv_sizeof_long_int} in
-			4) export ac_cv_dev_minor_bits="32";;
-			8) export ac_cv_dev_minor_bits="44";;
-			esac
-
-			cat <<-EOF >"${T}"/test.c
-			struct {
-				char start[6];
-				unsigned char x1:4;
-				unsigned char x2:4;
-				char end[5];
-			} a = {
-				.start = {'S', 't', 'A', 'r', 'T', '_'},
-				.x1 = 5,
-				.x2 = 4,
-				.end = {'_', 'e', 'N', 'd', 'X'},
-			};
-			EOF
-			${CC} ${CPPFLAGS} ${CFLAGS} -c "${T}"/test.c -o "${T}"/test.o
-			if grep -q 'StArT_E_eNdX' "${T}"/test.o ; then
-				export ac_cv_c_bitfields_htol="no"
-			elif grep -q 'StArT_T_eNdX' "${T}"/test.o ; then
-				export ac_cv_c_bitfields_htol="yes"
-			fi
-			;;
-		esac
-	fi
-}
-
-src_compile() {
-	if use unicode; then
-		local flags="$(test-flags -finput-charset=ISO-8859-1 -fexec-charset=UTF-8)"
-		if [[ -n ${flags} ]]; then
-			append-flags ${flags}
-		else
-			ewarn "Your compiler does not support the options required to build"
-			ewarn "cdrtools with unicode in USE. unicode flag will be ignored."
-		fi
-	fi
-
-	# If not built with -j1, "sometimes" cdda2wav will not be built.
-	emake -j1 CPPOPTX="${CPPFLAGS}" COPTX="${CFLAGS}" C++OPTX="${CXXFLAGS}" \
-		LDOPTX="${LDFLAGS}" GMAKE_NOWARN="true"
-}
-
-src_install() {
-	# If not built with -j1, "sometimes" manpages are not installed.
-	emake -j1 CPPOPTX="${CPPFLAGS}" COPTX="${CFLAGS}" C++OPTX="${CXXFLAGS}" \
-		LDOPTX="${LDFLAGS}" GMAKE_NOWARN="true" install
-
-	# These symlinks are for compat with cdrkit.
-	dosym schily /usr/include/scsilib
-	dosym ../scg /usr/include/schily/scg
-
-	dodoc ABOUT Changelog* CONTRIBUTING PORTING README.linux-shm READMEs/README.linux
-
-	cd "${S}"/cdda2wav || die
-	docinto cdda2wav
-	dodoc Changelog FAQ Frontends HOWTOUSE NEEDED README THANKS TODO
-
-	cd "${S}"/mkisofs || die
-	docinto mkisofs
-	dodoc ChangeLog* TODO
-
-	# Remove man pages related to the build system
-	rm -rvf "${ED}"/usr/share/man/man5 || die
-}
-
-pkg_postinst() {
-	fcaps_pkg_postinst
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		einfo
-		einfo "Darwin/OS X use the following device names:"
-		einfo
-		einfo "CD burners: (probably) ./cdrecord dev=IOCompactDiscServices"
-		einfo
-		einfo "DVD burners: (probably) ./cdrecord dev=IODVDServices"
-		einfo
-	fi
-}
--- a/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild
@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

 EAPI=7
@ -15,7 +15,7 @@ S=${WORKDIR}/${P/_alpha[0-9][0-9]}

 LICENSE="GPL-2 LGPL-2.1 CDDL-Schily"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
 IUSE="acl caps nls unicode selinux"

 BDEPEND="
@ -33,9 +33,9 @@ DEPEND="
 "

 FILECAPS=(
-	cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
-	cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --
-	cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep usr/bin/readcd
+	-m u+s cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
+	-m u+s cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --
+	-m u+s cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep usr/bin/readcd
 )

 cdrtools_os() {
@ -278,6 +278,9 @@ src_install() {
 	emake -j1 CPPOPTX="${CPPFLAGS}" COPTX="${CFLAGS}" C++OPTX="${CXXFLAGS}" \
 		LDOPTX="${LDFLAGS}" GMAKE_NOWARN="true" install

+	# Let fcaps handle this
+	fperms 0755 /usr/bin/{cdda2wav,cdrecord,readcd}
+
 	# These symlinks are for compat with cdrkit.
 	dosym schily /usr/include/scsilib
 	dosym ../scg /usr/include/schily/scg
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}

 # update this on every bump
@ -54,10 +54,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }

 pkg_postinst() {
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}

 # update this on every bump
@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }

 pkg_postinst() {
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.1.1.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}

 # update this on every bump
@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }

 pkg_postinst() {
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-inherit bash-completion-r1 go-module
+inherit shell-completion go-module
 MY_PV=${PV/_/-}

 # update this on every bump
@ -60,10 +60,8 @@ src_install() {
 	doman "${WORKDIR}"/man/man?/*
 	dobashcomp contrib/completion/bash/docker
 	bashcomp_alias docker dockerd
-	insinto /usr/share/fish/vendor_completions.d/
-	doins contrib/completion/fish/docker.fish
-	insinto /usr/share/zsh/site-functions
-	doins contrib/completion/zsh/_*
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
 }

 pkg_postinst() {
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
@ -2,6 +2,8 @@ DIST incus-6.0.3.tar.xz 11916020 BLAKE2B d3d998bd50124604c52ff007eefed586c216ce1
 DIST incus-6.0.3.tar.xz.asc 833 BLAKE2B 38835ab036709161150992cb40df4ff1ae1887d4f3e0b037d0415f75d2bb711cb3c5945bffe1b91d289acfb7e19e726964278e5c2ab31731ba9f7534f139dec7 SHA512 7d5360ab91aafe1d047a60e38a07e24c3c7b158e753087a943ec5e59d6a27c19a872080c9007b6cf592040d3408845bc188d76f6e732408d0680a3782cebce47
 DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1b5487dc98901f000894b3781aec89f617d2246314cf9a95a7d65531e486c4092f8939722e1b3c2bf7d33063c8 SHA512 14a5cdad3f9365d58e526c8f451d9e7a57729010073caff31256e0b94d28206adc82ead4820278e7eac17b74d22a76d9f3b9f5f8424ddbfa6b74a5cea13e019f
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
+DIST incus-6.0.5.tar.xz 12532820 BLAKE2B a256c37c309d82f6326ede3d90e20522ff91317b1bce0a4dc1c391c2694599c7f3f6ab06368757a12e85133f82bd85ea4d50906dc250f43563a6ff765850b874 SHA512 b209dde671b13e101ccdf0daf975ae8547d050ec95e67ad1ee17aa99761e8ed3327e7edace0c4394aa79932d11b846e0f1edf5f95b2ad0b56eafca9905e844c8
+DIST incus-6.0.5.tar.xz.asc 833 BLAKE2B 1e8818fdb2edf9ff0d0288d2a7d61585571a0fdfe514e1bdf05b27b607560115168c07d420f8384d07d216fdc8dc1f31113fa5afa4838042743636974bf76151 SHA512 d0412fe8850ff5783d4c3cee982ff8beac74f19c5dc538438fc210b9f7421bcb6e663e4c32f9a2604f1a5e2f42d8bb8d3f8e599f15a0fa1b5fa6f1bc1982b1dd
 DIST incus-6.14.tar.xz 12509468 BLAKE2B ec3bb614088d82e07c13169a6b26d8c83214fddbdf30049d58f2cca2678a16ccb6acca7bba68d4e15a514dad71639a144a7b2f4b9f3efdf9c8ca8d750692e250 SHA512 186abb32dcfbe851f04131ea7a9256fafaa465d40379e825554275697e04f005920c09939a8cb199b499b60df667921900c4a2d5b9a7ab9bd20b3e473468dbf1
 DIST incus-6.14.tar.xz.asc 833 BLAKE2B c9cfa631bb316234a6958f2aa3e708e32ea2fca34357700e7d1e38723be539f5b6b1484597c18baca1f22d922c7aca148463dfc0b818f7809126e6873e4826b5 SHA512 6a2f4ceeab44462cca74799a1c135eeb17cbece3d270c5195c3eacda8ea24419fc34cab6d157dbfed803bb269df42a02abc417b98887cec5f10b0ec70b430644
 DIST incus-6.15.tar.xz 12716184 BLAKE2B bc821575f7f24b42054028ce628a29f38ef41b8a31a94f34381019306681f9279ae6c36cb00b7f84d62f5ddc89d27216d753e5c0f5ec1d327bbd283ab5fe1e15 SHA512 7561abce8eb9c01764aca9bb5477028439c05f6c1c20637f288028be93f4bc0d74a36af76f7ad0e35028dfe40e2a0bb2d7b4a363d1da35fe657072f5d847c78e
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.5.ebuild
@ -0,0 +1,252 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
+		local bindir="_dist/bin/linux_${GOARCH}"
+	else
+		local bindir="_dist/bin"
+	fi
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
--- a/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/lxc/Manifest
@ -4,3 +4,5 @@ DIST lxc-6.0.3.tar.gz 964210 BLAKE2B 8d5dec7f088111a2ca82aadd6cd90eb30a3a1b61900
 DIST lxc-6.0.3.tar.gz.asc 833 BLAKE2B 3a23eacfdd248a95c9fa41a6edcb55abb07abc81314fa227649663ac264a9e5fdcf81cb38b79f1bd51b9172a70a0aee5bf65ecfdaf438c944c25f11c882ab562 SHA512 5de32e772bd2864e3b688a90fd9f08d98829d61ba3e1cc76a9b403fc005256149f55ad034e186c3329f3abe52a8815f60c5027b16de46be0bc81b14d0134babd
 DIST lxc-6.0.4.tar.gz 964064 BLAKE2B f8911993ce333300e68fe3d817cceb49d6c18f83e5fec1ab2da8ba6f0820808883cf73ce1f7dea2725c6279d87e6fcc0a3feeaeadad76112a47ef69265dbef50 SHA512 8ccdd9cf37b8b75e1e58021bc9bd7841faf3a2790d07f0214b6c8bde7a23e579345f576079a541dba5e71361bf5672af9d482a9e82323068ca0f7291f6063aaf
 DIST lxc-6.0.4.tar.gz.asc 833 BLAKE2B 4600373e9534515fe3ec0c41ebe5b17ee8c4e7ab125e3a211ed300f0fdd79a04a9c183b903e1b6600d7b7ce4d9f2e66451326c473beb02b4a83a7200764e56e7 SHA512 2efe6e06b33a34fdf7ba1393b5e07aa1a18f189b2e43673b4f9bbdc7cf0fcb9ad47b99ebbd08e910e139047d54b1104f098cbbef586796767b9dd1a4a99ca748
+DIST lxc-6.0.5.tar.gz 958966 BLAKE2B 74ee775f8a23467049f38f0973a24eb12b34b7c758549294342470b7b6b8e95eaef118c493f62b6394c435a5c86389fde4454199107e90743dd40d3a5bf373fd SHA512 3674397e789ed9eda7e37d4e22c42ab02687c0ab6a12f6c234a3393bdfb3f048aa0ded419c5c2f435d653d3dd70f47ae19d28b7a46838f12004d00b05c54a26d
+DIST lxc-6.0.5.tar.gz.asc 833 BLAKE2B ac1480c0b5588b290ab1ec81bf7bf85990df98a650832363529e9ede8afb7594bd21b58a4a79e7fe9519c381d4860d7a33f4090582612ffff7c448c77e641929 SHA512 8c28da0ebc280ae491bab815105f3c58f2c9cd742586ce86f9b1d2032724db4893811d689f7278bfc8c5570dc45ca6071e4c25b77647d762c77eca59249a15b5
--- a/sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/lxc/lxc-6.0.5.ebuild
@ -0,0 +1,168 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3"
+SLOT="0/1.8" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps examples io-uring man pam seccomp selinux ssl systemd test +tools"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS CONTRIBUTING MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="sysvinit")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream sysvinit/systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		rm "${ED}"/etc/init.d/lxc-{containers,net} || die "Failed to remove sysvinit scripts"
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-2.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-2.0.0.ebuild
@ -27,7 +27,7 @@ LICENSE="GPL-2 LGPL-2.1"
 # Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
 # Subslot: SONAME of each: <libgpgme.FUDGE>
 SLOT="1/45.0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="common-lisp static-libs test"
 RESTRICT="!test? ( test )"

--- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
@ -1,2 +1,3 @@
 DIST krb5-1.21.3.tar.gz 9136145 BLAKE2B e909a55eaedab68e5c829bb7bbd26cec5db2d7b8d97f3b034de94d8f957003f16977ac619afee3b862f288e59f05c5e44f41e65b8883961c8b22a26e2f4733bc SHA512 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71
+DIST krb5-1.22.1.tar.gz 8747101 BLAKE2B aed6a7f511ae7085a81fa6dc553881ea478bb8bb8aa43ab13e1312ead392fb93173998bfdfc730dca4d715b2ed52da6a12f2417f95525d9ff5c4629e8ca5fedc SHA512 c33bfada5e0c035133436031d9818ad97b0ff08578691c832b743c55751a2cf9460501d3cc658ab79655ed7a0f9f4795ba94b363d6b616795d9bdca668825c52
 DIST mit-krb5-1.21.3-c23.patch.xz 59948 BLAKE2B f611ccda16ee4e2bcfbdbaf72204f0ede6ebe3517f4df016ae7db9c364bc55d81e1e32aaaa0506197ddca09555a5a4d3ef75f7c33b6434115b6c57bd99f1bcb5 SHA512 35b226b351a81f4610e1ef2be9822a57f94f9cc5017ed082584fb8c85a0f0be78b8e9fda4fc5c78248421be39517df639cee9cae49ddccf3d62f1a0cff4224ae
--- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.22.1.ebuild
@ -0,0 +1,155 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{12..14} )
+inherit autotools flag-o-matic python-any-r1 systemd toolchain-funcs multilib-minimal
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+S=${WORKDIR}/${MY_P}/src
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux test xinetd"
+
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb:= )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-alternatives/yacc
+	>=sys-fs/e2fsprogs-1.46.4-r51
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? ( dev-util/cmocka )
+	"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# lto-type-mismatch (bug #854225)
+	filter-lto
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--enable-thread-support \
+		--disable-rpath
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif"
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif"
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/Manifest
@ -1,2 +1,4 @@
 DIST pinentry-1.3.1.tar.bz2 611233 BLAKE2B 47a510b3746fc8cdd83b56302132f4f4d9c61324fc857ce0867387f70f79490dad375bca4dc72e5d1cdca707bf89a16e1c9a20bf1aa0e857d69e59dc59403afd SHA512 3b72034dc1792b1475acb6d605ff7c1bd7647a0f02d1b6bdcd475acdef24bc802f49e275055436c3271261c4b7a64168477a698aab812a145962146b2f67a0e2
 DIST pinentry-1.3.1.tar.bz2.sig 119 BLAKE2B ca562d2903c88c4297e641ddc39f6cd99db3e3fd40cf5d69e7b4335f006c7717c874fa4b5e47920af3ec97385a96c0c96aafb849cf399d11a7f9f1a6b693f479 SHA512 22bd94f74486300eb84c1c9c371a43b05fb6179118518004fba0d42b6d3e6731f94d79b37c2a3a6b0c5886578c4575f75d2460accd36cd4874342e7239521be9
+DIST pinentry-1.3.2.tar.bz2 612858 BLAKE2B 985bcf0b4f85d4e5001bfd714ddd064e05ba6d5bd6e1d3b6f1044f27ca148921d22148b301c91cce4fa7f2f7e7f3b743a9bc1383cb9d8e1d0583a595109a699e SHA512 3b4d50a42d412d649a7830f7378aa966342c2bc0157d03b0ad79cf0aed29d6698d48c734e23b1dccada5f6ef81d0c09d3ead6cd703eadfc8082987e6bea0aafc
+DIST pinentry-1.3.2.tar.bz2.sig 266 BLAKE2B 1c428abb285dd56566a83fe4ceef5e0efc3b2a9ed40a2a0b48e7dc06575d24044677091f6a042e1f08ac6308f2bb1e82eddc82f22b78f1a316ca78ed670745f3 SHA512 82352cb5183a7922ab27619e19fc4d7adaa461847040232610b002365db605200961d1d950887aa5b09d12488d70f432fe739e0e2501a28465a28fb428b62aad
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.2.ebuild
@ -0,0 +1,119 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools qmake-utils verify-sig
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/related_software/pinentry/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="caps efl emacs gtk keyring ncurses qt6 wayland X"
+
+DEPEND="
+	>=dev-libs/libassuan-2.1:=
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	efl? ( dev-libs/efl[X] )
+	keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:= )
+	qt6? (
+		dev-qt/qtbase:6[gui,widgets]
+		wayland? (
+			kde-frameworks/kguiaddons:6
+			kde-frameworks/kwindowsystem:6
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	gtk? ( app-crypt/gcr:4[gtk] )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+PDEPEND="emacs? ( app-emacs/pinentry )"
+IDEPEND=">=app-eselect/eselect-pinentry-0.7.4"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+	"${FILESDIR}/${PN}-1.3.0-automagic.patch" # bug #819939, bug #837719
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	unset FLTK_CONFIG
+
+	local myeconfargs=(
+		$(use_enable efl pinentry-efl)
+		$(use_enable emacs pinentry-emacs)
+		$(use_enable keyring libsecret)
+		$(use_enable gtk pinentry-gnome3)
+		$(use_enable ncurses fallback-curses)
+		$(use_enable ncurses pinentry-curses)
+		$(use_enable qt6 pinentry-qt)
+		$(use_with X x)
+
+		--enable-pinentry-tty
+		--disable-kf5-wayland
+		--disable-pinentry-fltk
+		--disable-pinentry-gtk2
+		--disable-pinentry-qt5
+		--disable-qtx11extras
+
+		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+	)
+
+	if use qt6 ; then
+		export PATH="$(qt6_get_bindir):${PATH}"
+		export QTLIB="$(qt6_get_libdir):${QTLIB}"
+		export MOC="$(qt6_get_libdir)/qt6/libexec/moc"
+
+		myeconfargs+=(
+			$(use_enable wayland kf6-wayland)
+		)
+	else
+		myeconfargs+=(
+			--disable-kf6-wayland
+		)
+	fi
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/bin/pinentry || die
+
+	# The preferred Qt implementation upstream gets installed as just 'qt'.
+	# Make a symlink for eselect-pinentry and friends.
+	if use qt6 ; then
+		dosym pinentry-qt /usr/bin/pinentry-qt6
+	fi
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/Manifest
@ -1,3 +1,2 @@
 DIST sbsigntool-0.8-ccan.tar.gz 113537 BLAKE2B 8fbf27463d30c1895930628a145be2d521ae4f6adb7af3299bf2f5f4319fd643df0a07347ef6851bd41d233af4c3fc5f77002771af1c43aa0f20665aef2390b8 SHA512 6857096879f116f1802eb6b44789cbea7bb24440bc0f16503aeadf5f276fa45943f322f844dbb9abee717655205d82b830143be3a7f4424fd4146b9360674a09
-DIST sbsigntools-0.9.4.tar.gz 57714 BLAKE2B 94797af6c98a9c13cb71e52ba6f7ff07de70660af2194b14061e0cb618d6effff52ef7a4dd2fd4e44e75f022b979442d4290b1d65d63017b2fbebdca5951c5c9 SHA512 953d3d9a7f92b837da966eabe3572163a29c5292e792d5ef17cf842d7373ffaa901377cb4ec68006a6ef2f9c97d48db8ffdd3a6d2853be67016d3484a118bba9
 DIST sbsigntools-0.9.5.tar.gz 57876 BLAKE2B 677f87eac9fba9185acd7e25b8d7a3682083938313f3086aaaa6871e010bd403bdda5b9a5fe931151af75a344802c964918be8feb38ec6229d9a16c5b63416b6 SHA512 3b23bdf1855132a91e2063039bd4d14c5564e9cd8f551711aa89a91646ff783afb6e318479e9cf46eedbc914a1eade142398c774d8dbfef8fd1d65cbbe60aabd
--- a/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/sbsigntools/sbsigntools-0.9.4-r1.ebuild
@ -1,53 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-MY_PN="${PN::-1}"
-
-inherit autotools toolchain-funcs
-
-DESCRIPTION="Utilities for signing and verifying files for UEFI Secure Boot"
-HOMEPAGE="https://git.kernel.org/cgit/linux/kernel/git/jejb/sbsigntools.git/"
-SRC_URI="https://git.kernel.org/pub/scm/linux/kernel/git/jejb/${PN}.git/snapshot/${P}.tar.gz
-	https://dev.gentoo.org/~tamiko/distfiles/${MY_PN}-0.8-ccan.tar.gz"
-
-LICENSE="GPL-3 LGPL-3 LGPL-2.1 CC0-1.0"
-SLOT="0"
-KEYWORDS="amd64 arm64 ~riscv x86"
-IUSE=""
-
-RDEPEND="
-	dev-libs/openssl:0=
-	sys-apps/util-linux"
-DEPEND="${RDEPEND}
-	sys-apps/help2man
-	sys-boot/gnu-efi
-	sys-libs/binutils-libs
-	virtual/pkgconfig"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.9.4-no-werror.patch
-	"${FILESDIR}"/${PN}-0.9.4-openssl3.patch
-)
-
-src_prepare() {
-	mv "${WORKDIR}"/lib/ccan "${S}"/lib || die "mv failed"
-	rmdir "${WORKDIR}"/lib || die "rmdir failed"
-
-	local iarch
-	case ${ARCH} in
-		amd64) iarch=x86_64 ;;
-		arm64) iarch=aarch64 ;;
-		ia64)  iarch=ia64 ;;
-		riscv) iarch=riscv64 ;;
-		x86)   iarch=ia32 ;;
-		*)     die "unsupported architecture: ${ARCH}" ;;
-	esac
-	sed -i "/^EFI_ARCH=/s:=.*:=${iarch}:" configure.ac || die
-	sed -i 's/-m64$/& -march=x86-64/' tests/Makefile.am || die
-	sed -i "/^AR /s:=.*:= $(tc-getAR):" lib/ccan/Makefile.in || die #481480
-
-	default
-	eautoreconf
-}
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@ -1,5 +1,3 @@
-DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8d74b664b1f38e7f0555f812c25de494d8c18628f08e065738e6cfd2082769fc8367478a53849f1923d461027acca16f2a66a SHA512 99a361f0c4a144bf89f3dfdd02d298ef6c3a7138cd2b4e151449559fafaf6e83403ad73334494239c827bbc25eef30e701945b1783c9cc16aeff94fdf29679bb
-DIST eclass-manpages-20250704.tar.xz 484052 BLAKE2B 9711ec8ba766335eb73cfa69cd406960055213eb7d29f7a1e7fd1fcef504e8becc4f638eb351a54dd5032725bdcb43342dba38d80929aa8843d31be03e8332d4 SHA512 a96be86457a9268e986e07496d4a0ac07737ee58e63d7b4e7d4538519b47795d0cbf164520ab253645befeafae35e79832386a0a6dfce5f686f5c25e62a0d413
-DIST eclass-manpages-20250705.tar.xz 498848 BLAKE2B 0a7907abaf983968c219ae26f3c5f0a0e33103b94ea7afdfad06cea22810094e0fdec2bfb150def85158922a444bdb675c0ae3d618d4a6a52175b83771f9e03a SHA512 2fb686403c8307e3a5259c15abdd23bf117ca9d4bcbda2b301e68755a0ba6dc3a2a4fac48d64803cca72626e410295e8684c0a45812788353cd11366b4df8f36
 DIST eclass-manpages-20250711.tar.xz 499388 BLAKE2B 7f4df3869449444fbc8805f468ea06754b8942eef3aec362765a54ed1e81d644e104847f1ded853321b79d45bfb5f818c5da49bfa8fec9c9d482016a4d2f540c SHA512 e4922972cd282d851405f9f9a3223924df27f7edfda40f0faabcbe5d072936039998cf63823faac8e50c6fcf2851cde7d57c0eee9d291a9469c7c11d70aa5672
 DIST eclass-manpages-20250730.tar.xz 502128 BLAKE2B f798b31c2ac69ab58015941c1cc4cb51b80d70e68f1b9eaf69dcbbe9cd0b488c3b66da2852eb0d8247b62ebfb7faddd13db7a9ddfc312162e3203b09d130263d SHA512 ef8514d5cf79b2549a0bf04deff844bf2bd039644f8a8f4c31201ee681ca94dc8182484685398b432169af7d6c93e3a2794329bc703635aa965414ab32f6823a
+DIST eclass-manpages-20250815.tar.xz 505524 BLAKE2B af3a3d4f98ed9de28c4c4555f556b03372a32a8e3d88d34f29917200a14347409f391736ea1eb60025fb8ac734d34de03407845c5d484ce99b0d6278f33ccc0d SHA512 3addcf0d7e24bb254bd720fb75a8385893174a4693dddab29a389e5a292e83a282abece87b1f237a2eab8f2c17227c9e3bea6bc6cbc7cc3d13cd0da03fc8af00
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250704.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250704.ebuild
@ -1,24 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Instructions to make a dist tarball:
-# git clone https://github.com/projg2/eclass-to-manpage.git
-# cd eclass-to-manpage
-# make dist ECLASSDIR=~/g/eclass/
-
-DESCRIPTION="Collection of Gentoo eclass manpages"
-HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
-SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0"
-# Keep the keywords stable. No need to change to ~arch.
-KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-BDEPEND="sys-apps/gawk"
-
-src_install() {
-	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
-}
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250705.ebuild
@ -1,24 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Instructions to make a dist tarball:
-# git clone https://github.com/projg2/eclass-to-manpage.git
-# cd eclass-to-manpage
-# make dist ECLASSDIR=~/g/eclass/
-
-DESCRIPTION="Collection of Gentoo eclass manpages"
-HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
-SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0"
-# Keep the keywords stable. No need to change to ~arch.
-KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-BDEPEND="sys-apps/gawk"
-
-src_install() {
-	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
-}
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250815.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250815.ebuild
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
@ -1,3 +1,4 @@
 DIST nano-8.3.tar.xz 1681216 BLAKE2B 39c400483f79f11da0f959fed769462b65007f9235cb76d38e71d0a63919b659dc553d44f5d13dd13db801ec361fd7a3ad68b68bfa456ac6c169c861e80c6067 SHA512 9f57bb16a30240fdfc8fc31f5a55f681b80dd72de66fa143ef36c59ab696cc672d8fa054f5a4a547324db3deb2fe2f777cd7c1c023b571e2bb36c86a783ff1d6
 DIST nano-8.4.tar.xz 1691256 BLAKE2B 2e5dbe6982ef9d284c6e018abad593bf383f27c85047241bafaa098948b73897c0a81b63aa453385ac93afc1c398936464d5a1fb024d00936ad383c5e5e4403f SHA512 1b8258e341a8722114b24af9d4676fbd8a91dc3639786a81bcd192a7b4fbca87581ab8ebe49493dfb3599ae90b59f4df8ae2a4ee0c0c7ccec9a49b563c82f44a
 DIST nano-8.5.tar.xz 1707128 BLAKE2B 85de6d5349ed2332d41c054ff64979d7b00ec3c792564fcfb6ebed56b74a17c948117218a50297fead17674c06755afba393e73466eb2af9d3bb33af085c4f23 SHA512 d79562b2adbfe165e565b80ab4339e24f4a0ea464a97dfb7dce166df851b514c83e5071d89bee97759c0d6ff7d1fab1da97eaa0e742f3913d5c41a5539a3d8a1
+DIST nano-8.6.tar.xz 1707688 BLAKE2B f7e17085d237ec3512b21bb732c2ebcf71a96991344acd0efc3592a650be856aed3ad958df59e27f332f750ac5e46ba7ed06b23093c8b68c4bf0a94aeecd2af0 SHA512 f783c59d2fb47e121c63779c4ce8c6d5e90c31184ca28449c6c9270933d02e19ee60d29b6c9a1122fe59de1132d56d9e402cc63fc88f847cea2b4af6302524ea
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.6.ebuild
@ -0,0 +1,105 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
+	inherit autotools git-r3
+else
+	MY_P="${PN}-${PV/_}"
+	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="GNU GPL'd Pico clone with more functionality"
+HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Guide"
+
+LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
+SLOT="0"
+IUSE="debug justify magic minimal ncurses nls +spell unicode"
+
+RDEPEND="
+	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
+	magic? ( sys-apps/file )
+	nls? ( virtual/libintl )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	magic? ( !minimal )
+"
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN static_assert )
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconfargs=(
+		--bindir="${EPREFIX}"/bin
+		--htmldir=/trash
+		$(use_enable !minimal color)
+		$(use_enable !minimal multibuffer)
+		$(use_enable !minimal nanorc)
+		$(use_enable magic libmagic)
+		$(use_enable spell speller)
+		$(use_enable justify)
+		$(use_enable debug)
+		$(use_enable nls)
+		$(use_enable unicode utf8)
+		$(use_enable minimal tiny)
+	)
+
+	econf "${myconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	# Don't use "${ED}" here or things break (#654534)
+	rm -r "${D}"/trash || die
+
+	dodoc doc/sample.nanorc
+	docinto html
+	dodoc doc/faq.html
+	insinto /etc
+	newins doc/sample.nanorc nanorc
+
+	if ! use minimal ; then
+		# Enable colorization by default.
+		sed -i \
+			-e '/^# include /s:# *::' \
+			"${ED}"/etc/nanorc || die
+
+		# Since nano-5.0 these are no longer being "enabled" by default
+		# (bug #736848)
+		local rcdir="/usr/share/nano"
+		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
+		rmdir "${ED}"${rcdir}/extra || die
+
+		insinto "${rcdir}"
+		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
+	fi
+}
+
+pkg_postrm() {
+	[[ -n ${REPLACED_BY_VERSION} ]] && return
+
+	local e
+	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
+	if [[ ${e##*/} == nano ]]; then
+		ewarn "The EDITOR variable is still set to ${e}."
+		ewarn "You can update it with \"eselect editor\"."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
@ -2,4 +2,5 @@ DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d5
 DIST vim-9.1.0794.tar.gz 18235753 BLAKE2B 6ab377e6e0661ff8d4f0de2526b29b1c58c128babff662144425665582d390f772b9ded38ec21db4c32c4d68441b566500c434139f23f1ea79af8b7ecd693953 SHA512 38106d56c774b8f1dfed16953c07ff09c411bba5c7ab69e696ee9423dabdec9b0b405665fbd2411122f9963d3af8f9a259cc56b2954443ab41a14a8f2476624a
 DIST vim-9.1.1436.tar.gz 18860692 BLAKE2B ae0471654446ff4101f2df698f46c59c9d634336a6dd762732e46238e97bb6fd00a42b56cad3ae5cce572da2fc3cc65490cd10a024419940352fddd285bd6e23 SHA512 c6007fecf7e8ba2134246b0072ebfa8ce0f85666ac96a6ccc1a81e23a4e46a6b75c136823cdf6dccb6dfdf703affaede9ce83988cf8fe7e5542087a769e61961
 DIST vim-9.1.1500.tar.gz 18567738 BLAKE2B 9222c3245eed55b71b228562ee768857207b3198d738dddfab0fdbb3bb8e497a906fedc497f55a416d4e05c5dda4cd0d373298557fe05c554a03c28732c06bba SHA512 f36a80bf76ea2813aba64d5ce7c6d60241609409bdb70d3a1a622fdcab826d9c8d61a611379125428136afc64b309ca92c33c265dfc276a1bebfc0d4f5d71253
+DIST vim-9.1.1652.tar.gz 18776578 BLAKE2B c4cc711ee996d6b7268c243c1fae01600d104763f6eee2abbe342f2cf9ee90fb6ee3f0b44fe4814ff47ae13c5a391510c3b711c92acbee591e290da621289029 SHA512 f1dfb1dc0fd834fa3ffb40c31f48de78b48225c9d67667f069ff8b23a6a76d534f3e228b936141616a33a0d73445626dcd2ff52a8571e9f4370a8fbcad9771d7
 DIST vim-patches-vim-9.1.1432-patches.tar.bz2 2618 BLAKE2B fe7c302c71fbf66f1921e1b55e2f67914ed104ab86e2a6cf2e6bf67c98214f13f1d8ff1ed7015ec41a5665c692946e20ec5bdf4806e789a70e34c0c888472739 SHA512 a794a7e4d9014d5508db7b205404f5a4b44748a82c5599a26c1ec6b06d3105f6cebf9a93a058f65ad853bbadf432034fc8257a7c77b4f3446331b9d66c19b3af
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.1652.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.1652.ebuild
@ -0,0 +1,233 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim and app-editors/gvim
+
+VIM_VERSION="9.1"
+VIM_PATCHES_VERSION="9.1.1432"
+inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+		# https://github.com/douglarek/gentoo-vim-patches/releases/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="vim and gvim shared files"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+S="${WORKDIR}/vim-${PV}"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="nls acl minimal"
+
+# ncurses is only needed by ./configure, so no subslot operator required
+DEPEND=">=sys-libs/ncurses-5.2-r2:0"
+BDEPEND="dev-build/autoconf"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898406):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i \
+		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "sed failed"
+
+	# See bug #77841. We remove this file after the tarball extraction.
+	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
+	# everyone since previous flag filtering bugs have turned out to affect
+	# multiple archs...
+	replace-flags -O3 -O2
+
+	# Fix bug #18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+
+	# Remove src/auto/configure file.
+	rm -v src/auto/configure || die "rm configure failed"
+
+	# bug 908961
+	if use elibc_musl ; then
+		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
+	fi
+}
+
+src_configure() {
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug 24447). The hvc
+	# things are for ppc64, see bug 86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	# Let Portage do the stripping. Some people like that.
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	local myconf=(
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
+		--enable-gui=no
+		--without-x
+		--disable-darwin
+		--disable-perlinterp
+		--disable-pythoninterp
+		--disable-rubyinterp
+		--disable-gpm
+		--disable-selinux
+		$(use_enable nls)
+		$(use_enable acl)
+	)
+
+	# Keep Gentoo Prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake -j1 -C src auto/osdef.h objects
+	emake tools
+}
+
+src_test() { :; }
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	dodir /usr/{bin,share/{man/man1,vim}}
+	emake -C src \
+		installruntime \
+		installmanlinks \
+		installmacros \
+		installtutor \
+		installtutorbin \
+		installtools \
+		install-languages \
+		DESTDIR="${D}" \
+		BINDIR="${EPREFIX}"/usr/bin \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		DATADIR="${EPREFIX}"/usr/share
+
+	keepdir ${vimfiles}/keymap
+
+	# default vimrc is installed by vim-core since it applies to
+	# both vim and gvim
+	insinto /etc/vim/
+	newins "${FILESDIR}"/vimrc-r7 vimrc
+	eprefixify "${ED}"/etc/vim/vimrc
+
+	if use minimal; then
+		# To save space, install only a subset of the files.
+		# Helps minimalize the livecd, bug 65144.
+		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
+		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
+		rm -v "${ED}"/usr/bin/vimtutor || die
+
+		for f in "${ED}${vimfiles}"/colors/*.vim; do
+			if [[ ${f} != */@(default).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+
+		for f in "${ED}${vimfiles}"/syntax/*.vim; do
+			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+	fi
+
+	newbashcomp "${FILESDIR}"/xxd-completion xxd
+
+	# install gvim icon since both vim/gvim desktop files reference it
+	doicon -s scalable "${FILESDIR}"/gvim.svg
+}
+
+pkg_postinst() {
+	# update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
@ -2,4 +2,5 @@ DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d5
 DIST vim-9.1.0794.tar.gz 18235753 BLAKE2B 6ab377e6e0661ff8d4f0de2526b29b1c58c128babff662144425665582d390f772b9ded38ec21db4c32c4d68441b566500c434139f23f1ea79af8b7ecd693953 SHA512 38106d56c774b8f1dfed16953c07ff09c411bba5c7ab69e696ee9423dabdec9b0b405665fbd2411122f9963d3af8f9a259cc56b2954443ab41a14a8f2476624a
 DIST vim-9.1.1436.tar.gz 18860692 BLAKE2B ae0471654446ff4101f2df698f46c59c9d634336a6dd762732e46238e97bb6fd00a42b56cad3ae5cce572da2fc3cc65490cd10a024419940352fddd285bd6e23 SHA512 c6007fecf7e8ba2134246b0072ebfa8ce0f85666ac96a6ccc1a81e23a4e46a6b75c136823cdf6dccb6dfdf703affaede9ce83988cf8fe7e5542087a769e61961
 DIST vim-9.1.1500.tar.gz 18567738 BLAKE2B 9222c3245eed55b71b228562ee768857207b3198d738dddfab0fdbb3bb8e497a906fedc497f55a416d4e05c5dda4cd0d373298557fe05c554a03c28732c06bba SHA512 f36a80bf76ea2813aba64d5ce7c6d60241609409bdb70d3a1a622fdcab826d9c8d61a611379125428136afc64b309ca92c33c265dfc276a1bebfc0d4f5d71253
+DIST vim-9.1.1652.tar.gz 18776578 BLAKE2B c4cc711ee996d6b7268c243c1fae01600d104763f6eee2abbe342f2cf9ee90fb6ee3f0b44fe4814ff47ae13c5a391510c3b711c92acbee591e290da621289029 SHA512 f1dfb1dc0fd834fa3ffb40c31f48de78b48225c9d67667f069ff8b23a6a76d534f3e228b936141616a33a0d73445626dcd2ff52a8571e9f4370a8fbcad9771d7
 DIST vim-patches-vim-9.1.1432-patches.tar.bz2 2618 BLAKE2B fe7c302c71fbf66f1921e1b55e2f67914ed104ab86e2a6cf2e6bf67c98214f13f1d8ff1ed7015ec41a5665c692946e20ec5bdf4806e789a70e34c0c888472739 SHA512 a794a7e4d9014d5508db7b205404f5a4b44748a82c5599a26c1ec6b06d3105f6cebf9a93a058f65ad853bbadf432034fc8257a7c77b4f3446331b9d66c19b3af
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.1652.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.1652.ebuild
@ -0,0 +1,373 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim-core and app-editors/gvim
+
+VIM_VERSION="9.1"
+VIM_PATCHES_VERSION="9.1.1432"
+
+LUA_COMPAT=( lua5-{1..4} luajit )
+PYTHON_COMPAT=( python3_{10..14} )
+PYTHON_REQ_USE="threads(+)"
+USE_RUBY="ruby31 ruby32"
+
+inherit vim-doc flag-o-matic bash-completion-r1 lua-single python-single-r1 ruby-single toolchain-funcs desktop xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+		# https://github.com/douglarek/gentoo-vim-patches/releases/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="Vim, an improved vi-style text editor"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="X acl crypt cscope debug gpm lua minimal nls perl python racket ruby selinux sound tcl terminal vim-pager"
+REQUIRED_USE="
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	vim-pager? ( !minimal )
+"
+
+RDEPEND="
+	>=app-eselect/eselect-vi-1.1
+	>=sys-libs/ncurses-5.2-r2:0=
+	nls? ( virtual/libintl )
+	acl? ( kernel_linux? ( sys-apps/acl ) )
+	crypt? ( dev-libs/libsodium:= )
+	cscope? ( dev-util/cscope )
+	gpm? ( >=sys-libs/gpm-1.19.3 )
+	lua? ( ${LUA_DEPS}
+		$(lua_gen_impl_dep 'deprecated' lua5-1)
+	)
+	~app-editors/vim-core-${PV}
+	vim-pager? ( app-editors/vim-core[-minimal] )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	racket? ( dev-scheme/racket )
+	ruby? ( ${RUBY_DEPS} )
+	selinux? ( sys-libs/libselinux )
+	sound? ( media-libs/libcanberra )
+	tcl? ( dev-lang/tcl:0= )
+	X? ( x11-libs/libXt )
+"
+DEPEND="${RDEPEND}
+	X? ( x11-base/xorg-proto )
+"
+# configure runs the Lua interpreter
+BDEPEND="
+	dev-build/autoconf
+	lua? ( ${LUA_DEPS} )
+	nls? ( sys-devel/gettext )
+"
+PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898452):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+
+	use lua && lua-single_pkg_setup
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i -e \
+		'1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "mve.awk sed failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i -e \
+		's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# conditionally make the manpager.sh script
+	if use vim-pager; then
+		cat > "${S}"/runtime/macros/manpager.sh <<-_EOF_ || die "cat EOF failed"
+			#!/bin/sh
+			sed -e 's/\x1B\[[[:digit:]]\+m//g' | col -b | \\
+					vim \\
+						-c 'let no_plugin_maps = 1' \\
+						-c 'set nolist nomod ft=man ts=8' \\
+						-c 'let g:showmarks_enable=0' \\
+						-c 'runtime! macros/less.vim' -
+			_EOF_
+	fi
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug 18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+	rm src/auto/configure || die "rm failed"
+
+	# bug 908961
+	if use elibc_musl ; then
+		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
+	fi
+}
+
+src_configure() {
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug #24447). The hvc
+	# things are for ppc64, see bug #86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	local myconf=()
+	if use minimal; then
+		myconf=(
+			--with-features=tiny
+			--disable-nls
+			--disable-canberra
+			--disable-acl
+			--enable-gui=no
+			--without-x
+			--disable-darwin
+			--disable-luainterp
+			--disable-perlinterp
+			--disable-pythoninterp
+			--disable-mzschemeinterp
+			--disable-rubyinterp
+			--disable-selinux
+			--disable-tclinterp
+			--disable-gpm
+		)
+	else
+		use debug && append-flags "-DDEBUG"
+
+		myconf=(
+			--with-features=huge
+			$(use_enable sound canberra)
+			$(use_enable acl)
+			$(use_enable crypt libsodium)
+			$(use_enable cscope)
+			$(use_enable gpm)
+			$(use_enable nls)
+			$(use_enable perl perlinterp)
+			$(use_enable python python3interp)
+			$(use_with python python3-command "${PYTHON}")
+			$(use_enable racket mzschemeinterp)
+			$(use_enable ruby rubyinterp)
+			$(use_enable selinux)
+			$(use_enable tcl tclinterp)
+			$(use_enable terminal)
+		)
+
+		# --with-features=huge forces on cscope even if we --disable it. We need
+		# to sed this out to avoid screwiness. (1 Sep 2004 ciaranm)
+		if ! use cscope; then
+			sed -i -e \
+				'/# define FEAT_CSCOPE/d' src/feature.h || die "sed failed"
+		fi
+
+		if use lua; then
+			# -DLUA_COMPAT_OPENLIB=1 is required to enable the
+			# deprecated (in 5.1) luaL_openlib API (#874690)
+			use lua_single_target_lua5-1 && append-cppflags -DLUA_COMPAT_OPENLIB=1
+
+			myconf+=(
+				--enable-luainterp
+				$(use_with lua_single_target_luajit luajit)
+				--with-lua-prefix="${EPREFIX}/usr"
+			)
+		fi
+
+		# don't test USE=X here ... see bug #19115
+		# but need to provide a way to link against X ... see bug #20093
+		myconf+=(
+			--enable-gui=no
+			--disable-darwin
+			$(use_with X x)
+		)
+	fi
+
+	# let package manager strip binaries
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	# keep prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf \
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)" \
+		"${myconf[@]}"
+}
+
+src_compile() {
+	# The following allows emake to be used
+	emake -j1 -C src auto/osdef.h objects
+
+	emake
+}
+
+src_test() {
+	einfo
+	einfo "Starting vim tests. Several error messages will be shown"
+	einfo "while the tests run. This is normal behaviour and does not"
+	einfo "indicate a fault."
+	einfo
+	ewarn "If the tests fail, your terminal may be left in a strange"
+	ewarn "state. Usually, running 'reset' will fix this."
+	einfo
+
+	# Don't let vim talk to X
+	unset DISPLAY
+
+	# Arch and opensuse seem to do this and at this point, I'm willing
+	# to try anything to avoid random test hangs!
+	export TERM=xterm
+
+	# See https://github.com/vim/vim/blob/f08b0eb8691ff09f98bc4beef986ece1c521655f/src/testdir/runtest.vim#L5
+	# for more information on test variables we can use.
+	# Note that certain variables need vim-compatible regex (not PCRE), see e.g.
+	# http://www.softpanorama.org/Editors/Vimorama/vim_regular_expressions.shtml.
+	#
+	# Skipped tests:
+	# - Test_expand_star_star
+	# Hangs because of a recursive symlink in /usr/include/nodejs (bug #616680)
+	# - Test_exrc
+	# Looks in wrong location? (bug #742710)
+	# - Test_job_tty_in_out
+	# Fragile and depends on TERM(?)
+	# - Test_spelldump_bang
+	# Hangs.
+	# - Test_fuzzy_completion_env
+	# Too sensitive to leaked environment variables.
+	# - Test_term_mouse_multiple_clicks_to_select_mode
+	# Hangs.
+	# - Test_spelldump
+	# Hangs.
+	# - Test_glvs_*
+	# Depends on local network.
+	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\|Test_glvs_\)'
+
+	echo "throw 'Skipped: needs X'" > src/testdir/test_clientserver.vim || die
+	echo "throw 'Skipped: needs X'" > src/testdir/test_vim9_builtin.vim || die
+
+	emake -j1 -C src/testdir nongui
+}
+
+# Call eselect vi update with --if-unset
+# to respect user's choice (bug #187449)
+eselect_vi_update() {
+	ebegin "Calling eselect vi update"
+	eselect vi update --if-unset
+	eend $?
+}
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	# Note: Do not install symlinks for 'vi', 'ex', or 'view', as these are
+	#       managed by eselect-vi
+	dobin src/vim
+	if ! use minimal ; then
+		dosym vim /usr/bin/vimdiff
+	fi
+	dosym vim /usr/bin/rvim
+	dosym vim /usr/bin/rview
+	if use vim-pager ; then
+		dosym ${vimfiles}/macros/less.sh /usr/bin/vimpager
+		dosym ${vimfiles}/macros/manpager.sh /usr/bin/vimmanpager
+		insinto ${vimfiles}/macros
+		doins runtime/macros/manpager.sh
+		fperms a+x ${vimfiles}/macros/manpager.sh
+	fi
+
+	domenu runtime/vim.desktop
+
+	newbashcomp "${FILESDIR}"/${PN}-completion ${PN}
+
+	# keep in sync with 'complete ... -F' list
+	bashcomp_alias vim ex vi view rvim rview vimdiff
+}
+
+pkg_postinst() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/files/qemu-ga.init-r1
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/files/qemu-ga.init-r1
@ -1,24 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2013 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-start() {
-    GA_METHOD=${GA_METHOD:-virtio-serial}
-    GA_PATH=${GA_PATH:-/dev/virtio-ports/org.qemu.guest_agent.0}
-
-    ebegin "Starting QEMU Guest Agent"
-
-    start-stop-daemon --start --pidfile /run/qemu-ga.pid \
-        --exec /usr/bin/qemu-ga -- -m ${GA_METHOD} -p ${GA_PATH} \
-        -l /var/log/qemu-ga.log -d -f /run/qemu-ga.pid -t /run ${GA_OPTIONS}
-
-    eend $?
-}
-
-stop() {
-    ebegin "Stopping QEMU Guest Agent"
-
-    start-stop-daemon --stop --pidfile /run/qemu-ga.pid
-
-    eend $?
-}
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/files/qemu-ga.init-r2
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/files/qemu-ga.init-r2
@ -0,0 +1,11 @@
+#!/sbin/openrc-run
+# Copyright 1999-2024 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+GA_METHOD=${GA_METHOD:-virtio-serial}
+GA_PATH=${GA_PATH:-/dev/virtio-ports/org.qemu.guest_agent.0}
+
+description="QEMU Guest Agent (qemu-ga) for use when running inside a VM"
+command="/usr/bin/qemu-ga"
+pidfile="/run/qemu-ga.pid"
+command_args="-m ${GA_METHOD} -p ${GA_PATH} -l /var/log/qemu-ga.log -d -f ${pidfile} -t /run ${GA_OPTIONS}"
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.2.0.ebuild
@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

 EAPI=8
@ -6,14 +6,14 @@ EAPI=8
 PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"

-inherit edo systemd toolchain-funcs python-any-r1 udev
+inherit edo linux-info python-any-r1 systemd toolchain-funcs udev

 MY_PN="qemu"
 MY_P="${MY_PN}-${PV}"

 DESCRIPTION="QEMU Guest Agent (qemu-ga) for use when running inside a VM"
 HOMEPAGE="https://wiki.qemu.org/Features/GuestAgent"
-SRC_URI="http://wiki.qemu.org/download/${MY_P}.tar.xz"
+SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
 S="${WORKDIR}/${MY_P}"

 LICENSE="GPL-2 BSD-2"
@ -24,6 +24,9 @@ RDEPEND="dev-libs/glib"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		dev-python/distlib[${PYTHON_USEDEP}]
+	')
 	dev-lang/perl
 	app-alternatives/ninja
 "
@ -32,6 +35,18 @@ PATCHES=(
 	"${FILESDIR}"/qemu-8.1.0-find-sphinx.patch
 )

+python_check_deps() {
+	python_has_version "dev-python/distlib[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	# While qemu-ga supports multiple modes, virtio-serial is the
+	# default. Make sure it's enabled in kernel.
+	CONFIG_CHECK="~VIRTIO_CONSOLE"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
 src_configure() {
 	tc-export AR LD OBJCOPY RANLIB

@ -70,7 +85,7 @@ src_install() {
 	dobin build/qga/qemu-ga

 	# Normal init stuff
-	newinitd "${FILESDIR}/qemu-ga.init-r1" qemu-guest-agent
+	newinitd "${FILESDIR}/qemu-ga.init-r2" qemu-guest-agent
 	newconfd "${FILESDIR}/qemu-ga.conf-r1" qemu-guest-agent

 	insinto /etc/logrotate.d
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-9.2.0.ebuild
@ -6,14 +6,14 @@ EAPI=8
 PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"

-inherit edo systemd toolchain-funcs python-any-r1 udev
+inherit edo linux-info python-any-r1 systemd toolchain-funcs udev

 MY_PN="qemu"
 MY_P="${MY_PN}-${PV}"

 DESCRIPTION="QEMU Guest Agent (qemu-ga) for use when running inside a VM"
 HOMEPAGE="https://wiki.qemu.org/Features/GuestAgent"
-SRC_URI="http://wiki.qemu.org/download/${MY_P}.tar.xz"
+SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
 S="${WORKDIR}/${MY_P}"

 LICENSE="GPL-2 BSD-2"
@ -24,6 +24,9 @@ RDEPEND="dev-libs/glib"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		dev-python/distlib[${PYTHON_USEDEP}]
+	')
 	dev-lang/perl
 	app-alternatives/ninja
 "
@ -32,6 +35,18 @@ PATCHES=(
 	"${FILESDIR}"/qemu-8.1.0-find-sphinx.patch
 )

+python_check_deps() {
+	python_has_version "dev-python/distlib[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	# While qemu-ga supports multiple modes, virtio-serial is the
+	# default. Make sure it's enabled in kernel.
+	CONFIG_CHECK="~VIRTIO_CONSOLE"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
 src_configure() {
 	tc-export AR LD OBJCOPY RANLIB

@ -70,7 +85,7 @@ src_install() {
 	dobin build/qga/qemu-ga

 	# Normal init stuff
-	newinitd "${FILESDIR}/qemu-ga.init-r1" qemu-guest-agent
+	newinitd "${FILESDIR}/qemu-ga.init-r2" qemu-guest-agent
 	newconfd "${FILESDIR}/qemu-ga.conf-r1" qemu-guest-agent

 	insinto /etc/logrotate.d
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@ -5,6 +5,8 @@ DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df280894284259
 DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
 DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
 DIST qemu-10.0.3.tar.xz 135736600 BLAKE2B 382800d9a9f5241123ebeb43d8eaa6a4aaf9acae0df7a25f2c7831aa7eeb97014cff29886c53f03ea0a1ac98729b85bad1e4d5634e592a373af84f79a9219adc SHA512 7f37c2df5ac7048fb32f1d89a7c2da0929be9d2f5767bc209ca1e99167f196fb5867fc8b69f915c8c349c58089ce3d7e08c9a3f35a73223abff258b9a5bf3466
+DIST qemu-10.1.0-docs.tar.xz 2788092 BLAKE2B c9f1138e6eb19966da05b5be6e28640cabf698cb7c4247e0a69b29ed71d462423ba356efc8c0f26a727a58b4adc84edc3eefbff12a35e0c93e475f0ab51e6ff7 SHA512 96d9133d83991014c3ce9a57273a017f45bf29ae3f7029c5b926c8c5fbfd0e8da80dbbecca038b981312cec68b931a0471837a0aebd3e5dbc1648eb49e28ecc9
+DIST qemu-10.1.0.tar.xz 141999456 BLAKE2B 025012e73cdd2468b1b0fdef9b34aae41893780cfcad0d52c05e7f67ff7a9969c8c596f006b8a7e6f1b59e39da8fdec07d6f241911c604502755acd26bb750b6 SHA512 20552a524b6b298181df1af7084b470ded3fe8d1505f05011dda3c33cbc3d91f518ce026b44ba1a8b7f34c64ae81afddceda383066f4772a3a2a6333a2638caf
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
@ -32,6 +32,7 @@
 		<flag name="ncurses">Enable the ncurses-based console</flag>
 		<flag name="nfs">Enable NFS support</flag>
 		<flag name="numa">Enable NUMA support</flag>
+		<flag name="passt">Enable TCP/IP in hypervisor via <pkg>net-misc/passt</pkg></flag>
 		<flag name="pin-upstream-blobs">Pin the versions of BIOS firmware to the version included in the upstream release.
 		This is needed to sanely support migration/suspend/resume/snapshotting/etc... of instances.
 		When the blobs are different, random corruption/bugs/crashes/etc... may be observed.</flag>
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@ -277,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -942,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
@ -291,6 +291,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -956,7 +957,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
@ -277,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -942,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.3.ebuild
@ -291,6 +291,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -956,7 +957,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.1.0.ebuild
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@ -278,6 +278,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -953,7 +954,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@ -277,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -943,7 +944,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
@ -277,6 +277,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -942,7 +943,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@ -16,8 +16,6 @@ QEMU_DOC_USEFLAG="+doc"
 PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"

-FIRMWARE_ABI_VERSION="7.2.0"
-
 inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
 		readme.gentoo-r1 pax-utils xdg-utils

@ -61,11 +59,11 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
 	jack jemalloc +jpeg keyutils
 	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	ncurses nfs nls numa opengl +oss pam passt +pin-upstream-blobs pipewire
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
+	usbredir valgrind vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"

 COMMON_TARGETS="
@ -209,6 +207,7 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[egl(+),gbm(+)]
 	)
 	pam? ( sys-libs/pam )
+	passt? ( net-misc/passt )
 	pipewire? ( >=media-video/pipewire-0.3.60 )
 	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
 	pulseaudio? ( media-libs/libpulse )
@ -239,7 +238,23 @@ SOFTMMU_TOOLS_DEPEND="
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "

-EDK2_OVMF_VERSION="202202"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
 SEABIOS_VERSION="1.16.3"

 X86_FIRMWARE_DEPEND="
@ -277,6 +292,7 @@ PPC_FIRMWARE_DEPEND="
 # See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
+	dev-python/distlib[${PYTHON_USEDEP}]
 	dev-lang/perl
 	>=dev-build/meson-0.63.0
 	app-alternatives/ninja
@ -304,6 +320,7 @@ DEPEND="
 	${CDEPEND}
 	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
 	static-user? ( ${ALL_DEPEND} )
+	valgrind? ( dev-debug/valgrind )
 "
 RDEPEND="
 	${CDEPEND}
@ -555,6 +572,7 @@ qemu_src_configure() {
 		$(use_enable pulseaudio pa)
 		$(use_enable selinux)
 		$(use_enable xattr attr)
+		$(use_enable valgrind)
 	)

 	# Disable options not used by user targets. This simplifies building
@ -617,6 +635,7 @@ qemu_src_configure() {
 		$(conf_notuser numa)
 		$(conf_notuser opengl)
 		$(conf_notuser pam auth-pam)
+		$(conf_notuser passt)
 		$(conf_notuser png)
 		$(conf_notuser rbd)
 		$(conf_notuser sasl vnc-sasl)
@ -942,7 +961,7 @@ pkg_postinst() {
 	xdg_icon_cache_update

 	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+		fcaps -m u+s cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper

 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
@ -967,8 +986,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20250718.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20250718.ebuild
@ -19,7 +19,7 @@ else
 		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
 	"

-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi

 LICENSE="GPL-2"
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/metadata.xml
@ -6,6 +6,8 @@
 		<name>Fabian Groffen</name>
 	</maintainer>
 	<use>
+		<flag name="gpkg">Build GLEP-78 gpkg support in qpkg</flag>
+		<flag name="gtree">Build gtree repository cache support</flag>
 		<flag name="qmanifest">Build qmanifest applet, this adds additional dependencies for GPG, OpenSSL and BLAKE2B hashing</flag>
 		<flag name="qtegrity">Build qtegrity applet, this adds additional dependencies for OpenSSL</flag>
 	</use>
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
@ -18,9 +18,21 @@ fi

 LICENSE="GPL-2"
 SLOT="0"
-IUSE="openmp +qmanifest static"
+IUSE="+gpkg +gtree openmp +qmanifest static"

 RDEPEND="
+	gpkg? (
+		!static? (
+			app-crypt/gpgme:=
+			app-arch/libarchive:=
+		)
+	)
+	gtree? (
+		!static? (
+			app-crypt/gpgme:=
+			app-arch/libarchive:=[zstd]
+		)
+	)
 	openmp? ( || (
 		sys-devel/gcc:*[openmp]
 		llvm-runtimes/openmp
@ -33,6 +45,18 @@ RDEPEND="
 		)
 	)"
 DEPEND="${RDEPEND}
+	gpkg? (
+		static? (
+			app-crypt/gpgme[static-libs]
+			app-arch/libarchive[static-libs]
+		)
+	)
+	gtree? (
+		static? (
+			app-crypt/gpgme[static-libs]
+			app-arch/libarchive[static-libs,zstd]
+		)
+	)
 	qmanifest? (
 		static? (
 			app-crypt/gpgme[static-libs]
@ -65,6 +89,8 @@ src_configure() {
 	econf \
 		--disable-maintainer-mode \
 		--with-eprefix="${EPREFIX}" \
+		$(use_enable gpkg) \
+		$(use_enable gtree) \
 		$(use_enable qmanifest) \
 		$(use_enable openmp)
 }
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r2.ebuild
@ -0,0 +1,169 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+BASHCOMP_P=bashcomp-2.0.3
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit autotools python-any-r1
+
+DESCRIPTION="Programmable Completion for bash"
+HOMEPAGE="https://github.com/scop/bash-completion"
+SRC_URI="
+	https://github.com/scop/bash-completion/releases/download/${PV}/${P}.tar.xz
+	eselect? (
+		https://github.com/projg2/bashcomp2/releases/download/v${BASHCOMP_P#*-}/${BASHCOMP_P}.tar.gz
+	)
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="+eselect test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-shells/bash-4.3_p30-r1:0
+	sys-apps/miscfiles
+	!<app-text/tree-2.1.1-r1
+	!!<=net-fs/mc-2025.04.16.18.13.26
+"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		$(python_gen_any_dep '
+			dev-python/pexpect[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		')
+	)
+"
+PDEPEND="
+	>=app-shells/gentoo-bashcomp-20140911
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.14.0-optimize-kernel-modules.patch
+	"${FILESDIR}"/${PN}-2.16.0-libsecret-completion.patch
+)
+
+strip_completions() {
+	# Remove unwanted completions.
+	local strip_completions=(
+		# Slackware package stuff, quite generic names cause collisions
+		# (e.g. with sys-apps/pacman)
+		explodepkg installpkg makepkg pkgtool removepkg upgradepkg
+
+		# Debian/Red Hat network stuff
+		ifdown ifup ifquery ifstatus
+
+		# Installed in app-editors/vim-core
+		xxd
+
+		# Now-dead symlinks to deprecated completions
+		hd ncal
+
+		# For GNU mailman, which isn't packaged. If mailman isn't installed,
+		# it triggers a QA warning.
+		arch
+	)
+
+	local file
+	for file in "${strip_completions[@]}"; do
+		rm "${ED}"/usr/share/bash-completion/completions/${file} ||
+			die "stripping ${file} failed"
+	done
+
+	# remove deprecated completions (moved to other packages)
+	rm "${ED}"/usr/share/bash-completion/completions/_* || die
+}
+
+python_check_deps() {
+	python_has_version "dev-python/pexpect[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest-xdist[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use eselect; then
+		eapply "${WORKDIR}/${BASHCOMP_P}/bash-completion-blacklist-support.patch"
+	fi
+
+	default
+	# Only needed for ${PN}-2.16.0-libsecret-completion.patch
+	eautoreconf
+}
+
+src_test() {
+	local EPYTEST_DESELECT=(
+		# redhat-specific, we strip these completions
+		test/t/test_if{down,up}.py
+		# not available for icedtea
+		test/t/test_javaws.py
+		# TODO
+		test/t/test_vi.py::TestVi::test_2
+		test/t/test_xmlwf.py::TestXmlwf::test_2 #bug 886159
+		test/t/test_xrandr.py::TestXrandr::test_output_filter
+		test/t/unit/test_unit_dequote.py
+		test/t/test_sudo.py::TestSudo::test_1 #bug 935400
+		test/t/test_xfreerdp.py::TestXfreerdp::test_6 #bug 935400
+		test/t/unit/test_unit_command_offset.py::TestUnitCommandOffset::test_cmd_quoted #bug 931744
+		test/t/test_make.py::TestMake::test_6 #bug 931744
+	)
+	local EPYTEST_IGNORE=(
+		# stupid test that async tests work
+		test/fixtures/pytest/test_async.py
+	)
+	local EPYTEST_XDIST=1
+
+	# portage's HOME override breaks tests
+	local -x HOME=$(unset HOME; echo ~)
+	addpredict "${HOME}"
+	# used in pytest tests
+	local -x NETWORK=none
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	local -x PYTEST_PLUGINS=xdist.plugin
+	emake -C completions check
+	epytest
+}
+
+src_install() {
+	# work-around race conditions, bug #526996
+	mkdir -p "${ED}"/usr/share/bash-completion/{completions,helpers} || die
+
+	emake DESTDIR="${D}" profiledir="${EPREFIX}"/etc/bash/bashrc.d install
+
+	strip_completions
+
+	dodoc AUTHORS CHANGELOG.md CONTRIBUTING.md README.md
+
+	# install the python completions for all targets, bug #622892
+	local TARGET
+	for TARGET in "${PYTHON_COMPAT[@]}"; do
+		if [[ ! -e "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.} ]]; then
+			dosym python "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.}
+		fi
+	done
+
+	# install the eselect module
+	if use eselect; then
+		insinto /usr/share/eselect/modules
+		doins "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect"
+		doman "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect.5"
+	fi
+}
+
+pkg_postinst() {
+	if has_version 'app-shells/zsh'; then
+		elog
+		elog "If you are interested in using the provided bash completion functions with"
+		elog "zsh, valuable tips on the effective use of bashcompinit are available:"
+		elog "  http://www.zsh.org/mla/workers/2003/msg00046.html"
+		elog
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-9999.ebuild
@ -16,12 +16,10 @@ SLOT="0"
 IUSE="+eselect test"
 RESTRICT="!test? ( test )"

-# completion collision with net-fs/mc
 RDEPEND="
 	>=app-shells/bash-4.3_p30-r1:0
 	sys-apps/miscfiles
 	!<app-text/tree-2.1.1-r1
-	!!net-fs/mc
 "
 BDEPEND="
 	test? (
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@ -24,9 +24,9 @@ DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
 DIST bash-5.3.tar.gz 11354270 BLAKE2B 88a4f0146eb11698120890f2afaf28210295135f8f7f61dcbb99eeb0c39c84da5360a3b0572a26dc2a36b207fd440b83bb5a947213af90306c8f6ab608964ff1 SHA512 05ef640e8ba011d10f858a270c626daa42ed5a75789d0298ae0ced9b2ebaf93d94d8ed5a211ac30cd34e82af8865e50024144c88a3c979bee7c38e449350e02e
 DIST bash-5.3.tar.gz.sig 95 BLAKE2B 90a6a47b5b318d03ff7e196e6504a987c281f564db878e8452f0543953832b5ac4f767f69a9bdf6b6a98938b0b439040c10674dd54e38ef03730ae6a2ec4484e SHA512 e9da98e993528d69bec9c6da272eb7a96858b4ba33487435f584c7df2d73c3ce82f373b5277cc3a7d8dc9ee04410dc06ce476d3f9ade097121bea0570abe07bc
-DIST bash-5.4_alpha_pre20250711-80a8f650a1defc3f72539c3b57bf6d228c33c116.tar.gz 16111994 BLAKE2B 7ab445c5580c3c8d0af10a6764d65a33705f42ed79c50297a4cbf3b345b2f0ba9f28001a80ec5cc85291f57f88e81aef41492a79779239a33292b460e4361d8f SHA512 64f5985ad9a94fd37bc5efa06a57b72c5b3ec8d43a0ed36d9cdc9f292b37137e035bcba0d9855965e0f7bc2416ae60ec44d8f19ee2201acef01d3eda43d8989b
-DIST bash-5.4_alpha_pre20250718-01070d43248fb97f3b2a08d780ae5a392573ce34.tar.gz 16112469 BLAKE2B 6ebcf65b4f1ae93f52d549d2c6836cd4ff7e87739efa9746ef10f00bf6010f00d957c0624e3b806c4d581539f9160338a00824302b245f4c82c72c416976a0f0 SHA512 b200d62eb6634bf9f623841b7a024dc8b3a89c43b8e127dbc89dbf06f3df793d82ad37d35e1be43558ef97c473e37e44384d8c73736c7b62794e65dcfb8f30ce
-DIST bash-5.4_alpha_pre20250801-c1d9c088531eef0797e78c66b899d895862de80c.tar.gz 16116027 BLAKE2B 1be7657f61e91acc9e5e3bb9d5051f4d9e6f29e5457db544ebd26ac4ff7931925732d8b81de243bf6374ba3ce3aaa133ec6a33f03133e22317d712e696847bed SHA512 44c890bd46ec87ba11b78a0a817ed42544d32df12270c9766f78418e966d3247457facad0e4dcdbf07fd9a6a8865029f3eb3a93c485e01506d67d4ed1c156670
+DIST bash-5.4_alpha_pre20250814-3160c0b89ce4f3934e791de94f9370b6cfc26ae5.tar.gz 16118231 BLAKE2B a956361f3c111f1e03bdca68678c08cd595c26cfbb926243fe059689d354fde452feb28b984469fd6b201d5aebc5f6007abdf05a824f0e3f7518f945eef78823 SHA512 7ba29f861fd2e7a0162664f0dba14c4bf8cafb9db9ed8ce36564436c8e797cbae1817c6f8fe6450a5f2863b616bd56feba09a045534b998e5c194fe1104b2b04
+DIST bash-5.4_alpha_pre20250820-086456835944d1a3098a026646144573deafc917.tar.gz 16118833 BLAKE2B d0fc57ce9c6fb1d4105e937b407fe554bb921b279883db138ead2ff72a25b87c1496f3c4010c0dbf40ced88b7729fee9ff127300cef9704f8bf91398bd053213 SHA512 e3c5c4d5d48507a1fe0325a499651ab5eaa613f2d0009677118ac2d2358586b0bc2407ce55b133400fe5af07016477bac6b3537565467bdb6513acba1a332eff
+DIST bash-5.4_alpha_pre20250822-ab17ddb7af948ee6e1a6370aac4ee57b4179cd9c.tar.gz 16121182 BLAKE2B 2802ab3bea45fe40f515d668baeaf5ca04797b992dcb764ee38b707701bc6aac845f091b16770a51c84bfdd2ba3953b12b1fded9fdbfde035df7088f4376c236 SHA512 af7182bcad82bc7256d2b806a6f8c3ee1855fa1b3e4b3695cd8b3618e56263285899a01d6ef49fe2862e812731718fc9d309836ff260e39d30e7e02fab044c72
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-2.05b-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-2.05b-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-3.0-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-3.0-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-3.1-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-3.1-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-3.2-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-3.2-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-4.0-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-4.0-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-4.1-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-4.1-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-4.2-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-4.2-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}-r2"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-4.3-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-4.3-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}-r2"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-4.4-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-4.4-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
@ -10,7 +10,7 @@ GENTOO_PATCH_DEV="sam"
 GENTOO_PATCH_VER="${PV}"

 # Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-5.0-patches/
+# See https://ftp.gnu.org/gnu/bash/bash-5.0-patches/
 PLEVEL="${PV##*_p}"
 MY_PV="${PV/_p*}"
 MY_PV="${MY_PV/_/-}"
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.1-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.1-patches/.
 case ${PV} in
 	*_p*)
 		PLEVEL=${PV##*_p}
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	*_p*)
 		PLEVEL=${PV##*_p}
@ -328,7 +328,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r4.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	*_p*)
 		PLEVEL=${PV##*_p}
@ -65,7 +65,7 @@ S=${WORKDIR}/${MY_P}
 LICENSE="GPL-3+"
 SLOT="0"
 if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"

@ -98,6 +98,8 @@ PATCHES=(
 	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
 	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
 	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-1.patch"
+	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch"
+	"${FILESDIR}/${PN}-5.2_p32-erroneous-delimiter-pushback-condition.patch"
 )

 pkg_setup() {
@ -315,18 +317,18 @@ src_install() {

 	insinto /etc/bash
 	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r2 | newins - bashrc

 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+
+	insinto /etc/profile.d
+	doins "${FILESDIR}/profile.d/00-prompt-command.sh"

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3-r1.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.3-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -321,7 +321,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3-r2.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.3-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -320,7 +320,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.3-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -319,7 +319,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3-r1.ebuild
@ -0,0 +1,404 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.3-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="b35866a2891a9b069e37ca5684d4309c0391e261"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.3-read-sys.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r2 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+
+	insinto /etc/profile.d
+	doins "${FILESDIR}/profile.d/00-prompt-command.sh"
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel. See https://ftp.gnu.org/gnu/bash/bash-5.3-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -320,7 +320,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250814.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -46,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="c1d9c088531eef0797e78c66b899d895862de80c"
+	BASH_COMMIT="3160c0b89ce4f3934e791de94f9370b6cfc26ae5"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@ -319,7 +319,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250820.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250820.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -46,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="80a8f650a1defc3f72539c3b57bf6d228c33c116"
+	BASH_COMMIT="086456835944d1a3098a026646144573deafc917"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@ -319,7 +319,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250822.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250822.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -46,7 +46,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="01070d43248fb97f3b2a08d780ae5a392573ce34"
+	BASH_COMMIT="ab17ddb7af948ee6e1a6370aac4ee57b4179cd9c"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
@ -319,7 +319,7 @@ src_install() {

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()

-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+# Determine the patchlevel.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@ -167,8 +167,10 @@ src_configure() {
 	# Upstream only test with Bison and require GNUisms like YYEOF and
 	# YYERRCODE. The former at least may be in POSIX soon:
 	# https://www.austingroupbugs.net/view.php?id=1269.
+	#
 	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
+	# may misbehave at runtime. Chet also advises against use of byacc:
+	# https://lists.gnu.org/archive/html/bug-bash/2025-08/msg00115.html
 	unset -v YACC

 	if tc-is-cross-compiler; then
@ -308,18 +310,18 @@ src_install() {

 	insinto /etc/bash
 	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r2 | newins - bashrc

 	insinto /etc/bash/bashrc.d
 	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
+
+	insinto /etc/profile.d
+	doins "${FILESDIR}/profile.d/00-prompt-command.sh"

 	insinto /etc/skel
 	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
+		newins "${FILESDIR}/skel/dot-${f}" ".${f}"
 	done

 	if use plugins; then
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc-r2
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc-r2
@ -0,0 +1,30 @@
+# /etc/bash/bashrc
+
+# Proceed no further in the case of a non-interactive shell.
+if [[ $- != *i* ]]; then
+	return
+fi
+
+# Disable errexit in case the user enabled it then chose to re-source this file.
+shopt -u -o errexit
+
+# Disable completion when the input buffer is empty. Mute STDERR because this
+# option is only present in the case that bash was built with readline support.
+shopt -s no_empty_cmd_completion 2>/dev/null &&
+
+# Append to HISTFILE rather than overwrite upon exiting, per bug #139609. This
+# option also requires for bash to have been built with readline support.
+shopt -s histappend
+
+# Initialise PROMPT_COMMAND as an array, unless bash is acting as a login shell.
+# In the latter case, the profile.d drop-in will already have initialised it.
+shopt -q login_shell || PROMPT_COMMAND=()
+
+# Don't let the user influence the order of sourcing for bash 5.3 or greater.
+unset -v GLOBSORT
+
+for _ in /etc/bash/bashrc.d/*; do
+	if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
+		source "$_"
+	fi
+done
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color.bash
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color.bash
@ -1,68 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-color.bash
-
-if [[ ${NO_COLOR} ]]; then
-	# Respect the user's wish not to use color. See https://no-color.org/.
-	gentoo_color=0
-elif [[ ${COLORTERM@a} == *x* && ${COLORTERM} == @(24bit|truecolor) ]]; then
-	# The COLORTERM environment variable can reasonably be trusted here.
-	# See https://github.com/termstandard/colors for further information.
-	gentoo_color=1
-elif unset -v COLORTERM; ! gentoo_color=$(tput colors 2>/dev/null); then
-	# Either ncurses is not installed or no terminfo database could be
-	# found. Fall back to a whitelist which covers the majority of terminal
-	# emulators and virtual console implementations known to support color
-	# and which remain (somewhat) popular. This will rarely happen, so the
-	# list need not be exhaustive.
-	case ${TERM} in
-		*color*    |\
-		*direct*   |\
-		[Ekx]term* |\
-		alacritty  |\
-		aterm      |\
-		dtterm     |\
-		foot*      |\
-		jfbterm    |\
-		linux      |\
-		mlterm     |\
-		rxvt*      |\
-		screen*    |\
-		tmux*      |\
-		wsvt25*    ) gentoo_color=1
-	esac
-elif (( gentoo_color == 16777216 )); then
-	# Truecolor support is available. Advertise it.
-	export COLORTERM=truecolor
-fi
-
-# For direxpand to be missing indicates that bash is lacking readline support.
-if (( gentoo_color <= 0 )) || [[ ! $(shopt -p direxpand 2>/dev/null) ]]; then
-	# Define a prompt without color.
-	PS1='\u@\h \w \$ '
-elif (( EUID == 0 )); then
-	# If root, omit the username and print the hostname in red.
-	PS1='\[\e[01;31m\]\h\[\e[01;34m\] \w \$\[\e[00m\] '
-else
-	# Otherwise, print the username and hostname in green.
-	PS1='\[\e[01;32m\]\u@\h\[\e[01;34m\] \w \$\[\e[00m\] '
-fi
-
-if (( gentoo_color > 0 )); then
-	# Colorize the output of diff(1), grep(1) and a few coreutils utilities.
-	for _ in diff dir grep ls vdir; do
-		alias "$_=$_ --color=auto"
-	done
-
-	# Enable colors for ls(1) and some other utilities that respect the
-	# LS_COLORS variable. Prefer ~/.dir_colors, per bug #64489.
-	if hash dircolors 2>/dev/null; then
-		if [[ -f ~/.dir_colors ]]; then
-			eval "$(dircolors -b -- ~/.dir_colors)"
-		elif [[ -f /etc/DIR_COLORS ]]; then
-			eval "$(dircolors -b /etc/DIR_COLORS)"
-		else
-			eval "$(dircolors -b)"
-		fi
-	fi
-fi
-
-unset -v gentoo_color
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title-r1.bash
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title-r1.bash
@ -1,81 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-title.bash
-
-# For information regarding the control sequences used, please refer to
-# https://invisible-island.net/xterm/ctlseqs/ctlseqs.html.
-
-genfun_set_win_title() {
-	# Advertise the fact that the presently running interactive shell will
-	# update the title. Doing so allows for its subprocesses to determine
-	# whether it is safe to set the title of their own accord. Note that 0
-	# refers to the value of Ps within the OSC Ps ; Pt BEL sequence.
-	export SHELL_SETS_TITLE=0
-
-	# Assigns the basename of the current working directory, having
-	# sanitised it with @Q parameter expansion. Useful for paths containing
-	# newlines and such. As a special case, names consisting entirely of
-	# graphemes shall not undergo the expansion, for reasons of cleanliness.
-	genfun_sanitise_cwd() {
-		_cwd=${PWD##*/}
-		if [[ ! ${_cwd} ]]; then
-			_cwd=${PWD}
-		elif [[ ${_cwd} == *[![:graph:]]* ]]; then
-			_cwd=${_cwd@Q}
-		fi
-	}
-
-	# Sets the window title with the Set Text Parameters control sequence.
-	# For screen, the sequence defines the hardstatus (%h) and for tmux, the
-	# pane_title (#T). For graphical terminal emulators, it is normal for
-	# the title bar to be affected.
-	genfun_set_win_title() {
-		genfun_sanitise_cwd
-		printf '\033]0;%s@%s - %s\007' "${USER}" "${HOSTNAME%%.*}" "${_cwd}"
-	}
-
-	genfun_set_win_title
-}
-
-unset -v SHELL_SETS_TITLE
-
-# Determine whether the terminal can handle the Set Text Parameters sequence.
-# The only terminals permitted here are those for which there is empirical
-# evidence that the sequence is supported and that the UTF-8 character encoding
-# is handled correctly. Quite rightly, this precludes many vintage terminals.
-case ${TERM} in
-	alacritty|foot*|tmux*)
-		# The terminal emulator also supports XTWINOPS. If the PTY was
-		# created by sshd(8) then push the current window title to the
-		# stack and arrange for it to be popped upon exiting. Xterm also
-		# supports this but there are far too many terminal emulators
-		# that falsely identify as being xterm-compatible.
-		if [[ ${SSH_TTY} && ${SSH_TTY} == "$(tty)" ]]; then
-			trap 'printf "\033[23;0t"' EXIT
-			printf '\033[22;0t'
-		fi
-		;;
-	rxvt-unicode*|st-256color|xterm*)
-		# If the PTY was created by sshd(8) then proceed no further.
-		# Alas, there exist many operating environments in which the
-		# title would otherwise not be restored upon ssh(1) exiting.
-		# Those wanting for the title to be set regardless may adjust
-		# ~/.bashrc or create a bashrc.d drop-in to set PROMPT_COMMAND.
-		# For example, PROMPT_COMMAND=(genfun_set_win_title).
-		if [[ ${SSH_TTY} && ${SSH_TTY} == "$(tty)" ]]; then
-			return
-		fi
-		;;
-	screen*)
-		# If the PTY was created by sshd(8) and screen(1) was launched
-		# prior to the SSH session beginning, as opposed to afterwards,
-		# proceed no further. It is another case in which there would be
-		# no guarantee of the title being restored upon ssh(1) exiting.
-		if [[ ! ${WINDOW} && ${SSH_TTY} && ${SSH_TTY} == "$(tty)" ]]; then
-			return
-		fi
-		;;
-	*)
-		return
-esac
-
-# Arrange for the title to be updated each time the primary prompt is displayed.
-PROMPT_COMMAND+=('genfun_set_win_title')
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title.bash
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title.bash
@ -1,52 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-title.bash
-
-genfun_set_win_title() {
-	# Assigns the basename of the current working directory, having
-	# sanitised it with @Q parameter expansion. Useful for paths containing
-	# newlines and such. As a special case, names consisting entirely of
-	# graphemes shall not undergo the expansion, for reasons of cleanliness.
-	genfun_sanitise_cwd() {
-		_cwd=${PWD##*/}
-		if [[ ! ${_cwd} ]]; then
-			_cwd=${PWD}
-		elif [[ ${_cwd} == *[![:graph:]]* ]]; then
-			_cwd=${_cwd@Q}
-		fi
-	}
-
-	# Sets the window title with the Set Text Parameters sequence. For
-	# screen, the sequence defines the hardstatus (%h) and for tmux, the
-	# pane_title (#T). For graphical terminal emulators, it is normal for
-	# the title bar to be affected.
-	genfun_set_win_title() {
-		genfun_sanitise_cwd
-		printf '\033]0;%s@%s - %s\007' "${USER}" "${HOSTNAME%%.*}" "${_cwd}"
-	}
-
-	genfun_set_win_title
-}
-
-# Proceed no further if the TTY is that of sshd(8) and if not running a terminal
-# multiplexer. Alas, there exist many operating environments in which the window
-# title would otherwise not be restored upon ssh(1) exiting. Those who wish for
-# the title to be set unconditionally may adjust ~/.bashrc - or create a custom
-# bashrc.d drop-in - to define PROMPT_COMMAND=(genfun_set_win_title).
-if [[ ${SSH_TTY} && ${TERM} != @(screen|tmux)* && ${SSH_TTY} == "$(tty)" ]]; then
-	return
-fi
-
-# Determine whether the terminal can handle the Set Text Parameters sequence.
-# The only terminals permitted here are those for which there is empirical
-# evidence that the sequence is supported and that the UTF-8 character encoding
-# is handled correctly. Quite rightly, this precludes many vintage terminals.
-# https://invisible-island.net/xterm/ctlseqs/ctlseqs.html#h3-Operating-System-Commands
-case ${TERM} in
-	alacritty     |\
-	foot*         |\
-	rxvt-unicode* |\
-	screen*       |\
-	st-256color   |\
-	tmux*         |\
-	xterm*        )
-		PROMPT_COMMAND+=('genfun_set_win_title')
-esac
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/profile.d/00-prompt-command.sh
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/profile.d/00-prompt-command.sh
@ -0,0 +1,7 @@
+# This unit serves to initialise PROMPT_COMMAND as early as possible in cases
+# where bash has been launched as a login shell. Though not an especially
+# common practice, some profile.d drop-ins need to be able to extend its value.
+
+if [ "${BASH}" ] && shopt -q login_shell; then
+	eval 'PROMPT_COMMAND=()'
+fi
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bash_logout
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bash_logout
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bash_profile
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bash_profile
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bashrc
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/skel/dot-bashrc
--- a/sdk_container/src/third_party/portage-stable/app-text/scdoc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-text/scdoc/Manifest
@ -0,0 +1 @@
+DIST scdoc-1.11.3.tar.gz 12768 BLAKE2B c39ed51f9279aa8a08bbd99a3d3780ef37654a37f687c7de340266d9c7a6edceb8f6824baaa34c756440d45bd51611ab28f7f2e42ea632b943f6018d6e5f5a04 SHA512 fbecc505b44c396890c53c05183d34336160dbd02993ee120421fc6e2a3ec78ba349747e8acfe97af956a0081c923309290ff97fb7babafbc3ca8addc9ec92f9
--- a/sdk_container/src/third_party/portage-stable/app-text/scdoc/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-text/scdoc/metadata.xml
@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>arthurzam@gentoo.org</email>
+		<name>Arthur Zamarin</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="sourcehut">~sircmpwn/scdoc</remote-id>
+	</upstream>
+</pkgmetadata>
--- a/sdk_container/src/third_party/portage-stable/app-text/scdoc/scdoc-1.11.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-text/scdoc/scdoc-1.11.3.ebuild
@ -0,0 +1,45 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="Standalone tool for generating man pages with a simple syntax"
+HOMEPAGE="https://git.sr.ht/~sircmpwn/scdoc"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.sr.ht/~sircmpwn/scdoc"
+	inherit git-r3
+else
+	SRC_URI="https://git.sr.ht/~sircmpwn/scdoc/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+
+src_prepare() {
+	default
+
+	sed -e 's/-Werror//' \
+		-i Makefile || die 'Failed to patch Makefile'
+}
+
+src_compile() {
+	local MY_HS="./scdoc"
+	if tc-is-cross-compiler; then
+		tc-export_build_env
+		MY_HS="./hostscdoc"
+		emake scdoc HOST_SCDOC="./hostscdoc" OUTDIR="${S}/.build.host" CC="$(tc-getBUILD_CC)" \
+			CFLAGS="${BUILD_CFLAGS} -DVERSION='\"${PV}\"'" LDFLAGS="${BUILD_LDFLAGS}"
+		mv scdoc hostscdoc || die 'Failed to rename host scdoc'
+	fi
+
+	emake CC="$(tc-getCC)" LDFLAGS="${LDFLAGS}" PREFIX="${EPREFIX}/usr" HOST_SCDOC="${MY_HS}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" PREFIX="${EPREFIX}/usr" HOST_SCDOC="${MY_HS}" \
+		PCDIR="${EPREFIX}/usr/$(get_libdir)/pkgconfig" install
+}
--- a/sdk_container/src/third_party/portage-stable/app-text/scdoc/scdoc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-text/scdoc/scdoc-9999.ebuild
@ -0,0 +1,45 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="Standalone tool for generating man pages with a simple syntax"
+HOMEPAGE="https://git.sr.ht/~sircmpwn/scdoc"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.sr.ht/~sircmpwn/scdoc"
+	inherit git-r3
+else
+	SRC_URI="https://git.sr.ht/~sircmpwn/scdoc/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+
+src_prepare() {
+	default
+
+	sed -e 's/-Werror//' \
+		-i Makefile || die 'Failed to patch Makefile'
+}
+
+src_compile() {
+	local MY_HS="./scdoc"
+	if tc-is-cross-compiler; then
+		tc-export_build_env
+		MY_HS="./hostscdoc"
+		emake scdoc HOST_SCDOC="./hostscdoc" OUTDIR="${S}/.build.host" CC="$(tc-getBUILD_CC)" \
+			CFLAGS="${BUILD_CFLAGS} -DVERSION='\"${PV}\"'" LDFLAGS="${BUILD_LDFLAGS}"
+		mv scdoc hostscdoc || die 'Failed to rename host scdoc'
+	fi
+
+	emake CC="$(tc-getCC)" LDFLAGS="${LDFLAGS}" PREFIX="${EPREFIX}/usr" HOST_SCDOC="${MY_HS}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" PREFIX="${EPREFIX}/usr" HOST_SCDOC="${MY_HS}" \
+		PCDIR="${EPREFIX}/usr/$(get_libdir)/pkgconfig" install
+}
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@ -16,3 +16,6 @@ DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d419
 DIST cmake-4.0.3-SHA-256.txt 2015 BLAKE2B a346da6aa064c5b390459ab265680e0835f4a66fae6c957cedce302da13daa31e8387b1113b049d5518a2b0431d6ee9ad8fd10abec9e6b35502f954cc02a15ee SHA512 f1ce0d1d9ca3286d311611de2da19de543105dfedda5f0449648a79d0c4ecb2a221aad540915bdc3f1904966c79c60b828cb8a7e6198a718f6f6906bd07697eb
 DIST cmake-4.0.3-SHA-256.txt.asc 833 BLAKE2B 0e82305e93eedfe888e2c54590e509aad58f5d634d3112c66ff5eff622619aef53e4d97f67921b5998082117430d541220df6e2e58656749ae8620aad4928a8a SHA512 d502d87bbf5bb24bdd2d6a0a1d97b854dcc09e17b00e6fa9af4610eb5984b46fd2d7a2a01c15e89bbeed25882738fa764d4b7746c4e25c197d9017277c6f95b8
 DIST cmake-4.0.3.tar.gz 11830216 BLAKE2B 4dc2705baf2404b64da88a5b8838850b782849a4dcdfb0eaefa819ba00a018885a8bd0b42f17f92c8e24b9e76c66e60880377017d8e2d584cb75b2978018e214 SHA512 d3fb9ef408a1b13cd6ef1c294b2515733d1c7220c2c639426bd8037d023ebb439f02e412dd8dd42e385b8e3553547d785eeedc47f2b0843e413b88bd5a7eab18
+DIST cmake-4.1.0-SHA-256.txt 2015 BLAKE2B cbbe940911a0bfb18a0fb0dcc714ad750f348c1a7f7e176816cc6d9e32e0ae4b3f0c1ace3779e17cb443f2cce2b41bf53d756a20b665a3bdcb95d4acd0b6638f SHA512 e81e07abae94588a5ed9cb62396dba04885ed8ddda98751c991af970509e07e6899896d998b52c04c67e58e81e1af243fc64bf7a127e37027385539c5cf6a050
+DIST cmake-4.1.0-SHA-256.txt.asc 833 BLAKE2B 28b6415e1e60f81cf3295573ad43e732fbd53b8d8c76b589a56ea9a8abb02bc7de1d0875fe55ffde8588368a1555f8010769b6ffa92ef860a085b15d0b7f5917 SHA512 beb141dbb66c302a6aff1667afa56898f266e9f8d630e75b806bc2e59178ba56f5a84022b5c9d2e24fb8e762168644ba49fe059812750132c2b11b5821ee456a
+DIST cmake-4.1.0.tar.gz 12042798 BLAKE2B 57e086b18f24d97e386a391151b09fe228feb22fbf0af31f26859069cf269de32b763d1545cdd18f5f73ede1980a83cb21a2b9a8a04a5aa0b08f2525def4c134 SHA512 644b6b13539ba0e7f35a7496e4240b1d3361606163f35b69006e47d03ffd9759d35c62a73826253ed168af4196df29983ec10c0f561ea74d7ed6ffee0c2cd8e4
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.1.0.ebuild
@ -0,0 +1,321 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=4.0.0_rc1
+#CMAKE_DOCS_VERSION=${PV}
+#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == *9999* ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+	inherit verify-sig
+
+	SRC_URI+=" verify-sig? (
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
+	)"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? ( dev-qt/qtbase:6[gui,widgets] )
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+pkg_pretend() {
+	if [[ -z ${EPREFIX} ]] ; then
+		local file
+		local errant_files=()
+
+		# See bug #599684 and bug #753581 (at least)
+		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
+			if [[ -e ${file} ]]; then
+				errant_files+=( "${file}" )
+			fi
+		done
+
+		# If errant files exist
+		if [[ ${#errant_files[@]} -gt 0 ]]; then
+			eerror "Errant files found!"
+			eerror "The presence of these files is known to confuse CMake's"
+			eerror "library path logic. Please (re)move these files:"
+
+			for file in "${errant_files[@]}"; do
+				eerror " mv ${file} ${file}.bak"
+			done
+
+			die "Stray files found in /etc/, see above message"
+		fi
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	# 4.0.0_rc1 is missing this, fails to configure
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
+	touch .clang-tidy Utilities/.clang-tidy || die
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actually bootstrap it every time so why test it?
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
@ -10,7 +10,6 @@ inherit flag-o-matic unpacker verify-sig guile-single
 DESCRIPTION="Standard tool to compile source trees"
 HOMEPAGE="https://www.gnu.org/software/make/make.html"
 if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/make.git"
 	inherit autotools git-r3
 elif [[ $(ver_cut 3) -ge 90 || $(ver_cut 4) -ge 90 ]] ; then
 	SRC_URI="https://alpha.gnu.org/gnu/make/${P}.tar.lz"
@ -50,6 +49,15 @@ PATCHES=(

 src_unpack() {
 	if [[ ${PV} == 9999 ]] ; then
+		EGIT_REPO_URI=("https://git.savannah.gnu.org/git/make.git")
+		git-r3_src_unpack
+
+		EGIT_REPO_URI=(
+			"https://github.com/coreutils/gnulib/"
+			"https://git.savannah.gnu.org/git/gnulib.git"
+		)
+		EGIT_BRANCH=$(. "${S}/bootstrap.conf" && echo "${GNULIB_REVISION}" || die)
+		EGIT_CHECKOUT_DIR=${S}/gnulib
 		git-r3_src_unpack

 		cd "${S}" || die
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@ -10,24 +10,18 @@ DIST meson-1.5.2.tar.gz 2265788 BLAKE2B bda0742cf053cb235833b347e66b8706983815fd
 DIST meson-1.5.2.tar.gz.asc 833 BLAKE2B 0ea6af017430568b2834081a60d0153cc80cb55d835b1f570e27ae6220a163aff9f4607654fe87841df112c78763b4d45dabd45072e398cdf901762095ce52e7 SHA512 7b7c0ee2b872c83d98954079fc27665b3a9ec5464aa8decc5919ff4e1c4134d7006494bd64b901dc2ade408131ea512eefef9416f3c57d1460c9308cb6683fc8
 DIST meson-1.6.1.tar.gz 2276144 BLAKE2B 7ccdb3bf3f701fc787fabf91413db8301a8658b89e08c1d712711bd35845dc2468211e4b666cf46ad68ad9462e62b12b62d60c3767a2804f9b695b4390bb8235 SHA512 b4ca7a3b667db0ad370110abd8b20467b1c74ae7777a068db33f8974602c123881a7130b2340664abb52e36fe5195989a5cc8fa7de6212c37abf5b0900554425
 DIST meson-1.6.1.tar.gz.asc 833 BLAKE2B 6666eca8e5506b8692fc29ba66dc3ee9d725a7d720a7b43db720098f7e00671e71993586606c187d8314e3919474f5733d64a8d052be6552cbcf013a872905ab SHA512 543cf396de0a58998c3587aa05580fa9a56734db40b74fc5fbb22cd56124531804a5360d6b9acb9baa71753ac04c343364da4d78a0d366d8e8bc760030ebf8d3
-DIST meson-1.7.0.tar.gz 2293975 BLAKE2B 64465b33c2358fddc3594807ee5d251dc6bcc1030ed3559d2d5dc33b7092a512b8a3d3b75cc7152812dbc62631d3b9fba596cd105654ae3ff38f01be8ada5232 SHA512 a5d1f00b193ca37ae64f85c9dfc29a2661c167d82d9953b9acd1393b222b05fa5fc03ffdf00fd1ae7a2014da3a7366c35f70bf02e3204e929b74f7b00c17c840
-DIST meson-1.7.0.tar.gz.asc 833 BLAKE2B 34783968262e5ce54cca7f4878b09e7611670ede620b8588ac915bb55fed7f4051e151d789b10e9bd650241149dc9930c14b356c3ce436682d496eeabc805672 SHA512 85ec14f080d0d1492922c971909dc734ab1cd4914a567afbfeff5dc00d19a9a72e6e0668280fc045f270c49389ea03059b9eeb831788b2154fb39116b38f6e5e
 DIST meson-1.7.2.tar.gz 5009274 BLAKE2B f5a19d7c0dfa35efda5bdef972fa6362a64fee2c74be0c09dee6d52c30a8b0169dbe7fab3199add306c778f6a57196251b44ec27ff6b5e038e12c11b27513a54 SHA512 c3c71ae0e0c31d8d72e200bb5fd5e6584ce41aabe1e85575d50371f82ed02c6e346da3b0b4a2786199b9410daaa1622807a88bfc8ac991cf134bad4a53b3c863
 DIST meson-1.7.2.tar.gz.asc 996 BLAKE2B 9a34bb86f15eb92d4eb972835e8e18e175c869a6ba9d88310ca6058654200b227c7a4a945eee220784f584737a3b74ffcd06e2b60a3e502e49af5da69eb1e5bf SHA512 a1e0461a28dfc8ba74ffd919511584148094c2bc809c3d380749856cbdaa33473c1a0c1ec92928020f50e116803fc03deb37b3ee2aca7e56287b155a5ccc36ac
-DIST meson-1.8.1.tar.gz 2332007 BLAKE2B 8fa77bd0e1494d94de585f8f740cb01dfc302fef1f1d8f25a4a2110470e53e33e61ce1f6c3605b1babdda6531d238e1e87227071334a8f42085dcc35f1940d9b SHA512 f5e7a6098f73e46b30a5e9b09f4da21c2e9cd8133a2ee6f2894fe1603356dbe29361ff95063ac364828676c56da1675c5d58238abda4329e935bcf216a9a80df
-DIST meson-1.8.1.tar.gz.asc 833 BLAKE2B a31c10eb386597049eed127987dfa32f044fbd2ec0261fa0547c066a47a57e27893821f80eb6a7ad82fd72278ff77abdaf4a88fd057b9b960edd8626530a17be SHA512 5d6a0681ccd1132f86904b88fdef4838a9de403d29b6dddb8d8626ce3f1e9d1d911b79f821aa81cd1421fd4c095ca488494a1b77e59f94ba616504eef251dbc7
-DIST meson-1.8.2.tar.gz 2335538 BLAKE2B c3a4e2c505af02b85407f66bb076d4c1a96ca0fde85576d26d8ad6522dce8107f1bdb97c771b0f28e527da0383853b36cd56e8533d5be175cf62b7fbadca40b6 SHA512 d3d87c806a0ac8405af9205cc2c9a5f2dbeda8639506bf96bfb3821aa8184c185a1afc29738a54b47902ef830c1b5253e3ee3542a3f9bbc8fd91b9ea02f0a0b7
-DIST meson-1.8.2.tar.gz.asc 833 BLAKE2B c59ef68cf74daf9658c6589cc037a21bbc9fa03134093b1a30425ba19a69036868c1c7bd1c7f26b486a6eb9e6e13796f02b52e7caa78701d546d9da3f7591b41 SHA512 9f6dbe0329a8f1685110fadd803239eb675b67f59f2f1988494ec6e95110aca754ff7dbb6edad708c53b9420bd09c2d115af5f9f879175a9e37cb28f978add8b
 DIST meson-1.8.3.tar.gz 2335924 BLAKE2B 3c440854bd91c757d4370b498f0e6e903df4589f4958e05fa16ae70e6efc01d2e96f101612146556b81cc3db370255f4319bd5d49d8e46210df282cc447ec12e SHA512 effd6f556152e508185a5bc59131b3a31696577298aec5f3d3ab68153ade9e98242171d6b72c00f8c32fc3492aba3487252d77a94a96b5a92e89724de045d49b
 DIST meson-1.8.3.tar.gz.asc 833 BLAKE2B 25f00f76819c74e64b3750ddd4507fdd8a0be764db54ea48ba49f0985bfbf04d294e5eff1ee799ec082cba24ed59b21a8fd75f81dee9d824e5f8cd9c775b0dcd SHA512 9c28747ff4756422dae4eb4a86de24fe230e6676660aa9cfb72d29311012106a9edbcfff3559682917a7e0ed8c80af8b8ec37807d3f7e0f4005eed5793367307
-DIST meson-1.9.0rc1.tar.gz 2366185 BLAKE2B 83405d3daa8caf95a2991249abdb2f3f32b2508c93cfcdc36451290989778d98173dea932520e27005d28bac19ca28024be8914122bd516b8efd2c56b52b85d5 SHA512 7f892004aae8f2618d03424829fa053560ec3ecf04a32c691769356ac671358616c512fa0efd1f37f3e33702bf2b907150059faf6e305ecf6f786463194cacab
-DIST meson-1.9.0rc1.tar.gz.asc 833 BLAKE2B 55ec82df85b58697116f4dc0014f2b49bfcd49facf92db28d8a73ee4a3928d38cabfe32fdef773ad7e0f453cc1e271b9b7b599b1e2156f6835e2bc85f2685417 SHA512 de12d08222a1d3bba245b1aba06ef49c711214271883a7c92d0cc7936e005a361a347b5fe5592c1e7bd9aac4a752edd854831290dbb8cbf8464658271de6d9b2
+DIST meson-1.8.4.tar.gz 2336961 BLAKE2B fd574be17f1dde56fed13e18151cddc3265b4175b46bb45961f46a586e0e3b619ce5179df78505ac46cc6af7d8cbd4fc73f6434b8581b3e3518d791f6bb6e75c SHA512 3325c3968649847621e4d39309222741e5158b204ff6cc88410f364634c9978b5fb4c02c73968b3b7df46c89371a5b27aec9a997917dae757415bd77f5db39f2
+DIST meson-1.8.4.tar.gz.asc 833 BLAKE2B 33fea09355be6f3df1c9f82daf2c92cbebd79846f82039e697f390db4811ade49edaeb942a4d1da8cb95238cff400e4ef1a76e141189acf10bc5da70e3fb3c44 SHA512 e0e6474a020e320d940d8de1843b491d1906c38bca304168324cae333c5635c70b210ef14e1d31ada2a31e7d3b8e5ae4a8563373230f40c52c2cac017359fd29
+DIST meson-1.9.0.tar.gz 2366082 BLAKE2B 54cef087a9629087e67a0d75422d08370e86273a202d9e054d160a4ae52b7b1ad612a2a2c8e72a00a8e29bd5857375bedca5935cd74a560950c6b45a48d69f19 SHA512 62e633e07e7e8be1bf4f62f9e5a2df9535750fc0047ee5c21b17bc851d190cc0cf8e6696614692091013dc72e68aa23d2c1fe04500e146f56876591250474d04
+DIST meson-1.9.0.tar.gz.asc 833 BLAKE2B 3054c5f24b264fd5471b4094e6a37cfa4cad3567b8eda69d4b7a6c0e5486c95199b683c1b5b9ed1be44fd0eacaca1afb9dd95fd363a23753fdd0f71f194e9793 SHA512 7f2ce856cf16004ebdef1ce294e7efc44f644691cac2f704625b4a56b270d4b2db54564bef9f4c90360c1ec738e54b948aba336e1feb70dca2daf0e500f2b627
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
-DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150943b6cd95a0599b0392299e2a9338921b52bbe3613fc03fa931c28fb2121801bdb74880f2bd4fecb051b7f1fcb4b SHA512 9d9a3862602251ca780acdf18cee4ab9cd14404481e216b557eafc88b23561ecf481836898b78cbc4ee3539869b5578c649a5c71f32b3074d8125b867ea4751d
 DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
-DIST meson-reference-1.8.1.3 345633 BLAKE2B 026423161eeddff3e663016c4b3fff885e96dc1a652562fe312cb80cfcc845015cab0d0f51c39f187cc484752f8f2bf7954dc8daf6762a74f895338cac4c35c4 SHA512 d3041eee86e63c178a04d5ec1ec383e7bbd209f358103806d488b28383471c1ecb5a13aa3716f699c1973a1d32dace34b0fdb0375e19abc0050deeb66fc5d376
-DIST meson-reference-1.8.2.3 345633 BLAKE2B a53888284967c1beb8875a380eb7fd58402db0ae8d3357f47cd265a1695f73f85dd5ef6c36ee95252012120f3b904d74dabcbd4b1aa4174975b1d1899d30283c SHA512 b40904bebedc678f4e8567cd0b6a377a678d4f3fa13feb5d978d65b39a308b607c78adfc6b742f9d7c2f2c57e7b011f52d875e97b85f1c4ffbfd4ebe52814443
 DIST meson-reference-1.8.3.3 345855 BLAKE2B c8825ba7b72b36866ebfa8cdf63362f2d38673315378ea213c438057f5dafa36b9e729e8c415a29715c1da4fe72733a4a6a2cdbee4b7df57e5eb97f50152491b SHA512 3085c10cfc08ce4f0edad7129ce4d9a0bf75c6522309e344ba14e27c34d46c3da25ebb46260de28caef4a6c8134857d63297ded26f1296639a8a097e62a1801c
-DIST meson-reference-1.9.0rc1.3 347290 BLAKE2B 3aed4aa402e25d3c16c38a7637d318f67dd0c37a7edad6ceaa9f867132bf2709be0b874a57a8ecad30e2a30f8daba6e0802198a4b0747372850493429b2d12d1 SHA512 9c493127efdb3420f863f9b1b357661c661dfdb1510638e9264c14c6291e9c7cf8cbed2b5611fe19afc076326f4031a7bc6fe7f023b547c123c81455b2026189
+DIST meson-reference-1.8.4.3 345964 BLAKE2B a2840cfabe319cb244ad46bb3b72b7e19bcaf3bfbd0f804c3982a191f795284cc4d35ee00266bf069dd95c0fa99fdb565343007aed75a7a0859ad85528422667 SHA512 95385faa364103c9f38b497f6e021d81c0e08048863a046b5c9030d11f7554f8237d405fe04d2145513e3685a13c71b167f29a8727d0f8cb0ca591076e0b39b9
+DIST meson-reference-1.9.0.3 347286 BLAKE2B 1fb96870791e7bdaefed5c9a0e807d412e922e965690ef2f8820075a27c2d20d7b8057f0f3b7b009dcc5f20cb7ba7ee778d2df6e4eac583cda58625d58fe9266 SHA512 6e0e127c988b6269c13ba901ce7bbedab135d81a0b4bcd8528a01371d9f74964381c446c2fa35876953ad0199866a0016b1e39f315b054b91499fc00597a9c5d
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
@ -1,226 +0,0 @@
-# Copyright 2016-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-DISTUTILS_USE_PEP517=setuptools
-
-inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
-
-if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
-	inherit ninja-utils git-r3
-
-	BDEPEND="
-		${NINJA_DEPEND}
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	"
-
-else
-	inherit verify-sig
-
-	MY_PV=${PV/_/}
-	MY_P=${P/_/}
-	S=${WORKDIR}/${MY_P}
-
-	SRC_URI="
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
-		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
-	"
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-DESCRIPTION="Open source build system"
-HOMEPAGE="https://mesonbuild.com/"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-IUSE="test test-full"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="test-full? ( test )"
-
-DEPEND="
-	test? (
-		dev-libs/glib:2
-		dev-libs/gobject-introspection
-		app-alternatives/ninja
-		dev-vcs/git
-		sys-libs/zlib[static-libs(+)]
-		virtual/pkgconfig
-		dev-build/cmake
-	)
-	test-full? (
-		|| ( dev-lang/rust dev-lang/rust-bin )
-		dev-lang/nasm
-		>=dev-lang/pypy-3
-		dev-lang/vala
-		dev-python/cython
-		virtual/fortran
-		virtual/jdk
-
-		app-text/doxygen
-		dev-cpp/gtest
-		dev-libs/protobuf
-		dev-util/bindgen
-		dev-util/gtk-doc
-		dev-util/itstool
-		llvm-core/llvm
-		media-libs/libsdl2
-		media-libs/libwmf
-		net-libs/libpcap
-		sci-libs/hdf5[fortran]
-		sci-libs/netcdf
-		sys-cluster/openmpi[fortran]
-		sys-devel/bison
-		sys-devel/flex
-
-		dev-qt/linguist-tools:5
-		dev-qt/qtwidgets:5
-		dev-qt/qtbase:6[gui,widgets]
-		dev-qt/qtdeclarative:6
-		dev-qt/qttools:6
-		dev-util/gdbus-codegen
-		x11-libs/gtk+:3
-
-		dev-libs/wayland
-		dev-util/wayland-scanner
-	)
-"
-RDEPEND="
-	!<dev-build/muon-0.2.0-r2[man(-)]
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
-)
-
-src_unpack() {
-	if [[ ${PV} = *9999* ]]; then
-		git-r3_src_unpack
-	else
-		default
-		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
-	fi
-}
-
-python_prepare_all() {
-	local disable_unittests=(
-		# ASAN and sandbox both want control over LD_PRELOAD
-		# https://bugs.gentoo.org/673016
-		-e 's/test_generate_gir_with_address_sanitizer/_&/'
-
-		# ASAN is unsupported on some targets
-		# https://bugs.gentoo.org/692822
-		-e 's/test_pch_with_address_sanitizer/_&/'
-
-		# clippy-driver fails, but only when run via portage.
-		#
-		#   error[E0463]: can't find crate for `std`
-		#   error: requires `sized` lang_item
-		-e 's/test_rust_clippy/_&/'
-	)
-
-	sed -i "${disable_unittests[@]}" unittests/*.py || die
-
-	# Broken due to python2 script created by python_wrapper_setup
-	rm -r "test cases/frameworks/1 boost" || die
-	# nvcc breaks on essentially any LDFLAGS
-	# https://bugs.gentoo.org/936757
-	# https://github.com/mesonbuild/meson/issues/11234
-	rm -r "test cases/cuda"/* || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_check_deps() {
-	if [[ ${PV} = *9999* ]]; then
-		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-	fi
-}
-
-python_configure_all() {
-	if [[ ${PV} = *9999* ]]; then
-		# We use the unsafe_yaml loader because strictyaml is not packaged. In
-		# theory they produce the same results, but pyyaml is faster and
-		# without safety checks.
-		edo ./meson.py setup \
-			--prefix "${EPREFIX}/usr" \
-			-Dhtml=false \
-			-Dunsafe_yaml=true \
-			docs/ docs/builddir
-	fi
-}
-
-python_compile_all() {
-	if [[ ${PV} = *9999* ]]; then
-		eninja -C docs/builddir
-	fi
-}
-
-src_test() {
-	tc-export PKG_CONFIG
-	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
-		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
-	else
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	(
-		# meson has its own tests for LTO support. We don't need to verify that
-		# all tests work when they happen to use it. And in particular, this
-		# breaks rust.
-		filter-lto
-
-		# remove unwanted python_wrapper_setup contents
-		# We actually do want to non-error if python2 is installed and tested.
-		remove="${T}/${EPYTHON}/bin:"
-		PATH=${PATH/${remove}/}
-
-		# test_meson_installed
-		unset PYTHONDONTWRITEBYTECODE
-
-		# https://bugs.gentoo.org/687792
-		unset PKG_CONFIG
-
-		# test_cross_file_system_paths
-		unset XDG_DATA_HOME
-
-		# 'test cases/unit/73 summary' expects 80 columns
-		export COLUMNS=80
-
-		# If JAVA_HOME is not set, meson looks for javac in PATH.
-		# If javac is in /usr/bin, meson assumes /usr/include is a valid
-		# JDK include path. Setting JAVA_HOME works around this broken
-		# autodetection. If no JDK is installed, we should end up with an empty
-		# value in JAVA_HOME, and the tests should get skipped.
-		export JAVA_HOME=$(java-config -O 2>/dev/null)
-
-		${EPYTHON} -u run_tests.py
-	) || die "Testing failed with ${EPYTHON}"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all
-
-	insinto /usr/share/vim/vimfiles
-	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
-
-	dozshcomp data/shell-completions/zsh/_meson
-	dobashcomp data/shell-completions/bash/meson
-
-	if [[ ${PV} = *9999* ]]; then
-		DESTDIR="${ED}" eninja -C docs/builddir install
-	else
-		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
-	fi
-}
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@ -32,11 +32,11 @@ else
 	# Releases may be signed by those listed in Releasing.md. Jussi
 	# remains the default release manager.
 	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-eschwartz )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.gpg
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-eschwartz-20250723-r1 )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.asc

 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi

--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.2.ebuild
@ -1,229 +0,0 @@
-# Copyright 2016-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
-DISTUTILS_USE_PEP517=setuptools
-
-inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
-
-if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
-	inherit ninja-utils git-r3
-
-	BDEPEND="
-		${NINJA_DEPEND}
-		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
-	"
-
-else
-	inherit verify-sig
-
-	MY_PV=${PV/_/}
-	MY_P=${P/_/}
-	S=${WORKDIR}/${MY_P}
-
-	SRC_URI="
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
-		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
-		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
-	"
-	# Releases may be signed by those listed in Releasing.md. Jussi
-	# remains the default release manager.
-	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-DESCRIPTION="Open source build system"
-HOMEPAGE="https://mesonbuild.com/"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-IUSE="test test-full"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="test-full? ( test )"
-
-DEPEND="
-	test? (
-		dev-libs/glib:2
-		dev-libs/gobject-introspection
-		app-alternatives/ninja
-		dev-vcs/git
-		sys-libs/zlib[static-libs(+)]
-		virtual/pkgconfig
-		dev-build/cmake
-	)
-	test-full? (
-		|| ( dev-lang/rust dev-lang/rust-bin )
-		dev-lang/nasm
-		>=dev-lang/pypy-3
-		dev-lang/vala
-		dev-python/cython
-		virtual/fortran
-		virtual/jdk
-
-		app-text/doxygen
-		dev-cpp/gtest
-		dev-libs/protobuf
-		dev-util/bindgen
-		dev-util/gtk-doc
-		dev-util/itstool
-		llvm-core/llvm
-		media-libs/libsdl2
-		media-libs/libwmf
-		net-libs/libpcap
-		sci-libs/hdf5[fortran]
-		sci-libs/netcdf
-		sys-cluster/openmpi[fortran]
-		sys-devel/bison
-		sys-devel/flex
-
-		dev-qt/linguist-tools:5
-		dev-qt/qtwidgets:5
-		dev-qt/qtbase:6[gui,widgets]
-		dev-qt/qttools:6
-		dev-util/gdbus-codegen
-		x11-libs/gtk+:3
-
-		dev-libs/wayland
-		dev-util/wayland-scanner
-	)
-"
-RDEPEND="
-	!<dev-build/muon-0.2.0-r2[man(-)]
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
-)
-
-src_unpack() {
-	if [[ ${PV} = *9999* ]]; then
-		git-r3_src_unpack
-	else
-		default
-		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
-	fi
-}
-
-python_prepare_all() {
-	local disable_unittests=(
-		# ASAN and sandbox both want control over LD_PRELOAD
-		# https://bugs.gentoo.org/673016
-		-e 's/test_generate_gir_with_address_sanitizer/_&/'
-		-e 's/test_env_cflags_ldflags/_&/'
-
-		# ASAN is unsupported on some targets
-		# https://bugs.gentoo.org/692822
-		-e 's/test_pch_with_address_sanitizer/_&/'
-
-		# clippy-driver fails, but only when run via portage.
-		#
-		#   error[E0463]: can't find crate for `std`
-		#   error: requires `sized` lang_item
-		-e 's/test_rust_clippy/_&/'
-	)
-
-	sed -i "${disable_unittests[@]}" unittests/*.py || die
-
-	# Broken due to python2 script created by python_wrapper_setup
-	rm -r "test cases/frameworks/1 boost" || die
-	# nvcc breaks on essentially any LDFLAGS
-	# https://bugs.gentoo.org/936757
-	# https://github.com/mesonbuild/meson/issues/11234
-	rm -r "test cases/cuda"/* || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_check_deps() {
-	if [[ ${PV} = *9999* ]]; then
-		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
-	fi
-}
-
-python_configure_all() {
-	if [[ ${PV} = *9999* ]]; then
-		# We use the unsafe_yaml loader because strictyaml is not packaged. In
-		# theory they produce the same results, but pyyaml is faster and
-		# without safety checks.
-		edo ./meson.py setup \
-			--prefix "${EPREFIX}/usr" \
-			-Dhtml=false \
-			-Dunsafe_yaml=true \
-			docs/ docs/builddir
-	fi
-}
-
-python_compile_all() {
-	if [[ ${PV} = *9999* ]]; then
-		eninja -C docs/builddir
-	fi
-}
-
-src_test() {
-	tc-export PKG_CONFIG
-	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
-		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
-	else
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	(
-		# meson has its own tests for LTO support. We don't need to verify that
-		# all tests work when they happen to use it. And in particular, this
-		# breaks rust.
-		filter-lto
-
-		# remove unwanted python_wrapper_setup contents
-		# We actually do want to non-error if python2 is installed and tested.
-		remove="${T}/${EPYTHON}/bin:"
-		PATH=${PATH/${remove}/}
-
-		# test_meson_installed
-		unset PYTHONDONTWRITEBYTECODE
-
-		# https://bugs.gentoo.org/687792
-		unset PKG_CONFIG
-
-		# test_cross_file_system_paths
-		unset XDG_DATA_HOME
-
-		# 'test cases/unit/73 summary' expects 80 columns
-		export COLUMNS=80
-
-		# If JAVA_HOME is not set, meson looks for javac in PATH.
-		# If javac is in /usr/bin, meson assumes /usr/include is a valid
-		# JDK include path. Setting JAVA_HOME works around this broken
-		# autodetection. If no JDK is installed, we should end up with an empty
-		# value in JAVA_HOME, and the tests should get skipped.
-		export JAVA_HOME=$(java-config -O 2>/dev/null)
-
-		${EPYTHON} -u run_tests.py
-	) || die "Testing failed with ${EPYTHON}"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all
-
-	insinto /usr/share/vim/vimfiles
-	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
-
-	dozshcomp data/shell-completions/zsh/_meson
-	dobashcomp data/shell-completions/bash/meson
-
-	if [[ ${PV} = *9999* ]]; then
-		DESTDIR="${ED}" eninja -C docs/builddir install
-	else
-		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
-	fi
-}
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc1.ebuild
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools

 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
@ -102,7 +103,6 @@ RDEPEND="

 PATCHES=(
 	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
-	"${FILESDIR}"/unbreak-setuptools-test_installed.patch
 )

 src_unpack() {
@ -120,6 +120,7 @@ python_prepare_all() {
 		# https://bugs.gentoo.org/673016
 		-e 's/test_generate_gir_with_address_sanitizer/_&/'
 		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'

 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.13.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.13.1.ebuild
@ -15,7 +15,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/ninja-build/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi

 GTEST_VER=1.16.0
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`DIST scdoc-1.11.3.tar.gz 12768 BLAKE2B c39ed51f9279aa8a08bbd99a3d3780ef37654a37f687c7de340266d9c7a6edceb8f6824baaa34c756440d45bd51611ab28f7f2e42ea632b943f6018d6e5f5a04 SHA512 fbecc505b44c396890c53c05183d34336160dbd02993ee120421fc6e2a3ec78ba349747e8acfe97af956a0081c923309290ff97fb7babafbc3ca8addc9ec92f9`