diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
index 048c7911b0..6b824a1d69 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
@@ -15,7 +15,7 @@ IUSE=""
 # Depending on specific version of python-oem allows us to notice when
 # we update the major version of python and then to make sure that we
 # install the package in correctly versioned site-packages directory.
-DEP_PYVER="3.9"
+DEP_PYVER="3.10"
 
 RDEPEND="
 dev-lang/python-oem:${DEP_PYVER}
diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md
new file mode 100644
index 0000000000..5d6f600590
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md
@@ -0,0 +1 @@
+- btrfs-progs ([6.0.2](https://btrfs.readthedocs.io/en/latest/CHANGES.html#btrfs-progs-6-0-2-2022-11-24), includes [6.0](https://btrfs.readthedocs.io/en/latest/CHANGES.html#btrfs-progs-6-0-2022-10-11))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r206.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r206.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 76267e3e90..95e47322a0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -52,7 +52,6 @@ RDEPEND="${RDEPEND}
 	dev-libs/protobuf
 	dev-python/flit_core
 	dev-python/gpep517
-	dev-python/mako
 	dev-python/setuptools
 	dev-python/wheel
 	dev-util/gdbus-codegen
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
index 3631e180ba..4f6d96b08f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
@@ -30,6 +30,7 @@ DEPEND="
 	coreos-devel/fero-client
 	dev-libs/gobject-introspection
 	dev-python/setuptools
+	dev-python/six
 	dev-util/b2
 	dev-util/catalyst
 	dev-util/checkbashisms
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem
new file mode 100644
index 0000000000..8b527f5a5d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem
@@ -0,0 +1,9 @@
+# Work around configure test that cannot be cross compiled :(
+#
+# When checking if this is still applicable, try grepping the
+# configure script for lines with "$cross_compiling", like
+#
+# grep -B 20 -F 'when cross compiling' configure
+
+export ac_cv_file__dev_ptc=no
+export ac_cv_file__dev_ptmx=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
index 9baca72593..5cebbd8384 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
@@ -1,3 +1,3 @@
-DIST Python-3.9.16.tar.xz 19738796 BLAKE2B 70dedeb70d9d8f27e4f6db5106623e087c61d451c7a04639cf8d3503ad02d4d43f1b36d0cdf1131aefc9bf6e677e561227dd4baef2c2c3d2dbf6d3e7dc36bd94 SHA512 b5fd0afe131c82bbce6ddf887c59eef6945910d6a9a2bc87c0927f4e4a096bf9ca4d25bcb729c40f6ebb8a65fbe8bf7b0b97a7c4a8c9e551240eb4f34b878653
-DIST Python-3.9.16.tar.xz.asc 833 BLAKE2B 416b4a4be06e101c5971c12a6f21229c425bcabaea58487e0d1b24d6dea318c58806ee43892fc704df8252670451bd6a4a2610c25672d3983ddb081fed34b92d SHA512 468959c36a3ec6136f57a39475fff4745a25be0cb5d3d58cf3e5faf0b9ce2d2a8b89f1f9fea1479c4c6ad12ac49e97c1cfd4291c978bb3d30df5a582ec315210
-DIST python-gentoo-patches-3.9.16.tar.xz 23348 BLAKE2B 26b66e57530d167776d2aee60fd4620fc8e6c229f371616fdaa74aa2f03fd5a50b61653a5f34e0f2659901ba167af7c2aadbb0d2db773ab08bac8b3125c84b77 SHA512 8260369d96a6328ad8498359ecc56f48cb02015547065cdaec28a6bb2293bef420cb12764fae9fdd13f4a6faa60c4c402e804a22cbed7dca031ac1679032f9f6
+DIST Python-3.10.9.tar.xz 19612112 BLAKE2B ef2d063a9fbaf234aa4a47149cb184a0379dc403515df10249104a5092750cdaf22ad47916d34e17dd68fff1c30338c0375f4e4e3cc9bde33e0896c1c3ba655b SHA512 d66ea8adeb6dc4951e612175f8838b3092967ff275b7a3470f2d86f470036aa2221e722c3144d90bcd230b88efd53dde204213f72f703e524e4b833e2ccc68e2
+DIST Python-3.10.9.tar.xz.asc 833 BLAKE2B 8895c6cb5031b2463cc6ba3e0dc56bee40c2e99117c062f9c72f2b7adb0d5a49782b968abfc764117e8513bd12816915245677c25b1710e3dae3c9e26937c2b9 SHA512 525e166ede6836086de814c26fc880f41eaf1ed4bff6118f00342e42f7ab1c47148447ced1b565e146d3125fa06b5cd6b394a256bc61096766b26e07f18bbf10
+DIST python-gentoo-patches-3.10.9.tar.xz 12216 BLAKE2B ced4f951089c51ddaab6c62ade9d2c84f69e7e1baf2acf5247559534c7d0fb0e88dca1222f5bd2209b4e61f5aca17279b8054f269535dbc10de0786c2c5779f5 SHA512 2d01f0f3831beeba004517bb82f7d616f25f08e5c755409ecff79cd68e0a619b5bf6802fffd0e5f7f39f1d9d93e65b018b91cdeb337a5e47f1651f36bea0e96e
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
index 8b27d3d896..12b071faeb 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
@@ -1,84 +1,45 @@
 Modifications made:
 
-- Drop `pgo` and `lto` USE flags, so flags passed to configure are
-  `--without-lto` and `--disable-optimizations`. Also drop `pgo` code
-  in `src_configure` and `src_compile`.
+- Keep using internal expat and libffi, thus dropping dev-libs/libffi
+  and dev-libs/expat from the dependencies.
 
-- We are not running any tests, so drop the `test` use flag and
-  `src_test` function. Drop also `pkg_pretend` and `pkg_setup`
-  functions as they were only doing some stuff if `test` use flag was
-  enabled.
+- Drop dev-python/gentoo-common dependency, it provides the
+  EXTERNALLY-MANAGED file, but we will provide our own.
 
-- Fix a path to a patchset that was using a `${PN}` variable, but
-  expected it to be `python` while our package is actually
-  `python-oem`.
+- Since this package is installed only for OEM partition as a binary
+  package, and the installation there happens after the packages
+  database is removed, we unset the RDEPEND variable. The RDEPEND
+  variable needs to be empty as it's also used during the binary
+  package installation. The contents of RDEPEND are already inside the
+  DEPEND variable, so we are safe.
 
-- Drop the following use flags and simplify the ebuild assuming that
-  they were disabled: `bluetooth examples gdbm ncurses readline sqlite
-  ssl tk wininst`.
+- We modify the configure flags:
 
-- Drop the following use flags and simplify the ebuild assuming that
-  they were enabled: `build`.
+  - Add `--prefix=/usr/share/oem/python` as `/usr/share/oem` is where
+    the OEM partition is mounted.
 
-- Drop `xml` use flag. Drop the dependency on expat, but instead keep
-  the internal copy of expat, so we keep `_elementtree` and `pyexpat`
-  modules enabled. Finally tell the configure script to use the
-  internal stuff (by passing the `--without-system-expat` flag).
+  - Add `--with-platlibdir="$(get_libdir)"`, this is to make sure that
+    consistent library directory gets picked. In our case for both
+    amd64 and arm64, it's lib64.
 
-- Drop the dependency on libffi, instead keep using internal libffi
-  and tell the configure script to use internal stuff (by passing the
-  `--without-system-ffi` flag).
+  - Change `--enable-shared` to `--disable-shared`. This will skip
+    building dynamic libraries, as we don't need them.
 
-- Rename `RDEPEND` to `DEPEND`, so `RDEPEND` remains empty. OEM
-  packages are installed after production images are pruned of the
-  previously installed package database.
+  - Add `--includedir=/discard/include` and change `--mandir` and
+    `--infodir` to also use `/discard` to install files there. Makes
+    it easy to remove the unnecessary files.
 
-- Make the following changes in configure flags:
+  - We disable loadable sqlite extensions.
 
-  - Add `--prefix=/usr/share/oem/python` to the `myeconfargs` variable.
+  - As we want to use the internal versions of expat and libffi, we
+    change `--with-system-{expat,ffi}` to
+    `--without-system-{expat,ffi}`.
 
-  - To make sure that python library ends up where we want (for
-    example, in `lib64` instead of `lib`, because in this prefix, we
-    have no symlinks from `lib` to `lib64`), add
-    `--with-platlibdir=$(get_libdir)` to the `myeconfargs` variable.
+  - Comment out the `--with-wheel-pkg-dir` as it's some ensurepip
+    stuff we are disabling anyway.
 
-  - Change `--enable-shared` to `--disable-shared`.
-
-  - Set `--mandir`, `--infodir` and `--includedir` to some subdirectory of
-    `/discard`, so during installation this could be easily removed.
-
-  - Drop `--enable-loadable-sqlite-extensions` flag.
-
-- Export some configure variables for the cross-compilation:
-  `ac_cv_file__dev_ptc` and `ac_cv_file__dev_ptmx`. If not done, build
-  will fail with a message saying that these should be set to either
-  yes or no.
-
-- Drop pax stuff (search for `pax-utils` and `pax-mark`) - it's noop
-  on Flatcar.
-
-- Simplify `src_install`:
-
-  - Replace the hardcoded `${ED}/usr` with `${ED}/usr/share/oem/python`.
-
-  - Drop sed stuff mucking with `LDFLAGS`.
-
-  - Drop collision fixes.
-
-  - Drop `ABIFLAGS` hack.
-
-  - Do not install ACKS, HISTORY and NEWS files.
-
-  - Drop gdb autoload stuff.
-
-  - Drop `pydoc.{conf,init}` stuff.
-
-  - Drop `epython.py` stuff.
-
-  - Drop python-exec stuff.
-
-    - Just everything below that involves `${scriptdir}`.
-
-  - Create versionless links (python and python3) to python executable.
-
-  - Remove installed stuff in `/discard`.
+- Essentially drop `src_install` and write our own variant, where we
+  run `make altinstall`, remove unnecessary files (the original
+  `src_install` could be read to find out which files to remove),
+  creates a versionless python symlink, adds an EXTERNALLY-MANAGED
+  file, and removes the `/discard` directory.
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
similarity index 53%
rename from sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
index 8135fb61e4..25cd1da064 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
 WANT_LIBTOOL="none"
 
-inherit autotools check-reqs flag-o-matic multiprocessing
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
 inherit prefix python-utils-r1 toolchain-funcs verify-sig
 
 MY_PV=${PV/_rc/rc}
@@ -29,21 +29,52 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="PSF-2"
 SLOT="${PYVER}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="hardened"
+IUSE="
+	bluetooth build +ensurepip examples gdbm hardened libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind +xml
+"
+RESTRICT="!test? ( test )"
 
 # Do not add a dependency on dev-lang/python to this ebuild.
 # If you need to apply a patch which requires python for bootstrapping, please
 # run the bootstrap code on your dev box and include the results in the
 # patchset. See bug 447752.
 
-DEPEND="
+# Flatcar: Drop a dependency on dev-libs/expat, we will use the internal one.
+# Flatcar: Drop a dependency on dev-libs/libffi, we will use the internal one.
+# Flatcar: Drop a dependency on dev-python/gentoo-common, we will install our own EXTERNALLY-MANAGED file
+RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
-	dev-lang/python-exec[python_targets_python3_9(-)]
+	dev-lang/python-exec[python_targets_python3_10(-)]
+	dev-python/gentoo-common
 	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+	!!<sys-apps/sandbox-2.21
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-util/valgrind )
+	test? ( app-arch/xz-utils[extra-filters(+)] )
 "
 # autoconf-archive needed to eautoreconf
 BDEPEND="
@@ -52,6 +83,14 @@ BDEPEND="
 	virtual/pkgconfig
 	verify-sig? ( sec-keys/openpgp-keys-python )
 "
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+# Flatcar: Unset RDEPEND, DEPEND already contains it. OEM packages are
+# installed after production images are pruned of the previously
+# installed package database.
+unset RDEPEND
 
 VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
 
@@ -60,6 +99,14 @@ CHECKREQS_DISK_BUILD=5500M
 
 QA_PKGCONFIG_VERSION=${PYVER}
 
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
 src_unpack() {
 	if use verify-sig; then
 		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
@@ -68,6 +115,12 @@ src_unpack() {
 }
 
 src_prepare() {
+	# Flatcar: We keep the internal expat copy.
+	# Flatcar: We keep the internal libffi copy.
+	# # Ensure that internal copies of expat and libffi are not used.
+	# rm -r Modules/expat || die
+	# rm -r Modules/_ctypes/libffi* || die
+
 	local PATCHES=(
 		"${WORKDIR}/${PATCHSET}"
 	)
@@ -88,15 +141,25 @@ src_prepare() {
 
 src_configure() {
 	# disable automagic bluetooth headers detection
-	export ac_cv_header_bluetooth_bluetooth_h=no
-	disable+=" gdbm"
-	disable+=" _curses _curses_panel"
-	disable+=" readline"
-	disable+=" _sqlite3"
-	export PYTHON_DISABLE_SSL="1"
-	disable+=" _tkinter"
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	use xml       || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
 	export PYTHON_DISABLE_MODULES="${disable}"
 
+	if ! use xml; then
+		ewarn "You have configured Python without XML support."
+		ewarn "This is NOT a recommended configuration as you"
+		ewarn "may face problems parsing any XML documents."
+	fi
+
 	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
@@ -109,17 +172,42 @@ src_configure() {
 		append-cflags $(test-flags-CC -ffat-lto-objects)
 	fi
 
-	if tc-is-cross-compiler; then
-		# Force some tests that try to poke fs paths.
-		export ac_cv_file__dev_ptc=no
-		export ac_cv_file__dev_ptmx=yes
-	fi
-
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
 	# PKG_CONFIG needed for cross.
 	tc-export CXX PKG_CONFIG
 
 	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-x test_gdb
+			-u-network
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
 
 	local myeconfargs=(
 		# glibc-2.30 removes it; since we can't cleanly force-rebuild
@@ -127,22 +215,42 @@ src_configure() {
 		# a chance for users rebuilding python before glibc
 		ac_cv_header_stropts_h=no
 
+		# Flatcar: Use oem-specific prefix.
 		--prefix=/usr/share/oem/python
-		--with-platlibdir=$(get_libdir)
+		# Flatcar: Make sure we put libs into a correct subdirectory.
+		--with-platlibdir="$(get_libdir)"
+		# Flatcar: No need for shared libs.
+		# --enable-shared
 		--disable-shared
+		--without-static-libpython
 		--enable-ipv6
+		# Flatcar: Set includedir to discardable directory
+		--includedir='/discard/include'
+		# Flatcar: Set infodir and mandir to discardable directory
+		# --infodir='/${prefix}/share/info'
+		# --mandir='/${prefix}/share/man'
 		--infodir='/discard/info'
 		--mandir='/discard/man'
-		--includedir='/discard/include'
 		--with-computed-gotos
 		--with-dbmliborder="${dbmliborder}"
 		--with-libc=
-		--enable-loadable-sqlite-extensions
+		# Flatcar: No need for loadable extensions.
+		# --enable-loadable-sqlite-extensions
+		--disable-loadable-sqlite-extensions
 		--without-ensurepip
+		# Flatcar: We use internal expat
+		# --with-system-expat
 		--without-system-expat
+		# Flatcar: We use internal ffi
+		# --with-system-ffi
 		--without-system-ffi
-		--without-lto
-		--disable-optimizations
+		# Flatcar: It's for ensurepip, which we disable
+		# --with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
 	)
 
 	# disable implicit optimization/debugging flags
@@ -165,6 +273,9 @@ src_configure() {
 
 			--libdir="${cbuild_libdir:2}"
 
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
 			# As minimal as possible for the mini CBUILD Python
 			# we build just for cross.
 			--without-lto
@@ -213,6 +324,11 @@ src_configure() {
 	local -x LDFLAGS_NODIST=${LDFLAGS}
 	local -x CFLAGS= LDFLAGS=
 
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
 	hprefixify setup.py
 	econf "${myeconfargs[@]}"
 
@@ -239,33 +355,105 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
 	# also need to clear the flags explicitly here or they end up
 	# in _sysconfigdata*
 	emake CPPFLAGS= CFLAGS= LDFLAGS=
 
 	# Restore saved value from above.
 	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
 }
 
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+# Flatcar: Rewrite src_install to just run make altinstall, remove
+# some installed files (refer to the original src_install to see which
+# files to drop), adding symlinks and the EXTERNALLY-MANAGED file, and
+# removing the /discard directory.
 src_install() {
 	local prefix=/usr/share/oem/python
 	local eprefix="${ED}${prefix}"
+        local libdir="${prefix}/$(get_libdir)"
 	local elibdir="${eprefix}/$(get_libdir)"
+	local pythonplatlibdir="${libdir}/python${PYVER}"
 	local epythonplatlibdir="${elibdir}/python${PYVER}"
 	local bindir="${prefix}/bin"
 	local ebindir="${eprefix}/bin"
 
 	emake DESTDIR="${D}" altinstall
 
-	# Remove static library
-	rm "${elibdir}"/libpython*.a || die
-
+	rm -r "${epythonplatlibdir}"/ensurepip || die
 	rm -r "${epythonplatlibdir}/"{sqlite3,test/test_sqlite*} || die
-	rm -r "${ebindir}/idle${PYVER}" "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
+	rm -r "${ebindir}/idle${PYVER}" || die
+	rm -r "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
 
 	# create a simple versionless 'python' symlink
 	dosym "python${PYVER}" "${bindir}/python"
 	dosym "python${PYVER}" "${bindir}/python3"
 
+	insinto "${pythonplatlibdir}"
+	# https://peps.python.org/pep-0668/
+	newins - EXTERNALLY-MANAGED <<-EOF
+		[externally-managed]
+		Error=
+		 Please contact Flatcar maintainers if some python package
+		 is necessary for this OEM image.
+	EOF
+
 	rm -r "${ED}/discard" || die
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest
deleted file mode 100644
index 880178074c..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest
+++ /dev/null
@@ -1 +0,0 @@
-DIST boto-2.49.0.tar.gz 1478498 BLAKE2B 6a897ea162f5f4bd34a2d488a3e3897f7f2f5b8707dd0922c01b6a0b90ea577223bf3e588b6685bda1f2bc0e92af426711fcba67a70377183465a530065c6c84 SHA512 2175cf30cd25bbc05812e83e5ade7668c3e21b1bb09aa1b43f0f0ac7d6967a646394fb52c9be673ebb65618c5b33a52d6f31f6da702f5cd1d6c9a18169476dd4
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
deleted file mode 100644
index 4dd30bd7dc..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
+++ /dev/null
@@ -1,67 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-PYTHON_COMPAT=( python3_{8..10} )
-DISTUTILS_USE_SETUPTOOLS=bdepend
-
-inherit distutils-r1
-
-DESCRIPTION="Amazon Web Services API"
-HOMEPAGE="https://github.com/boto/boto https://pypi.org/project/boto/"
-SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc ~ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
-
-PATCHES=(
-	# taken from https://bugs.debian.org/909545
-	"${FILESDIR}"/${P}-try-to-add-SNI-support-v3.patch
-	"${FILESDIR}"/${P}-py38.patch
-	"${FILESDIR}"/${P}-py3-socket-binary.patch
-	"${FILESDIR}"/${P}-py3-httplib-strict.patch
-	"${FILESDIR}"/${P}-py3-server-port.patch
-	"${FILESDIR}"/${P}-unbundle-six.patch
-	"${FILESDIR}"/${P}-py310.patch
-)
-
-RDEPEND=">=dev-python/six-1.12.0[${PYTHON_USEDEP}]"
-
-BDEPEND="
-	test? (
-		dev-python/httpretty[${PYTHON_USEDEP}]
-		dev-python/keyring[${PYTHON_USEDEP}]
-		dev-python/lxml[${PYTHON_USEDEP}]
-		dev-python/mock[${PYTHON_USEDEP}]
-		dev-python/paramiko[${PYTHON_USEDEP}]
-		dev-python/requests[${PYTHON_USEDEP}]
-		dev-python/rsa[${PYTHON_USEDEP}]
-		dev-python/selenium[${PYTHON_USEDEP}]
-	)"
-
-distutils_enable_tests nose
-
-src_prepare() {
-	# remove bundled libs.
-	rm -f "${S}"/boto/vendored/six.py || die
-	# broken, not worth fixing
-	rm tests/unit/cloudfront/test_signed_urls.py || die
-	# fix tests
-	mkdir -p "${HOME}"/.ssh || die
-	: > "${HOME}"/.ssh/known_hosts || die
-	# Flatcar: Do not import boto only for the version number in
-	# setup.py - it ends up trying to import six, which we have
-	# unbundled and the six module effectively becomes a BDEPEND
-	# instead of RDEPEND. Drop the import and define the
-	# __variable__ instead.
-	sed -i -e 's/^from boto import __version__$/__version__ = '"'${PV}'"'/' setup.py
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	nosetests -v tests/unit ||
-		die "Tests fail with ${EPYTHON}"
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch
deleted file mode 100644
index 209b01aa74..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-https://github.com/boto/boto/commit/4f4dcb31fe852c05ce19b44eb9d5b5d747e36f7c
-https://github.com/boto/boto/pull/2718
-
-From 4f4dcb31fe852c05ce19b44eb9d5b5d747e36f7c Mon Sep 17 00:00:00 2001
-From: Lee Ball <43632885+catleeball@users.noreply.github.com>
-Date: Mon, 10 Jun 2019 16:02:53 -0700
-Subject: [PATCH] Remove `strict=True` from http_client (#6)
-
-In Python 3.4, the `strict` kwarg was removed[1]. We are removing it
-here too.
-
-Alternatively, we can leave in `strict=True` for 2.x, but I chose to
-remove it entirely to maintain consistent behavior across versions.
-
-[1]: https://docs.python.org/3/library/http.client.html
----
- boto/connection.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index c731173bb4eb..54e26fb2de16 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -807,7 +807,7 @@ class AWSAuthConnection(object):
-                 sock.sendall(six.ensure_binary("\r\n"))
-         else:
-             sock.sendall(six.ensure_binary("\r\n"))
--        resp = http_client.HTTPResponse(sock, strict=True, debuglevel=self.debug)
-+        resp = http_client.HTTPResponse(sock, debuglevel=self.debug)
-         resp.begin()
- 
-         if resp.status != 200:
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch
deleted file mode 100644
index 62e3319219..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-https://github.com/boto/boto/commit/b9f6cb0ab717ea76e2780c7fddd1cd36b3bf7d63
-
-From b9f6cb0ab717ea76e2780c7fddd1cd36b3bf7d63 Mon Sep 17 00:00:00 2001
-From: Matt Houglum <houglum@google.com>
-Date: Fri, 21 Jun 2019 15:09:11 -0700
-Subject: [PATCH] Make server_name() behave correctly for PY3
-
-...because Python-2.6-or-newer doesn't just include Python 2.6 and 2.7.
----
- boto/connection.py | 14 +++++---------
- 1 file changed, 5 insertions(+), 9 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index 54e26fb2de16..bbb25d8fb842 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -650,17 +650,13 @@ class AWSAuthConnection(object):
-         if port == 80:
-             signature_host = self.host
-         else:
--            # This unfortunate little hack can be attributed to
--            # a difference in the 2.6 version of http_client.  In old
--            # versions, it would append ":443" to the hostname sent
--            # in the Host header and so we needed to make sure we
--            # did the same when calculating the V2 signature.  In 2.6
--            # (and higher!)
--            # it no longer does that.  Hence, this kludge.
--            if ((ON_APP_ENGINE and sys.version[:3] == '2.5') or
--                    sys.version[:3] in ('2.6', '2.7')) and port == 443:
-+            ver_int = sys.version_info[0] * 10 + sys.version_info[1]
-+            if port == 443 and ver_int >= 26:  # Py >= 2.6
-                 signature_host = self.host
-             else:
-+                # In versions < 2.6, Python's http_client would append ":443"
-+                # to the hostname sent in the Host header and so we needed to
-+                # make sure we did the same when calculating the V2 signature.
-                 signature_host = '%s:%d' % (self.host, port)
-         return signature_host
- 
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch
deleted file mode 100644
index 1d109a3f49..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-https://github.com/boto/boto/commit/d2cb697b32c297858ecc36701a5a4176818ab36d
-https://github.com/boto/boto/pull/2718
-https://github.com/boto/boto/pull/2893
-https://github.com/boto/boto/pull/3699
-
-From d2cb697b32c297858ecc36701a5a4176818ab36d Mon Sep 17 00:00:00 2001
-From: Cat Lee Ball <cball@google.com>
-Date: Mon, 10 Jun 2019 13:31:11 -0700
-Subject: [PATCH] Ensure binary strings sent to socket
-
-When running pre-release tests with proxied connections, it appeared a
-few spots in connection.py would fail under Python 3 since the
-socket.sendall method expects binary strings rather than unicode.
----
- boto/connection.py | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index a0d89a51f49c..d084d1f881fb 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -796,17 +796,17 @@ class AWSAuthConnection(object):
-         else:
-             sock = socket.create_connection((self.proxy, int(self.proxy_port)))
-         boto.log.debug("Proxy connection: CONNECT %s HTTP/1.0\r\n", host)
--        sock.sendall("CONNECT %s HTTP/1.0\r\n" % host)
--        sock.sendall("User-Agent: %s\r\n" % UserAgent)
-+        sock.sendall(six.ensure_binary("CONNECT %s HTTP/1.0\r\n" % host))
-+        sock.sendall(six.ensure_binary("User-Agent: %s\r\n" % UserAgent))
-         if self.proxy_user and self.proxy_pass:
-             for k, v in self.get_proxy_auth_header().items():
--                sock.sendall("%s: %s\r\n" % (k, v))
-+                sock.sendall(six.ensure_binary("%s: %s\r\n" % (k, v)))
-             # See discussion about this config option at
-             # https://groups.google.com/forum/?fromgroups#!topic/boto-dev/teenFvOq2Cc
-             if config.getbool('Boto', 'send_crlf_after_proxy_auth_headers', False):
--                sock.sendall("\r\n")
-+                sock.sendall(six.ensure_binary("\r\n"))
-         else:
--            sock.sendall("\r\n")
-+            sock.sendall(six.ensure_binary("\r\n"))
-         resp = http_client.HTTPResponse(sock, strict=True, debuglevel=self.debug)
-         resp.begin()
- 
-@@ -814,9 +814,10 @@ class AWSAuthConnection(object):
-             # Fake a socket error, use a code that make it obvious it hasn't
-             # been generated by the socket library
-             raise socket.error(-71,
-+                               six.ensure_binary(
-                                "Error talking to HTTP proxy %s:%s: %s (%s)" %
-                                (self.proxy, self.proxy_port,
--                                resp.status, resp.reason))
-+                                resp.status, resp.reason)))
- 
-         # We can safely close the response, it duped the original socket
-         resp.close()
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
deleted file mode 100644
index 7b427f1f15..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/boto/dynamodb/types.py b/boto/dynamodb/types.py
-index d9aaaa4c..3f8d8601 100644
---- a/boto/dynamodb/types.py
-+++ b/boto/dynamodb/types.py
-@@ -27,7 +27,7 @@ Python types and vice-versa.
- import base64
- from decimal import (Decimal, DecimalException, Context,
-                      Clamped, Overflow, Inexact, Underflow, Rounded)
--from collections import Mapping
-+from collections.abc import Mapping
- from boto.dynamodb.exceptions import DynamoDBNumberError
- from boto.compat import filter, map, six, long_type
- 
-diff --git a/boto/mws/connection.py b/boto/mws/connection.py
-index 687fae74..3a1f5f80 100644
---- a/boto/mws/connection.py
-+++ b/boto/mws/connection.py
-@@ -21,7 +21,7 @@
- import xml.sax
- import hashlib
- import string
--import collections
-+import collections.abc
- from boto.connection import AWSQueryConnection
- from boto.exception import BotoServerError
- import boto.mws.exception
-@@ -109,7 +109,7 @@ def http_body(field):
- def destructure_object(value, into, prefix, members=False):
-     if isinstance(value, boto.mws.response.ResponseElement):
-         destructure_object(value.__dict__, into, prefix, members=members)
--    elif isinstance(value, collections.Mapping):
-+    elif isinstance(value, collections.abc.Mapping):
-         for name in value:
-             if name.startswith('_'):
-                 continue
-@@ -117,7 +117,7 @@ def destructure_object(value, into, prefix, members=False):
-                                members=members)
-     elif isinstance(value, six.string_types):
-         into[prefix] = value
--    elif isinstance(value, collections.Iterable):
-+    elif isinstance(value, collections.abc.Iterable):
-         for index, element in enumerate(value):
-             suffix = (members and '.member.' or '.') + str(index + 1)
-             destructure_object(element, into, prefix + suffix,
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch
deleted file mode 100644
index 0052c6e32e..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-diff --git a/boto/ecs/item.py b/boto/ecs/item.py
-index 79177a31..292b05af 100644
---- a/boto/ecs/item.py
-+++ b/boto/ecs/item.py
-@@ -21,7 +21,7 @@
- 
- 
- import xml.sax
--import cgi
-+import html
- from boto.compat import six, StringIO
- 
- class ResponseGroup(xml.sax.ContentHandler):
-@@ -67,7 +67,7 @@ class ResponseGroup(xml.sax.ContentHandler):
-         return None
- 
-     def endElement(self, name, value, connection):
--        self._xml.write("%s</%s>" % (cgi.escape(value).replace("&amp;amp;", "&amp;"), name))
-+        self._xml.write("%s</%s>" % (html.escape(value).replace("&amp;amp;", "&amp;"), name))
-         if len(self._nodepath) == 0:
-             return
-         obj = None
-diff --git a/tests/unit/utils/test_utils.py b/tests/unit/utils/test_utils.py
-index db15b56d..89d1a524 100644
---- a/tests/unit/utils/test_utils.py
-+++ b/tests/unit/utils/test_utils.py
-@@ -85,7 +85,7 @@ class TestPassword(unittest.TestCase):
-         def hmac_hashfunc(cls, msg):
-             if not isinstance(msg, bytes):
-                 msg = msg.encode('utf-8')
--            return hmac.new(b'mysecretkey', msg)
-+            return hmac.new(b'mysecretkey', msg, digestmod='MD5')
- 
-         class HMACPassword(Password):
-             hashfunc = hmac_hashfunc
-@@ -95,15 +95,15 @@ class TestPassword(unittest.TestCase):
-         password.set('foo')
- 
-         self.assertEquals(str(password),
--                          hmac.new(b'mysecretkey', b'foo').hexdigest())
-+                          hmac.new(b'mysecretkey', b'foo', digestmod='MD5').hexdigest())
- 
-     def test_constructor(self):
--        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg)
-+        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg, digestmod='MD5')
- 
-         password = Password(hashfunc=hmac_hashfunc)
-         password.set('foo')
-         self.assertEquals(password.str,
--                          hmac.new(b'mysecretkey', b'foo').hexdigest())
-+                          hmac.new(b'mysecretkey', b'foo', digestmod='MD5').hexdigest())
- 
- 
- class TestPythonizeName(unittest.TestCase):
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch
deleted file mode 100644
index 11d346a219..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From f5e7f6c98b46ff622f60a4661ffc9ce07216d109 Mon Sep 17 00:00:00 2001
-From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
-Date: Sat, 29 Sep 2018 21:47:11 +0200
-Subject: [PATCH] boto: try to add SNI support
-
-Add SNI support. Newer OpenSSL (with TLS1.3) fail to connect if the
-hostname is missing.
-
-Link: https://bugs.debian.org/bug=909545
-Tested-by: Witold Baryluk <witold.baryluk@gmail.com>
-Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
----
- boto/connection.py       | 19 ++++++++++---------
- boto/https_connection.py | 22 +++++++++++-----------
- 2 files changed, 21 insertions(+), 20 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index 34b428f101df7..b4867a7657465 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -778,8 +778,10 @@
- 
-     def proxy_ssl(self, host=None, port=None):
-         if host and port:
-+            cert_host = host
-             host = '%s:%d' % (host, port)
-         else:
-+            cert_host = self.host
-             host = '%s:%d' % (self.host, self.port)
-         # Seems properly to use timeout for connect too
-         timeout = self.http_connection_kwargs.get("timeout")
-@@ -824,23 +824,24 @@ DEFAULT_CA_CERTS_FILE = os.path.join(os.path.dirname(os.path.abspath(boto.cacert
-         h = http_client.HTTPConnection(host)
- 
-         if self.https_validate_certificates and HAVE_HTTPS_CONNECTION:
-+            context = ssl.create_default_context()
-+            context.verify_mode = ssl.CERT_REQUIRED
-+            context.check_hostname = True
-+
-             msg = "wrapping ssl socket for proxied connection; "
-             if self.ca_certificates_file:
-                 msg += "CA certificate file=%s" % self.ca_certificates_file
-+                context.load_verify_locations(cafile=self.ca_certificates_file)
-             else:
-                 msg += "using system provided SSL certs"
-+                context.load_default_certs()
-             boto.log.debug(msg)
-             key_file = self.http_connection_kwargs.get('key_file', None)
-             cert_file = self.http_connection_kwargs.get('cert_file', None)
--            sslSock = ssl.wrap_socket(sock, keyfile=key_file,
--                                      certfile=cert_file,
--                                      cert_reqs=ssl.CERT_REQUIRED,
--                                      ca_certs=self.ca_certificates_file)
--            cert = sslSock.getpeercert()
--            hostname = self.host.split(':', 0)[0]
--            if not https_connection.ValidateCertificateHostname(cert, hostname):
--                raise https_connection.InvalidCertificateException(
--                    hostname, cert, 'hostname mismatch')
-+            if key_file:
-+                context.load_cert_chain(certfile=cert_file, keyfile=key_file)
-+
-+            sslSock = context.wrap_socket(sock, server_hostname=cert_host)
-         else:
-             # Fallback for old Python without ssl.wrap_socket
-             if hasattr(http_client, 'ssl'):
-diff --git a/boto/https_connection.py b/boto/https_connection.py
-index ddc31a152292e..a5076f6f9b261 100644
---- a/boto/https_connection.py
-+++ b/boto/https_connection.py
-@@ -119,20 +119,20 @@ from boto.compat import six, http_client
-             sock = socket.create_connection((self.host, self.port), self.timeout)
-         else:
-             sock = socket.create_connection((self.host, self.port))
-+
-+        context = ssl.create_default_context()
-+        context.verify_mode = ssl.CERT_REQUIRED
-+        context.check_hostname = True
-+        if self.key_file:
-+            context.load_cert_chain(certfile=self.cert_file, keyfile=self.key_file)
-+
-         msg = "wrapping ssl socket; "
-         if self.ca_certs:
-             msg += "CA certificate file=%s" % self.ca_certs
-+            context.load_verify_locations(cafile=self.ca_certs)
-         else:
-             msg += "using system provided SSL certs"
-+            context.load_default_certs()
-         boto.log.debug(msg)
--        self.sock = ssl.wrap_socket(sock, keyfile=self.key_file,
--                                    certfile=self.cert_file,
--                                    cert_reqs=ssl.CERT_REQUIRED,
--                                    ca_certs=self.ca_certs)
--        cert = self.sock.getpeercert()
--        hostname = self.host.split(':', 0)[0]
--        if not ValidateCertificateHostname(cert, hostname):
--            raise InvalidCertificateException(hostname,
--                                              cert,
--                                              'remote hostname "%s" does not match '
--                                              'certificate' % hostname)
-+
-+        self.sock = context.wrap_socket(sock, server_hostname=self.host)
--- 
-2.19.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch
deleted file mode 100644
index 188dae7eb6..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-use the system copy of six
-
---- a/boto/compat.py
-+++ b/boto/compat.py
-@@ -46,16 +46,16 @@ except (AttributeError, ImportError):
-     # This is probably running on App Engine.
-     expanduser = (lambda x: x)
- 
--from boto.vendored import six
-+import six
- 
--from boto.vendored.six import BytesIO, StringIO
--from boto.vendored.six.moves import filter, http_client, map, _thread, \
-+from six import BytesIO, StringIO
-+from six.moves import filter, http_client, map, _thread, \
-                                     urllib, zip
--from boto.vendored.six.moves.queue import Queue
--from boto.vendored.six.moves.urllib.parse import parse_qs, quote, unquote, \
-+from six.moves.queue import Queue
-+from six.moves.urllib.parse import parse_qs, quote, unquote, \
-                                                  urlparse, urlsplit
--from boto.vendored.six.moves.urllib.parse import unquote_plus
--from boto.vendored.six.moves.urllib.request import urlopen
-+from six.moves.urllib.parse import unquote_plus
-+from six.moves.urllib.request import urlopen
- 
- if six.PY3:
-     # StandardError was removed, so use the base exception type instead
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml
deleted file mode 100644
index 3ab9e0b0a8..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-  <maintainer type="project">
-    <email>python@gentoo.org</email>
-    <name>Python</name>
-  </maintainer>
-  <stabilize-allarches/>
-  <upstream>
-    <remote-id type="google-code">boto</remote-id>
-    <remote-id type="pypi">boto</remote-id>
-    <remote-id type="github">boto/boto</remote-id>
-  </upstream>
-</pkgmetadata>
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
index 146f015bd5..149cfc59a4 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
@@ -19,7 +19,7 @@ KEYWORDS="amd64 arm64"
 # Depending on specific version of python-oem allows us to notice when
 # we update the major version of python and then to make sure that we
 # install the package in correctly versioned site-packages directory.
-DEP_PYVER="3.9"
+DEP_PYVER="3.10"
 
 SLOT="0"
 RDEPEND="dev-lang/python-oem:${DEP_PYVER}"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
index cbf3bd6b3c..774d3072fd 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
@@ -39,7 +39,6 @@
 =sys-devel/gcc-11.3.1_p20230120-r1 ~arm64
 
 =sys-firmware/edk2-aarch64-18.02 **
-=sys-fs/btrfs-progs-4.19.1 ~arm64
 =sys-libs/libselinux-3.1-r2 ~arm64
 =sys-libs/libsemanage-3.1-r1 ~arm64
 =sys-libs/libsepol-3.1 ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index f390955959..b73c719c5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -14,12 +14,12 @@ USE_EXPAND="${USE_EXPAND} GO_VERSION"
 USE="${USE} cros_host expat -cracklib -introspection -cups -tcpd -berkdb"
 
 # Use Python 3 as the default version
-USE="${USE} -python_single_target_python2_7 python_single_target_python3_9"
-USE="${USE} -python_targets_python2_7 python_targets_python3_9"
+USE="${USE} -python_single_target_python2_7 python_single_target_python3_10"
+USE="${USE} -python_targets_python2_7 python_targets_python3_10"
 
 # Use Python 3 as the default version
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_9"
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_9"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_10"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_10"
 
 # Never install cron or cron jobs
 USE="${USE} -cron"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index 783cb56b97..fada03a3d7 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -18,9 +18,9 @@
 # version 10 or later.
 >=virtual/libcrypt-2
 
-# Python 3.10 is stable in portage-stable, so avoid picking it
+# Python 3.11 is stable in portage-stable, so avoid picking it
 # up. Drop this when we switch to it.
->=dev-lang/python-3.10
+>=dev-lang/python-3.11
 
 # sys-devel/gcc-11.3.1_p20230120-r1 is the latest stable gcc version
 # that fixes the CET build issue of glibc. There are newer versions of
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index 6d9a8d9d1c..c02b3aba0d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -26,3 +26,7 @@ sys-libs/glibc -crypt
 
 # We don't use pip.
 dev-lang/python ensurepip
+dev-lang/python-oem ensurepip
+
+# Pulls dev-python/sphinx, which in turn pulls a lot of other python stuff.
+sys-fs/btrfs-progs man
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 6e03cd1800..56ea60f1a8 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,17 +1,15 @@
 # Never enable experimental code
 kdbus
 
-# We default to python 3.9 for now
+# We default to python 3.10 for now
 python_targets_python2_7
 python_single_target_python2_7
-python_targets_python3_6
-python_single_target_python3_6
-python_targets_python3_7
-python_single_target_python3_7
 python_targets_python3_8
 python_single_target_python3_8
-python_targets_python3_10
-python_single_target_python3_10
+python_targets_python3_9
+python_single_target_python3_9
+python_targets_python3_11
+python_single_target_python3_11
 
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 1154ac8dc0..e710d28c4d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -7,6 +7,10 @@ app-editors/vim		minimal -crypt
 # minimal: Don't pull app-vim/gentoo-syntax
 app-editors/vim-core	minimal
 dev-lang/python		gdbm
+
+# Disable everything for python-oem except of build and xml
+dev-lang/python-oem -bluetooth build -ensurepip -examples -gdbm -hardened -libedit -lto -ncurses -pgo -readline -sqlite -ssl -test -tk -valgrind xml
+
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r8.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r9.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r8.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r9.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
index 7703a9f528..3d976f29b5 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 CROS_WORKON_PROJECT="flatcar/grub"
 CROS_WORKON_REPO="https://github.com"
@@ -21,7 +21,7 @@ if [[ -n ${GRUB_AUTOGEN} ]]; then
 	inherit autotools python-any-r1
 fi
 
-inherit autotools bash-completion-r1 flag-o-matic multibuild pax-utils toolchain-funcs versionator
+inherit autotools bash-completion-r1 flag-o-matic multibuild pax-utils toolchain-funcs
 DEJAVU=dejavu-sans-ttf-2.37
 UNIFONT=unifont-9.0.06
 SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz )
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
index 23718c47f8..7ad8a320e1 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
@@ -1 +1 @@
-DIST btrfs-progs-v5.15.1.tar.xz 2280796 BLAKE2B b460254a6261d3d04a2d265a3b4e05a89385888f7ea4f2b16ec5b73922646c7f47a546fc78ba7c009e65914125435cf38157eabffc74f5d00df2c21c844922e3 SHA512 68ed89e337ae857fdaf077eaa889e259e9f162ea2222bdaa03f4187783a8682c24d45c91b0559b901d81429ba2cd3f84087d032d354092d5512fb226bdf91549
+DIST btrfs-progs-v6.0.2.tar.xz 2321220 BLAKE2B 391bd9dcc7ae2d40c339eb9b7fb466624c3f122149af640bc0ca73abfc85ca7bd076976d47ce2d4eab64fb3b9b1309e3446acdd78ba77e5cb583b939710f8b6c SHA512 8e01fa6e3373d95a8e8577003ceb94722e4dfdf24110bfea79191a9862daf5e6580d72e898fdea134b5e86beeda32948eed572072f7906226189c6f1ac8615e3
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
index d3ed623221..16f62cc8c0 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
@@ -6,9 +6,3 @@ We forked this package for the following reasons:
   it by overriding it in Makefile.inc.in. Ideal solution here would be
   to patch btrfs-progs to allow overriding the udev path and then
   override it in the ebuild properly, without the sed hacks.
-
-- We change the python versions, because we still have only python
-  3.6.
-
-- We stabilize the package on both amd64 and arm64 to keep it in sync
-  with our linux kernel version.
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
similarity index 63%
rename from sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
index 73f71df572..ad75587042 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
@@ -1,43 +1,47 @@
-# Copyright 2008-2021 Gentoo Authors
+# Copyright 2008-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-# Flatcar: We still have python 3.6 only.
-PYTHON_COMPAT=( python3_{6..9} )
+PYTHON_COMPAT=( python3_{9..10} )
 
-# Flatcar: Inherit udev eclass, so we can get the udev directory.
 inherit bash-completion-r1 python-single-r1 udev
 
 libbtrfs_soname=0
 
 if [[ ${PV} != 9999 ]]; then
 	MY_PV="v${PV/_/-}"
-	[[ "${PV}" = *_rc* ]] || \
-	# Flatcar: Stabilize our arches.
-	KEYWORDS="~alpha amd64 ~arm arm64 ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 	SRC_URI="https://www.kernel.org/pub/linux/kernel/people/kdave/${PN}/${PN}-${MY_PV}.tar.xz"
-	S="${WORKDIR}/${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
+
+	S="${WORKDIR}"/${PN}-${MY_PV}
 else
-	WANT_LIBTOOL=none
-	inherit autotools git-r3
 	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
 	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
 fi
 
 DESCRIPTION="Btrfs filesystem utilities"
-HOMEPAGE="https://btrfs.wiki.kernel.org"
+HOMEPAGE="https://btrfs.wiki.kernel.org https://btrfs.readthedocs.io/en/latest/"
 
 LICENSE="GPL-2"
 SLOT="0/${libbtrfs_soname}"
-IUSE="+convert doc python reiserfs static static-libs +zstd"
+IUSE="+convert python +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
 
-RESTRICT=test # tries to mount repared filesystems
+# Tries to mount repaired filesystems
+RESTRICT="test"
 
 RDEPEND="
 	dev-libs/lzo:2=
-	sys-apps/util-linux:0=[static-libs(+)?]
-	sys-libs/zlib:0=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
 	convert? (
 		sys-fs/e2fsprogs:=
 		reiserfs? (
@@ -45,7 +49,8 @@ RDEPEND="
 		)
 	)
 	python? ( ${PYTHON_DEPS} )
-	zstd? ( app-arch/zstd:0= )
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
 "
 DEPEND="${RDEPEND}
 	>=sys-kernel/linux-headers-5.10
@@ -65,19 +70,14 @@ DEPEND="${RDEPEND}
 				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
 			)
 		)
-		zstd? ( app-arch/zstd:0[static-libs(+)] )
-	)
-"
-BDEPEND="
-	doc? (
-		|| ( >=app-text/asciidoc-8.6.0 dev-ruby/asciidoctor )
-		app-text/docbook-xml-dtd:4.5
-		app-text/xmlto
+		zstd? ( app-arch/zstd[static-libs(+)] )
 	)
 "
+BDEPEND="virtual/pkgconfig
+	man? ( dev-python/sphinx )"
 
 if [[ ${PV} == 9999 ]]; then
-	DEPEND+=" sys-devel/gnuconfig"
+	BDEPEND+=" sys-devel/gnuconfig"
 fi
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
@@ -88,14 +88,17 @@ pkg_setup() {
 
 src_prepare() {
 	default
+
 	if [[ ${PV} == 9999 ]]; then
-		AT_M4DIR=m4 eautoreconf
+		AT_M4DIR="m4" eautoreconf
+
 		mkdir config || die
 		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
 		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
 		ln -s "${automakedir}"/install-sh config/install-sh || die
-		ln -s "${EPREFIX}"/usr/share/gnuconfig/config.guess config/config.guess || die
-		ln -s "${EPREFIX}"/usr/share/gnuconfig/config.sub config/config.sub || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
 	fi
 	# Flatcar: Replace udevdir variable with proper udev directory.
 	sed -i -e 's#^\(udevdir\s\+=\).*#\1 $(get_udevdir)#' Makefile.inc.in
@@ -104,14 +107,22 @@ src_prepare() {
 src_configure() {
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
 		$(use_enable convert)
-		$(use_enable doc documentation)
+		$(use_enable man documentation)
 		$(use_enable elibc_glibc backtrace)
 		$(use_enable python)
 		$(use_enable static-libs static)
+		$(use_enable udev libudev)
 		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi
+		--with-crypto=builtin
 		--with-convert=ext2$(usex reiserfs ',reiserfs' '')
 	)
+
 	econf "${myeconfargs[@]}"
 }
 
@@ -124,10 +135,18 @@ src_install() {
 		$(usex python install_python '')
 		$(usex static install-static '')
 	)
-	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
-	newbashcomp btrfs-completion btrfs
-	use python && python_optimize
 
-	# install prebuilt subset of manuals
-	use doc || doman Documentation/*.[58]
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
 }