diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 8134a3ebcf..ed49fe1e2c 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -22,12 +22,9 @@ DIST bash-5.1.tar.gz 10458638 BLAKE2B 42059556694b604911b5b7936f94d42d8923f2931f
 DIST bash-5.1.tar.gz.sig 95 BLAKE2B ac9209d6a4ab4436c511a7a195594e9036d7d1aef7887972f61a0e97378a9685b882621d7f95f5326b155dc155c41635417ce2ca41ac6d0dda78bd293ea4249f SHA512 3966404c0f683c7ef214fcf283b551e5441af3897009f778308c2e34067d98d57c95561453416a54ca5b1daf9a1288dbf950fe3f13353703cead12f5eec5fad8
 DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30919a13271e39e1cb66a0672f242df75fc7d71627ea873dfbce53ec35c0c56a71c5167143070a7811343fd9 SHA512 5647636223ba336bf33e0c65e516d8ebcf6932de8b44f37bc468eedb87579c628ad44213f78534beb10f47aebb9c6fa670cb0bed3b4e7717e5faf7e9a1ef81ae
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
-DIST bash-5.3-rc1.tar.gz 10742642 BLAKE2B 846414fe545da1ee62b541a8861d68e1dc57114276d40c6af2a9ab1f91cedb220d060f1bd81a811d6dacd841cd1b66e0ed7d8462b3c7066ad204f3786d6af0ec SHA512 16a74fcb31a8ea20cf9505a8cee584a02baed1d2c47b75556e4ae6752712db8f9e0b4b202d2cbe77990fec1ff141ff35e410d4495887ed90f5457c032079c5e5
-DIST bash-5.3-rc1.tar.gz.sig 95 BLAKE2B cc7916f92eddd881ac4d791918b7bb579396df4badbd671a7d0664fd814cee37327dce31d288a8fb03bc66a23536873b5fcd72f2e08e294b9ff9f2ef889741e3 SHA512 a275ff17f9318b5626450eeeb9f49157c9b20df974e004adb26f6585c84deea8d68fc0e1670f990096675ecadd652b58895f74c4e40c8e142a3c2ed414145248
-DIST bash-5.3_rc1_p20250409-42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c.tar.gz 15866668 BLAKE2B 472b67d397dd0f4ba070d4899bb1ecde08a90a7d2f5fc16b8f79c7113d2ca66cbc353e128ace17128069ebc7f8560605dda1441019174a942abb0dd345629746 SHA512 43614445ac11d25258ba6c47f020a1b87d8fa33b139e4d2237683ea0465bf24b03cf84e7e2771de4b038bbecab44c923bb307e4a60b9590b42936ea4e7c86e73
-DIST bash-5.3_rc1_p20250419-482872ed8b51408066c3275a18350436f4d0ee41.tar.gz 16004323 BLAKE2B 936b2bf45e90be658105a2755b9a0be046cd5ae50b6d34624ff20199fa93c1de4a8f9ab669c2c9cf86e2e4d6379f124d91141354d41d437536931cd157491626 SHA512 f04eb6c45124a66fc894c4a1f217351a0247ddd870cfcbbcd01bcff77369d022c6ca82f693c6f2fcd035ce5a67ab3fdbc902b30a4c76e84fdaddd25eeb7c407f
-DIST bash-5.3_rc1_p20250422-7731dc5c4d405ab147fc562e3af2a375ca593554.tar.gz 15996966 BLAKE2B 6a9c720b2747ccff7d8d198354163b6e0645b8a8e436a65e5d1f86ad509b8f197d95ba7cd4097ec4558911d73f98817da65f90a879215b8ad243388e1fdd75df SHA512 21847abf8019776f310c1de8f7469823c233039fa95ca1f872071580f917c728ac767f6daa778dfcfa0fd7583edf07b7928075d5086f3711d68a45ea3133857f
-DIST bash-5.3_rc1_p20250430-15df5993542463ba9798e4ea5e488dfddf83c276.tar.gz 15996459 BLAKE2B 013768ddce578a50845f1709a276b80474999e83172d32d4ba1978a795c17fbd2c77d3812a631ade937afa9a0850ee40f45dcd8b02251fce8c3d0619b82de33d SHA512 e86edefd13e9863c059411587377393b5dc290bf42d1bb5f3684e4a881a0ea10f554b22752f3632b1fc29ff8be08ec1ace8f729639b55ec97eb77968886856fd
+DIST bash-5.3-rc2.tar.gz 11032468 BLAKE2B 42f3b6b3b675a618c965fbde8e3052ac4e171b0f50848589ab4996f6a8de22aca8bdaa5819eb21d3e3dbd67cddaad17d8c48d5a977ae77373fedfdec67cb4155 SHA512 8dfd16723ea14a5901f3a056d30a0fa7b633e41495bbf071897f6a7794293dec59e4eb8618345aeb9e06a924e87c8b823e3ab1e3888a963421b1e8398cc0c12e
+DIST bash-5.3-rc2.tar.gz.sig 95 BLAKE2B 2068f4b5e5045f00a389256c8e753253a1f9b7d06970c51516555e463ef3d5e682e28a9052a2fbae0f9ce7bb0f9e31116a0a780ae3dc7d083a71591feee6501d SHA512 2a4cad6d8f5212319045b6139fb8e3c56664efa5ffcf1ef522219f5a100d5385ab627f6c122f9b49178b48e9c2a85da43f72fd70425547c3a71c0ec1ae812e33
+DIST bash-5.3_rc2_p20250606-727b8d366390fea446f7a566c4be1be6c0e2a765.tar.gz 16083935 BLAKE2B 05821cd7598a6915651ca5f0f9c601ea4e118406d3db652c0989cebe32d15a03e1c95b517740834564e27be1d1e312aa2433f4456a4a8307249d2cfd9fd471fd SHA512 f9f8b17efd119fb0d82251a5be7ead3af8502461116036ffb22b4318f924d97927f1ec010982a21fb0f6fe39ad78e0ccbedfd66a469bb20ed4006bb39595ae4e
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
index 6836c71ee4..b9f9750612 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-2.05b_p13.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-2.05b-destdir.patch
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch # bug #220040
@@ -105,6 +102,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
index 6ea72c0719..255cc1a142 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.0_p22.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-3.0-protos.patch
@@ -110,6 +107,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
index 66fae17e01..3e199434c7 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.1_p23.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.53.patch # bug #220040
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-2.05b-parallel-build.patch # bug #41002
@@ -105,6 +102,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
index 790bcdb42b..b899e15996 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-3.2_p57.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-2"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/autoconf-mktime-2.59.patch # bug #220040
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-3.2-loadables.patch
@@ -107,6 +104,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
index 83095fd102..73eed8f83b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.0_p44.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.0-configure.patch # bug #304901
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.x-deferred-heredocs.patch
@@ -101,6 +98,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
index 056fcbfee8..f9c68efe3b 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.1_p17.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -51,8 +50,6 @@ RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
 DEPEND="${RDEPEND}
 	static? ( ${LIB_DEPEND} )"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.1-fbsd-eaccess.patch #bug #303411
 
@@ -96,6 +93,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
index 9189dd5421..3933c300ad 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.2_p53.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -39,6 +36,8 @@ if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -53,8 +52,6 @@ DEPEND="${RDEPEND}
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.2-execute-job-control.patch # bug #383237
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-4.2-parallel-build.patch
@@ -108,6 +105,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--with-installed-readline=.
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
index d1bd7188d3..91c5b5af35 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.3_p48-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,10 +24,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -37,12 +34,13 @@ READLINE_VER="6.3"
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html"
 SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
-[[ ${PV} == *_rc* ]] && SRC_URI+=" ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
 
 if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -63,8 +61,6 @@ PATCHES=(
 	"${WORKDIR}"/${P}-r2-patches/${PN}-4.4-popd-offset-overflow.patch # bug #600174
 )
 
-S="${WORKDIR}/${MY_P}"
-
 pkg_setup() {
 	# bug #7332
 	if is-flag -malign-double ; then
@@ -117,6 +113,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--docdir='$(datarootdir)'/doc/${PF}
 		--htmldir='$(docdir)/html'
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
index a00a3d5f57..ec1563be77 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-4.4_p23-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -30,10 +30,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -44,14 +41,14 @@ DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html"
 if is_release ; then
 	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
-else
-	SRC_URI="ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
 fi
 
 if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
@@ -68,8 +65,6 @@ RDEPEND="
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 #BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 pkg_setup() {
 	# bug #7332
 	if is-flag -malign-double ; then
@@ -128,6 +123,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
index 2fa356b7fa..70ea14d975 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.0_p18-r3.ebuild
@@ -30,10 +30,7 @@ patches() {
 	if [[ ${opt} == -s ]] ; then
 		echo "${@/#/${DISTDIR}/}"
 	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
+		printf "mirror://gnu/${pn}/${pn}-${pv}-patches/%s " "$@"
 	fi
 }
 
@@ -44,14 +41,14 @@ DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html"
 if is_release ; then
 	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
-else
-	SRC_URI="ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
 fi
 
 if [[ -n ${GENTOO_PATCH_VER} ]] ; then
 	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 fi
 
+S="${WORKDIR}/${MY_P}"
+
 LICENSE="GPL-3"
 SLOT="${MY_PV}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
@@ -68,8 +65,6 @@ RDEPEND="
 # We only need bison (yacc) when the .y files get patched (bash42-005)
 BDEPEND="sys-devel/bison"
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	# Patches from Chet sent to bashbug ml
 	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-5.0-history-append.patch
@@ -132,6 +127,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu89)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	local myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
index 0a1dbe4b63..b1a75ff93c 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r14.ebuild
@@ -40,14 +40,14 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_BRANCH=devel
 	inherit git-r3
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -177,6 +177,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
deleted file mode 100644
index b3ac276e72..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r1.ebuild
+++ /dev/null
@@ -1,408 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
-case ${PV} in
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.2_p1"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-S=${WORKDIR}/${MY_P}
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-	"${FILESDIR}/${PN}-5.2_p15-random-ub.patch"
-	"${FILESDIR}/${PN}-5.2_p15-configure-clang16.patch"
-	"${FILESDIR}/${PN}-5.2_p21-wpointer-to-int.patch"
-	"${FILESDIR}/${PN}-5.2_p32-memory-leaks.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-1.patch"
-	"${FILESDIR}/${PN}-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch"
-	"${FILESDIR}/${PN}-5.2_p32-erroneous-delimiter-pushback-condition.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# bash 5.3 drops unprototyped functions, earlier versions are
-	# incompatible with C23.
-	append-cflags $(test-flags-CC -std=gnu17)
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
index 2e063be865..f844573464 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37-r3.ebuild
@@ -40,14 +40,14 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_BRANCH=devel
 	inherit git-r3
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -65,7 +65,7 @@ S=${WORKDIR}/${MY_P}
 LICENSE="GPL-3+"
 SLOT="0"
 if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
 
@@ -180,6 +180,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
index 4bb6c49f60..73d60fd1bc 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p37.ebuild
@@ -40,14 +40,14 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_BRANCH=devel
 	inherit git-r3
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -178,6 +178,10 @@ src_configure() {
 	# incompatible with C23.
 	append-cflags $(test-flags-CC -std=gnu17)
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
deleted file mode 100644
index d495d9e3b9..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
+++ /dev/null
@@ -1,410 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="2e113467f061587a3475b692d25ca449717834c8"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
deleted file mode 100644
index b8c4d806b7..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
+++ /dev/null
@@ -1,410 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
deleted file mode 100644
index d6c2f34c71..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250419.ebuild
+++ /dev/null
@@ -1,410 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="482872ed8b51408066c3275a18350436f4d0ee41"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2.ebuild
index a71d009bc5..1efdb19b50 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250430.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,18 +46,18 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="15df5993542463ba9798e4ea5e488dfddf83c276"
+	BASH_COMMIT="dbe4256d5ea02fec1817fe7e275b0e534dc33a40"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,7 +320,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2_p20250606.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2_p20250606.ebuild
index e9dedb0573..829bb15fb6 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250422.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc2_p20250606.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_beta"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,18 +46,18 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="7731dc5c4d405ab147fc562e3af2a375ca593554"
+	BASH_COMMIT="727b8d366390fea446f7a566c4be1be6c0e2a765"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -264,8 +269,6 @@ src_compile() {
 		fi
 	fi
 
-	# builtins/evalstring.c needs y.tab.h but can't (easily) specify the dep on it from above
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" y.tab.h
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
 	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
@@ -282,7 +285,6 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" y.tab.h
 		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
 		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
@@ -318,8 +320,8 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
index 48dc6faddf..3d5c11da47 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-9999.ebuild
@@ -15,7 +15,7 @@ MY_PV=${MY_PV/_/-}
 MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-# Determine the patchlevel.
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
 case ${PV} in
 	9999|*_alpha*|*_beta*|*_rc*)
 		# Set a negative patchlevel to indicate that it's a pre-release.
@@ -26,11 +26,12 @@ case ${PV} in
 		;;
 	*)
 		PLEVEL=0
+		;;
 esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.3_rc1"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,18 +46,18 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="d3e86e66ce857a8dc02e3116fd98b6e5b34d6364"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
+	BASH_COMMIT="535a8150b65ee6888f54f602274dbbdcd77c788e"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
 
 	# bash-5.1 -> bash51
 	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
 	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
 		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
 		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
 	done
 
@@ -179,6 +180,10 @@ src_configure() {
 	# may misbehave at runtime.
 	unset -v YACC
 
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
 	myconf=(
 		--disable-profiling
 
@@ -315,7 +320,7 @@ src_install() {
 	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r1.bash | newins - 10-gentoo-color.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
 	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
 	if [[ ! ${EPREFIX} ]]; then
 		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
index 6e80009526..e997c37cff 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-erroneous-delimiter-pushback-condition.patch
@@ -1,4 +1,4 @@
-From 57fbf1c67f2d89365601f39e72781fba001fe2f3 Mon Sep 17 00:00:00 2001
+From 01463f6ae5a58b7309769596714e76b0d265b622 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 08:13:38 +0100
 Subject: [PATCH 3/3] Backport fix for erroneous delimiter pushback condition
@@ -23,7 +23,7 @@ $'\315'
 ''
 ''
 
-With the upcoming 5.3-rc2, which will incoprorate this patch, all three
+With the upcoming 5.3-rc2, which will incorporate this patch, all three
 records are read correctly.
 
 <FOO>
@@ -47,7 +47,7 @@ Signed-off-by: Kerin Millar <kfm@plushkava.net>
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 9fd9a74c..8000def3 100644
+index 48351c3c..70a3508b 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -1102,14 +1102,14 @@ read_mbchar (fd, string, ind, ch, delim, unbuffered)
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
index ff6fdf2541..ea27d3b3d1 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p32-invalid-continuation-byte-ignored-as-delimiter-2.patch
@@ -1,4 +1,4 @@
-From fb31e1965baa732f9e4cdbe3a7d6691d7beb4e03 Mon Sep 17 00:00:00 2001
+From c87aca06c259b6283a499584d95c87f163accba0 Mon Sep 17 00:00:00 2001
 From: Kerin Millar <kfm@plushkava.net>
 Date: Mon, 28 Apr 2025 07:59:25 +0100
 Subject: [PATCH 2/3] Backport fix for invalid continuation bytes above 0x7F
@@ -26,11 +26,11 @@ Link: https://mywiki.wooledge.org/BashPitfalls#IFS.3D_read_-r_-d_.27.27_filename
 Link: https://lists.gnu.org/r/bug-bash/2024-08/msg00100.html
 Signed-off-by: Kerin Millar <kfm@plushkava.net>
 ---
- builtins/read.def | 40 +++++++++++++++++++++++-----------------
- 1 file changed, 23 insertions(+), 17 deletions(-)
+ builtins/read.def | 41 +++++++++++++++++++++++------------------
+ 1 file changed, 23 insertions(+), 18 deletions(-)
 
 diff --git builtins/read.def builtins/read.def
-index 53b4bd81..9fd9a74c 100644
+index 53b4bd81..48351c3c 100644
 --- builtins/read.def
 +++ builtins/read.def
 @@ -142,7 +142,7 @@ sh_timer *read_timeout;
@@ -80,16 +80,17 @@ index 53b4bd81..9fd9a74c 100644
  	      mbchar[--i] = '\0';		/* unget the delimiter */
  	    }
  	  break;		/* invalid multibyte character */
-@@ -1220,6 +1219,8 @@ edit_line (p, itext)
+@@ -1219,7 +1218,8 @@ edit_line (p, itext)
+ 
    len = strlen (ret);
    ret = (char *)xrealloc (ret, len + 2);
-   ret[len++] = delim;
+-  ret[len++] = delim;
 +  if (delim > 0)
 +    ret[len++] = delim;
    ret[len] = '\0';
    return ret;
  }
-@@ -1240,7 +1241,7 @@ static rl_command_func_t *old_delim_func;
+@@ -1240,7 +1240,7 @@ static rl_command_func_t *old_delim_func;
  static int old_newline_ctype;
  static rl_command_func_t *old_newline_func;
  
@@ -98,7 +99,7 @@ index 53b4bd81..9fd9a74c 100644
  
  static void
  set_eol_delim (c)
-@@ -1252,19 +1253,21 @@ set_eol_delim (c)
+@@ -1252,19 +1252,21 @@ set_eol_delim (c)
      initialize_readline ();
    cmap = rl_get_keymap ();
  
@@ -128,7 +129,7 @@ index 53b4bd81..9fd9a74c 100644
  
    delim_char = c;
  }
-@@ -1280,7 +1283,10 @@ reset_eol_delim (cp)
+@@ -1280,7 +1282,10 @@ reset_eol_delim (cp)
    cmap[RETURN].type = old_newline_ctype;
    cmap[RETURN].function = old_newline_func;
  
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
deleted file mode 100644
index 72693cb33a..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color-r1.bash
+++ /dev/null
@@ -1,73 +0,0 @@
-# /etc/bash/bashrc.d/10-gentoo-color.bash
-
-if [[ ${NO_COLOR} ]]; then
-	# Respect the user's wish not to use color. See https://no-color.org/.
-	gentoo_color=0
-elif [[ ${COLORTERM@a} == *x* && ${COLORTERM} == @(24bit|truecolor) ]]; then
-	# The COLORTERM environment variable can reasonably be trusted here.
-	# See https://github.com/termstandard/colors for further information.
-	gentoo_color=1
-elif unset -v COLORTERM; ! gentoo_color=$(tput colors 2>/dev/null); then
-	# Either ncurses is not installed or no terminfo database could be
-	# found. Fall back to a whitelist which covers the majority of terminal
-	# emulators and virtual console implementations known to support color
-	# and which remain (somewhat) popular. This will rarely happen, so the
-	# list need not be exhaustive.
-	case ${TERM} in
-		*color*    |\
-		*direct*   |\
-		*ghostty   |\
-		[Ekx]term* |\
-		alacritty  |\
-		aterm      |\
-		contour    |\
-		dtterm     |\
-		foot*      |\
-		jfbterm    |\
-		linux      |\
-		mlterm     |\
-		rxvt*      |\
-		screen*    |\
-		tmux*      |\
-		wsvt25*    ) gentoo_color=1
-	esac
-elif (( gentoo_color == 16777216 )); then
-	# Truecolor support is available. Advertise it.
-	export COLORTERM=truecolor
-fi
-
-# For direxpand to be missing indicates that bash is lacking readline support.
-if (( gentoo_color <= 0 )) || [[ ! $(shopt -p direxpand 2>/dev/null) ]]; then
-	# Define a prompt without color.
-	PS1='\u@\h \w \$ '
-elif (( EUID == 0 )); then
-	# If root, omit the username and print the hostname in red.
-	PS1='\[\e[01;31m\]\h\[\e[01;34m\] \w \$\[\e[00m\] '
-else
-	# Otherwise, print the username and hostname in green.
-	PS1='\[\e[01;32m\]\u@\h\[\e[01;34m\] \w \$\[\e[00m\] '
-fi
-
-if (( gentoo_color > 0 )); then
-	# Colorize the output of diff(1), grep(1) and a few coreutils utilities.
-	# However, do so only where no alias/function by the given name exists.
-	for _ in diff dir grep ls vdir; do
-		if [[ $(type -t "$_") == file ]]; then
-			alias "$_=$_ --color=auto"
-		fi
-	done
-
-	# Enable colors for ls(1) and some other utilities that respect the
-	# LS_COLORS variable. Prefer ~/.dir_colors, per bug #64489.
-	if hash dircolors 2>/dev/null; then
-		if [[ -f ~/.dir_colors ]]; then
-			eval "$(COLORTERM=1 dircolors -b -- ~/.dir_colors)"
-		elif [[ -f /etc/DIR_COLORS ]]; then
-			eval "$(COLORTERM=1 dircolors -b /etc/DIR_COLORS)"
-		else
-			eval "$(COLORTERM=1 dircolors -b)"
-		fi
-	fi
-fi
-
-unset -v gentoo_color