From 18ac5a79705f44e63d731ae634efe63ae72f365b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 24 Jan 2023 11:32:04 +0100
Subject: [PATCH 01/16] coreos-base/hard-host-depends: Drop dev-python/mako

Nothing needs it.
---
 ...nds-0.0.1-r206.ebuild => hard-host-depends-0.0.1-r207.ebuild} | 0
 .../coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild | 1 -
 2 files changed, 1 deletion(-)
 rename sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/{hard-host-depends-0.0.1-r206.ebuild => hard-host-depends-0.0.1-r207.ebuild} (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r206.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r206.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 76267e3e90..95e47322a0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -52,7 +52,6 @@ RDEPEND="${RDEPEND}
 	dev-libs/protobuf
 	dev-python/flit_core
 	dev-python/gpep517
-	dev-python/mako
 	dev-python/setuptools
 	dev-python/wheel
 	dev-util/gdbus-codegen

From 0ea44b439b59ca929e30089d9fb41373fbf5bc18 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 24 Jan 2023 11:56:52 +0100
Subject: [PATCH 02/16] dev-python/boto: Move to portage-stable

We did one change in setup.py. We can do it with a user patch.
---
 .../coreos-overlay/dev-python/boto/Manifest   |   1 -
 .../dev-python/boto/boto-2.49.0-r4.ebuild     |  67 -----------
 .../boto-2.49.0-py3-httplib-strict.patch      |  35 ------
 .../files/boto-2.49.0-py3-server-port.patch   |  42 -------
 .../files/boto-2.49.0-py3-socket-binary.patch |  59 ----------
 .../boto/files/boto-2.49.0-py310.patch        |  44 --------
 .../boto/files/boto-2.49.0-py38.patch         |  54 ---------
 ...oto-2.49.0-try-to-add-SNI-support-v3.patch | 104 ------------------
 .../boto/files/boto-2.49.0-unbundle-six.patch |  28 -----
 .../dev-python/boto/metadata.xml              |  14 ---
 10 files changed, 448 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest
deleted file mode 100644
index 880178074c..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/Manifest
+++ /dev/null
@@ -1 +0,0 @@
-DIST boto-2.49.0.tar.gz 1478498 BLAKE2B 6a897ea162f5f4bd34a2d488a3e3897f7f2f5b8707dd0922c01b6a0b90ea577223bf3e588b6685bda1f2bc0e92af426711fcba67a70377183465a530065c6c84 SHA512 2175cf30cd25bbc05812e83e5ade7668c3e21b1bb09aa1b43f0f0ac7d6967a646394fb52c9be673ebb65618c5b33a52d6f31f6da702f5cd1d6c9a18169476dd4
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
deleted file mode 100644
index 4dd30bd7dc..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
+++ /dev/null
@@ -1,67 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-PYTHON_COMPAT=( python3_{8..10} )
-DISTUTILS_USE_SETUPTOOLS=bdepend
-
-inherit distutils-r1
-
-DESCRIPTION="Amazon Web Services API"
-HOMEPAGE="https://github.com/boto/boto https://pypi.org/project/boto/"
-SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc ~ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
-
-PATCHES=(
-	# taken from https://bugs.debian.org/909545
-	"${FILESDIR}"/${P}-try-to-add-SNI-support-v3.patch
-	"${FILESDIR}"/${P}-py38.patch
-	"${FILESDIR}"/${P}-py3-socket-binary.patch
-	"${FILESDIR}"/${P}-py3-httplib-strict.patch
-	"${FILESDIR}"/${P}-py3-server-port.patch
-	"${FILESDIR}"/${P}-unbundle-six.patch
-	"${FILESDIR}"/${P}-py310.patch
-)
-
-RDEPEND=">=dev-python/six-1.12.0[${PYTHON_USEDEP}]"
-
-BDEPEND="
-	test? (
-		dev-python/httpretty[${PYTHON_USEDEP}]
-		dev-python/keyring[${PYTHON_USEDEP}]
-		dev-python/lxml[${PYTHON_USEDEP}]
-		dev-python/mock[${PYTHON_USEDEP}]
-		dev-python/paramiko[${PYTHON_USEDEP}]
-		dev-python/requests[${PYTHON_USEDEP}]
-		dev-python/rsa[${PYTHON_USEDEP}]
-		dev-python/selenium[${PYTHON_USEDEP}]
-	)"
-
-distutils_enable_tests nose
-
-src_prepare() {
-	# remove bundled libs.
-	rm -f "${S}"/boto/vendored/six.py || die
-	# broken, not worth fixing
-	rm tests/unit/cloudfront/test_signed_urls.py || die
-	# fix tests
-	mkdir -p "${HOME}"/.ssh || die
-	: > "${HOME}"/.ssh/known_hosts || die
-	# Flatcar: Do not import boto only for the version number in
-	# setup.py - it ends up trying to import six, which we have
-	# unbundled and the six module effectively becomes a BDEPEND
-	# instead of RDEPEND. Drop the import and define the
-	# __variable__ instead.
-	sed -i -e 's/^from boto import __version__$/__version__ = '"'${PV}'"'/' setup.py
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	nosetests -v tests/unit ||
-		die "Tests fail with ${EPYTHON}"
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch
deleted file mode 100644
index 209b01aa74..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-httplib-strict.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-https://github.com/boto/boto/commit/4f4dcb31fe852c05ce19b44eb9d5b5d747e36f7c
-https://github.com/boto/boto/pull/2718
-
-From 4f4dcb31fe852c05ce19b44eb9d5b5d747e36f7c Mon Sep 17 00:00:00 2001
-From: Lee Ball <43632885+catleeball@users.noreply.github.com>
-Date: Mon, 10 Jun 2019 16:02:53 -0700
-Subject: [PATCH] Remove `strict=True` from http_client (#6)
-
-In Python 3.4, the `strict` kwarg was removed[1]. We are removing it
-here too.
-
-Alternatively, we can leave in `strict=True` for 2.x, but I chose to
-remove it entirely to maintain consistent behavior across versions.
-
-[1]: https://docs.python.org/3/library/http.client.html
----
- boto/connection.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index c731173bb4eb..54e26fb2de16 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -807,7 +807,7 @@ class AWSAuthConnection(object):
-                 sock.sendall(six.ensure_binary("\r\n"))
-         else:
-             sock.sendall(six.ensure_binary("\r\n"))
--        resp = http_client.HTTPResponse(sock, strict=True, debuglevel=self.debug)
-+        resp = http_client.HTTPResponse(sock, debuglevel=self.debug)
-         resp.begin()
- 
-         if resp.status != 200:
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch
deleted file mode 100644
index 62e3319219..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-server-port.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-https://github.com/boto/boto/commit/b9f6cb0ab717ea76e2780c7fddd1cd36b3bf7d63
-
-From b9f6cb0ab717ea76e2780c7fddd1cd36b3bf7d63 Mon Sep 17 00:00:00 2001
-From: Matt Houglum <houglum@google.com>
-Date: Fri, 21 Jun 2019 15:09:11 -0700
-Subject: [PATCH] Make server_name() behave correctly for PY3
-
-...because Python-2.6-or-newer doesn't just include Python 2.6 and 2.7.
----
- boto/connection.py | 14 +++++---------
- 1 file changed, 5 insertions(+), 9 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index 54e26fb2de16..bbb25d8fb842 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -650,17 +650,13 @@ class AWSAuthConnection(object):
-         if port == 80:
-             signature_host = self.host
-         else:
--            # This unfortunate little hack can be attributed to
--            # a difference in the 2.6 version of http_client.  In old
--            # versions, it would append ":443" to the hostname sent
--            # in the Host header and so we needed to make sure we
--            # did the same when calculating the V2 signature.  In 2.6
--            # (and higher!)
--            # it no longer does that.  Hence, this kludge.
--            if ((ON_APP_ENGINE and sys.version[:3] == '2.5') or
--                    sys.version[:3] in ('2.6', '2.7')) and port == 443:
-+            ver_int = sys.version_info[0] * 10 + sys.version_info[1]
-+            if port == 443 and ver_int >= 26:  # Py >= 2.6
-                 signature_host = self.host
-             else:
-+                # In versions < 2.6, Python's http_client would append ":443"
-+                # to the hostname sent in the Host header and so we needed to
-+                # make sure we did the same when calculating the V2 signature.
-                 signature_host = '%s:%d' % (self.host, port)
-         return signature_host
- 
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch
deleted file mode 100644
index 1d109a3f49..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py3-socket-binary.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-https://github.com/boto/boto/commit/d2cb697b32c297858ecc36701a5a4176818ab36d
-https://github.com/boto/boto/pull/2718
-https://github.com/boto/boto/pull/2893
-https://github.com/boto/boto/pull/3699
-
-From d2cb697b32c297858ecc36701a5a4176818ab36d Mon Sep 17 00:00:00 2001
-From: Cat Lee Ball <cball@google.com>
-Date: Mon, 10 Jun 2019 13:31:11 -0700
-Subject: [PATCH] Ensure binary strings sent to socket
-
-When running pre-release tests with proxied connections, it appeared a
-few spots in connection.py would fail under Python 3 since the
-socket.sendall method expects binary strings rather than unicode.
----
- boto/connection.py | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index a0d89a51f49c..d084d1f881fb 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -796,17 +796,17 @@ class AWSAuthConnection(object):
-         else:
-             sock = socket.create_connection((self.proxy, int(self.proxy_port)))
-         boto.log.debug("Proxy connection: CONNECT %s HTTP/1.0\r\n", host)
--        sock.sendall("CONNECT %s HTTP/1.0\r\n" % host)
--        sock.sendall("User-Agent: %s\r\n" % UserAgent)
-+        sock.sendall(six.ensure_binary("CONNECT %s HTTP/1.0\r\n" % host))
-+        sock.sendall(six.ensure_binary("User-Agent: %s\r\n" % UserAgent))
-         if self.proxy_user and self.proxy_pass:
-             for k, v in self.get_proxy_auth_header().items():
--                sock.sendall("%s: %s\r\n" % (k, v))
-+                sock.sendall(six.ensure_binary("%s: %s\r\n" % (k, v)))
-             # See discussion about this config option at
-             # https://groups.google.com/forum/?fromgroups#!topic/boto-dev/teenFvOq2Cc
-             if config.getbool('Boto', 'send_crlf_after_proxy_auth_headers', False):
--                sock.sendall("\r\n")
-+                sock.sendall(six.ensure_binary("\r\n"))
-         else:
--            sock.sendall("\r\n")
-+            sock.sendall(six.ensure_binary("\r\n"))
-         resp = http_client.HTTPResponse(sock, strict=True, debuglevel=self.debug)
-         resp.begin()
- 
-@@ -814,9 +814,10 @@ class AWSAuthConnection(object):
-             # Fake a socket error, use a code that make it obvious it hasn't
-             # been generated by the socket library
-             raise socket.error(-71,
-+                               six.ensure_binary(
-                                "Error talking to HTTP proxy %s:%s: %s (%s)" %
-                                (self.proxy, self.proxy_port,
--                                resp.status, resp.reason))
-+                                resp.status, resp.reason)))
- 
-         # We can safely close the response, it duped the original socket
-         resp.close()
--- 
-2.28.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
deleted file mode 100644
index 7b427f1f15..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/boto/dynamodb/types.py b/boto/dynamodb/types.py
-index d9aaaa4c..3f8d8601 100644
---- a/boto/dynamodb/types.py
-+++ b/boto/dynamodb/types.py
-@@ -27,7 +27,7 @@ Python types and vice-versa.
- import base64
- from decimal import (Decimal, DecimalException, Context,
-                      Clamped, Overflow, Inexact, Underflow, Rounded)
--from collections import Mapping
-+from collections.abc import Mapping
- from boto.dynamodb.exceptions import DynamoDBNumberError
- from boto.compat import filter, map, six, long_type
- 
-diff --git a/boto/mws/connection.py b/boto/mws/connection.py
-index 687fae74..3a1f5f80 100644
---- a/boto/mws/connection.py
-+++ b/boto/mws/connection.py
-@@ -21,7 +21,7 @@
- import xml.sax
- import hashlib
- import string
--import collections
-+import collections.abc
- from boto.connection import AWSQueryConnection
- from boto.exception import BotoServerError
- import boto.mws.exception
-@@ -109,7 +109,7 @@ def http_body(field):
- def destructure_object(value, into, prefix, members=False):
-     if isinstance(value, boto.mws.response.ResponseElement):
-         destructure_object(value.__dict__, into, prefix, members=members)
--    elif isinstance(value, collections.Mapping):
-+    elif isinstance(value, collections.abc.Mapping):
-         for name in value:
-             if name.startswith('_'):
-                 continue
-@@ -117,7 +117,7 @@ def destructure_object(value, into, prefix, members=False):
-                                members=members)
-     elif isinstance(value, six.string_types):
-         into[prefix] = value
--    elif isinstance(value, collections.Iterable):
-+    elif isinstance(value, collections.abc.Iterable):
-         for index, element in enumerate(value):
-             suffix = (members and '.member.' or '.') + str(index + 1)
-             destructure_object(element, into, prefix + suffix,
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch
deleted file mode 100644
index 0052c6e32e..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py38.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-diff --git a/boto/ecs/item.py b/boto/ecs/item.py
-index 79177a31..292b05af 100644
---- a/boto/ecs/item.py
-+++ b/boto/ecs/item.py
-@@ -21,7 +21,7 @@
- 
- 
- import xml.sax
--import cgi
-+import html
- from boto.compat import six, StringIO
- 
- class ResponseGroup(xml.sax.ContentHandler):
-@@ -67,7 +67,7 @@ class ResponseGroup(xml.sax.ContentHandler):
-         return None
- 
-     def endElement(self, name, value, connection):
--        self._xml.write("%s</%s>" % (cgi.escape(value).replace("&amp;amp;", "&amp;"), name))
-+        self._xml.write("%s</%s>" % (html.escape(value).replace("&amp;amp;", "&amp;"), name))
-         if len(self._nodepath) == 0:
-             return
-         obj = None
-diff --git a/tests/unit/utils/test_utils.py b/tests/unit/utils/test_utils.py
-index db15b56d..89d1a524 100644
---- a/tests/unit/utils/test_utils.py
-+++ b/tests/unit/utils/test_utils.py
-@@ -85,7 +85,7 @@ class TestPassword(unittest.TestCase):
-         def hmac_hashfunc(cls, msg):
-             if not isinstance(msg, bytes):
-                 msg = msg.encode('utf-8')
--            return hmac.new(b'mysecretkey', msg)
-+            return hmac.new(b'mysecretkey', msg, digestmod='MD5')
- 
-         class HMACPassword(Password):
-             hashfunc = hmac_hashfunc
-@@ -95,15 +95,15 @@ class TestPassword(unittest.TestCase):
-         password.set('foo')
- 
-         self.assertEquals(str(password),
--                          hmac.new(b'mysecretkey', b'foo').hexdigest())
-+                          hmac.new(b'mysecretkey', b'foo', digestmod='MD5').hexdigest())
- 
-     def test_constructor(self):
--        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg)
-+        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg, digestmod='MD5')
- 
-         password = Password(hashfunc=hmac_hashfunc)
-         password.set('foo')
-         self.assertEquals(password.str,
--                          hmac.new(b'mysecretkey', b'foo').hexdigest())
-+                          hmac.new(b'mysecretkey', b'foo', digestmod='MD5').hexdigest())
- 
- 
- class TestPythonizeName(unittest.TestCase):
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch
deleted file mode 100644
index 11d346a219..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-try-to-add-SNI-support-v3.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From f5e7f6c98b46ff622f60a4661ffc9ce07216d109 Mon Sep 17 00:00:00 2001
-From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
-Date: Sat, 29 Sep 2018 21:47:11 +0200
-Subject: [PATCH] boto: try to add SNI support
-
-Add SNI support. Newer OpenSSL (with TLS1.3) fail to connect if the
-hostname is missing.
-
-Link: https://bugs.debian.org/bug=909545
-Tested-by: Witold Baryluk <witold.baryluk@gmail.com>
-Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
----
- boto/connection.py       | 19 ++++++++++---------
- boto/https_connection.py | 22 +++++++++++-----------
- 2 files changed, 21 insertions(+), 20 deletions(-)
-
-diff --git a/boto/connection.py b/boto/connection.py
-index 34b428f101df7..b4867a7657465 100644
---- a/boto/connection.py
-+++ b/boto/connection.py
-@@ -778,8 +778,10 @@
- 
-     def proxy_ssl(self, host=None, port=None):
-         if host and port:
-+            cert_host = host
-             host = '%s:%d' % (host, port)
-         else:
-+            cert_host = self.host
-             host = '%s:%d' % (self.host, self.port)
-         # Seems properly to use timeout for connect too
-         timeout = self.http_connection_kwargs.get("timeout")
-@@ -824,23 +824,24 @@ DEFAULT_CA_CERTS_FILE = os.path.join(os.path.dirname(os.path.abspath(boto.cacert
-         h = http_client.HTTPConnection(host)
- 
-         if self.https_validate_certificates and HAVE_HTTPS_CONNECTION:
-+            context = ssl.create_default_context()
-+            context.verify_mode = ssl.CERT_REQUIRED
-+            context.check_hostname = True
-+
-             msg = "wrapping ssl socket for proxied connection; "
-             if self.ca_certificates_file:
-                 msg += "CA certificate file=%s" % self.ca_certificates_file
-+                context.load_verify_locations(cafile=self.ca_certificates_file)
-             else:
-                 msg += "using system provided SSL certs"
-+                context.load_default_certs()
-             boto.log.debug(msg)
-             key_file = self.http_connection_kwargs.get('key_file', None)
-             cert_file = self.http_connection_kwargs.get('cert_file', None)
--            sslSock = ssl.wrap_socket(sock, keyfile=key_file,
--                                      certfile=cert_file,
--                                      cert_reqs=ssl.CERT_REQUIRED,
--                                      ca_certs=self.ca_certificates_file)
--            cert = sslSock.getpeercert()
--            hostname = self.host.split(':', 0)[0]
--            if not https_connection.ValidateCertificateHostname(cert, hostname):
--                raise https_connection.InvalidCertificateException(
--                    hostname, cert, 'hostname mismatch')
-+            if key_file:
-+                context.load_cert_chain(certfile=cert_file, keyfile=key_file)
-+
-+            sslSock = context.wrap_socket(sock, server_hostname=cert_host)
-         else:
-             # Fallback for old Python without ssl.wrap_socket
-             if hasattr(http_client, 'ssl'):
-diff --git a/boto/https_connection.py b/boto/https_connection.py
-index ddc31a152292e..a5076f6f9b261 100644
---- a/boto/https_connection.py
-+++ b/boto/https_connection.py
-@@ -119,20 +119,20 @@ from boto.compat import six, http_client
-             sock = socket.create_connection((self.host, self.port), self.timeout)
-         else:
-             sock = socket.create_connection((self.host, self.port))
-+
-+        context = ssl.create_default_context()
-+        context.verify_mode = ssl.CERT_REQUIRED
-+        context.check_hostname = True
-+        if self.key_file:
-+            context.load_cert_chain(certfile=self.cert_file, keyfile=self.key_file)
-+
-         msg = "wrapping ssl socket; "
-         if self.ca_certs:
-             msg += "CA certificate file=%s" % self.ca_certs
-+            context.load_verify_locations(cafile=self.ca_certs)
-         else:
-             msg += "using system provided SSL certs"
-+            context.load_default_certs()
-         boto.log.debug(msg)
--        self.sock = ssl.wrap_socket(sock, keyfile=self.key_file,
--                                    certfile=self.cert_file,
--                                    cert_reqs=ssl.CERT_REQUIRED,
--                                    ca_certs=self.ca_certs)
--        cert = self.sock.getpeercert()
--        hostname = self.host.split(':', 0)[0]
--        if not ValidateCertificateHostname(cert, hostname):
--            raise InvalidCertificateException(hostname,
--                                              cert,
--                                              'remote hostname "%s" does not match '
--                                              'certificate' % hostname)
-+
-+        self.sock = context.wrap_socket(sock, server_hostname=self.host)
--- 
-2.19.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch
deleted file mode 100644
index 188dae7eb6..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-unbundle-six.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-use the system copy of six
-
---- a/boto/compat.py
-+++ b/boto/compat.py
-@@ -46,16 +46,16 @@ except (AttributeError, ImportError):
-     # This is probably running on App Engine.
-     expanduser = (lambda x: x)
- 
--from boto.vendored import six
-+import six
- 
--from boto.vendored.six import BytesIO, StringIO
--from boto.vendored.six.moves import filter, http_client, map, _thread, \
-+from six import BytesIO, StringIO
-+from six.moves import filter, http_client, map, _thread, \
-                                     urllib, zip
--from boto.vendored.six.moves.queue import Queue
--from boto.vendored.six.moves.urllib.parse import parse_qs, quote, unquote, \
-+from six.moves.queue import Queue
-+from six.moves.urllib.parse import parse_qs, quote, unquote, \
-                                                  urlparse, urlsplit
--from boto.vendored.six.moves.urllib.parse import unquote_plus
--from boto.vendored.six.moves.urllib.request import urlopen
-+from six.moves.urllib.parse import unquote_plus
-+from six.moves.urllib.request import urlopen
- 
- if six.PY3:
-     # StandardError was removed, so use the base exception type instead
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml
deleted file mode 100644
index 3ab9e0b0a8..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/metadata.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-  <maintainer type="project">
-    <email>python@gentoo.org</email>
-    <name>Python</name>
-  </maintainer>
-  <stabilize-allarches/>
-  <upstream>
-    <remote-id type="google-code">boto</remote-id>
-    <remote-id type="pypi">boto</remote-id>
-    <remote-id type="github">boto/boto</remote-id>
-  </upstream>
-</pkgmetadata>

From 48e842f66ba7ca4937e85e701421d42dd821c36a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 24 Jan 2023 12:26:37 +0100
Subject: [PATCH 03/16] profiles: Switch to python 3.10

---
 .../profiles/coreos/base/make.defaults               |  8 ++++----
 .../coreos-overlay/profiles/coreos/base/package.mask |  4 ++--
 .../coreos-overlay/profiles/coreos/base/use.mask     | 12 +++++-------
 3 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index f390955959..b73c719c5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -14,12 +14,12 @@ USE_EXPAND="${USE_EXPAND} GO_VERSION"
 USE="${USE} cros_host expat -cracklib -introspection -cups -tcpd -berkdb"
 
 # Use Python 3 as the default version
-USE="${USE} -python_single_target_python2_7 python_single_target_python3_9"
-USE="${USE} -python_targets_python2_7 python_targets_python3_9"
+USE="${USE} -python_single_target_python2_7 python_single_target_python3_10"
+USE="${USE} -python_targets_python2_7 python_targets_python3_10"
 
 # Use Python 3 as the default version
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_9"
-BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_9"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_single_target_python2_7 python_single_target_python3_10"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} -python_targets_python2_7 python_targets_python3_10"
 
 # Never install cron or cron jobs
 USE="${USE} -cron"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index 68d088c019..1b1e176a90 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -18,9 +18,9 @@
 # version 10 or later.
 >=virtual/libcrypt-2
 
-# Python 3.10 is stable in portage-stable, so avoid picking it
+# Python 3.11 is stable in portage-stable, so avoid picking it
 # up. Drop this when we switch to it.
->=dev-lang/python-3.10
+>=dev-lang/python-3.11
 
 # sys-devel/gcc-11.3.1_p20221209 is the latest gcc version that is
 # stable on both amd64 and arm64. There are newer versions of gcc
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 6e03cd1800..56ea60f1a8 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -1,17 +1,15 @@
 # Never enable experimental code
 kdbus
 
-# We default to python 3.9 for now
+# We default to python 3.10 for now
 python_targets_python2_7
 python_single_target_python2_7
-python_targets_python3_6
-python_single_target_python3_6
-python_targets_python3_7
-python_single_target_python3_7
 python_targets_python3_8
 python_single_target_python3_8
-python_targets_python3_10
-python_single_target_python3_10
+python_targets_python3_9
+python_single_target_python3_9
+python_targets_python3_11
+python_single_target_python3_11
 
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux

From b2cc62502ceedafee1f6596bcc63d281164d1b2b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 24 Jan 2023 14:12:05 +0100
Subject: [PATCH 04/16] dev-lang/python-oem: Update to 3.10.9

So we have a matching versions of python in OEM and SDK.
---
 .../dev-lang/python-oem/Manifest              |   6 +-
 .../dev-lang/python-oem/README.md             |  84 ---
 .../python-oem/python-oem-3.10.9-r1.ebuild    | 486 ++++++++++++++++++
 .../python-oem/python-oem-3.9.16.ebuild       | 271 ----------
 4 files changed, 489 insertions(+), 358 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
 create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
index 9baca72593..5cebbd8384 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
@@ -1,3 +1,3 @@
-DIST Python-3.9.16.tar.xz 19738796 BLAKE2B 70dedeb70d9d8f27e4f6db5106623e087c61d451c7a04639cf8d3503ad02d4d43f1b36d0cdf1131aefc9bf6e677e561227dd4baef2c2c3d2dbf6d3e7dc36bd94 SHA512 b5fd0afe131c82bbce6ddf887c59eef6945910d6a9a2bc87c0927f4e4a096bf9ca4d25bcb729c40f6ebb8a65fbe8bf7b0b97a7c4a8c9e551240eb4f34b878653
-DIST Python-3.9.16.tar.xz.asc 833 BLAKE2B 416b4a4be06e101c5971c12a6f21229c425bcabaea58487e0d1b24d6dea318c58806ee43892fc704df8252670451bd6a4a2610c25672d3983ddb081fed34b92d SHA512 468959c36a3ec6136f57a39475fff4745a25be0cb5d3d58cf3e5faf0b9ce2d2a8b89f1f9fea1479c4c6ad12ac49e97c1cfd4291c978bb3d30df5a582ec315210
-DIST python-gentoo-patches-3.9.16.tar.xz 23348 BLAKE2B 26b66e57530d167776d2aee60fd4620fc8e6c229f371616fdaa74aa2f03fd5a50b61653a5f34e0f2659901ba167af7c2aadbb0d2db773ab08bac8b3125c84b77 SHA512 8260369d96a6328ad8498359ecc56f48cb02015547065cdaec28a6bb2293bef420cb12764fae9fdd13f4a6faa60c4c402e804a22cbed7dca031ac1679032f9f6
+DIST Python-3.10.9.tar.xz 19612112 BLAKE2B ef2d063a9fbaf234aa4a47149cb184a0379dc403515df10249104a5092750cdaf22ad47916d34e17dd68fff1c30338c0375f4e4e3cc9bde33e0896c1c3ba655b SHA512 d66ea8adeb6dc4951e612175f8838b3092967ff275b7a3470f2d86f470036aa2221e722c3144d90bcd230b88efd53dde204213f72f703e524e4b833e2ccc68e2
+DIST Python-3.10.9.tar.xz.asc 833 BLAKE2B 8895c6cb5031b2463cc6ba3e0dc56bee40c2e99117c062f9c72f2b7adb0d5a49782b968abfc764117e8513bd12816915245677c25b1710e3dae3c9e26937c2b9 SHA512 525e166ede6836086de814c26fc880f41eaf1ed4bff6118f00342e42f7ab1c47148447ced1b565e146d3125fa06b5cd6b394a256bc61096766b26e07f18bbf10
+DIST python-gentoo-patches-3.10.9.tar.xz 12216 BLAKE2B ced4f951089c51ddaab6c62ade9d2c84f69e7e1baf2acf5247559534c7d0fb0e88dca1222f5bd2209b4e61f5aca17279b8054f269535dbc10de0786c2c5779f5 SHA512 2d01f0f3831beeba004517bb82f7d616f25f08e5c755409ecff79cd68e0a619b5bf6802fffd0e5f7f39f1d9d93e65b018b91cdeb337a5e47f1651f36bea0e96e
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
deleted file mode 100644
index 8b27d3d896..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
+++ /dev/null
@@ -1,84 +0,0 @@
-Modifications made:
-
-- Drop `pgo` and `lto` USE flags, so flags passed to configure are
-  `--without-lto` and `--disable-optimizations`. Also drop `pgo` code
-  in `src_configure` and `src_compile`.
-
-- We are not running any tests, so drop the `test` use flag and
-  `src_test` function. Drop also `pkg_pretend` and `pkg_setup`
-  functions as they were only doing some stuff if `test` use flag was
-  enabled.
-
-- Fix a path to a patchset that was using a `${PN}` variable, but
-  expected it to be `python` while our package is actually
-  `python-oem`.
-
-- Drop the following use flags and simplify the ebuild assuming that
-  they were disabled: `bluetooth examples gdbm ncurses readline sqlite
-  ssl tk wininst`.
-
-- Drop the following use flags and simplify the ebuild assuming that
-  they were enabled: `build`.
-
-- Drop `xml` use flag. Drop the dependency on expat, but instead keep
-  the internal copy of expat, so we keep `_elementtree` and `pyexpat`
-  modules enabled. Finally tell the configure script to use the
-  internal stuff (by passing the `--without-system-expat` flag).
-
-- Drop the dependency on libffi, instead keep using internal libffi
-  and tell the configure script to use internal stuff (by passing the
-  `--without-system-ffi` flag).
-
-- Rename `RDEPEND` to `DEPEND`, so `RDEPEND` remains empty. OEM
-  packages are installed after production images are pruned of the
-  previously installed package database.
-
-- Make the following changes in configure flags:
-
-  - Add `--prefix=/usr/share/oem/python` to the `myeconfargs` variable.
-
-  - To make sure that python library ends up where we want (for
-    example, in `lib64` instead of `lib`, because in this prefix, we
-    have no symlinks from `lib` to `lib64`), add
-    `--with-platlibdir=$(get_libdir)` to the `myeconfargs` variable.
-
-  - Change `--enable-shared` to `--disable-shared`.
-
-  - Set `--mandir`, `--infodir` and `--includedir` to some subdirectory of
-    `/discard`, so during installation this could be easily removed.
-
-  - Drop `--enable-loadable-sqlite-extensions` flag.
-
-- Export some configure variables for the cross-compilation:
-  `ac_cv_file__dev_ptc` and `ac_cv_file__dev_ptmx`. If not done, build
-  will fail with a message saying that these should be set to either
-  yes or no.
-
-- Drop pax stuff (search for `pax-utils` and `pax-mark`) - it's noop
-  on Flatcar.
-
-- Simplify `src_install`:
-
-  - Replace the hardcoded `${ED}/usr` with `${ED}/usr/share/oem/python`.
-
-  - Drop sed stuff mucking with `LDFLAGS`.
-
-  - Drop collision fixes.
-
-  - Drop `ABIFLAGS` hack.
-
-  - Do not install ACKS, HISTORY and NEWS files.
-
-  - Drop gdb autoload stuff.
-
-  - Drop `pydoc.{conf,init}` stuff.
-
-  - Drop `epython.py` stuff.
-
-  - Drop python-exec stuff.
-
-    - Just everything below that involves `${scriptdir}`.
-
-  - Create versionless links (python and python3) to python executable.
-
-  - Remove installed stuff in `/discard`.
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
new file mode 100644
index 0000000000..9981c0df61
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
@@ -0,0 +1,486 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build +ensurepip examples gdbm hardened libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind +xml
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	dev-lang/python-exec[python_targets_python3_10(-)]
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	sys-apps/util-linux:=
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+	xml? ( >=dev-libs/expat-2.1:= )
+	!!<sys-apps/sandbox-2.21
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-util/valgrind )
+	test? ( app-arch/xz-utils[extra-filters(+)] )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	use xml       || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if ! use xml; then
+		ewarn "You have configured Python without XML support."
+		ewarn "This is NOT a recommended configuration as you"
+		ewarn "may face problems parsing any XML documents."
+	fi
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-x test_gdb
+			-u-network
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-system-ffi
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
+		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
+		local -x CFLAGS= LDFLAGS=
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild
deleted file mode 100644
index 8135fb61e4..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.16.ebuild
+++ /dev/null
@@ -1,271 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="hardened"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-DEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	dev-lang/python-exec[python_targets_python3_9(-)]
-	sys-apps/util-linux:=
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	sys-devel/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	export ac_cv_header_bluetooth_bluetooth_h=no
-	disable+=" gdbm"
-	disable+=" _curses _curses_panel"
-	disable+=" readline"
-	disable+=" _sqlite3"
-	export PYTHON_DISABLE_SSL="1"
-	disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# https://bugs.gentoo.org/700012
-	if is-flagq -flto || is-flagq '-flto=*'; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-	fi
-
-	if tc-is-cross-compiler; then
-		# Force some tests that try to poke fs paths.
-		export ac_cv_file__dev_ptc=no
-		export ac_cv_file__dev_ptmx=yes
-	fi
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--prefix=/usr/share/oem/python
-		--with-platlibdir=$(get_libdir)
-		--disable-shared
-		--enable-ipv6
-		--infodir='/discard/info'
-		--mandir='/discard/man'
-		--includedir='/discard/include'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-system-expat
-		--without-system-ffi
-		--without-lto
-		--disable-optimizations
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
-		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
-		local -x CFLAGS= LDFLAGS=
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-}
-
-src_install() {
-	local prefix=/usr/share/oem/python
-	local eprefix="${ED}${prefix}"
-	local elibdir="${eprefix}/$(get_libdir)"
-	local epythonplatlibdir="${elibdir}/python${PYVER}"
-	local bindir="${prefix}/bin"
-	local ebindir="${eprefix}/bin"
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${elibdir}"/libpython*.a || die
-
-	rm -r "${epythonplatlibdir}/"{sqlite3,test/test_sqlite*} || die
-	rm -r "${ebindir}/idle${PYVER}" "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
-
-	# create a simple versionless 'python' symlink
-	dosym "python${PYVER}" "${bindir}/python"
-	dosym "python${PYVER}" "${bindir}/python3"
-
-	rm -r "${ED}/discard" || die
-}

From c34577a86af1cb209138393ddebab5ad0e432d8f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 2 Feb 2023 17:00:45 +0100
Subject: [PATCH 05/16] coreos: Add some overrides for python-oem

This is a thing that needs to be done just this once. The necessary
modifications to the python-oem ebuild will be done in follow-up
commit, that can be later cherry-picked if we update the package
again.
---
 .../coreos-overlay/coreos/config/env/dev-lang/python-oem | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem
new file mode 100644
index 0000000000..8b527f5a5d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-lang/python-oem
@@ -0,0 +1,9 @@
+# Work around configure test that cannot be cross compiled :(
+#
+# When checking if this is still applicable, try grepping the
+# configure script for lines with "$cross_compiling", like
+#
+# grep -B 20 -F 'when cross compiling' configure
+
+export ac_cv_file__dev_ptc=no
+export ac_cv_file__dev_ptmx=yes

From 8e045df98d67c7f387103f5a38cba566f2ef93cd Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 2 Feb 2023 17:01:13 +0100
Subject: [PATCH 06/16] profiles: Set use flags for dev-lang/python-oem

This is a thing that needs to be done just this once. The necessary
modifications to the python-oem ebuild will be done in follow-up
commit, that can be later cherry-picked if we update the package
again.
---
 .../coreos-overlay/profiles/coreos/base/package.use.mask      | 1 +
 .../profiles/coreos/targets/generic/package.use               | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index 6d9a8d9d1c..66c01ec9ac 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -26,3 +26,4 @@ sys-libs/glibc -crypt
 
 # We don't use pip.
 dev-lang/python ensurepip
+dev-lang/python-oem ensurepip
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 1154ac8dc0..e710d28c4d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -7,6 +7,10 @@ app-editors/vim		minimal -crypt
 # minimal: Don't pull app-vim/gentoo-syntax
 app-editors/vim-core	minimal
 dev-lang/python		gdbm
+
+# Disable everything for python-oem except of build and xml
+dev-lang/python-oem -bluetooth build -ensurepip -examples -gdbm -hardened -libedit -lto -ncurses -pgo -readline -sqlite -ssl -test -tk -valgrind xml
+
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11

From f7935aa5e146390ea6ed2c925c0f2be9cfc95e7f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 2 Feb 2023 17:01:38 +0100
Subject: [PATCH 07/16] dev-lang/python-oem: Apply Flatcar modifications

I changed the way we modify the ebuild by keeping the modifications as
minimal as possible, leaving disabling whatever that can be disabled
to the USE flags.
---
 .../dev-lang/python-oem/README.md             |  45 +++++
 .../python-oem/python-oem-3.10.9-r1.ebuild    | 159 ++++++++----------
 2 files changed, 111 insertions(+), 93 deletions(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
new file mode 100644
index 0000000000..12b071faeb
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
@@ -0,0 +1,45 @@
+Modifications made:
+
+- Keep using internal expat and libffi, thus dropping dev-libs/libffi
+  and dev-libs/expat from the dependencies.
+
+- Drop dev-python/gentoo-common dependency, it provides the
+  EXTERNALLY-MANAGED file, but we will provide our own.
+
+- Since this package is installed only for OEM partition as a binary
+  package, and the installation there happens after the packages
+  database is removed, we unset the RDEPEND variable. The RDEPEND
+  variable needs to be empty as it's also used during the binary
+  package installation. The contents of RDEPEND are already inside the
+  DEPEND variable, so we are safe.
+
+- We modify the configure flags:
+
+  - Add `--prefix=/usr/share/oem/python` as `/usr/share/oem` is where
+    the OEM partition is mounted.
+
+  - Add `--with-platlibdir="$(get_libdir)"`, this is to make sure that
+    consistent library directory gets picked. In our case for both
+    amd64 and arm64, it's lib64.
+
+  - Change `--enable-shared` to `--disable-shared`. This will skip
+    building dynamic libraries, as we don't need them.
+
+  - Add `--includedir=/discard/include` and change `--mandir` and
+    `--infodir` to also use `/discard` to install files there. Makes
+    it easy to remove the unnecessary files.
+
+  - We disable loadable sqlite extensions.
+
+  - As we want to use the internal versions of expat and libffi, we
+    change `--with-system-{expat,ffi}` to
+    `--without-system-{expat,ffi}`.
+
+  - Comment out the `--with-wheel-pkg-dir` as it's some ensurepip
+    stuff we are disabling anyway.
+
+- Essentially drop `src_install` and write our own variant, where we
+  run `make altinstall`, remove unnecessary files (the original
+  `src_install` could be read to find out which files to remove),
+  creates a versionless python symlink, adds an EXTERNALLY-MANAGED
+  file, and removes the `/discard` directory.
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
index 9981c0df61..25cd1da064 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.10.9-r1.ebuild
@@ -40,11 +40,13 @@ RESTRICT="!test? ( test )"
 # run the bootstrap code on your dev box and include the results in the
 # patchset. See bug 447752.
 
+# Flatcar: Drop a dependency on dev-libs/expat, we will use the internal one.
+# Flatcar: Drop a dependency on dev-libs/libffi, we will use the internal one.
+# Flatcar: Drop a dependency on dev-python/gentoo-common, we will install our own EXTERNALLY-MANAGED file
 RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	dev-lang/python-exec[python_targets_python3_10(-)]
-	dev-libs/libffi:=
 	dev-python/gentoo-common
 	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
@@ -65,7 +67,6 @@ RDEPEND="
 		dev-tcltk/blt:=
 		dev-tcltk/tix
 	)
-	xml? ( >=dev-libs/expat-2.1:= )
 	!!<sys-apps/sandbox-2.21
 "
 # bluetooth requires headers from bluez
@@ -86,6 +87,11 @@ RDEPEND+="
 	!build? ( app-misc/mime-types )
 "
 
+# Flatcar: Unset RDEPEND, DEPEND already contains it. OEM packages are
+# installed after production images are pruned of the previously
+# installed package database.
+unset RDEPEND
+
 VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
@@ -109,9 +115,11 @@ src_unpack() {
 }
 
 src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
+	# Flatcar: We keep the internal expat copy.
+	# Flatcar: We keep the internal libffi copy.
+	# # Ensure that internal copies of expat and libffi are not used.
+	# rm -r Modules/expat || die
+	# rm -r Modules/_ctypes/libffi* || die
 
 	local PATCHES=(
 		"${WORKDIR}/${PATCHSET}"
@@ -207,19 +215,37 @@ src_configure() {
 		# a chance for users rebuilding python before glibc
 		ac_cv_header_stropts_h=no
 
-		--enable-shared
+		# Flatcar: Use oem-specific prefix.
+		--prefix=/usr/share/oem/python
+		# Flatcar: Make sure we put libs into a correct subdirectory.
+		--with-platlibdir="$(get_libdir)"
+		# Flatcar: No need for shared libs.
+		# --enable-shared
+		--disable-shared
 		--without-static-libpython
 		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
+		# Flatcar: Set includedir to discardable directory
+		--includedir='/discard/include'
+		# Flatcar: Set infodir and mandir to discardable directory
+		# --infodir='/${prefix}/share/info'
+		# --mandir='/${prefix}/share/man'
+		--infodir='/discard/info'
+		--mandir='/discard/man'
 		--with-computed-gotos
 		--with-dbmliborder="${dbmliborder}"
 		--with-libc=
-		--enable-loadable-sqlite-extensions
+		# Flatcar: No need for loadable extensions.
+		# --enable-loadable-sqlite-extensions
+		--disable-loadable-sqlite-extensions
 		--without-ensurepip
-		--with-system-expat
-		--with-system-ffi
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		# Flatcar: We use internal expat
+		# --with-system-expat
+		--without-system-expat
+		# Flatcar: We use internal ffi
+		# --with-system-ffi
+		--without-system-ffi
+		# Flatcar: It's for ensurepip, which we disable
+		# --with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
 
 		$(use_with lto)
 		$(use_enable pgo optimizations)
@@ -395,92 +421,39 @@ src_test() {
 	[[ ${ret} -eq 0 ]] || die "emake test failed"
 }
 
+# Flatcar: Rewrite src_install to just run make altinstall, remove
+# some installed files (refer to the original src_install to see which
+# files to drop), adding symlinks and the EXTERNALLY-MANAGED file, and
+# removing the /discard directory.
 src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
+	local prefix=/usr/share/oem/python
+	local eprefix="${ED}${prefix}"
+        local libdir="${prefix}/$(get_libdir)"
+	local elibdir="${eprefix}/$(get_libdir)"
+	local pythonplatlibdir="${libdir}/python${PYVER}"
+	local epythonplatlibdir="${elibdir}/python${PYVER}"
+	local bindir="${prefix}/bin"
+	local ebindir="${eprefix}/bin"
 
 	emake DESTDIR="${D}" altinstall
 
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	rm -r "${epythonplatlibdir}"/ensurepip || die
+	rm -r "${epythonplatlibdir}/"{sqlite3,test/test_sqlite*} || die
+	rm -r "${ebindir}/idle${PYVER}" || die
+	rm -r "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
 
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
+	# create a simple versionless 'python' symlink
+	dosym "python${PYVER}" "${bindir}/python"
+	dosym "python${PYVER}" "${bindir}/python3"
 
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
+	insinto "${pythonplatlibdir}"
+	# https://peps.python.org/pep-0668/
+	newins - EXTERNALLY-MANAGED <<-EOF
+		[externally-managed]
+		Error=
+		 Please contact Flatcar maintainers if some python package
+		 is necessary for this OEM image.
 	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
+
+	rm -r "${ED}/discard" || die
 }

From 27b73a5c4af00b22eed1a4d270038bfa8367b0c1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 25 Jan 2023 17:47:22 +0100
Subject: [PATCH 08/16] sys-fs/btrfs-progs: Sync with Gentoo

It's from Gentoo commit ed468028e725c9580a7b2ee02d6b7b9375f7a0b2.
---
 .../sys-fs/btrfs-progs/Manifest               |  2 +-
 .../sys-fs/btrfs-progs/README.md              | 14 ---
 ...5.15.1.ebuild => btrfs-progs-6.0.2.ebuild} | 91 +++++++++++--------
 3 files changed, 55 insertions(+), 52 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
 rename sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/{btrfs-progs-5.15.1.ebuild => btrfs-progs-6.0.2.ebuild} (61%)

diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
index 23718c47f8..7ad8a320e1 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
@@ -1 +1 @@
-DIST btrfs-progs-v5.15.1.tar.xz 2280796 BLAKE2B b460254a6261d3d04a2d265a3b4e05a89385888f7ea4f2b16ec5b73922646c7f47a546fc78ba7c009e65914125435cf38157eabffc74f5d00df2c21c844922e3 SHA512 68ed89e337ae857fdaf077eaa889e259e9f162ea2222bdaa03f4187783a8682c24d45c91b0559b901d81429ba2cd3f84087d032d354092d5512fb226bdf91549
+DIST btrfs-progs-v6.0.2.tar.xz 2321220 BLAKE2B 391bd9dcc7ae2d40c339eb9b7fb466624c3f122149af640bc0ca73abfc85ca7bd076976d47ce2d4eab64fb3b9b1309e3446acdd78ba77e5cb583b939710f8b6c SHA512 8e01fa6e3373d95a8e8577003ceb94722e4dfdf24110bfea79191a9862daf5e6580d72e898fdea134b5e86beeda32948eed572072f7906226189c6f1ac8615e3
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
deleted file mode 100644
index d3ed623221..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
+++ /dev/null
@@ -1,14 +0,0 @@
-We forked this package for the following reasons:
-
-- We override the udev rules directory. The configure script does not
-  provide a way to override it, so we need to hack it, otherwise the
-  configure script will figure out the wrong path in our builds. We do
-  it by overriding it in Makefile.inc.in. Ideal solution here would be
-  to patch btrfs-progs to allow overriding the udev path and then
-  override it in the ebuild properly, without the sed hacks.
-
-- We change the python versions, because we still have only python
-  3.6.
-
-- We stabilize the package on both amd64 and arm64 to keep it in sync
-  with our linux kernel version.
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
similarity index 61%
rename from sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
index 73f71df572..3e995e27b3 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-5.15.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
@@ -1,43 +1,47 @@
-# Copyright 2008-2021 Gentoo Authors
+# Copyright 2008-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-# Flatcar: We still have python 3.6 only.
-PYTHON_COMPAT=( python3_{6..9} )
+PYTHON_COMPAT=( python3_{9..10} )
 
-# Flatcar: Inherit udev eclass, so we can get the udev directory.
 inherit bash-completion-r1 python-single-r1 udev
 
 libbtrfs_soname=0
 
 if [[ ${PV} != 9999 ]]; then
 	MY_PV="v${PV/_/-}"
-	[[ "${PV}" = *_rc* ]] || \
-	# Flatcar: Stabilize our arches.
-	KEYWORDS="~alpha amd64 ~arm arm64 ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 	SRC_URI="https://www.kernel.org/pub/linux/kernel/people/kdave/${PN}/${PN}-${MY_PV}.tar.xz"
-	S="${WORKDIR}/${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
+
+	S="${WORKDIR}"/${PN}-${MY_PV}
 else
-	WANT_LIBTOOL=none
-	inherit autotools git-r3
 	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
 	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
 fi
 
 DESCRIPTION="Btrfs filesystem utilities"
-HOMEPAGE="https://btrfs.wiki.kernel.org"
+HOMEPAGE="https://btrfs.wiki.kernel.org https://btrfs.readthedocs.io/en/latest/"
 
 LICENSE="GPL-2"
 SLOT="0/${libbtrfs_soname}"
-IUSE="+convert doc python reiserfs static static-libs +zstd"
+IUSE="+convert python +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
 
-RESTRICT=test # tries to mount repared filesystems
+# Tries to mount repaired filesystems
+RESTRICT="test"
 
 RDEPEND="
 	dev-libs/lzo:2=
-	sys-apps/util-linux:0=[static-libs(+)?]
-	sys-libs/zlib:0=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
 	convert? (
 		sys-fs/e2fsprogs:=
 		reiserfs? (
@@ -45,7 +49,8 @@ RDEPEND="
 		)
 	)
 	python? ( ${PYTHON_DEPS} )
-	zstd? ( app-arch/zstd:0= )
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
 "
 DEPEND="${RDEPEND}
 	>=sys-kernel/linux-headers-5.10
@@ -65,19 +70,14 @@ DEPEND="${RDEPEND}
 				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
 			)
 		)
-		zstd? ( app-arch/zstd:0[static-libs(+)] )
-	)
-"
-BDEPEND="
-	doc? (
-		|| ( >=app-text/asciidoc-8.6.0 dev-ruby/asciidoctor )
-		app-text/docbook-xml-dtd:4.5
-		app-text/xmlto
+		zstd? ( app-arch/zstd[static-libs(+)] )
 	)
 "
+BDEPEND="virtual/pkgconfig
+	man? ( dev-python/sphinx )"
 
 if [[ ${PV} == 9999 ]]; then
-	DEPEND+=" sys-devel/gnuconfig"
+	BDEPEND+=" sys-devel/gnuconfig"
 fi
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
@@ -88,30 +88,39 @@ pkg_setup() {
 
 src_prepare() {
 	default
+
 	if [[ ${PV} == 9999 ]]; then
-		AT_M4DIR=m4 eautoreconf
+		AT_M4DIR="m4" eautoreconf
+
 		mkdir config || die
 		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
 		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
 		ln -s "${automakedir}"/install-sh config/install-sh || die
-		ln -s "${EPREFIX}"/usr/share/gnuconfig/config.guess config/config.guess || die
-		ln -s "${EPREFIX}"/usr/share/gnuconfig/config.sub config/config.sub || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
 	fi
-	# Flatcar: Replace udevdir variable with proper udev directory.
-	sed -i -e 's#^\(udevdir\s\+=\).*#\1 $(get_udevdir)#' Makefile.inc.in
 }
 
 src_configure() {
 	local myeconfargs=(
 		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
 		$(use_enable convert)
-		$(use_enable doc documentation)
+		$(use_enable man documentation)
 		$(use_enable elibc_glibc backtrace)
 		$(use_enable python)
 		$(use_enable static-libs static)
+		$(use_enable udev libudev)
 		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi
+		--with-crypto=builtin
 		--with-convert=ext2$(usex reiserfs ',reiserfs' '')
 	)
+
 	econf "${myeconfargs[@]}"
 }
 
@@ -124,10 +133,18 @@ src_install() {
 		$(usex python install_python '')
 		$(usex static install-static '')
 	)
-	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
-	newbashcomp btrfs-completion btrfs
-	use python && python_optimize
 
-	# install prebuilt subset of manuals
-	use doc || doman Documentation/*.[58]
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
 }

From 842bc691448f18764f194ac009ffa5b9ac05c410 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 25 Nov 2021 11:41:41 +0100
Subject: [PATCH 09/16] sys-fs/btrfs-progs: Apply Flatcar modifications

---
 .../coreos-overlay/sys-fs/btrfs-progs/README.md           | 8 ++++++++
 .../sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild           | 2 ++
 2 files changed, 10 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md

diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
new file mode 100644
index 0000000000..16f62cc8c0
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
@@ -0,0 +1,8 @@
+We forked this package for the following reasons:
+
+- We override the udev rules directory. The configure script does not
+  provide a way to override it, so we need to hack it, otherwise the
+  configure script will figure out the wrong path in our builds. We do
+  it by overriding it in Makefile.inc.in. Ideal solution here would be
+  to patch btrfs-progs to allow overriding the udev path and then
+  override it in the ebuild properly, without the sed hacks.
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
index 3e995e27b3..ad75587042 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2.ebuild
@@ -100,6 +100,8 @@ src_prepare() {
 		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
 		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
 	fi
+	# Flatcar: Replace udevdir variable with proper udev directory.
+	sed -i -e 's#^\(udevdir\s\+=\).*#\1 $(get_udevdir)#' Makefile.inc.in
 }
 
 src_configure() {

From dc7a889296051aaa4588c7ff41dfc28ba981267e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 25 Jan 2023 18:12:10 +0100
Subject: [PATCH 10/16] coreos-devel/sdk-depends: Add dev-python/six

The dev-python/six became a build dependency for dev-python/boto.
---
 .../coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild            | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
index 3631e180ba..4f6d96b08f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild
@@ -30,6 +30,7 @@ DEPEND="
 	coreos-devel/fero-client
 	dev-libs/gobject-introspection
 	dev-python/setuptools
+	dev-python/six
 	dev-util/b2
 	dev-util/catalyst
 	dev-util/checkbashisms

From f5134084d46cd5a4481979b946794dbee49ffd31 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 26 Jan 2023 09:04:49 +0100
Subject: [PATCH 11/16] sys-boot/grub: Bump EAPI to 7

The ebuild uses python eclasses, which dropped support for EAPI 6
after the update. Updating EAPI required replacing the use of the
versionator eclass as it's banned in EAPI 7 or later. Fortunately,
nothing in the ebuild seemed to use anything from the eclass.
---
 .../grub/{grub-2.02-r8.ebuild => grub-2.02-r9.ebuild}         | 0
 .../third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild | 4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename sdk_container/src/third_party/coreos-overlay/sys-boot/grub/{grub-2.02-r8.ebuild => grub-2.02-r9.ebuild} (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r8.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r9.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r8.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-2.02-r9.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
index 7703a9f528..3d976f29b5 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/grub/grub-9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 CROS_WORKON_PROJECT="flatcar/grub"
 CROS_WORKON_REPO="https://github.com"
@@ -21,7 +21,7 @@ if [[ -n ${GRUB_AUTOGEN} ]]; then
 	inherit autotools python-any-r1
 fi
 
-inherit autotools bash-completion-r1 flag-o-matic multibuild pax-utils toolchain-funcs versionator
+inherit autotools bash-completion-r1 flag-o-matic multibuild pax-utils toolchain-funcs
 DEJAVU=dejavu-sans-ttf-2.37
 UNIFONT=unifont-9.0.06
 SRC_URI+=" fonts? ( mirror://gnu/unifont/${UNIFONT}/${UNIFONT}.pcf.gz )

From c0b5d9a78a8915dacf0823d93e88fb1937a9e1e6 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 26 Jan 2023 11:43:43 +0100
Subject: [PATCH 12/16] profiles: Update USE flags for sys-fs/btrfs-progs

---
 .../coreos-overlay/profiles/coreos/base/package.use.mask       | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
index 66c01ec9ac..c02b3aba0d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@@ -27,3 +27,6 @@ sys-libs/glibc -crypt
 # We don't use pip.
 dev-lang/python ensurepip
 dev-lang/python-oem ensurepip
+
+# Pulls dev-python/sphinx, which in turn pulls a lot of other python stuff.
+sys-fs/btrfs-progs man

From a9cd46e40b20e11a7943ae726280c5e1ff1fc05e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 26 Jan 2023 11:44:04 +0100
Subject: [PATCH 13/16] profiles: Drop outdated accept keywords for
 sys-fs/btrfs-progs

---
 .../coreos-overlay/profiles/coreos/arm64/package.accept_keywords | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
index 9c9902f00b..9078a1712c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/package.accept_keywords
@@ -35,7 +35,6 @@
 =sys-cluster/ipvsadm-1.27-r1 **
 
 =sys-firmware/edk2-aarch64-18.02 **
-=sys-fs/btrfs-progs-4.19.1 ~arm64
 =sys-libs/libselinux-3.1-r2 ~arm64
 =sys-libs/libsemanage-3.1-r1 ~arm64
 =sys-libs/libsepol-3.1 ~arm64

From ac0f9ba2d8bfb7ed9eec16dc685c351fa0721601 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 16 Feb 2023 14:44:17 +0100
Subject: [PATCH 14/16] app-emulation/wa-linux-agent: Bump python dep to 3.10

---
 ...ux-agent-2.6.0.2.ebuild => wa-linux-agent-2.6.0.2-r1.ebuild} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/{wa-linux-agent-2.6.0.2.ebuild => wa-linux-agent-2.6.0.2-r1.ebuild} (98%)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
index 048c7911b0..6b824a1d69 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.6.0.2-r1.ebuild
@@ -15,7 +15,7 @@ IUSE=""
 # Depending on specific version of python-oem allows us to notice when
 # we update the major version of python and then to make sure that we
 # install the package in correctly versioned site-packages directory.
-DEP_PYVER="3.9"
+DEP_PYVER="3.10"
 
 RDEPEND="
 dev-lang/python-oem:${DEP_PYVER}

From 724146435847c412646bdc5ffc3e84897b44f87e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 16 Feb 2023 14:45:06 +0100
Subject: [PATCH 15/16] dev-python/distro-oem: Bump python dep to 3.10

---
 .../{distro-oem-1.7.0.ebuild => distro-oem-1.7.0-r1.ebuild}     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/{distro-oem-1.7.0.ebuild => distro-oem-1.7.0-r1.ebuild} (98%)

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
index 146f015bd5..149cfc59a4 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0-r1.ebuild
@@ -19,7 +19,7 @@ KEYWORDS="amd64 arm64"
 # Depending on specific version of python-oem allows us to notice when
 # we update the major version of python and then to make sure that we
 # install the package in correctly versioned site-packages directory.
-DEP_PYVER="3.9"
+DEP_PYVER="3.10"
 
 SLOT="0"
 RDEPEND="dev-lang/python-oem:${DEP_PYVER}"

From b45bed244e0929e4c2bc70a02c5cd7df7e047456 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 17 Feb 2023 12:22:38 +0100
Subject: [PATCH 16/16] changelog: Add an entry

---
 .../coreos-overlay/changelog/updates/2023-02-17-python-update.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md

diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md
new file mode 100644
index 0000000000..5d6f600590
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-17-python-update.md
@@ -0,0 +1 @@
+- btrfs-progs ([6.0.2](https://btrfs.readthedocs.io/en/latest/CHANGES.html#btrfs-progs-6-0-2-2022-11-24), includes [6.0](https://btrfs.readthedocs.io/en/latest/CHANGES.html#btrfs-progs-6-0-2022-10-11))