Merge pull request #398 from flatcar/krnowak/move-portage

sys-apps/portage: Move from coreos-overlay and update
2025-08-17 01:46:58 +02:00 · 2023-01-12 15:37:36 +01:00 · 2023-01-12 15:37:36 +01:00 · 0425f76b8c
commit 0425f76b8c
parent 7da9b6b6e4 4e5fd29775
36 changed files with 1929 additions and 488 deletions
--- a/sdk_container/src/third_party/portage-stable/.github/workflows/packages-list
+++ b/sdk_container/src/third_party/portage-stable/.github/workflows/packages-list
@ -143,9 +143,11 @@ profiles
 # scripts

 sys-apps/diffutils
+sys-apps/file
 sys-apps/gentoo-functions
 sys-apps/help2man
 sys-apps/iucode_tool
+sys-apps/portage

 sys-devel/autoconf
 sys-devel/autoconf-archive
@ -172,6 +174,7 @@ sys-fs/multipath-tools

 sys-libs/binutils-libs
 sys-libs/libcap
+sys-libs/libseccomp
 sys-libs/zlib

 virtual/libcrypt
--- a/sdk_container/src/third_party/portage-stable/changelog/updates/2022-12-12-portage-update.md
+++ b/sdk_container/src/third_party/portage-stable/changelog/updates/2022-12-12-portage-update.md
@ -0,0 +1,3 @@
+- portage ([3.0.41](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.41))
+- file ([5.43](https://mailman.astron.com/pipermail/file/2022-September/000857.html))
+- libseccomp ([2.5.4](https://github.com/seccomp/libseccomp/releases/tag/v2.5.4) (contains [2.5.2](https://github.com/seccomp/libseccomp/releases/tag/v2.5.2), [2.5.3](https://github.com/seccomp/libseccomp/releases/tag/v2.5.3)))
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest
@ -1,2 +1,4 @@
-DIST file-5.40.tar.gz 1004214 BLAKE2B 4e15a1ca62fe7c03c90b0e509dc899b87f4474f758ad3d08172b3d838dc3f7c2954ba1074eeeeb3da8c04b8df84eff2b8cdf3177da334a926914429df67f60bf SHA512 3b70df75fa4c9050d55b1ffdc28e5f3c8b8ef7d4efd1a06bf53f113b676d81114a85aae56e0897d32b53716662d64ad18ab251ca8c92c6405c69eb758bb99afb
-DIST file-5.41.tar.gz 1064097 BLAKE2B 56fe8a58d9497bb1bfe3ed6b3ce5df70dd27cc308eb0cfdac8e91ba81c733a96aa622c120ac59079986c6d84901c6f2d82fa24f698d481d7f77e6cfdd432d648 SHA512 bbf2d8e39450b31d0ba8d76d202790fea953775657f942f06e6dc9091798d4a395f7205e542388e4a25b6a4506d07f36c5c4da37cfce0734133e9203a3b00654
+DIST file-5.43.tar.gz 1162786 BLAKE2B aaaf32c5054fb83e912af6656e5e67947f45576ec3711c7cba5531ed780e142a448580e0db41a828c8a3c5d2f1bf0c8ed49bc9688499caaae4a08baa16b3610c SHA512 9d02f4e7a69d90468d6bd35df5ec240ddee8c2408b7df3e73427d7f18736baf77db0638a1fe8283f4e6abd1d5ad653890ed3a5a0d48bb52d4023ca4070ecdf06
+DIST file-5.43.tar.gz.asc 195 BLAKE2B d7f83b3e21d1390467989f8870e36daa48ebb8c5ac7ab8dc6d667a65d10561126d32cfc5ef3d81a130990b3e46bcba9b5e03f0a7dd169782351b02cebec2471f SHA512 c565958840f2f5c62821cd08d4149ec97c574232913ec00400473364e160250cfaced8c715e109c4c617359e33d2470f7ca6af1891cbdf994329e890f90c8be3
+DIST file-5.44.tar.gz 1186437 BLAKE2B a90ccae738a95315d75a0aaee7bbff3624425cc9267daf18ba9147b7c9b9ebfb31288b54c63a73e4695eca0e876f206e40bcb81c422f1bf572b976e753b25a42 SHA512 26c3b9c7a6950649d0b2de896bfeca54289febe4cd487c0f91aa6ff1857fa49f9077f8738a17b86100125668a31dae05b586615c564f78da47ac20a1e4a74f63
+DIST file-5.44.tar.gz.asc 195 BLAKE2B a0905d42fec0fa052d75fb5b267c6ae223176451c0f1d3346006d4b760c3d858f2dcda5f0a30c6aa4b09b5afee427b75bc4debd5033d978f39dc1da01d3e1bd1 SHA512 1a4dc39283f4859581441aa35b3ed72b323c4e05ca0960d17126d1b9ec18465c695c0545e24f09f8437a60ab52e582be67b6cbbc656bbb676de00148c3644d23
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.43-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.43-r2.ebuild
@ -1,22 +1,29 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

-EAPI=7
+EAPI=8

-PYTHON_COMPAT=( python3_{8..10} )
+DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{8..11} )

 inherit distutils-r1 libtool toolchain-funcs multilib-minimal

-if [[ ${PV} == "9999" ]] ; then
+if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/glensc/file.git"
 	inherit autotools git-r3
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/file.asc
+	inherit verify-sig
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi

-DESCRIPTION="identify a file's format by scanning binary data for patterns"
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
 HOMEPAGE="https://www.darwinsys.com/file/"

 LICENSE="BSD-2"
@ -35,10 +42,16 @@ DEPEND="
 RDEPEND="${DEPEND}
 	python? ( !dev-python/python-magic )
 	seccomp? ( sys-libs/libseccomp[${MULTILIB_USEDEP}] )"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)"

 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
-	"${FILESDIR}/file-5.40-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #713710 #728978
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/${P}-configure-clang16.patch"
 )

 src_prepare() {
@ -46,13 +59,14 @@ src_prepare() {

 	if [[ ${PV} == 9999 ]] ; then
 		eautoreconf
+	else
+		elibtoolize
 	fi

-	elibtoolize
-
-	# don't let python README kill main README #60043
+	# don't let python README kill main README, bug ##60043
 	mv python/README.md python/README.python.md || die
-	sed 's@README.md@README.python.md@' -i python/setup.py || die #662090
+	# bug #662090
+	sed 's@README.md@README.python.md@' -i python/setup.py || die
 }

 multilib_src_configure() {
@ -75,13 +89,14 @@ build_src_configure() {
 		--disable-xzlib
 		--disable-zlib
 	)
-	tc-env_build econf "${myeconfargs[@]}"
+
+	econf_build "${myeconfargs[@]}"
 }

 need_build_file() {
 	# when cross-compiling, we need to build up our own file
 	# because people often don't keep matching host/target
-	# file versions #362941
+	# file versions, bug #362941
 	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
 }

@ -101,18 +116,20 @@ multilib_src_compile() {
 	if multilib_is_native_abi ; then
 		emake
 	else
-		cd src || die
-		emake magic.h #586444
-		emake libmagic.la
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
 	fi
 }

 src_compile() {
 	if need_build_file ; then
-		emake -C "${WORKDIR}"/build/src magic.h #586444
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
 		emake -C "${WORKDIR}"/build/src file
 		local -x PATH="${WORKDIR}/build/src:${PATH}"
 	fi
+
 	multilib-minimal_src_compile

 	if use python ; then
@ -140,5 +157,6 @@ multilib_src_install_all() {
 		cd python || die
 		distutils-r1_src_install
 	fi
+
 	find "${ED}" -type f -name "*.la" -delete || die
 }
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.44-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.44-r1.ebuild
@ -1,48 +1,61 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

-EAPI=7
+EAPI=8

-PYTHON_COMPAT=( python3_{8..10} )
+DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{8..11} )

 inherit distutils-r1 libtool toolchain-funcs multilib-minimal

-if [[ ${PV} == "9999" ]] ; then
+if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/glensc/file.git"
 	inherit autotools git-r3
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/file.asc
+	inherit verify-sig
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi

-DESCRIPTION="identify a file's format by scanning binary data for patterns"
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
 HOMEPAGE="https://www.darwinsys.com/file/"

 LICENSE="BSD-2"
 SLOT="0"
-IUSE="bzip2 lzma python seccomp static-libs zlib"
+IUSE="bzip2 lzip lzma python seccomp static-libs zlib zstd"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"

 DEPEND="
 	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	lzip? ( app-arch/lzlib )
 	lzma? ( app-arch/xz-utils[${MULTILIB_USEDEP}] )
 	python? (
 		${PYTHON_DEPS}
 		dev-python/setuptools[${PYTHON_USEDEP}]
 	)
-	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )"
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
 RDEPEND="${DEPEND}
 	python? ( !dev-python/python-magic )
 	seccomp? ( sys-libs/libseccomp[${MULTILIB_USEDEP}] )"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)"

 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
-	"${FILESDIR}/file-5.40-xz_magic.patch" #784773
-	"${FILESDIR}/file-5.40-seccomp-faccessat.patch"
-	"${FILESDIR}/file-5.40-seccomp-fstatat64.patch" #784857
-	"${FILESDIR}/file-5.40-revert-char-count.patch" #799188
-	"${FILESDIR}/file-5.40-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
+	"${FILESDIR}/file-5.44-limits-solaris.patch" # applied upstream
+	"${FILESDIR}/file-5.44-seccomp-utimes.patch" # upstream
 )

 src_prepare() {
@ -50,24 +63,29 @@ src_prepare() {

 	if [[ ${PV} == 9999 ]] ; then
 		eautoreconf
+	else
+		elibtoolize
 	fi

-	elibtoolize
-
-	# don't let python README kill main README #60043
+	# Don't let python README kill main README, bug ##60043
 	mv python/README.md python/README.python.md || die
-	sed 's@README.md@README.python.md@' -i python/setup.py || die #662090
+
+	# bug #662090
+	sed 's@README.md@README.python.md@' -i python/setup.py || die
 }

 multilib_src_configure() {
 	local myeconfargs=(
 		--enable-fsect-man5
 		$(use_enable bzip2 bzlib)
+		$(multilib_native_use_enable lzip lzlib)
 		$(use_enable lzma xzlib)
 		$(use_enable seccomp libseccomp)
 		$(use_enable static-libs static)
 		$(use_enable zlib)
+		$(use_enable zstd zstdlib)
 	)
+
 	econf "${myeconfargs[@]}"
 }

@ -79,13 +97,14 @@ build_src_configure() {
 		--disable-xzlib
 		--disable-zlib
 	)
-	tc-env_build econf "${myeconfargs[@]}"
+
+	econf_build "${myeconfargs[@]}"
 }

 need_build_file() {
-	# when cross-compiling, we need to build up our own file
+	# When cross-compiling, we need to build up our own file
 	# because people often don't keep matching host/target
-	# file versions #362941
+	# file versions, bug #362941
 	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
 }

@ -105,18 +124,20 @@ multilib_src_compile() {
 	if multilib_is_native_abi ; then
 		emake
 	else
-		cd src || die
-		emake magic.h #586444
-		emake libmagic.la
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
 	fi
 }

 src_compile() {
 	if need_build_file ; then
-		emake -C "${WORKDIR}"/build/src magic.h #586444
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
 		emake -C "${WORKDIR}"/build/src file
 		local -x PATH="${WORKDIR}/build/src:${PATH}"
 	fi
+
 	multilib-minimal_src_compile

 	if use python ; then
@ -134,7 +155,7 @@ multilib_src_install() {
 }

 multilib_src_install_all() {
-	dodoc ChangeLog MAINT README
+	dodoc ChangeLog MAINT # README

 	# Required for `file -C`
 	insinto /usr/share/misc/magic
@ -144,5 +165,6 @@ multilib_src_install_all() {
 		cd python || die
 		distutils-r1_src_install
 	fi
+
 	find "${ED}" -type f -name "*.la" -delete || die
 }
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
@ -1,43 +1,59 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

-EAPI=7
+EAPI=8

-PYTHON_COMPAT=( python3_{8..10} )
+DISTUTILS_USE_PEP517=setuptools
 DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{8..11} )

 inherit distutils-r1 libtool toolchain-funcs multilib-minimal

-if [[ ${PV} == "9999" ]] ; then
+if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/glensc/file.git"
 	inherit autotools git-r3
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/file.asc
+	inherit verify-sig
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi

-DESCRIPTION="identify a file's format by scanning binary data for patterns"
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
 HOMEPAGE="https://www.darwinsys.com/file/"

 LICENSE="BSD-2"
 SLOT="0"
-IUSE="bzip2 lzma python seccomp static-libs zlib"
+IUSE="bzip2 lzip lzma python seccomp static-libs zlib zstd"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"

 DEPEND="
 	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	lzip? ( app-arch/lzlib )
 	lzma? ( app-arch/xz-utils[${MULTILIB_USEDEP}] )
 	python? (
 		${PYTHON_DEPS}
 		dev-python/setuptools[${PYTHON_USEDEP}]
 	)
-	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )"
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
 RDEPEND="${DEPEND}
 	python? ( !dev-python/python-magic )
 	seccomp? ( sys-libs/libseccomp[${MULTILIB_USEDEP}] )"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)"

 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
 )

 src_prepare() {
@ -45,24 +61,29 @@ src_prepare() {

 	if [[ ${PV} == 9999 ]] ; then
 		eautoreconf
+	else
+		elibtoolize
 	fi

-	elibtoolize
-
-	# don't let python README kill main README #60043
+	# Don't let python README kill main README, bug ##60043
 	mv python/README.md python/README.python.md || die
-	sed 's@README.md@README.python.md@' -i python/setup.py || die #662090
+
+	# bug #662090
+	sed 's@README.md@README.python.md@' -i python/setup.py || die
 }

 multilib_src_configure() {
 	local myeconfargs=(
 		--enable-fsect-man5
 		$(use_enable bzip2 bzlib)
+		$(multilib_native_use_enable lzip lzlib)
 		$(use_enable lzma xzlib)
 		$(use_enable seccomp libseccomp)
 		$(use_enable static-libs static)
 		$(use_enable zlib)
+		$(use_enable zstd zstdlib)
 	)
+
 	econf "${myeconfargs[@]}"
 }

@ -74,13 +95,14 @@ build_src_configure() {
 		--disable-xzlib
 		--disable-zlib
 	)
-	tc-env_build econf "${myeconfargs[@]}"
+
+	econf_build "${myeconfargs[@]}"
 }

 need_build_file() {
-	# when cross-compiling, we need to build up our own file
+	# When cross-compiling, we need to build up our own file
 	# because people often don't keep matching host/target
-	# file versions #362941
+	# file versions, bug #362941
 	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
 }

@ -100,18 +122,20 @@ multilib_src_compile() {
 	if multilib_is_native_abi ; then
 		emake
 	else
-		cd src || die
-		emake magic.h #586444
-		emake libmagic.la
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
 	fi
 }

 src_compile() {
 	if need_build_file ; then
-		emake -C "${WORKDIR}"/build/src magic.h #586444
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
 		emake -C "${WORKDIR}"/build/src file
 		local -x PATH="${WORKDIR}/build/src:${PATH}"
 	fi
+
 	multilib-minimal_src_compile

 	if use python ; then
@ -129,7 +153,7 @@ multilib_src_install() {
 }

 multilib_src_install_all() {
-	dodoc ChangeLog MAINT README
+	dodoc ChangeLog MAINT # README

 	# Required for `file -C`
 	insinto /usr/share/misc/magic
@ -139,5 +163,6 @@ multilib_src_install_all() {
 		cd python || die
 		distutils-r1_src_install
 	fi
+
 	find "${ED}" -type f -name "*.la" -delete || die
 }
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.39-portage-sandbox.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.39-portage-sandbox.patch
@ -1,26 +0,0 @@
-From 81765a2d4fcce23f42495d5ec03bbfecb2a3c381 Mon Sep 17 00:00:00 2001
-From: tka <tka@kamph.org>
-Date: Wed, 24 Jun 2020 11:18:45 +0200
-Subject: [PATCH] Allow getcwd for Gentoo's portage sandbox
-
-Bug: https://bugs.gentoo.org/728978
---
- src/seccomp.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/seccomp.c b/src/seccomp.c
-index db9364ae..7f5d6f26 100644
--- a/src/seccomp.c
-+++ b/src/seccomp.c
-@@ -229,6 +229,8 @@ enable_sandbox_full(void)
- 	ALLOW_RULE(write);
- 	ALLOW_RULE(writev);
- 
-+	// needed by Gentoo's portage sandbox
-+	ALLOW_RULE(getcwd);
- 
- #if 0
- 	// needed by valgrind
-- 
-2.28.0
-
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-revert-char-count.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-revert-char-count.patch
@ -1,49 +0,0 @@
-From c07e242e766242a44ff720c149b1bdd4924ec247 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Tue, 27 Apr 2021 19:37:14 +0000
-Subject: [PATCH] Revert the fix for PR/180. It lead to PR/261. Using character
- count heuristics ends up with confusing behavior, the following should not be
- producing different results:     echo -n xx | ./file -     echo -n xy |
- ./file -
-
---
-[patch backported to 5.40 release -- ulm]
-
- src/encoding.c | 15 ++-------------
- 1 file changed, 2 insertions(+), 13 deletions(-)
-
-diff --git a/src/encoding.c b/src/encoding.c
-index 31d4d125..3647a481 100644
--- a/src/encoding.c
-+++ b/src/encoding.c
-@@ -265,9 +265,7 @@ private int \
- looks_ ## NAME(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf, \
-     size_t *ulen) \
- { \
-	size_t i, u; \
-	unsigned char dist[256]; \
-	memset(dist, 0, sizeof(dist)); \
-+	size_t i; \
- \
- 	*ulen = 0; \
- \
-@@ -278,16 +276,7 @@ looks_ ## NAME(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf, \
- 			return 0; \
- \
- 		ubuf[(*ulen)++] = buf[i]; \
-		dist[buf[i]]++; \
- 	} \
-	u = 0; \
-	for (i = 0; i < __arraycount(dist); i++) { \
-		if (dist[i]) \
-			u++; \
-	} \
-	if (u < 3) \
-		return 0; \
-\
- 	return 1; \
- }
- 
-- 
-2.32.0
-
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-seccomp-faccessat.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-seccomp-faccessat.patch
@ -1,34 +0,0 @@
-From abcd583135bb0762e6bfd0f2e06c50bea1fb3cd0 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Tue, 6 Apr 2021 22:02:17 +0000
-Subject: [PATCH] On ARM64 Linux access() syscall is no longer a real syscall
- to the kernel. Instead it's emulated by glibc with a new faccessat() syscall.
- (Icenowy Zheng)
-
---
- src/seccomp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/seccomp.c b/src/seccomp.c
-index 0da907ff7..81842cf5c 100644
--- a/src/seccomp.c
-+++ b/src/seccomp.c
-@@ -27,7 +27,7 @@
- #include "file.h"
- 
- #ifndef	lint
-FILE_RCSID("@(#)$File: seccomp.c,v 1.18 2021/03/14 17:01:58 christos Exp $")
-+FILE_RCSID("@(#)$File: seccomp.c,v 1.19 2021/04/06 22:02:17 christos Exp $")
- #endif	/* lint */
- 
- #if HAVE_LIBSECCOMP
-@@ -171,6 +171,9 @@ enable_sandbox_full(void)
- 	ALLOW_RULE(dup2);
- 	ALLOW_RULE(exit);
- 	ALLOW_RULE(exit_group);
-+#ifdef __NR_faccessat
-+	ALLOW_RULE(faccessat);
-+#endif
- 	ALLOW_RULE(fcntl);
-  	ALLOW_RULE(fcntl64);
- 	ALLOW_RULE(fstat);
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-seccomp-fstatat64.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-seccomp-fstatat64.patch
@ -1,29 +0,0 @@
-From e3d0265a147878b6c2903bcc83b9842dff68ceb4 Mon Sep 17 00:00:00 2001
-From: Mike Gilbert <floppym@gentoo.org>
-Date: Fri, 23 Apr 2021 15:00:42 -0400
-Subject: [PATCH] seccomp: allow fstatat64
-
-This is needed for the libsandbox LD_PRELOAD wrapper on Gentoo Linux.
-
-Bug: https://bugs.gentoo.org/784857
---
- src/seccomp.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/seccomp.c b/src/seccomp.c
-index 81842cf5..43abc684 100644
--- a/src/seccomp.c
-+++ b/src/seccomp.c
-@@ -178,6 +178,9 @@ enable_sandbox_full(void)
-  	ALLOW_RULE(fcntl64);
- 	ALLOW_RULE(fstat);
-  	ALLOW_RULE(fstat64);
-+#ifdef __NR_fstatat64
-+	ALLOW_RULE(fstatat64);
-+#endif
- 	ALLOW_RULE(futex);
- 	ALLOW_RULE(getdents);
- #ifdef __NR_getdents64
-- 
-2.31.1
-
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-xz_magic.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.40-xz_magic.patch
@ -1,37 +0,0 @@
-From 9b0459afab309a82aa4e46f73a4e50dd641f3d39 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Mon, 19 Apr 2021 17:01:45 +0000
-Subject: [PATCH] PR/257: cuihao: put attributes inside the xz magic.
-
---
- magic/Magdir/compress | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/magic/Magdir/compress b/magic/Magdir/compress
-index 64d11a736..41a65738f 100644
--- a/magic/Magdir/compress
-+++ b/magic/Magdir/compress
-@@ -1,5 +1,5 @@
- #------------------------------------------------------------------------------
-# $File: compress,v 1.80 2021/03/15 17:49:24 christos Exp $
-+# $File: compress,v 1.81 2021/04/19 17:01:45 christos Exp $
- # compress:  file(1) magic for pure-compression formats (no archives)
- #
- # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
-@@ -265,14 +265,13 @@
- 
- # http://tukaani.org/xz/xz-file-format.txt
- 0	ustring		\xFD7zXZ\x00		XZ compressed data, checksum
-+!:strength * 2
-+!:mime	application/x-xz
- >7	byte&0xf	0x0			NONE
- >7	byte&0xf	0x1			CRC32
- >7	byte&0xf	0x4			CRC64
- >7	byte&0xf	0xa			SHA-256
- 
-!:strength * 2
-!:mime	application/x-xz
-
- # https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
- 0	string		LRZI			LRZIP compressed data
- >4	byte		x			- version %d
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-configure-clang16.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-configure-clang16.patch
@ -0,0 +1,20 @@
+https://github.com/file/file/commit/4502517cc7316569d5902ab65c97b3b8e46f8a25
+https://github.com/file/file/commit/8c845b7bbad085678695d3e70467b8eec3dfa7af
+--- a/configure
+++ b/configure
+@@ -14037,13 +14037,14 @@ else $as_nop
+   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ #include <time.h>
+#include <stdlib.h>
+ int
+ main (void)
+ {
+ #if !HAVE_DECL_DAYLIGHT
+ extern int daylight;
+ #endif
+-atoi(daylight);
+daylight = atoi("1");
+   ;
+   return 0;
+ }
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-portage-sandbox.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-portage-sandbox.patch
@ -0,0 +1,28 @@
+Allow syscalls for Gentoo's portage sandbox
+
+- Add getcwd (bug #728978)
+- Add faccessat2 (bug #889046)
+
+Bug: https://bugs.gentoo.org/728978
+Bug: https://bugs.gentoo.org/889046
+--- a/src/seccomp.c
+++ b/src/seccomp.c
+@@ -174,6 +174,9 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(exit_group);
+ #ifdef __NR_faccessat
+ 	ALLOW_RULE(faccessat);
+#endif
+#ifdef __NR_faccessat2
+        ALLOW_RULE(faccessat2);
+ #endif
+ 	ALLOW_RULE(fcntl);
+  	ALLOW_RULE(fcntl64);
+@@ -237,6 +240,8 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(write);
+ 	ALLOW_RULE(writev);
+ 
+	// needed by Gentoo's portage sandbox
+	ALLOW_RULE(getcwd);
+ 
+ #if 0
+ 	// needed by valgrind
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-seccomp-fstatat64-musl.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.43-seccomp-fstatat64-musl.patch
@ -10,22 +10,13 @@ sys/stat.h in musl does this:
 Counteract this with an #undef.

 Bug: https://bugs.gentoo.org/789336
---
- src/seccomp.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/seccomp.c b/src/seccomp.c
-index 3318367c..eb8b1e57 100644
 --- a/src/seccomp.c
 +++ b/src/seccomp.c
-@@ -179,6 +179,7 @@ enable_sandbox_full(void)
- 	ALLOW_RULE(fstat);
+@@ -182,6 +182,7 @@ enable_sandbox_full(void)
+ #endif
  	ALLOW_RULE(fstat64);
 #ifdef __NR_fstatat64
 +#undef fstatat64
 	ALLOW_RULE(fstatat64);
 #endif
 	ALLOW_RULE(futex);
-- 
-2.32.0
-
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.44-limits-solaris.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.44-limits-solaris.patch
@ -0,0 +1,19 @@
+softmagic: include limits.h for UINT_MAX usage
+
+Platforms like Solaris need this to compile.
+
+Bug: https://bugs.astron.com/view.php?id=413
+Signed-off-by: Fabian Groffen <grobian@gentoo.org>
+
+--- a/src/softmagic.c
+++ b/src/softmagic.c
+@@ -42,6 +42,7 @@
+ #include <ctype.h>
+ #include <stdlib.h>
+ #include <time.h>
+#include <limits.h>
+ #include "der.h"
+
+ file_private int match(struct magic_set *, struct magic *, file_regex_t **,    size_t,
+
+
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.44-seccomp-utimes.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.44-seccomp-utimes.patch
@ -0,0 +1,18 @@
+https://github.com/file/file/commit/1590a653b520123d47070a47436abfba42d4c943
+
+From 1590a653b520123d47070a47436abfba42d4c943 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Mon, 26 Dec 2022 18:57:29 +0000
+Subject: [PATCH] PR/408: SpraxDev: Add utimes to the allow list for -p
+
+--- a/src/seccomp.c
+++ b/src/seccomp.c
+@@ -233,6 +233,7 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(umask);	// Used in file_pipe2file()
+ 	ALLOW_RULE(getpid);	// Used by glibc in file_pipe2file()
+ 	ALLOW_RULE(unlink);
+	ALLOW_RULE(utimes);
+ 	ALLOW_RULE(write);
+ 	ALLOW_RULE(writev);
+ 
+
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/metadata.xml
@ -1,12 +1,16 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-<maintainer type="project">
+	<maintainer type="project">
 		<email>base-system@gentoo.org</email>
 		<name>Gentoo Base System</name>
-</maintainer>
-<upstream>
+	</maintainer>
+	<upstream>
 		<bugs-to>https://bugs.astron.com/</bugs-to>
 		<remote-id type="cpe">cpe:/a:file_project:file</remote-id>
-</upstream>
+		<remote-id type="github">file/file</remote-id>
+	</upstream>
+	<use>
+		<flag name="lzip">Enable <pkg>app-arch/lzip</pkg> decompression support via <pkg>app-arch/lzlib</pkg></flag>
+	</use>
 </pkgmetadata>
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
@ -0,0 +1,4 @@
+DIST portage-3.0.38.1.tar.bz2 1116216 BLAKE2B d1cb4cc1924673d07ea7174ad0a84b3af977dd28ca659695d3e4014e4aa83b054acba82a160e7c0a8d3d4fbc3514bea619c3d720e450cb4890818e4b1bc1e43a SHA512 1375565e936276fd6cfd2a4f6f782b91e234e973d6a998f2276a076dd165272bcf12067fd01e77b238f194eac69edf967bbe3ac62edc3701fe9375c693622ab9
+DIST portage-3.0.41.tar.bz2 1119737 BLAKE2B 6c6d1fa11f16362505e321eb530d233cf73a7e1cc7dab2fc88ad40701c16835e08a7d16a408381e2f717ac5f48d46344e57b9b5296be4eba0a7583540c6a81aa SHA512 046621ee59b2b1b374a63091028ed3462b1212960b337e8e034c739d5c51d5ae1e7b491c88940199e710081409e38778749a5c86576cf5bb6c59b1890dc892b5
+DIST portage-3.0.42.tar.bz2 1122793 BLAKE2B 9df93e5ebeab415bd3b56e4e1771b628f5e3622d997aa8818e7ce42f77d60ffcb1807093dbc44852c5b359c632c11dcb7db6c026f2e7e224293e7ebb9e64b286 SHA512 f3d2bb5a1adc801c641ff14043b1617831c646a9432b2602e48343d8264850bb410a1666d646b97e224864d56cc7acae0aa044a7476384030063fb77e4323724
+DIST portage-3.0.43.tar.bz2 1139615 BLAKE2B e0f2646c3b6d5d49ec23038ad27507f7b9c0c03b848e82aff336896802c07b29344f924c4525d880f8895ba38f8116a7c79ecea51c794a433da9bd146efadc20 SHA512 b5e5339f3b5446f5c8f9b319e86e82d260e004b0606c3d0eadf09f91c95de0279c64c0fc4d7f6251ebd2cf7a65ba1ba37d752ed48b712e72b8c024835e747691
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/README.RESCUE
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/README.RESCUE
@ -0,0 +1,2 @@
+Please see https://wiki.gentoo.org/wiki/Project:Portage/Fixing_broken_portage
+for a recovery guide for a broken portage installation.
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.38.1-xz-32-bit.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.38.1-xz-32-bit.patch
@ -0,0 +1,90 @@
+https://github.com/gentoo/portage/commit/6a47cc7bcf49b7c17fdca31969b6d6aeff84332c
+https://github.com/gentoo/portage/commit/041da67db3a61d19fa5b287db4da9c51794af115
+https://github.com/gentoo/portage/commit/6834e464803b5ac98f8ab1bbca5379970b5bc6d9
+
+From 6a47cc7bcf49b7c17fdca31969b6d6aeff84332c Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Mon, 17 Oct 2022 19:37:03 +0100
+Subject: [PATCH] xz: add workaround for < xz 5.3.3_alpha 32-bit issue
+
+With older versions of xz, xz -T0 will on 32-bit systems
+try to allocate too much memory and bail out.
+
+After discussing with upstream, we set --memlimit-compress=50% as a
+way to make things work with both older & newer versions. This limiting
+is essentially already present with >= 5.3.3_alpha as -T0 includes it.
+
+Note that we don't need to do this for decompression as it's automatic
+there for newer versions and older versions -Tn a no-op.
+
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/bin/ecompress
+++ b/bin/ecompress
+@@ -128,7 +128,7 @@ if [[ ${PORTAGE_COMPRESS_FLAGS+set} != "set" ]] ; then
+ 		# See: https://bugs.gentoo.org/672916
+ 		# Setting '--rm' will remove the source files after a successful compression.
+ 		lz4)  PORTAGE_COMPRESS_FLAGS="-m --rm";;
+-		xz)   PORTAGE_COMPRESS_FLAGS="-9 -T$(___makeopts_jobs)";;
+		xz)   PORTAGE_COMPRESS_FLAGS="-9 -T$(___makeopts_jobs) --memlimit-compress=50%";;
+ 		zstd) PORTAGE_COMPRESS_FLAGS="-q --rm -T$(___makeopts_jobs)";;
+ 	esac
+ fi
+
+From 041da67db3a61d19fa5b287db4da9c51794af115 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Mon, 17 Oct 2022 23:07:58 +0100
+Subject: [PATCH] xz: pass -q to xz
+
+Avoids noise from memlimit-compress.
+
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/bin/ecompress
+++ b/bin/ecompress
+@@ -128,7 +128,7 @@ if [[ ${PORTAGE_COMPRESS_FLAGS+set} != "set" ]] ; then
+ 		# See: https://bugs.gentoo.org/672916
+ 		# Setting '--rm' will remove the source files after a successful compression.
+ 		lz4)  PORTAGE_COMPRESS_FLAGS="-m --rm";;
+-		xz)   PORTAGE_COMPRESS_FLAGS="-9 -T$(___makeopts_jobs) --memlimit-compress=50%";;
+		xz)   PORTAGE_COMPRESS_FLAGS="-9 -T$(___makeopts_jobs) --memlimit-compress=50% -q";;
+ 		zstd) PORTAGE_COMPRESS_FLAGS="-q --rm -T$(___makeopts_jobs)";;
+ 	esac
+ fi
+
+From 6834e464803b5ac98f8ab1bbca5379970b5bc6d9 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Fri, 21 Oct 2022 02:32:17 +0100
+Subject: [PATCH] ecompress: don't set -9 for xz
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From xz(1):
+"""
+The differences between the presets are more significant than with gzip(1) and bzip2(1).  The selected compression settings determine the memory requirements of the decompressor, thus  us‐
+ing  a too high preset level might make it painful to decompress the file on an old system with little RAM.  Specifically, it's not a good idea to blindly use -9 for everything like it of‐
+ten is with gzip(1) and bzip2(1).
+[...]
+-7 ... -9
+     These are like -6 but with higher compressor and decompressor memory requirements.  These are useful only when compressing files bigger than 8 MiB, 16 MiB, and 32 MiB, respectively.
+[...]
+•  DictSize  is  the  LZMA2 dictionary size.  It is waste of memory to use a dictionary bigger than the size of the uncompressed file.  This is why it is good to avoid using the presets -7
+... -9 when there's no real need for them.  At -6 and lower, the amount of memory wasted is usually low enough to not matter.
+"""
+
+Most things that ecompress touches are tiny (<32MB certainly). I made the
+mistake the man page warngs about -- don't assume it's a good idea just
+because of gzip & bzip2, and that's exactly what I did!
+
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/bin/ecompress
+++ b/bin/ecompress
+@@ -128,7 +128,7 @@ if [[ ${PORTAGE_COMPRESS_FLAGS+set} != "set" ]] ; then
+ 		# See: https://bugs.gentoo.org/672916
+ 		# Setting '--rm' will remove the source files after a successful compression.
+ 		lz4)  PORTAGE_COMPRESS_FLAGS="-m --rm";;
+-		xz)   PORTAGE_COMPRESS_FLAGS="-9 -T$(___makeopts_jobs) --memlimit-compress=50% -q";;
+		xz)   PORTAGE_COMPRESS_FLAGS="-q -T$(___makeopts_jobs) --memlimit-compress=50%";;
+ 		zstd) PORTAGE_COMPRESS_FLAGS="-q --rm -T$(___makeopts_jobs)";;
+ 	esac
+ fi
+
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-ccache.conf
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-ccache.conf
@ -0,0 +1,2 @@
+# Prevent ccache files from being cleaned
+x /var/tmp/ccache
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-tmpdir.conf
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-tmpdir.conf
@ -0,0 +1,2 @@
+d /var/tmp/portage 0775 portage portage
+d /tmp/portage 0775 portage portage
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/metadata.xml
@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>dev-portage@gentoo.org</email>
+	</maintainer>
+	<use>
+		<flag name="apidoc">Build html API documentation with sphinx-apidoc.</flag>
+		<flag name="gentoo-dev">Enable features required for Gentoo ebuild development.</flag>
+		<flag name="ipc">Use inter-process communication between portage and running ebuilds.</flag>
+		<flag name="native-extensions">
+		Compiles native "C" extensions (speedups, instead of using python
+		backup code).  Currently includes libc-locales.
+		This should only be temporarily disabled for some bootstrapping
+		operations.  Cross-compilation is not supported.
+		</flag>
+		<flag name="rsync-verify">
+		Enable full-tree cryptographic verification of Gentoo repository
+		rsync checkouts using <pkg>app-portage/gemato</pkg>.
+		</flag>
+		<flag name="xattr">
+		Preserve extended attributes (filesystem-stored metadata)
+		when installing files. Usually only required for hardened systems.
+		</flag>
+	</use>
+	<upstream>
+		<bugs-to>mailto:dev-portage@gentoo.org</bugs-to>
+		<changelog>https://gitweb.gentoo.org/proj/portage.git/plain/NEWS</changelog>
+		<doc>https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Portage</doc>
+		<remote-id type="cpe">cpe:/a:gentoo:portage</remote-id>
+		<remote-id type="gentoo">proj/portage</remote-id>
+		<remote-id type="github">gentoo/portage</remote-id>
+		<remote-id type="pypi">portage</remote-id>
+	</upstream>
+</pkgmetadata>
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.38.1-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.38.1-r6.ebuild
@ -0,0 +1,292 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{8..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	app-arch/xz-utils
+	test? ( dev-vcs/git )"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
+		>=sys-apps/coreutils-6.4
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	local PATCHES=(
+		"${FILESDIR}"/${P}-xz-32-bit.patch
+	)
+
+	distutils-r1_python_prepare_all
+
+	sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+
+		einfo "Adding FEATURES=force-prefix to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} force-prefix"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	cd "${S}/cnf" || die
+	if [ -f "make.conf.example.${ARCH}".diff ]; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.41-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.41-r2.ebuild
@ -0,0 +1,292 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{8..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	app-arch/xz-utils
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
+		>=sys-apps/coreutils-6.4
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	local PATCHES=(
+	)
+
+	distutils-r1_python_prepare_all
+
+	sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+
+		einfo "Adding FEATURES=force-prefix to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} force-prefix"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.42-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.42-r1.ebuild
@ -0,0 +1,292 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{8..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	app-arch/xz-utils
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
+		>=sys-apps/coreutils-6.4
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	local PATCHES=(
+	)
+
+	distutils-r1_python_prepare_all
+
+	sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+
+		einfo "Adding FEATURES=force-prefix to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} force-prefix"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.43.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.43.ebuild
@ -0,0 +1,292 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{8..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	app-arch/xz-utils
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
+		>=sys-apps/coreutils-6.4
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	local PATCHES=(
+	)
+
+	distutils-r1_python_prepare_all
+
+	sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+
+		einfo "Adding FEATURES=force-prefix to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} force-prefix"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
@ -0,0 +1,275 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 python3_{8..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 git-r3 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/portage.git
+	https://github.com/gentoo/portage.git"
+
+LICENSE="GPL-2"
+KEYWORDS=""
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
+		>=sys-apps/coreutils-6.4
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	distutils-r1_python_prepare_all
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+
+		einfo "Adding FEATURES=force-prefix to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} force-prefix"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest
@ -1,3 +1,3 @@
-DIST libseccomp-2.5.1.tar.gz 638811 BLAKE2B 683ae7536c0cba36f4d30640b42361171fc34b7cb04985ea56e64369df29c440361a0205385b14580cc0e481e0f9ffd0b0e8ebd4ac98817ed59298db6b274c35 SHA512 2be80a6323f9282dbeae8791724e5778b32e2382b2a3d1b0f77366371ec4072ea28128204f675cce101c091c0420d12c497e1a9ccbb7dc5bcbf61bfd777160af
-DIST libseccomp-2.5.2.tar.gz 640305 BLAKE2B b61214cb9a9a793d1f04ae1de3f62c578cfaec54fcc355947b4c71efb75072bf60497db8c8a0fd34a46764952349027df3f025ddbd276d58be93209170950e89 SHA512 b2a95152cb274d6b35753596fd825406dae20c4a48b2f4076f835f977ecf324de38a3fe02e789dc20b49ecf6b4eb67f03e7733e92d40f5e20f25874307f1c2ac
-DIST libseccomp-2.5.3.tar.gz 637572 BLAKE2B cedf04b3a926f9fe5202e6169ddac6b983e755009c14fc1d645157b9c0bcdf65d4085f8ea7abad90f3a0c13ae4d66b5d8306e725168490863aad15976de1eae7 SHA512 00170fe2360f0c0b33293dccfcc33e98fabb99619f34ecefbcc92bfdaa249ba91e7433226545b842b71542a3b224b6e980ea2ae656c4addf07e84a0def1870a0
+DIST libseccomp-2.5.4-loongarch64-20220425.patch.xz 132768 BLAKE2B f3ab165b028b5f8b4c16574936b915595807ebeb49ef7365d6051f3dfafa7da46ef2a9de458e0a268298cb340152abe1f3c0c293446462a06696bc9ce92d2f72 SHA512 94f23c7a2cc2ea8acb01fef00ef184295c276b14b2b3ba0c65687fd72081df8478f3f04c51b0b391ba44529c4f914e6edbb4132af935e3be55902f641d478780
+DIST libseccomp-2.5.4-loongarch64-20220622.patch.xz 67668 BLAKE2B faf1b5653a4d454626e310cdfd7def1fb8b768b88d3f792a28170d969a834be7ced8bb7b511a11e0e44691d626046e4c387c08f3fbacdedd6689813f65c129aa SHA512 9aba715c6f120f8df249158f73bc64097243f911d5864294048dc3976580e9ca96cc538c890918a375c3b35369fdbf2383424b6f3d41822c834228ff188680fa
+DIST libseccomp-2.5.4.tar.gz 637228 BLAKE2B 38b134cb578f9355667546f92950ebcf8c53ccaf98db568db9aadfa9629c054136849e03d4bf9f09f73998fe66a5e8a9038573d19740b2bddf5518a8a0119229 SHA512 92650bd7d1d48b383f402a536b97a017fd0f6ad1234daf4b938d01c92e8d134a01d2f2dd45fd9e2d025d7556bd1386ec360402145a87f20580c85949d62cea0e
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.6.0-python-shared.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.6.0-python-shared.patch
@ -0,0 +1,25 @@
+From 594fecb16833c693ac0cff8f857aec0edd097077 Mon Sep 17 00:00:00 2001
+Message-Id: <594fecb16833c693ac0cff8f857aec0edd097077.1666701554.git.mprivozn@redhat.com>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Tue, 25 Oct 2022 14:39:07 +0200
+Subject: [PATCH] Link python module against shared library
+
+---
+ src/python/setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/python/setup.py b/src/python/setup.py
+index 46f9a73..85deb03 100755
+--- a/src/python/setup.py
+++ b/src/python/setup.py
+@@ -40,6 +40,6 @@ setup(
+ 	ext_modules = cythonize([
+ 		Extension("seccomp", ["seccomp.pyx"],
+ 			# unable to handle libtool libraries directly
+-			extra_objects=["../.libs/libseccomp.a"]),
+			extra_objects=["../.libs/libseccomp.so"]),
+ 	])
+ )
+-- 
+2.37.4
+
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.1-r1.ebuild
@ -1,90 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python3_{8..9} )
-DISTUTILS_OPTIONAL=1
-
-inherit distutils-r1 multilib-minimal
-
-DESCRIPTION="high level interface to Linux seccomp filter"
-HOMEPAGE="https://github.com/seccomp/libseccomp"
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/seccomp/libseccomp.git"
-	PRERELEASE="2.6.0"
-	inherit autotools git-r3
-else
-	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="-* amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
-fi
-
-LICENSE="LGPL-2.1"
-SLOT="0"
-IUSE="python static-libs"
-
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-DEPEND="python? ( ${PYTHON_DEPS} )"
-RDEPEND="${DEPEND}"
-BDEPEND="${DEPEND}
-	dev-util/gperf
-	python? ( dev-python/cython[${PYTHON_USEDEP}] )
-"
-# We need newer kernel headers; we don't keep strict control of the exact
-# version here, just be safe and pull in the latest stable ones. #551248
-DEPEND="${DEPEND} >=sys-kernel/linux-headers-4.3"
-
-src_prepare() {
-	local PATCHES=(
-		"${FILESDIR}/libseccomp-python-shared.patch"
-	)
-	default
-	if [[ "${PV}" == *9999 ]] ; then
-		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac
-		eautoreconf
-	fi
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-		--disable-python
-	)
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-do_python() {
-	# setup.py reads VERSION_RELEASE from the environment
-	local -x VERSION_RELEASE=${PRERELEASE-${PV}}
-	pushd "${BUILD_DIR}/src/python" >/dev/null || die
-	"$@"
-	popd >/dev/null || die
-}
-
-multilib_src_compile() {
-	emake
-
-	if multilib_is_native_abi && use python ; then
-		# setup.py expects libseccomp.so to live in "../.libs"
-		# Copy the python files to the right place for this.
-		rm -r "${BUILD_DIR}/src/python" || die
-		cp -r "${S}/src/python" "${BUILD_DIR}/src/python" || die
-		local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}"
-		do_python distutils-r1_src_compile
-	fi
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python ; then
-		do_python distutils-r1_src_install
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -type f -name "${PN}.la" -delete || die
-	einstalldocs
-}
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.1.ebuild
@ -1,84 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python3_{8..9} )
-DISTUTILS_OPTIONAL=1
-
-inherit distutils-r1 multilib-minimal
-
-DESCRIPTION="high level interface to Linux seccomp filter"
-HOMEPAGE="https://github.com/seccomp/libseccomp"
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/seccomp/libseccomp.git"
-	PRERELEASE="2.6.0"
-	inherit autotools git-r3
-else
-	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="-* amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
-fi
-
-LICENSE="LGPL-2.1"
-SLOT="0"
-IUSE="python static-libs"
-
-REQUIRED_USE="
-	python? (
-		static-libs
-		${PYTHON_REQUIRED_USE}
-	)"
-
-DEPEND="python? ( ${PYTHON_DEPS} )"
-RDEPEND="${DEPEND}"
-BDEPEND="${DEPEND}
-	dev-util/gperf
-	python? ( dev-python/cython[${PYTHON_USEDEP}] )
-"
-# We need newer kernel headers; we don't keep strict control of the exact
-# version here, just be safe and pull in the latest stable ones. #551248
-DEPEND="${DEPEND} >=sys-kernel/linux-headers-4.3"
-
-src_prepare() {
-	default
-	if [[ "${PV}" == *9999 ]] ; then
-		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac
-		eautoreconf
-	fi
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-		--disable-python
-	)
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	emake
-
-	if multilib_is_native_abi && use python ; then
-		cd "${S}/src/python" || die
-		sed -i -e "s/=.*VERSION_RELEASE.*,/=\"${PRERELEASE}\",/" \
-			-e "/extra_objects/s,\.\.,${OLDPWD}/src," \
-			setup.py || die
-		local -x CPPFLAGS="-I${OLDPWD}/include -I../../include"
-		distutils-r1_src_compile
-	fi
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi && use python ; then
-		cd "${S}/src/python" || die
-		distutils-r1_src_install
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -type f -name "${PN}.la" -delete || die
-	einstalldocs
-}
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.4-r1.ebuild
@ -1,9 +1,9 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

 EAPI=7

-PYTHON_COMPAT=( python3_{8..9} )
+PYTHON_COMPAT=( python3_{8..10} )
 DISTUTILS_OPTIONAL=1

 inherit distutils-r1 multilib-minimal
@ -16,33 +16,50 @@ if [[ ${PV} == *9999 ]] ; then
 	PRERELEASE="2.6.0"
 	inherit autotools git-r3
 else
-	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux"
+	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz
+		experimental-loong? ( https://dev.gentoo.org/~xen0n/distfiles/${P}-loongarch64-20220622.patch.xz )"
+	#KEYWORDS="-* amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="-* ~loong"
 fi

 LICENSE="LGPL-2.1"
 SLOT="0"
-IUSE="python static-libs"
+IUSE="experimental-loong python static-libs test"
+RESTRICT="!test? ( test )"

 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"

-DEPEND="python? ( ${PYTHON_DEPS} )"
+# We need newer kernel headers; we don't keep strict control of the exact
+# version here, just be safe and pull in the latest stable ones. bug #551248
+DEPEND=">=sys-kernel/linux-headers-5.15
+	python? ( ${PYTHON_DEPS} )"
 RDEPEND="${DEPEND}"
 BDEPEND="${DEPEND}
 	dev-util/gperf
-	python? ( dev-python/cython[${PYTHON_USEDEP}] )
-"
-# We need newer kernel headers; we don't keep strict control of the exact
-# version here, just be safe and pull in the latest stable ones. #551248
-DEPEND="${DEPEND} >=sys-kernel/linux-headers-4.3"
+	python? ( dev-python/cython[${PYTHON_USEDEP}] )"
+
+PATCHES=(
+	"${FILESDIR}"/libseccomp-python-shared.patch
+	"${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch
+)

 src_prepare() {
-	local PATCHES=(
-		"${FILESDIR}/libseccomp-python-shared.patch"
-	)
+	if use experimental-loong; then
+		PATCHES+=( "${WORKDIR}/${P}-loongarch64-20220622.patch" )
+	fi
+
 	default
-	if [[ "${PV}" == *9999 ]] ; then
-		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac
+
+	if use experimental-loong; then
+		# touch generated files to avoid activating maintainer mode
+		# remove when loong-fix-build.patch is no longer necessary
+		touch ./aclocal.m4 ./configure ./configure.h.in || die
+		find . -name Makefile.in -exec touch {} + || die
+	fi
+
+	if [[ ${PV} == *9999 ]] ; then
+		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die
+
 		eautoreconf
 	fi
 }
@ -52,12 +69,14 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		--disable-python
 	)
+
 	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
 }

 do_python() {
 	# setup.py reads VERSION_RELEASE from the environment
 	local -x VERSION_RELEASE=${PRERELEASE-${PV}}
+
 	pushd "${BUILD_DIR}/src/python" >/dev/null || die
 	"$@"
 	popd >/dev/null || die
@ -69,9 +88,10 @@ multilib_src_compile() {
 	if multilib_is_native_abi && use python ; then
 		# setup.py expects libseccomp.so to live in "../.libs"
 		# Copy the python files to the right place for this.
-		rm -r "${BUILD_DIR}/src/python" || die
-		cp -r "${S}/src/python" "${BUILD_DIR}/src/python" || die
+		rm -r "${BUILD_DIR}"/src/python || die
+		cp -r "${S}"/src/python "${BUILD_DIR}"/src/python || die
 		local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}"
+
 		do_python distutils-r1_src_compile
 	fi
 }
@ -86,5 +106,6 @@ multilib_src_install() {

 multilib_src_install_all() {
 	find "${ED}" -type f -name "${PN}.la" -delete || die
+
 	einstalldocs
 }
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.4.ebuild
@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

 EAPI=7
@ -16,36 +16,47 @@ if [[ ${PV} == *9999 ]] ; then
 	PRERELEASE="2.6.0"
 	inherit autotools git-r3
 else
-	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux"
+	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz
+		experimental-loong? ( https://dev.gentoo.org/~xen0n/distfiles/${P}-loongarch64-20220425.patch.xz )"
+	KEYWORDS="-* amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
 fi

 LICENSE="LGPL-2.1"
 SLOT="0"
-IUSE="python static-libs test"
+IUSE="experimental-loong python static-libs test"
 RESTRICT="!test? ( test )"

 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"

-DEPEND="python? ( ${PYTHON_DEPS} )"
+# We need newer kernel headers; we don't keep strict control of the exact
+# version here, just be safe and pull in the latest stable ones. bug #551248
+DEPEND=">=sys-kernel/linux-headers-5.15
+	python? ( ${PYTHON_DEPS} )"
 RDEPEND="${DEPEND}"
 BDEPEND="${DEPEND}
 	dev-util/gperf
-	python? ( dev-python/cython[${PYTHON_USEDEP}] )
-"
-# We need newer kernel headers; we don't keep strict control of the exact
-# version here, just be safe and pull in the latest stable ones. #551248
-DEPEND="${DEPEND} >=sys-kernel/linux-headers-4.3"
+	python? ( dev-python/cython[${PYTHON_USEDEP}] )"
+
+PATCHES=(
+	"${FILESDIR}"/libseccomp-python-shared.patch
+	"${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch
+)

 src_prepare() {
-	local PATCHES=(
-		"${FILESDIR}/libseccomp-python-shared.patch"
-		"${FILESDIR}/libseccomp-2.5.3-skip-valgrind.patch"
-	)
+	if use experimental-loong; then
+		PATCHES+=( "${WORKDIR}/${P}-loongarch64-20220425.patch" )
+	fi

 	default

-	if [[ "${PV}" == *9999 ]] ; then
+	if use experimental-loong; then
+		# touch generated files to avoid activating maintainer mode
+		# remove when loong-fix-build.patch is no longer necessary
+		touch ./aclocal.m4 ./configure ./configure.h.in || die
+		find . -name Makefile.in -exec touch {} + || die
+	fi
+
+	if [[ ${PV} == *9999 ]] ; then
 		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die

 		eautoreconf
@ -76,8 +87,8 @@ multilib_src_compile() {
 	if multilib_is_native_abi && use python ; then
 		# setup.py expects libseccomp.so to live in "../.libs"
 		# Copy the python files to the right place for this.
-		rm -r "${BUILD_DIR}/src/python" || die
-		cp -r "${S}/src/python" "${BUILD_DIR}/src/python" || die
+		rm -r "${BUILD_DIR}"/src/python || die
+		cp -r "${S}"/src/python "${BUILD_DIR}"/src/python || die
 		local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}"

 		do_python distutils-r1_src_compile
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild
@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2

 EAPI=7
@ -27,25 +27,24 @@ RESTRICT="!test? ( test )"

 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"

-DEPEND="python? ( ${PYTHON_DEPS} )"
+# We need newer kernel headers; we don't keep strict control of the exact
+# version here, just be safe and pull in the latest stable ones. bug #551248
+DEPEND=">=sys-kernel/linux-headers-5.15
+	python? ( ${PYTHON_DEPS} )"
 RDEPEND="${DEPEND}"
 BDEPEND="${DEPEND}
 	dev-util/gperf
-	python? ( dev-python/cython[${PYTHON_USEDEP}] )
-"
-# We need newer kernel headers; we don't keep strict control of the exact
-# version here, just be safe and pull in the latest stable ones. #551248
-DEPEND="${DEPEND} >=sys-kernel/linux-headers-4.3"
+	python? ( dev-python/cython[${PYTHON_USEDEP}] )"
+
+PATCHES=(
+	"${FILESDIR}"/libseccomp-2.6.0-python-shared.patch
+	"${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch
+)

 src_prepare() {
-	local PATCHES=(
-		"${FILESDIR}/libseccomp-python-shared.patch"
-		"${FILESDIR}/libseccomp-2.5.3-skip-valgrind.patch"
-	)
-
 	default

-	if [[ "${PV}" == *9999 ]] ; then
+	if [[ ${PV} == *9999 ]] ; then
 		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die

 		eautoreconf
@ -76,8 +75,8 @@ multilib_src_compile() {
 	if multilib_is_native_abi && use python ; then
 		# setup.py expects libseccomp.so to live in "../.libs"
 		# Copy the python files to the right place for this.
-		rm -r "${BUILD_DIR}/src/python" || die
-		cp -r "${S}/src/python" "${BUILD_DIR}/src/python" || die
+		rm -r "${BUILD_DIR}"/src/python || die
+		cp -r "${S}"/src/python "${BUILD_DIR}"/src/python || die
 		local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}"

 		do_python distutils-r1_src_compile
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/metadata.xml
@ -5,6 +5,9 @@
 		<email>base-system@gentoo.org</email>
 		<name>Gentoo Base System</name>
 	</maintainer>
+	<use>
+		<flag name="experimental-loong">Add experimental LoongArch patchset</flag>
+	</use>
 	<upstream>
 		<remote-id type="github">seccomp/libseccomp</remote-id>
 		<remote-id type="sourceforge">libseccomp</remote-id>