Merge pull request #3174 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-08-04

Weekly portage-stable package updates 2025-08-04
2026-05-04 19:56:32 +02:00 · 2025-08-27 11:53:47 +02:00 · 2025-08-27 11:53:47 +02:00 · 2196326d26
commit 2196326d26
parent 41b5592084 bdb20f15df
887 changed files with 17672 additions and 78013 deletions
--- a/build_library/extra_sysexts.sh
+++ b/build_library/extra_sysexts.sh
@ -3,8 +3,8 @@ EXTRA_SYSEXTS=(
  "incus|app-containers/incus"
  "nvidia-drivers-535|x11-drivers/nvidia-drivers:0/535|-kernel-open persistenced|amd64"
  "nvidia-drivers-535-open|x11-drivers/nvidia-drivers:0/535|kernel-open persistenced|amd64"
-  "nvidia-drivers-550|x11-drivers/nvidia-drivers:0/550|-kernel-open persistenced|amd64"
-  "nvidia-drivers-550-open|x11-drivers/nvidia-drivers:0/550|kernel-open persistenced|amd64"
+  "nvidia-drivers-550|x11-drivers/old-nvidia-drivers:0/550|-kernel-open persistenced|amd64"
+  "nvidia-drivers-550-open|x11-drivers/old-nvidia-drivers:0/550|kernel-open persistenced|amd64"
  "nvidia-drivers-570|x11-drivers/nvidia-drivers:0/570|-kernel-open persistenced|amd64"
  "nvidia-drivers-570-open|x11-drivers/nvidia-drivers:0/570|kernel-open persistenced|amd64"
  "podman|app-containers/podman,net-misc/passt"
--- a/changelog/security/2025-08-06-weekly-updates.md
+++ b/changelog/security/2025-08-06-weekly-updates.md
@ -0,0 +1,2 @@
+- nvidia-drivers ([CVE-2025-23277](https://www.cve.org/CVERecord?id=CVE-2025-23277), [CVE-2025-23278](https://www.cve.org/CVERecord?id=CVE-2025-23278), [CVE-2025-23279](https://www.cve.org/CVERecord?id=CVE-2025-23279), [CVE-2025-23286](https://www.cve.org/CVERecord?id=CVE-2025-23286))
+- python ([CVE-2025-6069](https://www.cve.org/CVERecord?id=CVE-2025-6069), [CVE-2025-8194](https://www.cve.org/CVERecord?id=CVE-2025-8194))
--- a/changelog/updates/3035-08-06-weekly-updates.md
+++ b/changelog/updates/3035-08-06-weekly-updates.md
@ -0,0 +1,7 @@
+- azure, dev, gce, sysext-python: python (3.11.13_p1)
+- base, dev: curl ([8.14.1](https://curl.se/ch/8.14.1.html) (includes [8.14.0](https://curl.se/ch/8.14.0.html)))
+- base, dev: nvidia-drivers-service (amd64) ([535.261.03](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-535-261-03/index.html))
+- base, dev: nvidia-drivers-service (arm64) ([570.172.08](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-570-172-08/index.html))
+- sysext-nvidia-drivers-535, sysext-nvidia-drivers-535-open: nvidia-drivers ([535.261.03](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-535-261-03/index.html))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers ([570.172.08](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-570-172-08/index.html))
+- sysext-python: distlib ([0.4.0](https://github.com/pypa/distlib/blob/0.4.0/CHANGES.rst#040))
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/x11-drivers/old-nvidia-drivers
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/x11-drivers/old-nvidia-drivers
@ -0,0 +1 @@
+nvidia-drivers
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@ -78,9 +78,6 @@ dev-cpp/azure-security-keyvault-keys
 # Keep versions on both arches in sync.
 =dev-util/xdelta-3.0.11-r1 ~arm64

-# Needed to address CVE-2024-11187, CVE-2024-12705
-=net-dns/bind-9.18.37-r1 ~arm64
-
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64

@ -90,6 +87,7 @@ dev-cpp/azure-security-keyvault-keys
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
+=net-misc/curl-8.14.1 ~arm64

 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@ -196,3 +196,7 @@ sys-libs/libcap static-libs

 # do not force a dependency on llvm-core/llvm yet
 dev-lang/rust -system-llvm
+
+# disable mpfr in gawk, this ends up being pulled into initrd, making
+# it grow by another 2mb
+sys-apps/gawk -mpfr
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask
@ -34,3 +34,4 @@ app-emulation/qemu X

 # disable all tools for NVIDIA driver, keep just kmods
 x11-drivers/nvidia-drivers tools X static-libs
+x11-drivers/old-nvidia-drivers tools X static-libs
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-535.261.03.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-535.261.03.ebuild
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-570.172.08.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/nvidia-drivers-service/nvidia-drivers-service-570.172.08.ebuild
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/Manifest
@ -0,0 +1,8 @@
+DIST NVIDIA-Linux-aarch64-550.163.01.run 236409124 BLAKE2B 21c79346f6b739f44d7ed2d4955129613f51e1329ff15948ef50a9a06b82975ad890d6142e5dfb163e7b0da19bf5c26029cf507d120037f8a76abc177a286403 SHA512 0ef4ab4aae308ec0cfb5458cef34a1503ac1a85f0e1d0c9f061d8e28f939b15784e3862d96d83e93123d9eb56807a6804318ce230ee68917fb75e363011f8304
+DIST NVIDIA-Linux-x86_64-550.163.01.run 307143336 BLAKE2B 256106bcd3bace402289e60aca4cd3b447d0fd8ec3dabd50e2bb303c5e866f8da5c28f9b578d95775bf69158f100d68a91d20d9a91426285a8e799817f21db6b SHA512 676b1de35d21e80091528a49080c114e0870ea90b3f3721265ae8071abbc2183c851e6f11ba96a332c743fedfaf4ec9a014ad6ceed586fdbb03d94d33405e356
+DIST NVIDIA-kernel-module-source-550.163.01.tar.xz 13552400 BLAKE2B e1fd753127d10097c5f1d3c90d95c7eb0934c0d5e1df0a371aed2a0d7669960b67c46eed20eec3c42ca41c0f34bf6d7d3d2a77a94308c9f86d4f5d831da19363 SHA512 c9f4ce2890db3fdc66dd080da4d6802a8bc3b18feba96be5d33641b02cca637b1bcd2a3748f36f93a32f26ba57eb352156314f139688b0d3a102efdfde6c32ba
+DIST nvidia-installer-550.163.01.tar.bz2 155861 BLAKE2B 662064b3ceb4aadebde419057d85c6b4e28b91944bd5bab241bcba9b3c9a105e507afc7651b17fff01e1cccb78d66fdc6789597ce059f882a6f322b08f28e832 SHA512 f8df7a0eccdecb7d4d4f47d96050cdbefff91289b29550b061358614845648451d4b161d9bdbfbf5a9a87ce650d272cb3b795e6d2ed4d0274844a56db097bd15
+DIST nvidia-modprobe-550.163.01.tar.bz2 41448 BLAKE2B 23e567d612e669ec6ae9f389651c9e1cebe7ba59ee95bb5961e5071952697860df77f02026040e29135338eb7cf96bba0015b3d94548297235fb5214f35bec48 SHA512 0f5b59468a6e5e95dcdef1d938ea78f4ce09a0c9784e3c70d83f1c3b1bd52e8055b6b332147316445c3be714abab3629320d6117878d50aa7a2d7d2d9b9b6485
+DIST nvidia-persistenced-550.163.01.tar.bz2 61450 BLAKE2B 1a11cb89981b88f8d14558227d9493f1f8a81ccb5502002c436e9311a38c9c8fe0402c65eac1517a2893985eec07699b2e7bc7a81aa14dc0d52198ac85a2cd1b SHA512 f17dbcafa917b5b450f7665f98fd24f06ad99e6bcd1fcf42ef95aa9337b55561b7b16eaad8fa408110d08ee7e6d812444792cccbb9c92865099891832da779ce
+DIST nvidia-settings-550.163.01.tar.bz2 1099317 BLAKE2B 25419c1796deeea238b3e44fd8d648a8627272565be40cb0745132cef1c16e0c422242a1e6369745d577e674a68bf9dfc3c009e281a84ba58db5429d97ac9cff SHA512 5306ab05f284ba06852d7c96ff62ded7b8b615d3a002009cd5d781fdad716db37f53d1c8a43337ada60d524b4f7d183d98ad2673f40a5ca1ca4c5112bb913e74
+DIST nvidia-xconfig-550.163.01.tar.bz2 111149 BLAKE2B d19ef0427e3432798e674dc66447090e8fb8fcb549ebe27aaee19aa38294cf178e175a067b2da5313342c93ea2aebef35861d05cc4cc0ee2c3eae955b3ddbbb3 SHA512 35f95d85928c82bc5de8e462ca5e90a6d8fe03e5b5367b9cdaadddc1e956f0d26b6dc42e716ae7c88512afdfb98cc841fe9b22846f6d6acc578c5dba4d0a16e1
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/95-nvidia-settings-r1
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/95-nvidia-settings-r1
@ -0,0 +1,2 @@
+#!/bin/sh
+/usr/bin/nvidia-settings --load-config-only
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-545.conf
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-545.conf
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-modprobe-390.141-uvm-perms.patch
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-modprobe-390.141-uvm-perms.patch
@ -0,0 +1,12 @@
+Create /dev/nvidia-uvm* by respecting nvidia.conf's permissions.
+--- a/nvidia-modprobe/modprobe-utils/nvidia-modprobe-utils.c
+++ b/nvidia-modprobe/modprobe-utils/nvidia-modprobe-utils.c
+@@ -742,6 +742,6 @@
+     }
+ 
+-    return mknod_helper(major, base_minor, NV_UVM_DEVICE_NAME, NULL) &&
+-           mknod_helper(major, base_minor + 1, NV_UVM_TOOLS_DEVICE_NAME, NULL);
+    return mknod_helper(major, base_minor, NV_UVM_DEVICE_NAME, NV_PROC_REGISTRY_PATH) &&
+           mknod_helper(major, base_minor + 1, NV_UVM_TOOLS_DEVICE_NAME, NV_PROC_REGISTRY_PATH);
+ }
+ 
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-persistenced.confd
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-persistenced.confd
@ -0,0 +1,7 @@
+# configuration file for /etc/init.d/nvidia-persistenced
+
+# NVPD_USER: user to run as, needs access to /dev/nvidia* (video group)
+NVPD_USER="nvpd"
+
+# ARGS: additional arguments, see nvidia-persistenced(1)
+ARGS=""
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-persistenced.initd
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-persistenced.initd
@ -0,0 +1,11 @@
+#!/sbin/openrc-run
+# SPDX-License-Identifier: MIT
+
+description="Maintain persistent software state in the NVIDIA driver"
+command="nvidia-persistenced"
+command_args="${NVPD_USER:+--user ${NVPD_USER}} ${ARGS}"
+pidfile="/var/run/nvidia-persistenced/nvidia-persistenced.pid"
+
+stop_post() {
+	rmdir "${pidfile%/*}" 2>/dev/null || true
+}
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-powerd.initd
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-powerd.initd
@ -0,0 +1,11 @@
+#!/sbin/openrc-run
+# SPDX-License-Identifier: MIT
+
+description="Support for NVIDIA Dynamic Boost (only for use with specific laptops)"
+command="nvidia-powerd"
+command_background=true
+pidfile="/var/run/nvidia-powerd.pid"
+
+depend() {
+	need dbus
+}
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-settings-530.30.02-desktop.patch
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/nvidia-settings-530.30.02-desktop.patch
@ -0,0 +1,11 @@
+These __PLACEHOLDER__ are replaced by nvidia-installer which we don't use.
+--- a/nvidia-settings/doc/nvidia-settings.desktop
+++ b/nvidia-settings/doc/nvidia-settings.desktop
+@@ -5,5 +5,5 @@
+ Comment=Configure NVIDIA X Server Settings
+-Exec=__UTILS_PATH__/nvidia-settings
+Exec=nvidia-settings
+ Icon=nvidia-settings
+-Categories=__NVIDIA_SETTINGS_DESKTOP_CATEGORIES__
+Categories=System;HardwareSettings;
+ 
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/system-sleep.elogind
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/files/system-sleep.elogind
@ -0,0 +1,7 @@
+#!/bin/sh
+case ${1-} in
+	pre)	nvidia-sleep.sh suspend;;
+	# run in background given resume is flaky if elogind did not finish
+	post)	nvidia-sleep.sh resume &;;
+	*)	exit 1;;
+esac
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/metadata.xml
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/metadata.xml
@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>maintainers@flatcar-linux.org</email>
+		<name>The Flatcar Container Linux Maintainers</name>
+	</maintainer>
+	<use>
+		<flag name="kernel-open">
+			Use the open source variant of the drivers (only
+			works for Turing/Ampere or newer GPUs, aka GTX 1650+
+			-- recommended with >=560.xx drivers if usable and
+			is *required* for 50xx Blackwell or newer GPUs)
+		</flag>
+		<flag name="persistenced">Install the persistence daemon for keeping devices state when unused (e.g. for headless)</flag>
+		<flag name="powerd">Install the NVIDIA dynamic boost support daemon (only useful with specific laptops, ignore if unsure)</flag>
+		<flag name="static-libs">Install the XNVCtrl static library for accessing sensors and other features</flag>
+		<flag name="tools">Install additional tools such as nvidia-settings</flag>
+	</use>
+	<upstream>
+		<remote-id type="cpe">cpe:/a:nvidia:gpu_driver</remote-id>
+		<remote-id type="github">NVIDIA/nvidia-installer</remote-id>
+		<remote-id type="github">NVIDIA/nvidia-modprobe</remote-id>
+		<remote-id type="github">NVIDIA/nvidia-persistenced</remote-id>
+		<remote-id type="github">NVIDIA/nvidia-settings</remote-id>
+		<remote-id type="github">NVIDIA/nvidia-xconfig</remote-id>
+		<remote-id type="github">NVIDIA/open-gpu-kernel-modules</remote-id>
+	</upstream>
+	<slots>
+		<subslots>
+			Subslot is primarily used to identify branches, at most
+			rebuilding reverse dependencies on bumps would only be
+			for the static library (not essential to) given other
+			headers are provided by nvidia-cuda-toolkit instead.
+		</subslots>
+	</slots>
+</pkgmetadata>
--- a/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/x11-drivers/old-nvidia-drivers/old-nvidia-drivers-550.163.01-r1.ebuild
--- a/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/Manifest
@ -1,2 +1,4 @@
 DIST sudo-1.9.17p1.tar.gz 5449076 BLAKE2B 21771348a8de392767c366bb938951327dcc64a4cedee716a802435899e5135c218468271833a9e3ab9d90bda29e36c0870e27dd333d3a5c64fb8e3a5ebbff58 SHA512 1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc
 DIST sudo-1.9.17p1.tar.gz.sig 566 BLAKE2B b6380c84b82740455a28388925d27bdf9296ddef943653c1883af3c7684ab53571053ef333ac9747ee11330b06fd23adf477856f70bd5fcaa6dbda1c9e432675 SHA512 714ce7c613683689e9d166171b04c03220e21d06f2e66d800f2d075927830014447611933d7293d9c763beeea66fc02255d8175c9ac8cba6d62166750aab50a6
+DIST sudo-1.9.17p2.tar.gz 5451682 BLAKE2B dd42ff4fd571ba8489cc59d71a09c7e0483d21daf9faf7e697beedc04d9f170b01e60446af179c949a3da115b616fbec07aff8fbf8b7d502161c24d1b35b7a69 SHA512 c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93
+DIST sudo-1.9.17p2.tar.gz.sig 566 BLAKE2B b778061533cd2778eec1093fc37e89f45ea4b2a5e97a71f85fc00fbfc1b550a194e4faa410bc072e3ecbd233a3834f004d7451e020d2be148a36336b35d462e5 SHA512 7ca1949a7ffe0481d7c0f9215fdeae54fff34f0156f06c72a090515b1a97d052e63ce94cffe5a92ca23a723ddd0b0186fabc957cdc22120482c6f9f87d65a5f6
--- a/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild
@ -0,0 +1,292 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit pam tmpfiles toolchain-funcs
+
+MY_P="${P/_/}"
+MY_P="${MY_P/beta/b}"
+
+DESCRIPTION="Allows users or groups to run commands as other users"
+HOMEPAGE="https://www.sudo.ws/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://github.com/sudo-project/sudo
+		https://git.sudo.ws/sudo
+	"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/sudo.ws.asc
+	inherit libtool verify-sig
+
+	uri_prefix=
+	case ${P} in
+		*_beta*|*_rc*) uri_prefix=beta/ ;;
+	esac
+
+	SRC_URI="
+		https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz
+		verify-sig? (
+			https://www.sudo.ws/sudo/dist/${uri_prefix}${MY_P}.tar.gz.sig
+		)
+	"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	fi
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"
+fi
+
+S="${WORKDIR}/${MY_P}"
+
+# Basic license is ISC-style as-is, some files are released under
+# 3-clause BSD license
+LICENSE="ISC BSD"
+SLOT="0"
+IUSE="gcrypt ldap nls offensive pam sasl +secure-path selinux +sendmail skey ssl sssd"
+
+DEPEND="
+	sys-libs/zlib:=
+	virtual/libcrypt:=
+	gcrypt? ( dev-libs/libgcrypt:= )
+	ldap? (
+		>=net-nds/openldap-2.1.30-r1:=
+		sasl? (
+			dev-libs/cyrus-sasl
+			net-nds/openldap:=[sasl]
+		)
+	)
+	pam? ( sys-libs/pam )
+	sasl? ( dev-libs/cyrus-sasl )
+	selinux? ( sys-libs/libselinux )
+	skey? ( >=sys-auth/skey-1.1.5-r1 )
+	ssl? ( dev-libs/openssl:= )
+	sssd? ( sys-auth/sssd[sudo(+)] )
+"
+RDEPEND="
+	${DEPEND}
+	>=app-misc/editor-wrapper-3
+	virtual/editor
+	ldap? ( dev-lang/perl )
+	pam? ( sys-auth/pambase )
+	selinux? ( sec-policy/selinux-sudo )
+	sendmail? ( virtual/mta )
+"
+BDEPEND+="
+	app-alternatives/yacc
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	?? ( pam skey )
+	?? ( gcrypt ssl )
+"
+
+MAKEOPTS+=" SAMPLES="
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+set_secure_path() {
+	# First extract the default ROOTPATH from build env
+	SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
+
+	case "${SECURE_PATH}" in
+		*/usr/sbin*)
+			;;
+		*)
+			SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}")
+			;;
+	esac
+
+	if [[ -z ${SECURE_PATH} ]] ; then
+		ewarn "	Failed to detect SECURE_PATH, please report this"
+	fi
+
+	# Then remove duplicate path entries
+	cleanpath() {
+		local newpath thisp IFS=:
+		for thisp in $1 ; do
+			if [[ :${newpath}: != *:${thisp}:* ]] ; then
+				newpath+=:${thisp}
+			else
+				einfo "   Duplicate entry ${thisp} removed..."
+			fi
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}}
+
+	# Finally, strip gcc paths, bug #136027
+	rmpath() {
+		local e newpath thisp IFS=:
+		for thisp in ${SECURE_PATH} ; do
+			for e ; do
+				[[ ${thisp} == ${e} ]] && continue 2 ;
+			done
+			newpath+=:${thisp}
+		done
+		SECURE_PATH=${newpath#:}
+	}
+	rmpath '*/gcc-bin/*' '*/gnat-gcc-bin/*' '*/gnat-gcc/*'
+}
+
+src_configure() {
+	local SECURE_PATH
+
+	set_secure_path
+
+	# bug #767712
+	tc-export PKG_CONFIG
+
+	# - audit: somebody got to explain me how I can test this before I
+	# enable it.. - Diego
+	# - plugindir: autoconf code is crappy and does not delay evaluation
+	# until `make` time, so we have to use a full path here rather than
+	# basing off other values.
+	local myeconfargs=(
+		# We set all of the relevant options by ourselves (patched
+		# into the toolchain) and setting these in the build system
+		# actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3
+		# (it'll downgrade to =2). So, this has no functional effect on
+		# the hardening for users. It's safe.
+		--disable-hardening
+
+		# requires some python eclass
+		--disable-python
+		--enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d
+		--enable-zlib=system
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+		--with-env-editor
+		--with-plugindir="${EPREFIX}"/usr/$(get_libdir)/sudo
+		--with-rundir="${EPREFIX}"/run/sudo
+		--with-vardir="${EPREFIX}"/var/db/sudo
+		--without-linux-audit
+		--without-opie
+		$(use_enable gcrypt)
+		$(use_enable nls)
+		$(use_enable sasl)
+		$(use_enable ssl openssl)
+		$(use_with ldap)
+		$(use_with ldap ldap_conf_file /etc/ldap.conf.sudo)
+		$(use_with offensive insults)
+		$(use_with offensive all-insults)
+		$(use_with pam)
+		$(use_with pam pam-login)
+		$(use_with secure-path)
+		"$(use_with secure-path secure-path-value "${SECURE_PATH}")"
+		$(use_with selinux)
+		$(use_with sendmail)
+		$(use_with skey)
+		$(use_with sssd)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	if use ldap ; then
+		dodoc README.LDAP.md
+
+		cat <<-EOF > "${T}"/ldap.conf.sudo
+		# See ldap.conf(5) and README.LDAP.md for details
+		# This file should only be readable by root
+
+		# supported directives: host, port, ssl, ldap_version
+		# uri, binddn, bindpw, sudoers_base, sudoers_debug
+		# tls_{checkpeer,cacertfile,cacertdir,randfile,ciphers,cert,key}
+		EOF
+
+		if use sasl ; then
+			cat <<-EOF >> "${T}"/ldap.conf.sudo
+
+			# SASL directives: use_sasl, sasl_mech, sasl_auth_id
+			# sasl_secprops, rootuse_sasl, rootsasl_auth_id, krb5_ccname
+			EOF
+		fi
+
+		insinto /etc
+		doins "${T}"/ldap.conf.sudo
+		fperms 0440 /etc/ldap.conf.sudo
+
+		insinto /etc/openldap/schema
+		newins docs/schema.OpenLDAP sudo.schema
+	fi
+
+	if use pam ; then
+		pamd_mimic system-auth sudo auth account session
+		pamd_mimic system-auth sudo-i auth account session
+	fi
+
+	keepdir /var/db/sudo/lectured
+	fperms 0700 /var/db/sudo/lectured
+	# bug #652958
+	fperms 0711 /var/db/sudo
+
+	# Don't install into /run as that is a tmpfs most of the time
+	# (bug #504854)
+	rm -rf "${ED}"/run || die
+
+	# bug #697812
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process sudo.conf
+
+	# bug #652958
+	local sudo_db="${EROOT}/var/db/sudo"
+	if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
+		chmod 711 "${sudo_db}" || die
+	fi
+
+	if use ldap ; then
+		ewarn
+		ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration."
+		ewarn
+		if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
+			ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
+			ewarn "configured in ${ROOT}/etc/nsswitch.conf."
+			ewarn
+			ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:"
+			ewarn "  sudoers: ldap files"
+			ewarn
+		fi
+	fi
+	if use prefix ; then
+		ewarn
+		ewarn "To use sudo on Prefix, you need to change file ownership and permissions"
+		ewarn "with root privileges, as follows:"
+		ewarn
+		ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"
+		ewarn "  # chown root:root ${EPREFIX}/usr/lib/sudo/sudoers.so"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers"
+		ewarn "  # chown root:root ${EPREFIX}/etc/sudoers.d"
+		ewarn "  # chown root:root ${EPREFIX}/var/db/sudo"
+		ewarn "  # chmod 4111 ${EPREFIX}/usr/bin/sudo"
+		ewarn
+	fi
+
+	elog "To use the -A (askpass) option, you need to install a compatible"
+	elog "password program from the following list. Starred packages will"
+	elog "automatically register for the use with sudo (but will not force"
+	elog "the -A option):"
+	elog ""
+	elog " [*] net-misc/ssh-askpass-fullscreen"
+	elog "     net-misc/x11-ssh-askpass"
+	elog ""
+	elog "You can override the choice by setting the SUDO_ASKPASS environmnent"
+	elog "variable to the program you want to use."
+}
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest
@ -4,3 +4,5 @@ DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
 DIST incus-6.14.tar.xz 12509468 BLAKE2B ec3bb614088d82e07c13169a6b26d8c83214fddbdf30049d58f2cca2678a16ccb6acca7bba68d4e15a514dad71639a144a7b2f4b9f3efdf9c8ca8d750692e250 SHA512 186abb32dcfbe851f04131ea7a9256fafaa465d40379e825554275697e04f005920c09939a8cb199b499b60df667921900c4a2d5b9a7ab9bd20b3e473468dbf1
 DIST incus-6.14.tar.xz.asc 833 BLAKE2B c9cfa631bb316234a6958f2aa3e708e32ea2fca34357700e7d1e38723be539f5b6b1484597c18baca1f22d922c7aca148463dfc0b818f7809126e6873e4826b5 SHA512 6a2f4ceeab44462cca74799a1c135eeb17cbece3d270c5195c3eacda8ea24419fc34cab6d157dbfed803bb269df42a02abc417b98887cec5f10b0ec70b430644
+DIST incus-6.15.tar.xz 12716184 BLAKE2B bc821575f7f24b42054028ce628a29f38ef41b8a31a94f34381019306681f9279ae6c36cb00b7f84d62f5ddc89d27216d753e5c0f5ec1d327bbd283ab5fe1e15 SHA512 7561abce8eb9c01764aca9bb5477028439c05f6c1c20637f288028be93f4bc0d74a36af76f7ad0e35028dfe40e2a0bb2d7b4a363d1da35fe657072f5d847c78e
+DIST incus-6.15.tar.xz.asc 833 BLAKE2B ccab84a2fd3f9d6971ff0fd7cba9afc23dbe0fc0bcb8738656f9071db7c773840566009d5014dc15d37be26bff018e3faf8af59dd5d50b629aebd2e79cf3dc5e SHA512 b1bf43ffff719a3f1c6be7a8d32e44f418efb8e926914dea5479ba1175768910fa38b4e5b83c51e90ec34d2d345629597beb286215b9658a611cf568b8e43122
--- a/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.15.ebuild
@ -0,0 +1,253 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
+		local bindir="_dist/bin/linux_${GOARCH}"
+	else
+		local bindir="_dist/bin"
+	fi
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest
@ -1,5 +1,3 @@
-DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
-DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855
 DIST gpgme-1.24.3.tar.bz2 1892862 BLAKE2B ace04d4fc803f6ce96f850a46b4b383ebdcbfe51d55fbe2a5ced10451310553c15ee5a603d1e6ffb78a8de75461fafacc296fec3e4f38d4908171a095cab185f SHA512 3b5fc22a2f83576058ac14e744333f46df362b39f742d6c9e54a5a66828194a1312f5f365bdc15683e148821f5d591fa92a2daad83fc116f65dccf14e817ca48
 DIST gpgme-1.24.3.tar.bz2.sig 238 BLAKE2B 5b8402b011899faae26bcba428e45a7bb7baf9b16e4c605cdae3d84dc1cbf52ccd524181ef0726e25075c42f9ccb72cd996707a2f96c04b7054cc9050270b586 SHA512 056b28b041dd83c86984e73c31403ea45d33db30c1b2b05e45b0cfb5bb723b25a0fa21ddee192c135cea5d93d934502085bc0fc94fa3c29858513e260c332948
 DIST gpgme-2.0.0.tar.bz2 1383911 BLAKE2B 7053955f80f9a69c62d8b4bb6cc80ea259e6854857b340577c4a68fac1d34c0f2aff1dbbf88b503dd2b021c48d9fff67709593817f3b0e74f72df913d7e3de0d SHA512 ee58dc2a4273c740d5b9ef13cc655d5e600ddddd137fb85a781c31e8854829283b4ce241d7810a963d9a125d603213600f37e7d0c1ce3b3cf1b935e62cf60777
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
@ -1,178 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintainers should:
-# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
-# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
-# (find the one for the current release then subscribe to it +
-# any subsequent ones linked within so you're covered for a while.)
-
-DISTUTILS_EXT=1
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{11..13} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-
-# in-source builds are not supported:
-# * https://dev.gnupg.org/T6313#166339
-# * https://dev.gnupg.org/T6673#174545
-inherit distutils-r1 libtool flag-o-matic out-of-source qmake-utils toolchain-funcs verify-sig
-
-DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
-HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
-SRC_URI="
-	mirror://gnupg/gpgme/${P}.tar.bz2
-	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
-"
-
-LICENSE="GPL-2 LGPL-2.1"
-# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
-# Use e.g. app-portage/iwdevtools integration with dev-libs/libabigail's abidiff.
-# Subslot: SONAME of each: <libgpgme.libgpgmepp.libqgpgme.FUDGE>
-# Bump FUDGE if a release is made which breaks ABI without changing SONAME.
-# (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
-SLOT="1/11.6.15.2"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="
-	qt5? ( cxx )
-	qt6? ( cxx )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-# - On each bump, update dep bounds on each version from configure.ac!
-RDEPEND="
-	>=app-crypt/gnupg-2
-	>=dev-libs/libassuan-2.5.3:=
-	>=dev-libs/libgpg-error-1.46-r1:=
-	python? ( ${PYTHON_DEPS} )
-	qt5? ( dev-qt/qtcore:5 )
-	qt6? ( dev-qt/qtbase:6 )
-"
-DEPEND="
-	${RDEPEND}
-	test? (
-		qt5? ( dev-qt/qttest:5 )
-	)
-"
-#doc? ( app-text/doxygen[dot] )
-BDEPEND="
-	python? (
-		${PYTHON_DEPS}
-		${DISTUTILS_DEPS}
-		dev-lang/swig
-	)
-	verify-sig? ( sec-keys/openpgp-keys-gnupg )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
-	"${FILESDIR}"/${PN}-1.23.1-tests-gnupg-no-tofu.patch
-)
-
-src_prepare() {
-	default
-
-	elibtoolize
-
-	# bug #697456
-	addpredict /run/user/$(id -u)/gnupg
-
-	local MAX_WORKDIR=66
-	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
-		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
-		die "Could not run tests as requested with too-long WORKDIR."
-	fi
-
-	# Make best effort to allow longer PORTAGE_TMPDIR
-	# as usock limitation fails build/tests
-	ln -s "${P}" "${WORKDIR}/b" || die
-	S="${WORKDIR}/b"
-}
-
-my_src_configure() {
-	# bug #847955
-	append-lfs-flags
-
-	cd "${BUILD_DIR}" || die
-
-	local languages=(
-		$(usev common-lisp 'cl')
-		$(usev cxx 'cpp')
-		$(usev qt5 'qt5')
-		$(usev qt6 'qt6')
-	)
-
-	use qt5 && export MOC5="$(qt5_get_bindir)/moc"
-	use qt6 && export MOC6="$(qt6_get_libdir)/qt6/libexec/moc"
-
-	local myeconfargs=(
-		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
-		--enable-languages="${languages[*]}"
-		$(use_enable static-libs static)
-		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
-	if use python ; then
-		emake -C lang/python prepare
-
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_configure
-		popd > /dev/null || die
-	fi
-}
-
-my_src_compile() {
-	cd "${BUILD_DIR}" || die
-
-	emake
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_compile
-		popd > /dev/null || die
-	fi
-}
-
-my_src_test() {
-	cd "${BUILD_DIR}" || die
-
-	emake check
-
-	if use python ; then
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	emake -C lang/python/tests check \
-		PYTHON=${EPYTHON} \
-		PYTHONS=${EPYTHON} \
-		TESTFLAGS="--python-libdir=${BUILD_DIR}/lib"
-}
-
-my_src_install() {
-	einstalldocs
-
-	cd "${BUILD_DIR}" || die
-
-	emake DESTDIR="${D}" install
-
-	if use python ; then
-		pushd lang/python > /dev/null || die
-		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_install
-		popd > /dev/null || die
-	fi
-
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	# Backward compatibility for gentoo
-	# (in the past, we had slots)
-	dodir /usr/include/gpgme
-	dosym -r /usr/include/gpgme.h /usr/include/gpgme/gpgme.h
-}
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/Manifest
@ -1,2 +1 @@
-DIST p11-kit-0.25.3.tar.xz 991528 BLAKE2B 5c695c1ef95edf4bbbab001aa634076c433df0bc89cb8104deaec2ce00c6908640e467755b49c6900e5d7d5d81e1a3871f4978a212c6f6ae088386ac0b95289a SHA512 ad2d393bf122526cbba18dc9d5a13f2c1cad7d70125ec90ffd02059dfa5ef30ac59dfc0bb9bc6380c8f317e207c9e87e895f1945634f56ddf910c2958868fb4c
 DIST p11-kit-0.25.5.tar.xz 1002056 BLAKE2B 96d6a9c2807586abafae4da4df89f566672733963997d6a83e00aaf83a7a0c0e2995638f505e98fb87a90c60bde28814f1e8b7d5071bf0af96bb0467105a1ddc SHA512 177ec6ff5eb891901078306dce2bf3f5c1a0e5c2a8c493bdf5a08ae1ff1240fdf6952961e973c373f80ac3d1d5a9927e07f4da49e4ff92269d992e744889fc94
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/files/p11-kit-0.25.3-pointer.patch
@ -1,109 +0,0 @@
-https://bugs.gentoo.org/918982
-https://github.com/p11-glue/p11-kit/commit/d49c92c8420db6ee4c88515bdb014f68f4d471d9
-
-From d49c92c8420db6ee4c88515bdb014f68f4d471d9 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sat, 2 Dec 2023 09:24:01 +0900
-Subject: [PATCH] import-object: Avoid integer truncation on 32-bit platforms
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The build fails when compiling for 32-bit platforms with
-Werror=incompatible-pointer-types:
-
-  CFLAGS="-m32 -march=i686 -Werror=incompatible-pointer-types -Werror=implicit -Werror=int-conversion" setarch i686 -- meson setup _build
-  setarch i686 -- meson compile -C _build -v
-  ...
-
-  ../p11-kit/import-object.c: In function ‘add_attrs_pubkey_rsa’:
-  ../p11-kit/import-object.c:223:62: error: passing argument 3 of ‘p11_asn1_read’ from incompatible pointer type [-Werror=incompatible-pointer-types]
-    223 |         attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-        |                                                              ^~~~~~~~~~~~~~~~~~~~~~~~
-        |                                                              |
-        |                                                              long unsigned int *
-
-Reported by Sam James in:
-https://github.com/p11-glue/p11-kit/issues/608
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- p11-kit/import-object.c | 30 +++++++++++++++++++++++++++---
- 1 file changed, 27 insertions(+), 3 deletions(-)
-
-diff --git a/p11-kit/import-object.c b/p11-kit/import-object.c
-index feee0765..fb47b964 100644
--- a/p11-kit/import-object.c
-+++ b/p11-kit/import-object.c
-@@ -55,6 +55,7 @@
- #endif
- 
- #include <assert.h>
-+#include <limits.h>
- #include <stdbool.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -201,6 +202,7 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_encrypt = { CKA_ENCRYPT, &tval, sizeof (tval) };
- 	CK_ATTRIBUTE attr_modulus = { CKA_MODULUS, };
- 	CK_ATTRIBUTE attr_exponent = { CKA_PUBLIC_EXPONENT, };
-+	size_t len = 0;
- 
- 	pubkey = p11_asn1_read (info, "subjectPublicKey", &pubkey_len);
- 	if (pubkey == NULL) {
-@@ -220,17 +222,31 @@ add_attrs_pubkey_rsa (CK_ATTRIBUTE *attrs,
- 		goto cleanup;
- 	}
- 
-	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &attr_modulus.ulValueLen);
-+	attr_modulus.pValue = p11_asn1_read (asn, "modulus", &len);
- 	if (attr_modulus.pValue == NULL) {
- 		p11_message (_("failed to obtain modulus"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain modulus"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_modulus.ulValueLen = len;
- 
-	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &attr_exponent.ulValueLen);
-+	attr_exponent.pValue = p11_asn1_read (asn, "publicExponent", &len);
- 	if (attr_exponent.pValue == NULL) {
- 		p11_message (_("failed to obtain exponent"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain exponent"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_exponent.ulValueLen = len;
- 
- 	result = p11_attrs_build (attrs, &attr_key_type, &attr_encrypt, &attr_modulus, &attr_exponent, NULL);
- 	if (result == NULL) {
-@@ -260,12 +276,20 @@ add_attrs_pubkey_ec (CK_ATTRIBUTE *attrs,
- 	CK_ATTRIBUTE attr_key_type = { CKA_KEY_TYPE, &key_type, sizeof (key_type) };
- 	CK_ATTRIBUTE attr_ec_params = { CKA_EC_PARAMS, };
- 	CK_ATTRIBUTE attr_ec_point = { CKA_EC_POINT, };
-+	size_t len = 0;
- 
-	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &attr_ec_params.ulValueLen);
-+	attr_ec_params.pValue = p11_asn1_read (info, "algorithm.parameters", &len);
- 	if (attr_ec_params.pValue == NULL) {
- 		p11_message (_("failed to obtain EC parameters"));
- 		goto cleanup;
- 	}
-+#if ULONG_MAX < SIZE_MAX
-+	if (len > ULONG_MAX) {
-+		p11_message (_("failed to obtain EC parameters"));
-+		goto cleanup;
-+	}
-+#endif
-+	attr_ec_params.ulValueLen = len;
- 
- 	/* subjectPublicKey is read as BIT STRING value which contains
- 	 * EC point data. We need to DER encode this data as OCTET STRING.
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.3-r2.ebuild
@ -1,77 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..13} )
-inherit bash-completion-r1 meson-multilib python-any-r1
-
-DESCRIPTION="Provides a standard configuration setup for installing PKCS#11"
-HOMEPAGE="https://p11-glue.github.io/p11-glue/p11-kit.html"
-SRC_URI="https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+libffi gtk-doc nls systemd test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	app-misc/ca-certificates
-	>=dev-libs/libtasn1-3.4:=[${MULTILIB_USEDEP}]
-	libffi? ( dev-libs/libffi:=[${MULTILIB_USEDEP}] )
-	systemd? ( sys-apps/systemd:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	${PYTHON_DEPS}
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	virtual/pkgconfig
-	gtk-doc? ( dev-util/gtk-doc )
-	nls? ( sys-devel/gettext )
-"
-
-PATCHES=(
-	"${FILESDIR}"/p11-kit-0.25.3-pointer.patch
-)
-
-src_prepare() {
-	default
-
-	# Relies on dlopen which won't work for multilib tests (bug #913971)
-	cat <<-EOF > "${S}"/p11-kit/test-server.sh || die
-	#!/bin/sh
-	exit 77
-	EOF
-}
-
-multilib_src_configure() {
-	# Disable unsafe tests, bug#502088
-	export FAKED_MODE=1
-
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# p11-kit doesn't need this to build and castxml needs Clang. To get
-	# a deterministic non-automagic build, always disable the search for
-	# castxml.
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	castxml='castxml-falseified'
-	EOF
-
-	local emesonargs=(
-		--native-file "${native_file}"
-		-Dbashcompdir="$(get_bashcompdir)"
-		-Dtrust_module=enabled
-		-Dtrust_paths="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
-		$(meson_feature libffi)
-		$(meson_use nls)
-		$(meson_use test)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_native_true man)
-		$(meson_native_use_feature systemd)
-	)
-
-	meson_src_configure
-}
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest
@ -2,3 +2,4 @@ DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8
 DIST eclass-manpages-20250704.tar.xz 484052 BLAKE2B 9711ec8ba766335eb73cfa69cd406960055213eb7d29f7a1e7fd1fcef504e8becc4f638eb351a54dd5032725bdcb43342dba38d80929aa8843d31be03e8332d4 SHA512 a96be86457a9268e986e07496d4a0ac07737ee58e63d7b4e7d4538519b47795d0cbf164520ab253645befeafae35e79832386a0a6dfce5f686f5c25e62a0d413
 DIST eclass-manpages-20250705.tar.xz 498848 BLAKE2B 0a7907abaf983968c219ae26f3c5f0a0e33103b94ea7afdfad06cea22810094e0fdec2bfb150def85158922a444bdb675c0ae3d618d4a6a52175b83771f9e03a SHA512 2fb686403c8307e3a5259c15abdd23bf117ca9d4bcbda2b301e68755a0ba6dc3a2a4fac48d64803cca72626e410295e8684c0a45812788353cd11366b4df8f36
 DIST eclass-manpages-20250711.tar.xz 499388 BLAKE2B 7f4df3869449444fbc8805f468ea06754b8942eef3aec362765a54ed1e81d644e104847f1ded853321b79d45bfb5f818c5da49bfa8fec9c9d482016a4d2f540c SHA512 e4922972cd282d851405f9f9a3223924df27f7edfda40f0faabcbe5d072936039998cf63823faac8e50c6fcf2851cde7d57c0eee9d291a9469c7c11d70aa5672
+DIST eclass-manpages-20250730.tar.xz 502128 BLAKE2B f798b31c2ac69ab58015941c1cc4cb51b80d70e68f1b9eaf69dcbbe9cd0b488c3b66da2852eb0d8247b62ebfb7faddd13db7a9ddfc312162e3203b09d130263d SHA512 ef8514d5cf79b2549a0bf04deff844bf2bd039644f8a8f4c31201ee681ca94dc8182484685398b432169af7d6c93e3a2794329bc703635aa965414ab32f6823a
--- a/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250730.ebuild
@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Instructions to make a dist tarball:
+# git clone https://github.com/projg2/eclass-to-manpage.git
+# cd eclass-to-manpage
+# make dist ECLASSDIR=~/g/eclass/
+
+DESCRIPTION="Collection of Gentoo eclass manpages"
+HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
+SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+# Keep the keywords stable. No need to change to ~arch.
+KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="sys-apps/gawk"
+
+src_install() {
+	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+}
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@ -4,10 +4,7 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
 DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
 DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
-DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
-DIST qemu-7.2.17.tar.xz 124405828 BLAKE2B 0613eb18a3dfc8af3c907110191eb1e639c8e4ed4ec80842f8a81e373800834ecae6701a8e87f54ea143f1d508b0799d6127ad2174cd5402ec8ad0bdc9e1e21a SHA512 8490fe388db6f72f56cf082eac6aeda6d9eed4749096d2b56dc2f878b058742b586f02fe9a13280eb408b563e8470da53e058505286683cf79a5805aefa2a06e
-DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
-DIST qemu-8.2.10.tar.xz 132685948 BLAKE2B a1e9a89ee8bdf36b597c7f59b18d19ea34a83bcbd0c3e6bc18b10b9bb1cfad50561af7814076c07da67b11ac280a1f4b39b55f80bbf715d49f264e6b67c69d2b SHA512 f847f4cf2e17b562fe974cf52ad623c516440344e708141913986130ef0436f6d31653250a458061eff7bbffacd1ec726f69964dddad08c9b907dfb90c3f48b6
+DIST qemu-10.0.3.tar.xz 135736600 BLAKE2B 382800d9a9f5241123ebeb43d8eaa6a4aaf9acae0df7a25f2c7831aa7eeb97014cff29886c53f03ea0a1ac98729b85bad1e4d5634e592a373af84f79a9219adc SHA512 7f37c2df5ac7048fb32f1d89a7c2da0929be9d2f5767bc209ca1e99167f196fb5867fc8b69f915c8c349c58089ce3d7e08c9a3f35a73223abff258b9a5bf3466
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml
@ -45,7 +45,6 @@
 		<flag name="spice">Enable Spice protocol support via <pkg>app-emulation/spice</pkg></flag>
 		<flag name="ssh">Enable SSH based block device support via <pkg>net-libs/libssh2</pkg></flag>
 		<flag name="static-user">Build the User targets as static binaries</flag>
-		<flag name="static">Build the User and Software MMU (system) targets as well as tools as static binaries</flag>
 		<flag name="systemtap">Enable SystemTap/DTrace tracing</flag>
 		<flag name="jpeg">Enable jpeg image support for the VNC console server</flag>
 		<flag name="png">Enable png image support for the VNC console server</flag>
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2-r50.ebuild
@ -13,13 +13,11 @@ QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"

-PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 PYTHON_REQ_USE="ensurepip(-),ncurses,readline"

-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils

 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
@ -27,11 +25,10 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
-		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
 	)

 	for proj in "${!SUBPROJECTS[@]}"; do
@ -47,7 +44,7 @@ else
 	fi

 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi

 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@ -66,14 +63,13 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"

 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@ -84,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@ -142,6 +137,7 @@ REQUIRED_USE="
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
 	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
@ -173,19 +169,19 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/gtk+:3
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@ -236,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "

-EDK2_OVMF_VERSION="202202"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
 SEABIOS_VERSION="1.16.3"

 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@ -288,8 +301,9 @@ BDEPEND="
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
@ -315,9 +329,8 @@ RDEPEND="
 "

 PATCHES=(
-	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
@ -325,6 +338,7 @@ PATCHES=(

 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@ -368,12 +382,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.

 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.

 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm

 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@ -402,6 +416,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"

 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@ -475,6 +491,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres

+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@ -631,6 +651,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@ -673,6 +694,7 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
 		local static_flag="none"
 		;;
@ -926,16 +948,6 @@ src_install() {
 	readme.gentoo_create_doc
 }

-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@ -949,7 +961,7 @@ pkg_postinst() {
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog

-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"

 		if has_version 'sys-firmware/edk2-bin'; then
@ -969,8 +981,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.2.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild
@ -7,31 +7,34 @@ EAPI=8
 # Set to 1 if prebuilt, 0 if not
 # (the construct below is to allow overriding from env for script)
 QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
-QEMU_DOCS_PREBUILT_DEV=ajak
-QEMU_DOCS_VERSION="7.2.0"
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"

-PYTHON_COMPAT=( python3_{11..12} )
-PYTHON_REQ_USE="ncurses,readline"
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"

-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils

 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0

 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
-	EGIT_SUBMODULES=(
-		tests/fp/berkeley-softfloat-3
-		tests/fp/berkeley-testfloat-3
-		ui/keycodemapdb
-	)
+	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
 else
 	MY_P="${PN}-${PV/_rc/-rc}"
 	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
@ -41,7 +44,7 @@ else
 	fi

 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi

 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@ -54,20 +57,19 @@ SLOT="0"

 IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg
+	jack jemalloc +jpeg keyutils
 	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
-	smartcard snappy spice ssh static static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"

 COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@ -78,7 +80,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@ -129,17 +130,17 @@ REQUIRED_USE="
 	qemu_softmmu_targets_riscv64? ( fdt )
 	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	virgl? ( opengl )
 	virtfs? ( xattr )
 	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
-	plugins? ( !static !static-user )
+	plugins? ( !static-user )
+	xdp? ( bpf )
 "
 for smname in ${IUSE_SOFTMMU_TARGETS} ; do
-	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
 done

 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
@ -155,12 +156,12 @@ ALL_DEPEND="
 	sys-libs/zlib[static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	systemtap? ( dev-debug/systemtap )
-	xattr? ( sys-apps/attr[static-libs(+)] )"
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"

 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
 # softmmu targets (qemu-system-*).
 SOFTMMU_TOOLS_DEPEND="
-	sys-libs/libcap-ng[static-libs(+)]
 	>=x11-libs/pixman-0.28.0[static-libs(+)]
 	accessibility? (
 		app-accessibility/brltty[api]
@ -168,7 +169,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
@ -180,10 +181,7 @@ SOFTMMU_TOOLS_DEPEND="
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3
-		x11-libs/libX11
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@ -192,6 +190,8 @@ SOFTMMU_TOOLS_DEPEND="
 	jack? ( virtual/jack )
 	jemalloc? ( dev-libs/jemalloc )
 	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
 	lzo? ( dev-libs/lzo:2[static-libs(+)] )
 	multipath? ( sys-fs/multipath-tools )
 	ncurses? (
@ -207,7 +207,8 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[egl(+),gbm(+)]
 	)
 	pam? ( sys-libs/pam )
-	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
 	pulseaudio? ( media-libs/libpulse )
 	rbd? ( sys-cluster/ceph )
 	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
@ -221,8 +222,8 @@ SOFTMMU_TOOLS_DEPEND="
 	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
 	snappy? ( app-arch/snappy:= )
 	spice? (
-		>=app-emulation/spice-protocol-0.12.3
-		>=app-emulation/spice-0.12.0[static-libs(+)]
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
 	)
 	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
 	udev? ( virtual/libudev:= )
@ -231,17 +232,34 @@ SOFTMMU_TOOLS_DEPEND="
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
 	xen? ( app-emulation/xen-tools:= )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "

-EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
+#
+# With USE=+pin-upstream-blobs we pin firmware versions to known good
+# version in order to  minimize the frequency of disruptive changes. This
+# avoids unnecessary frustration on user side because changing the firmware
+# version can break resume of hibernated guest, inhibit live migrations,
+# and might have other unwanted consequences. For now, let us try to
+# synchronize firmware blobs with the ones bundled in upstream qemu. Simply
+# check the upstream git repository for any changes, for example:
+#   https://github.com/qemu/qemu/tree/v10.0.2/roms for the 10.0.2 release.
+#
+# When changing pinned firmware versions
+#  - create a separate ebuild with revision -r50
+#  - update the FIRMWARE_ABI_VERSION to the current package version
+#
+
+FIRMWARE_ABI_VERSION="10.0.2"
+EDK2_OVMF_VERSION="202408"
+SEABIOS_VERSION="1.16.3"

 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@ -256,7 +274,8 @@ X86_FIRMWARE_DEPEND="
 			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		)
 		sys-firmware/sgabios
-	)"
+	)
+"
 PPC_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
@ -269,57 +288,57 @@ PPC_FIRMWARE_DEPEND="
 	)
 "

+# See bug #913084 for pip dep
 BDEPEND="
 	$(python_gen_impl_dep)
 	dev-lang/perl
-	dev-build/meson
-	sys-apps/texinfo
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
 	virtual/pkgconfig
 	doc? (
-		dev-python/sphinx[${PYTHON_USEDEP}]
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
 		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
-	!static? (
-		${ALL_DEPEND//\[static-libs(+)]}
-		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
-	)
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
 	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
 	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
 "
-DEPEND="${CDEPEND}
+DEPEND="
+	${CDEPEND}
 	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
-	static? (
-		${ALL_DEPEND}
-		${SOFTMMU_TOOLS_DEPEND}
-	)
-	static-user? ( ${ALL_DEPEND} )"
-RDEPEND="${CDEPEND}
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
 	acct-group/kvm
 	selinux? (
 		sec-policy/selinux-qemu
 		sys-libs/libselinux
-	)"
+	)
+"

 PATCHES=(
-	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-6.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )

 QA_PREBUILT="
 	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
 	usr/share/qemu/openbios-ppc
 	usr/share/qemu/openbios-sparc64
 	usr/share/qemu/openbios-sparc32
@ -331,7 +350,8 @@ QA_PREBUILT="
 	usr/share/qemu/u-boot.e500
 "

-QA_WX_LOAD="usr/bin/qemu-i386
+QA_WX_LOAD="
+	usr/bin/qemu-i386
 	usr/bin/qemu-x86_64
 	usr/bin/qemu-alpha
 	usr/bin/qemu-arm
@ -362,12 +382,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.

 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.

 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm

 If you want to register binfmt handlers for qemu user targets:
 For openrc:
@ -396,6 +416,8 @@ pkg_pretend() {
 			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
 			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
 			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"

 			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
 				if grep -q AuthenticAMD /proc/cpuinfo; then
@ -442,6 +464,23 @@ check_targets() {
 	popd >/dev/null
 }

+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
 src_prepare() {
 	check_targets IUSE_SOFTMMU_TARGETS softmmu
 	check_targets IUSE_USER_TARGETS linux-user
@ -452,6 +491,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres

+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
@ -463,13 +506,8 @@ src_prepare() {
 	# Verbose builds
 	MAKEOPTS+=" V=1"

-	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
-	# this setting (-U then -D..=2) will prevent us from trying out 3, so
-	# drop it. No change to level of protection b/c we patch our toolchain.
-	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
-
 	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
+	rm -r roms/*/ || die
 }

 ##
@ -497,7 +535,8 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
-		--with-git-submodules=ignore
+		--disable-download
+		--python="${PYTHON}"

 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@ -516,6 +555,7 @@ qemu_src_configure() {
 		--disable-gcrypt
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
 		--host-cc="$(tc-getBUILD_CC)"

 		$(use_enable alsa)
@ -524,6 +564,7 @@ qemu_src_configure() {
 		$(use_enable jack)
 		$(use_enable nls gettext)
 		$(use_enable oss)
+		$(use_enable pipewire)
 		$(use_enable plugins)
 		$(use_enable pulseaudio pa)
 		$(use_enable selinux)
@ -582,6 +623,7 @@ qemu_src_configure() {
 		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
 		$(conf_notuser lzo)
 		$(conf_notuser multipath mpath)
 		$(conf_notuser ncurses curses)
@ -609,6 +651,7 @@ qemu_src_configure() {
 		$(conf_softmmu virtfs)
 		$(conf_notuser vnc)
 		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
 		# use prebuilt keymaps, bug #759604
@ -622,6 +665,7 @@ qemu_src_configure() {
 			# Note: backend order matters here: #716202
 			# We iterate from higher-level to lower level.
 			$(usex pulseaudio pa "")
+			$(usev pipewire)
 			$(usev jack)
 			$(usev sdl)
 			$(usev alsa)
@ -637,7 +681,6 @@ qemu_src_configure() {
 		conf_opts+=(
 			--enable-linux-user
 			--disable-system
-			--disable-blobs
 			--disable-tools
 			--disable-cap-ng
 			--disable-seccomp
@ -651,18 +694,18 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	tools)
 		conf_opts+=(
 			--disable-linux-user
 			--disable-system
-			--disable-blobs
 			--enable-tools
 			--enable-cap-ng
 		)
-		local static_flag="static"
+		local static_flag="none"
 		;;
 	esac

@ -670,12 +713,12 @@ qemu_src_configure() {
 	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )

 	# Add support for SystemTap
-	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )

 	# We always want to attempt to build with PIE support as it results
 	# in a more secure binary. But it doesn't work with static or if
 	# the current GCC doesn't have PIE support.
-	if use ${static_flag}; then
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
 		conf_opts+=( --static --disable-pie )
 	else
 		tc-enables-pie && conf_opts+=( --enable-pie )
@ -855,7 +898,7 @@ src_install() {
 	doins "${FILESDIR}/bridge.conf"

 	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	dodoc MAINTAINERS
 	newdoc pc-bios/README README.pc-bios

 	# Disallow stripping of prebuilt firmware files.
@ -905,16 +948,6 @@ src_install() {
 	readme.gentoo_create_doc
 }

-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@ -928,7 +961,7 @@ pkg_postinst() {
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog

-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"

 		if has_version 'sys-firmware/edk2-bin'; then
@ -948,8 +981,7 @@ pkg_postinst() {
 		ewarn "This might break resume of hibernated guests (started with a different"
 		ewarn "firmware version) and live migration to/from qemu versions with different"
 		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
+		ewarn "guest migration ensure that all hosts run at least"
 		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
 	fi
 }
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -173,7 +172,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@ -27,7 +27,6 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=()
 	inherit git-r3
-	SRC_URI=""
 	declare -A SUBPROJECTS=(
 		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
 		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
@ -172,7 +171,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
+	bpf? ( >=dev-libs/libbpf-1.1.0:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@ -26,6 +26,7 @@ DIST bash-5.3.tar.gz 11354270 BLAKE2B 88a4f0146eb11698120890f2afaf28210295135f8f
 DIST bash-5.3.tar.gz.sig 95 BLAKE2B 90a6a47b5b318d03ff7e196e6504a987c281f564db878e8452f0543953832b5ac4f767f69a9bdf6b6a98938b0b439040c10674dd54e38ef03730ae6a2ec4484e SHA512 e9da98e993528d69bec9c6da272eb7a96858b4ba33487435f584c7df2d73c3ce82f373b5277cc3a7d8dc9ee04410dc06ce476d3f9ade097121bea0570abe07bc
 DIST bash-5.4_alpha_pre20250711-80a8f650a1defc3f72539c3b57bf6d228c33c116.tar.gz 16111994 BLAKE2B 7ab445c5580c3c8d0af10a6764d65a33705f42ed79c50297a4cbf3b345b2f0ba9f28001a80ec5cc85291f57f88e81aef41492a79779239a33292b460e4361d8f SHA512 64f5985ad9a94fd37bc5efa06a57b72c5b3ec8d43a0ed36d9cdc9f292b37137e035bcba0d9855965e0f7bc2416ae60ec44d8f19ee2201acef01d3eda43d8989b
 DIST bash-5.4_alpha_pre20250718-01070d43248fb97f3b2a08d780ae5a392573ce34.tar.gz 16112469 BLAKE2B 6ebcf65b4f1ae93f52d549d2c6836cd4ff7e87739efa9746ef10f00bf6010f00d957c0624e3b806c4d581539f9160338a00824302b245f4c82c72c416976a0f0 SHA512 b200d62eb6634bf9f623841b7a024dc8b3a89c43b8e127dbc89dbf06f3df793d82ad37d35e1be43558ef97c473e37e44384d8c73736c7b62794e65dcfb8f30ce
+DIST bash-5.4_alpha_pre20250801-c1d9c088531eef0797e78c66b899d895862de80c.tar.gz 16116027 BLAKE2B 1be7657f61e91acc9e5e3bb9d5051f4d9e6f29e5457db544ebd26ac4ff7931925732d8b81de243bf6374ba3ce3aaa133ec6a33f03133e22317d712e696847bed SHA512 44c890bd46ec87ba11b78a0a817ed42544d32df12270c9766f78418e966d3247457facad0e4dcdbf07fd9a6a8865029f3eb3a93c485e01506d67d4ed1c156670
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
@ -450,3 +451,9 @@ DIST bash52-036 5941 BLAKE2B e86b0df8ea7ace1ce4bc6f269de389f2f85fbe20e59e6a1e88a
 DIST bash52-036.sig 95 BLAKE2B 5ed270f26471e08456f73498ea8110c514b8e1bae424182f4cf530ab6e4f89a7946cabd3f7dd703f4f4bab7de9c73922e7be688df18df485cd64a33ce98df223 SHA512 7a26b606ab0d7a5716ac49bd1492e3b3480c3764aaec64e1763a2beda7a962c81a4066887c950b3bdd1ada317b790bd985f8b858e78c7cb8eb4a2bd02f1b07cd
 DIST bash52-037 2835 BLAKE2B 4af190d53b498d6d4403f64f39060f1add17edfe3e48b4b58a4377d1e96caa93017aed3df7011a64c99fd908af967603ed287e6bbb0380a8569d170779d8f26a SHA512 3e104dff63dabceea2f56f9dc58869d48a71ce61c3c8aff4f289d2f4a47d4325e70178d520c265a25ddb2227e0b78f08177fcd594470e5e81f4116aad282b4de
 DIST bash52-037.sig 95 BLAKE2B e3cfa89933fe59159a44dc20832406d3c42e28ac0c33674bf369a2f20a1d9de3e985bd178640f17be7b45a4fe3f96c72f80124384cec42fa263eb95586150a3b SHA512 437a69a167a4b889fca40b03eb2dcaa1ddc53db8fde924a6f8bcd21c3ac0c7629cb87b7bc08fa3b16f46b05c6a198a01dce6af3d2b761429345acd361df105dd
+DIST bash53-001 1531 BLAKE2B ca275ade6a7132d316a4d1ffd401c9bfc6de691c58531385d85087c4d50723aeacb5b4bc7abef0165b4fb3cbed146a0fefd9dae4c99c1547f61618798a772d29 SHA512 66d0987f1a8951974c3a707a1980ef391a1f2a2938f0fa46adb77fcdcef6a3ca49e67182b9640ece3e59bb289e5b4a17eb870aa2a525a03e829a7be158d020a6
+DIST bash53-001.sig 95 BLAKE2B 3f795e8881a9ff075b62ba1b3b87610632509b94472d28f04b20cc60f3023c6237dfcaaf030aa1e9533eb87f70ab2555472d22ef9cb6e3f1a9cb1c56467fbc13 SHA512 e27cac36d8f513a255e928b01661aac3c1a594fd254ceab119dcba662e9344ac8807be679953def9a2aab59035836c3e6a2aa7f1b21b6eec1f381dfe286099f5
+DIST bash53-002 2635 BLAKE2B fec52c475b8126774290eab7a514f8145ae51edab150d413c09f5540719c9578fe1cb99987b6190a9cd82bd947e059c32e740a03d26e9d472af51356cafd8a32 SHA512 05caea1c1f5a3d27f2aa351c24f324f9d544ded89db4183ae2872e0283dde62dd6166ca4e780304398935b4aa3fb4db77ecf57acd0f0e295d279ffe40b772158
+DIST bash53-002.sig 95 BLAKE2B 576dd4535af85d122f62e310ddae5cf7eec4ada59b5c73c5a891f3bc50cb6bbad8b47cd74d8c7a868381d340d1c7391f52f7a6f34ae99caf6b4ee290d2808849 SHA512 bd64fc61e5516a636a039c51a33f72e9adb7761d4e4101584b7dc3b43198be026c4165d6a34ca77e1ea5d4122b942dc853803a0c836bffc618aae9f7f8c008aa
+DIST bash53-003 2683 BLAKE2B 6bb6f6679726d65f95c11b4ac1fb0729eaebfeef02de06e9fda4e3ac2bb3d328cc6f7fd6e29976a0907390ed6709cd5a0a6046682acbed73eb0470143bf144e1 SHA512 3d4004653cb3f2cba984e67b8e7ae54c19351e176b62bb415f88fdd482ae04be063dacf6303c8343ab6c8bf4f2388026c1742ac603a5cd5c330db22a4b76f4cb
+DIST bash53-003.sig 95 BLAKE2B 9827f23ea927f39dd20316eec8b311bc7692c5645a77e15eba31d17252a0035d401f620ed9b51b62f643ae0c6c1ed9340e413564151da884b9361d8026557a06 SHA512 f128a82d19d83da70a8c72f3fca52a376a96a31be2b8e94ffd073329a254c5e9f3a231a4b29d33efe12c0b9a20a4c293331c5fc55767fb3538a6208996b7e2bb
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_p3.ebuild
@ -0,0 +1,404 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="b35866a2891a9b069e37ca5684d4309c0391e261"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.3-read-sys.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.4_alpha_pre20250801.ebuild
@ -0,0 +1,403 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel. See ftp://ftp.gnu.org/gnu/bash/bash-5.2-patches/.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+		;;
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="c1d9c088531eef0797e78c66b899d895862de80c"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( "mirror://gnu/bash/${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( "mirror://gnu/bash/${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	if tc-is-cross-compiler; then
+		export CFLAGS_FOR_BUILD="${BUILD_CFLAGS} -std=gnu17"
+	fi
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color-r2.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r2.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
--- a/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/gentoo-bashcomp/gentoo-bashcomp-20250620.ebuild
@ -11,7 +11,7 @@ SRC_URI="https://gitweb.gentoo.org/proj/${PN}.git/snapshot/${P}.tar.bz2"

 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"

 src_install() {
 	emake DESTDIR="${D}" install \
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@ -18,6 +18,10 @@ DIST meson-1.8.1.tar.gz 2332007 BLAKE2B 8fa77bd0e1494d94de585f8f740cb01dfc302fef
 DIST meson-1.8.1.tar.gz.asc 833 BLAKE2B a31c10eb386597049eed127987dfa32f044fbd2ec0261fa0547c066a47a57e27893821f80eb6a7ad82fd72278ff77abdaf4a88fd057b9b960edd8626530a17be SHA512 5d6a0681ccd1132f86904b88fdef4838a9de403d29b6dddb8d8626ce3f1e9d1d911b79f821aa81cd1421fd4c095ca488494a1b77e59f94ba616504eef251dbc7
 DIST meson-1.8.2.tar.gz 2335538 BLAKE2B c3a4e2c505af02b85407f66bb076d4c1a96ca0fde85576d26d8ad6522dce8107f1bdb97c771b0f28e527da0383853b36cd56e8533d5be175cf62b7fbadca40b6 SHA512 d3d87c806a0ac8405af9205cc2c9a5f2dbeda8639506bf96bfb3821aa8184c185a1afc29738a54b47902ef830c1b5253e3ee3542a3f9bbc8fd91b9ea02f0a0b7
 DIST meson-1.8.2.tar.gz.asc 833 BLAKE2B c59ef68cf74daf9658c6589cc037a21bbc9fa03134093b1a30425ba19a69036868c1c7bd1c7f26b486a6eb9e6e13796f02b52e7caa78701d546d9da3f7591b41 SHA512 9f6dbe0329a8f1685110fadd803239eb675b67f59f2f1988494ec6e95110aca754ff7dbb6edad708c53b9420bd09c2d115af5f9f879175a9e37cb28f978add8b
+DIST meson-1.8.3.tar.gz 2335924 BLAKE2B 3c440854bd91c757d4370b498f0e6e903df4589f4958e05fa16ae70e6efc01d2e96f101612146556b81cc3db370255f4319bd5d49d8e46210df282cc447ec12e SHA512 effd6f556152e508185a5bc59131b3a31696577298aec5f3d3ab68153ade9e98242171d6b72c00f8c32fc3492aba3487252d77a94a96b5a92e89724de045d49b
+DIST meson-1.8.3.tar.gz.asc 833 BLAKE2B 25f00f76819c74e64b3750ddd4507fdd8a0be764db54ea48ba49f0985bfbf04d294e5eff1ee799ec082cba24ed59b21a8fd75f81dee9d824e5f8cd9c775b0dcd SHA512 9c28747ff4756422dae4eb4a86de24fe230e6676660aa9cfb72d29311012106a9edbcfff3559682917a7e0ed8c80af8b8ec37807d3f7e0f4005eed5793367307
+DIST meson-1.9.0rc1.tar.gz 2366185 BLAKE2B 83405d3daa8caf95a2991249abdb2f3f32b2508c93cfcdc36451290989778d98173dea932520e27005d28bac19ca28024be8914122bd516b8efd2c56b52b85d5 SHA512 7f892004aae8f2618d03424829fa053560ec3ecf04a32c691769356ac671358616c512fa0efd1f37f3e33702bf2b907150059faf6e305ecf6f786463194cacab
+DIST meson-1.9.0rc1.tar.gz.asc 833 BLAKE2B 55ec82df85b58697116f4dc0014f2b49bfcd49facf92db28d8a73ee4a3928d38cabfe32fdef773ad7e0f453cc1e271b9b7b599b1e2156f6835e2bc85f2685417 SHA512 de12d08222a1d3bba245b1aba06ef49c711214271883a7c92d0cc7936e005a361a347b5fe5592c1e7bd9aac4a752edd854831290dbb8cbf8464658271de6d9b2
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
@ -25,3 +29,5 @@ DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150
 DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
 DIST meson-reference-1.8.1.3 345633 BLAKE2B 026423161eeddff3e663016c4b3fff885e96dc1a652562fe312cb80cfcc845015cab0d0f51c39f187cc484752f8f2bf7954dc8daf6762a74f895338cac4c35c4 SHA512 d3041eee86e63c178a04d5ec1ec383e7bbd209f358103806d488b28383471c1ecb5a13aa3716f699c1973a1d32dace34b0fdb0375e19abc0050deeb66fc5d376
 DIST meson-reference-1.8.2.3 345633 BLAKE2B a53888284967c1beb8875a380eb7fd58402db0ae8d3357f47cd265a1695f73f85dd5ef6c36ee95252012120f3b904d74dabcbd4b1aa4174975b1d1899d30283c SHA512 b40904bebedc678f4e8567cd0b6a377a678d4f3fa13feb5d978d65b39a308b607c78adfc6b742f9d7c2f2c57e7b011f52d875e97b85f1c4ffbfd4ebe52814443
+DIST meson-reference-1.8.3.3 345855 BLAKE2B c8825ba7b72b36866ebfa8cdf63362f2d38673315378ea213c438057f5dafa36b9e729e8c415a29715c1da4fe72733a4a6a2cdbee4b7df57e5eb97f50152491b SHA512 3085c10cfc08ce4f0edad7129ce4d9a0bf75c6522309e344ba14e27c34d46c3da25ebb46260de28caef4a6c8134857d63297ded26f1296639a8a097e62a1801c
+DIST meson-reference-1.9.0rc1.3 347290 BLAKE2B 3aed4aa402e25d3c16c38a7637d318f67dd0c37a7edad6ceaa9f867132bf2709be0b874a57a8ecad30e2a30f8daba6e0802198a4b0747372850493429b2d12d1 SHA512 9c493127efdb3420f863f9b1b357661c661dfdb1510638e9264c14c6291e9c7cf8cbed2b5611fe19afc076326f4031a7bc6fe7f023b547c123c81455b2026189
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
@ -84,6 +84,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools

 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.8.3.ebuild
@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.9.0_rc1.ebuild
@ -0,0 +1,231 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	dozshcomp data/shell-completions/zsh/_meson
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@ -3,7 +3,7 @@

 EAPI=8

-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools

 inherit shell-completion edo distutils-r1 flag-o-matic toolchain-funcs
@ -87,6 +87,7 @@ DEPEND="
 		dev-qt/linguist-tools:5
 		dev-qt/qtwidgets:5
 		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qtdeclarative:6
 		dev-qt/qttools:6
 		dev-util/gdbus-codegen
 		x11-libs/gtk+:3
@ -119,6 +120,7 @@ python_prepare_all() {
 		# https://bugs.gentoo.org/673016
 		-e 's/test_generate_gir_with_address_sanitizer/_&/'
 		-e 's/test_env_cflags_ldflags/_&/'
+		-e 's/test_c_link_args_and_env/_&/'

 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@ -5,6 +5,7 @@ DIST sqlite-doc-3490200.zip 11340124 BLAKE2B 56c1456f5720ee98553350790232d043caf
 DIST sqlite-doc-3500000.zip 11367399 BLAKE2B 3356bfc188a8827dbee655df559e0c12391e74d7d1a8afff47f19fd4e6136f30b8eaf43ad1a51da39b9e8e4259e24dc5c4f976d96ea5be008219b4caa48cd105 SHA512 bc385c3d47f738547eac353d78121076bc188cb972b78b5ef8176da91e7c325e99111ebdd80f93538254562281113a527bbfbcd687923874291f19481980cb22
 DIST sqlite-doc-3500100.zip 11377048 BLAKE2B 1634de3e4e31661d0039a62c362f3668b47bc01b3220c82e97d93f8d93a3502960d7fbd1d26dd1a3a6924d795fa50a61273956ccec14c0c4b596b117517ee598 SHA512 a4be8415e07750e6e414fbb3282087438dabf0a36cf81c60052e78618264688784da98ee30ad476fbc47fa405f5cc0d2db92010a1173d0b65a58608177e12589
 DIST sqlite-doc-3500200.zip 11382890 BLAKE2B f7cea3721d77b32ac4b4c514023750aae8fd95e417fa594452b6f29aa56a061f4177187effaad82d25b868076c6dd8b15db08cf5b9353aa6be06e9938be73e9d SHA512 d1dbec8bc41cc83d2fd048cdc353e44f1ae4a60949aabec1e5aee50485f8535efba85bdae88f93785c8e53d48feb76b8143f272d70f73ce13368815f978bd4bc
+DIST sqlite-doc-3500300.zip 11390337 BLAKE2B ba6d03c78d7c3c865f6ef7fab4077b5eac17c77bba6f64c8fec440da21611e03bf1c558cad1b45b20c30ac01c112624d7e14db273cba0f8023029e041f035de2 SHA512 abd9f19574268d11e8980166c257b7e7361c9fbdb5508fbcb67bb855809a4d7823f658acfeb8c48a142508a5a355882b4f4c976ffd53071f13357c4c5892c861
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
@ -12,3 +13,4 @@ DIST sqlite-src-3490200.zip 14377708 BLAKE2B b455388c3c9d0424b7f36b5ab41b7506f52
 DIST sqlite-src-3500000.zip 14387288 BLAKE2B 9df808ca2e754d8196c19bba3eca370b7675edb89c1fe3bce4d50f848132a5a67079ef6bfceef44fafc7f96f2ded495416093dcda821ea64e06b04b81f3678f1 SHA512 d1b14906011c22bdb1a77e2668aceb42ea912047d8c6358e68fd4097cdaf1dc932ad47f3e621b5242c0c30366a1ecea26c170cd21ff4153d4f0c91d4b9c9eb14
 DIST sqlite-src-3500100.zip 14391009 BLAKE2B 4e8568e3994b6fc63f0d27e035001fcf4798b6dda50e9a52943b618a5585c87b2658b57f7153361253bf574f2948c0f44436514c890f1e98f7d816e77d3b985c SHA512 20d5bda28ab6a9edff28c7a7b5c36b3aeabf34758560e87205626dad4202cd2e1e0e01226791e866e995423f7c76e89f26da49515f47c774a3241f59228a27f7
 DIST sqlite-src-3500200.zip 14392422 BLAKE2B d1d21b53e4eb5b4a89d1460e2a1f57f198fa194efa804f1eb71a747d8a8ff75240f7d2757bee537b901830c359b42d7639943f59d28623bc2fb3c870b725debf SHA512 827c78b2bfd823626cdae6a88fff882cbd90430babfab6c6fd224cf05c8764b43499184a4f07293fb00bfcbbaedfec958d1afbfe4431ea9b24b189c561213e7d
+DIST sqlite-src-3500300.zip 14393097 BLAKE2B 98c751f9d2aeaaef11d447b2921c7d9df160cdf74231d92f83b49a94df96bf3e09ba99a2aad54e85029f483c864430950f5869146f453accf4319b11cb30a825 SHA512 b09293191341df781353d1f76e7280b806e79ec79857e6ab881e4a0a2311ae8d524c2a918f1beeb007b487cc5615ad5c5ca96e2657c1e9853b2e727f637bcb5f
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.50.3.ebuild
@ -0,0 +1,444 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
+	options+=( --enable-fts4 )
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	options+=( --enable-memsys5 )
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	options+=( --enable-rtree --enable-geopoly )
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	options+=( --enable-session )
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		options+=( --with-icu-config )
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
+	fi
+
+	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
+	tc-export_build_env BUILD_CC
+
+	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usex tcl 1 0)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/Manifest
@ -1,3 +1,4 @@
-DIST go-md2man-2.0.3.tar.gz 64961 BLAKE2B 790fe7c247e0f934a397d7389be589c6e4d75be3cd533da13ae4e46c927604c3249e3a2f0c975320bac0f21f3040059202434f6fd4b2ea6dd50d6b772fa01842 SHA512 237e8039beea11b4efb7d0c75fb5826c17dea50057b0149b9533e72e2a5198811f9a3a5b264ea3788922d2f03b07cb57914448b2d4325d54d0f946fb42c42f40
 DIST go-md2man-2.0.6-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
 DIST go-md2man-2.0.6.tar.gz 11064 BLAKE2B fec5c061c5d1b85e3ad86563a301afd01d47f2d83ef5b97bf964f77ebbbbb19c58108ecd8caa9df1663396a13c8b178578a9b02c3c30341cea0bb9abe1d196ea SHA512 c6273040edf7e4c97851c0bfb5366ed0298e92ff1f7f4740104979f1cac17d6303b998ff75396a4264b164872886854e7dadfee3f139d76f684c1b6ca5512828
+DIST go-md2man-2.0.7-deps.tar.xz 76368 BLAKE2B 010d274d5e5c20e14848e92b210b03447d11c6fe8fd728b0f148a6f2cbc9f0a7cca22217f1920e00b0f7c363bbe2c5f572fb95ce02e67e3e55175c56cbd372d9 SHA512 7abc4eb75b4a168f2269936049eaca68ecb9ed39b29e6885cddf3683daf9b439b1573848192dff98ce67b99da0d1f09ddc27261e97c8cdfeb71e09e0030876b6
+DIST go-md2man-2.0.7.tar.gz 11337 BLAKE2B 4b82e6cff896317e555b0eb50da69e9c29b9532d115e3c9b2c5a9c98681ba2726db81bab6dc8fac95a2dc4ca32f9e99161c0a8943001863ef68191acf8fd6c09 SHA512 cc6878af3cfdb0c06ee46b39aa407ec5e48814dc8f68eeae885607407833ac263995fe61c0870217e7c2b2102904f1cf732fa210d89ba38e2443ab1436212905
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.3.ebuild
@ -1,32 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit go-module
-
-DESCRIPTION="A utility to convert markdown to man pages"
-	SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-HOMEPAGE="https://github.com/cpuguy83/go-md2man"
-
-LICENSE="BSD-2 MIT"
-SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
-
-# restrict tests because they need network-sandbox disabled
-# bug https://bugs.gentoo.org/715028
-RESTRICT+=" test"
-
-src_compile() {
-	emake BUILD_FLAGS="-mod=vendor" build
-}
-
-src_install() {
-	"${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1 ||
-		die "Unable to create man page"
-	dobin bin/go-md2man
-	doman go-md2man.1
-}
-
-src_test() {
-	emake test
-}
--- a/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-go/go-md2man/go-md2man-2.0.7.ebuild
@ -0,0 +1,30 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo go-module
+
+DESCRIPTION="A utility to convert markdown to man pages"
+HOMEPAGE="https://github.com/cpuguy83/go-md2man"
+SRC_URI="https://github.com/cpuguy83/go-md2man/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/dev-go/${PN}/${P}-deps.tar.xz"
+
+LICENSE="BSD-2 MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+
+src_compile() {
+	emake build
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	dobin bin/go-md2man
+
+	edo "${S}"/bin/go-md2man -in go-md2man.1.md -out go-md2man.1
+	doman go-md2man.1
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.11.ebuild
@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 ~arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.5.ebuild
@ -20,7 +20,7 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="-* amd64 ~arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 	;;
 esac

--- a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
@ -3,7 +3,10 @@

 EAPI=8

-PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+# This is just a stub for tooling, see the IUSE hack below. Don't panic
+# if the array here doesn't contain the latest impl. If you can't use a
+# new impl., it's likely because it's a stable-masked flag.
+PYTHON_COMPAT=( python3_{11..14} pypy3_11 )

 inherit python-any-r1

--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@ -12,17 +12,26 @@ DIST Python-3.13.5.tar.xz 22856016 BLAKE2B 9caacad8745dcd238b208022cb140a6655ae5
 DIST Python-3.13.5.tar.xz.asc 963 BLAKE2B 2db0162d18129ec42b48393108a72c28e7f8f8c3fa40b2e231c87fe0bdc3c166fb6ca4a1c1dfb3fffe1aa0c2618c7ccb245513beb7a0919b4aaca5ec7eb23b36 SHA512 07c1a2ec2d6ba2805680b7f1dc262fdc5dc3eec4503780ecdc08cd570ccbb5f1efa736ee03c83d36bdb33ce87db06be5892cf5a6eaf4018d5fe78fff99e615ae
 DIST Python-3.14.0b4.tar.xz 23641472 BLAKE2B e894c115d50371e2ecfd5c0cf79f37d3bff230338524bbb2352af8e42d256cd8fe17a38c68769d3125ddcae33500fd151ed64b5641d7f35f4b8968fcae9e31b4 SHA512 faaea000a474430a4ee41bdc95f9a77aa6573354698bc987a7617a6d36eae4b8e7f02ac945eb5b97df8dc62a256725ccd59fec08d4af2bd7b6e8a31ef4f92e2a
 DIST Python-3.14.0b4.tar.xz.sigstore 5038 BLAKE2B 95bd040d9be4d746b8d1a5a7486d309783248093b032b85ac5e7e7eaf35caa99b43bf3bf7c3ad69635a7b4f14bf6e42a9ba0b54d19986069b5dc075d17a8ddd5 SHA512 3e2a7a73d5cd98e4e8139ef89bf75c1213459db7634bb57ea2de126ff403e7f9244ec6fca525bcb55b9cd5342cbc80d659772709ebf405d330dcd4f14f93a7cc
+DIST Python-3.14.0rc1.tar.xz 23661916 BLAKE2B 77657bb87fe5a8ef538d97ca5ab39be8243d222400f0439ae6a719f528f19d79a22b3c0832c8e0ed9650e8d18a546cec4f40dd881d142b0739e97add688662be SHA512 6f34f593713282e105f9cf0396c523f738f3e4e8c2d4bcc4051c9febff96ab521e67abfe5fd072d7f584c3afcc7acb96a42939f51259ea411308a48468f7fd4e
+DIST Python-3.14.0rc1.tar.xz.sigstore 5134 BLAKE2B 10f93540d5acfcd1509826b606d5a2ded0b40c5c60951c893d18c1baa39d8189ac15fa586fcd34318ac6cfeb4c9ad51a86936849a8cdcbb179a11cc86f5f3189 SHA512 0ecd23bf303e42be6f639d55e2b00c13a87caf512923fd529b2661de6e73f76491def062037befbefd6c2fcf2608ae8cb27faae7431137b53e60c8cc20fec740
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.23.tar.xz 19659284 BLAKE2B 17c7c9acec1e2f2e9d146b2c35738ea05cf16609f267dd784668ab43bcce7be93e164c14106f9640a060326ebb2b8bd4ee4e58086bdced4ca611d7f96dbb3699 SHA512 ad2eb2eebff286a16ad631339bc0890b0686cf5e669d28905a98f96e9b1af6673d255f36bf19e146aa4de8d012587dc6b3193e903718f9cdba4b97041318f418
 DIST Python-3.9.23.tar.xz.asc 833 BLAKE2B a17a88b1997ece75e6447398d20c67e4b1be6d64204e6ac20aa4650e465b0657e7ae8bd497602d2e3c7193b50ecf7d15a1eb996942a05aab117eb25446dab159 SHA512 10187b0df66743308548780f82872d032530f8233f539cf66a2cfbdef1095b760f81f2fcc1759f003cc6f20752be91bdef71e4d821e76a75c0c85df112335698
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.18.tar.xz 29664 BLAKE2B dd69f7866cebad2536b41056571d74cbd90800062b06612b7509c9ce8f258aef66586f3c6e08f52caaceb7b0a01a52502b9c763b6f7d94caac0e929d9d77219b SHA512 b4cf4ff2d7e5b73e1102acc2183c4da3e734bdbec1c284d1fef8aceba0d49246dcdc954d3e4119521fde1e895bab0754b34b346b736b46ce45aff1afc6d38cef
+DIST python-gentoo-patches-3.10.18_p2.tar.xz 40708 BLAKE2B 9fb59889ffec1215511b0a1540d4765366ae850c43ea4fa41cdb65ffbae073b03288cf4071a0451cfc240a0e3a172224121c583ede5baa0784e47509aba83a1f SHA512 58404ae035becbac51031ac1dab84191f2ea342f763f9ac9ca0ded10bc2c3ece4c68d1b49f202c1ccf8faf5c5417f779d56a977da93af27c15aa08754e8bded8
 DIST python-gentoo-patches-3.11.13.tar.xz 16492 BLAKE2B 8b188742dd3f25974cead290e5793c31f02741a901dce65137c596045fa2fbd5baaef332204af90f95ddcd864ee542b252c00b190e15c25af60a7bda771b116f SHA512 b5abad341d2eede81df445b56a98720466ec23df40a8a2e99a04dba5a106205655c8e2b64df0ca2630f036c8fe457ba64524280d137bbc99f52e4fd8e6bbd5ae
+DIST python-gentoo-patches-3.11.13_p1.tar.xz 27748 BLAKE2B 26e0b5397d7927711bcc40330f72f54fb16c660c56a2f87166c5336eb2f53ccd4e920b906854ee122d64360b414e11a38a31a410936b4a49f6610626203f4322 SHA512 7c7eca7bf827255925e073c0ed5c69e9036b79e35e8f6ccb2684709bdc41fec80823a1df192c3decf56ba6d53e2c9feaf7fb81f3a214da69773da6a2997ca19b
 DIST python-gentoo-patches-3.12.11.tar.xz 12020 BLAKE2B b419d32b1d7bef9408027edda7eac9a920a877e1b8f521483df595199bad1bbadd9dd9500079c09beab63286a801bfb25da5f93a5d31462ed3e457a6e40ad6af SHA512 1b0eaff4c0df06554525a50576da7eadb4067c4f2970851e5c9e3e527a9ccc4216cbd65c45fd562af4a1cedc2c66278a74bee5cf5c1a65df8feb22f34f5a19e4
+DIST python-gentoo-patches-3.12.11_p1.tar.xz 23276 BLAKE2B 794485d0fa596f0f2797e2aa505f888a05e2ef63840068b3214efbe51b592586bcfdf193b71e239beb3c3037f01ca086b6b97aeff092b2a344e74d962fb9dffc SHA512 1402b0bbeb189ed4a16364398495fcccc31da0aad4fc88e30978e7754575fbd8f51974dcd97d2a57a581072f083233dfb00b30af687455ad170fc3c64875a9d5
 DIST python-gentoo-patches-3.13.4.tar.xz 8912 BLAKE2B e3d9f2a12f801dc75e09c5301757f35216d712b5e5394f2ec3ce1d79d0cb57571dbca525e3d5c35b90fa059c2b78ee24341b6a51cbe9691deac84c9ee0578824 SHA512 1a7141accb7aa70c7bd8dd12528f7de031dfeab9ff089f3d044da0b7b52461e2d6d7d1467161e0fe1e259d9fa06d70bcf107d86ad3590e8cf73aa1132ef3aaf9
 DIST python-gentoo-patches-3.13.5.tar.xz 8916 BLAKE2B 9d985b12af62b8a917cac1dab9576aac099bc81ad954a5de254a14a3c7d2254edcdcfaadc46314b69a1bb76bd30ca8bed7c866c0de3fc3f89aac0f76af344f32 SHA512 5ac92aa3eef82eae5d707ffcb5085ac98bd9bf64f72fc7ac4aa1b12a0c3aa86c57d0f671ca07f46e2250779f4cf4885916e4d175357ad626eca6e41257a027e7
+DIST python-gentoo-patches-3.13.5_p1.tar.xz 19756 BLAKE2B ecc594573bbe3a28364d541d5e1014778c342b6e8ecb09e5e9def238ce73d51f178d02ae91bedce3f7aee4a753f2653aee4f4035f238fa60d603baa59ce4e89b SHA512 a60f3cf65b57aa6c85f59dc5f36fbabe1fa19a5225c3e224c99696bb3d1186b54bdad94627638a3a73b66ceb5958b3a5dcb2b83d13357c71ded04c98ad7da0b9
 DIST python-gentoo-patches-3.14.0b1.tar.xz 5680 BLAKE2B 514b3edc3025e5bf675d371b5ada17dea426856edf1fb6095c2ee400eae95bd4265ef81fe593ae9338e801e7d0a25b1d5ba2d05ca563fd9dd020114b13575746 SHA512 74289e42cf532b54bb1b66a283ec19156f8a36ba38764209c133842314c9efb2ce2ebcba5aa9213bcf7fc0c8a5ca9b6e7adbd5dbfa4397233136d7cd55f53ee7
 DIST python-gentoo-patches-3.14.0b4.tar.xz 3780 BLAKE2B ad67e213b21bc039bf33c0a2e6d3a4ce5e06179ce167f89d56561834dfb5c5b5b5d7f43f6fe2597e94e4ea5d544bb0b60d38b847bb0c32277a0151f2084f3618 SHA512 e5e6fa02d2d24e46848fa5a79ba7fd8a6703473e3bee257fee7b5c55d5c82fedb29f0ba6de1117c6ca738df3841bae5bb00962ae0290d553020e3617dc557c6d
+DIST python-gentoo-patches-3.14.0rc1.tar.xz 3776 BLAKE2B 4f2cf7598dac08c3118bbca6c111684fe68fa7c8749ef394eae35c50bc7d78e30f6c54a77199fc87270ccdafa7725dad974226964841d666ceab7cb34d7bd778 SHA512 323586bfd662ff4ed41b7f5f34d1dc394e7e7e1ad87e8a9283b99a14e226cc73d7ff7fb510e772319e361f2ad2becfe4ac246cc0be34d0a981df286cb20c9734
+DIST python-gentoo-patches-3.14.0rc1_p1.tar.xz 5436 BLAKE2B 04a7e01c758e7e162ab05607e1a5f035c4bd77ad09cdbdfee183f02af396140f3b4f7cc0c627fbfeb05e076d4bb763afd77502a35178ec2eb0f4050d7d829734 SHA512 3795d4aa89d433196da74361b0b7ea9fa52966409667f88e8b069ec85674286068cfa3666a5503c62597c5cff4aa5ebf360b907c7571ced269a38019e593cf45
 DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.23.tar.xz 37148 BLAKE2B a7c0514037169b9938b2180ec2dd22063621d532367f6febfa47da43f47534559baab992d9c5257271121af755b8445346d4d92582e7e11b6468a1c359f28bf2 SHA512 73ef00a7aa671016de396c9e1c4bb5f5c1a97dc735739f806d809f987e802ec440370bf4c85468097547284a5d2b476cbffcec3cf219b7cb6fc890d5029eb5bd
+DIST python-gentoo-patches-3.9.23_p2.tar.xz 48060 BLAKE2B 2d4ddd3aa48fc52b9f63fbc6020e534234b4183366d121e836544cab93632cd05439205893a11bb505f679946b0690f0962eb0fc029e624cb1c61bc0936127be SHA512 61b3e2c7e8629e1c522c9de8ce9384ee8d1f90ca5ef0f7b902e6315c80196e5f13e0258f8002405a2a752e1c9b5e60f5c3c767c07554d83635fa074bce8a86bd
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.13.5_p1.ebuild
@ -0,0 +1,624 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1.ebuild
@ -0,0 +1,634 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-0.3.14.0_rc1_p1.ebuild
@ -0,0 +1,634 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+REAL_PV=${PV#0.}
+MY_PV=${REAL_PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 2-3)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${REAL_PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14t/site-packages"
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.18_p2.ebuild
@ -0,0 +1,570 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.13_p1.ebuild
@ -0,0 +1,623 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.11_p1.ebuild
@ -0,0 +1,610 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.5_p1.ebuild
@ -0,0 +1,629 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1.ebuild
@ -0,0 +1,645 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_rc1_p1.ebuild
@ -0,0 +1,645 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_/}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm jit libedit +ncurses pgo
+	+readline +sqlite +ssl tail-call-interp test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+PDEPEND="
+	ensurepip? ( dev-python/ensurepip-pip )
+"
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with tail-call-interp)
+		$(use_with valgrind)
+	)
+
+	if tc-is-lto; then
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.14.0_beta3; then
+		ewarn "Python 3.14.0b3 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.14 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.14/site-packages"
+	fi
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.23_p2.ebuild
@ -0,0 +1,564 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="
+	bluetooth debug +ensurepip examples gdbm +ncurses pgo +readline
+	+sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-misc/mime-types
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+PDEPEND="
+	ensurepip? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+	)
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@ -541,6 +541,8 @@ DIST rust-1.87.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e762097c3bfd
 DIST rust-1.87.0-powerpc64-unknown-linux-musl.tar.xz 80980736 BLAKE2B bacf5aed3af21f8b825e54e7f58fd4c442c47d2898da26d120ffcda3238b4cb9d52ce3256ec37df1def2f0313d822424d6b9ba8e47cc48c072861c631a6b33bc SHA512 904dd60d80edcb1b9a9b34c4184b27cfc21f7480ebd2910447ad6e8e9d11872e4c84432e658ad5f6d8c439c687ccb2ec87611df9d499d73b21602cab13a97632
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz 271039948 BLAKE2B 1bf3516b146fa88b4460e15bfb51960ebce8ea46ea2d79ea391cd30c5685d7d5e0d7178450538577aab462180f777789bb5061d1f5a4460fb609784d0e35c636 SHA512 60fa1a2656c6b9273bf27ad87b04b676e2cb71219e2f26b5ad4ae045809378d5072b9e1dcc19829dc0eb46be9819f20f3a53731d83a2ef6b024d458ebfdcd656
 DIST rust-1.87.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fe05b3cd1746932222690932292bf36af9cd9ee36efa30598c52d66a4e7452220901f6da0acd9b498aabfc3de457f36e5d69e07799e51dd417ae98ef171c9482 SHA512 052512118f795c63bd9a4ba50a68212ef57f21bc031b70fcf88b5903f6a95b3251d43d2a7895d3a697637d94e76623b5ffc1b6c190c9e1e426d3955d71e7d549
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz 276069796 BLAKE2B 9babd064bce24b081fa8f98a7ba0bca6aebe2cc153255c4407f874b1a0d13474958d07e0931668aeaa3848cddf94554bfdde9b0b2a46fd37df7b874f6672975c SHA512 46f53c1543276263be63936999e0e9bc5571d7feba59ad1cd2513ddbdb64a8cfdc723fb95fc1e04fd44b9fe5347f96a614f3dbc8fc25557c452b37601ba86814
+DIST rust-1.87.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 53554e54b65f289a7f2cbdad908db3aabcc8284746c4ee155275cea0f628480d78644ac248f8e9194c46b07d841cd81a21fa01b1f8663d272de7094677e5c4e5 SHA512 827948466feee0eb4206e0bebc5764e3f7db67b394177939248336423f172f9a52a7746b54efdae465fd6da5ac1ea0d7a1dfe4e3e7492c2a101fe15202588085
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz 250242712 BLAKE2B d9d75de2381bdbf40ca77cb8dc1c8ecb23b5e209f2c919b56c08605aa557c4d827b92404bf0012093fcf551cd01520c41c6c8f9f2f56798104c6db8592b4d918 SHA512 e5520a5d6fbc0a50a54ccd9c850652475bac2e95e19ec2141e57c038d9a26ccf7cc2a046fb2fe4272b721005a4deabfc2c35c6c7d0a6cc2426e8e45e3e97834b
 DIST rust-1.87.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e7c01e8a1027c408231812482418af16b1147ec577b6b67cea00172eba0716c58954b2a4378ee0213d839e35546efd7eab9f3d3b69ea57e8b560101229bad3d8 SHA512 4279b423334a9ec356d42d1973bf9d3388d5de8aa745b18c34d634d4d9d60c70cf165d851f571ab99a567e49bdd635eb0094c5c932571b0a5325408319403341
 DIST rust-1.87.0-riscv64gc-unknown-linux-musl.tar.xz 86942496 BLAKE2B 3c19dc3eb317518108cc269bc57c53296876d7f4d58a9dd0859dd2d42f377f204c7ee3337672875ee93f3f3a2459f9cdb882460d848dc4d12ca55bb0239e7a96 SHA512 872bb2a158159274b0eb70e21350ce56bf2edf5177ef3d9b8d63b7344930b6d93834d87ff24652f2487a1a997225e562567c53c906939836bff2cd374394e00b
@ -565,20 +567,57 @@ DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz 261235476 BLAKE2B 5ff3f9167158844
 DIST rust-1.88.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B dbcfa2e32906b07d4d9eb8d62af464f38c626d16b831e5d25fd9517f8f4e22ab60a2d6521f61ac3d36c0d9d6707a702ed3248fa0343462f62e1404574f83af9b SHA512 09f707dbed6f8d46872e4445e49c793a9f9cfedb71f3cc3b115b9447c7c4b86811081400bbf342c5a26b2f929738ffd9fb25f75ed1b13e333683ca6eedde430d
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz 261520268 BLAKE2B 23d53eecaa14898537cb3647cbff114870223173f4e50cbdc19a7514f34995196792b0390337ad53387a7bb515ec34330502acdc361826429b8f3985a9341c8a SHA512 6f4a040e22de950e975c29f16563f19030fab9fbe9476f55a4542c3ad9eaa9c34500cdd4344819b5cc27831b32811d25d296845fef01475224a2bfbae7ef9ce7
 DIST rust-1.88.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ad7b0c85d6ec2085e6005f0789b6eaa30af0fefbf6e621b58f470b916320141e78ec6e112a4bb69867417b69ef740bc033db65a2fd3f54e5cfacfae56b58b57f SHA512 0fb6caa3fa06a28fa1f3a3657df6c2c1d4d87db9a94a74b9ccab14418af7057f3be75ff33556507f48bcec2e648324bc1629ef94c8c57e5ca62b8a9fbc49c9c3
+DIST rust-1.88.0-mips-unknown-linux-gnu.tar.xz 78511648 BLAKE2B 83c2cb810b9d884e06bdd74b55a59e305e9121c0b9f8808afc2f015d53e3e6c3bdbdc94621cbf4bafd64a923dca76229baa99cc9cce3cf08e3c24bb52121376b SHA512 de758b89d3a44727ccbdadf00e32c1c2dfdee2dcf0d291d92ff204c839d41b3dded08b0f045ffde67649af1c02903db65241f3449aa738bc7546420aee2b6a40
+DIST rust-1.88.0-mips64-unknown-linux-gnuabi64.tar.xz 78365128 BLAKE2B b71689ad4fcd9f6688250a3da28d7256eb3409a3b9799c2d431037781a1591abc39bd9070fd7e68cb86153a910a04600c0de8bdb07853c63320075dd969dc31b SHA512 1108adc0be1a3b558cd0d0bbf92c88dcba78660dda1cb2beb8662f16b76bb381272b7700bf17a4ee110d065ca44a2460fd59873e337521db519ce12a9e612d6c
+DIST rust-1.88.0-mips64el-unknown-linux-gnuabi64.tar.xz 79916392 BLAKE2B 71d41fba617da56603a49c371d854980eeb62b5aee31dc268a9068b2a401e06cdc23464c17d21786fb338157ee97b69ef65f22f994f756e43d1f3b4f55e64d46 SHA512 c3c42ed9ab87f84332ea6c4faa8ca7d7ba321ed31a16aaaef4dd0339b941c1df6d35536763a99efeced9f50783e66195fdb659228ed4e37eb9165a2588e8f61d
+DIST rust-1.88.0-mipsel-unknown-linux-gnu.tar.xz 80184380 BLAKE2B 232b96fae72abc499ce31e8b9f7c8f61baad8e2d29069dc49aff9bb455ca7ceaa300dbca88cffae90ca903ae945e7391b4ac8343abd82d3160ae0bedafcc84bb SHA512 6609a3fb037f65ac49e61c4a20e5e8ca8466f83adc4f7becbd1bcbc04df3418adf5a2894a934a159ef8d905ed86dfbbdaa38721c5db4d74e9a47ce4642180b9a
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz 255291852 BLAKE2B 4ef3d89f38bbbf12ef2ee190457f4ce96b5e60e02cc72a1e312a897c73fc28677277008f322381f7f084ae7d93671a9b3a46dc5e266a1b8c9987c780b26e61ac SHA512 f7100076968cbc4bf529ec2214f2ead865e87fc5e55f0a683ffa3034d3e31db0c9619fbcd9e854a7fba8d2e06732456edc59280bbd8de75e33df9897e65520d4
 DIST rust-1.88.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7bf2a3229c6ae8a718812edd41dd0ffdd61dc792801d365dbeb46d7ae32cf12ecc7210ae67ba19be35349a27d656fa76a887a5d91d8e2dcd12b93600635d67df SHA512 2940a66102c6dc33dab8d410884f7bad88589c8df45f361c4f10a9be8a15d896c91a45c95f4c9b5f23a9d696af343b64d056274816b2454acba3adf1eccc0780
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz 255371956 BLAKE2B 45607ff673bab803e794a3ddb070de237e94eeda43ca5fe52c49d006db2789433dfe324f706bd57d82d14f18bea0bb02372e71593c0251420628f5edba9c0fde SHA512 55889385893cfd957d85376ff68a677dd70886476392bf8f4f8ff671777d0ea168491e4d778c88f40a9a06f68717887b8b0ff3dbb0a65b956a98aa00e6b81dba
 DIST rust-1.88.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0625be465cbfdd2b73e73c8adf5ada2d7c0eaa4541f3735eec32d464cae44b475fa860cf126e433aa69a6f2de02d94af31bceae4ac23364ce394f34cf8f65586 SHA512 b25598551b7c0946adbd11ffdeb1761640f6bb255a9925cc734b4c12d82f666fc4344fdba9ab83fa63bdc82129dbc68df7ba125b8851238ca8558ca5de5c7dc5
+DIST rust-1.88.0-powerpc64-unknown-linux-musl.tar.xz 81542068 BLAKE2B a27027a975d87e7fbffc4d8bbad0f4b9ce8975eeff724e0607e2d26636bff075867a50b426ac79da1e6d1d0104869d39ac6f0215f012c438ee24a1293baab2ca SHA512 f6c643f2e86efa4e5793d745c04c2c37481bb7630ccf33735474554973926952d0b80ad3028f07e94b103cc28aae3b7c9b93e73786d215ab095c7ed104bc854a
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz 270351680 BLAKE2B 0b47e4e756d571232ec07d73fb99a2dd8e5542fa8d7046d565ed0277111ce07e5801815f2391fc0c19681f63b45e781c18d43a3fc818cc0352aee4c0a8da71fe SHA512 0e0d800f02bfebcc10792f71a48a7c70fe197bf965b5a055df07e54408e49a9cdee4dc744f4e06a2e400174265c833fbb4075f5a477508e72deacf48e955fdce
 DIST rust-1.88.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B fdbf7a59a1a37c8ad09d0568e30487d01513734ae9bed276e3e3ba45cc0d39b14f958a377def77d9505e158d256780a7c1c936eaef40d7541279effa88f8c5e7 SHA512 1ccfe4f582783a80dc8bb0e50f5b782da661940930870c713ffd4a8ffed6df7e760829ee224e368bca583f611bdaad33eb46f3728fbe2b3062107510194671c9
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz 275018668 BLAKE2B 3c6307a0bfa9b67be222f010533107b56a81860e8db07b44b2155464df5f24ec77a83753d00c71ae85f03cf1ebf3d91739a892a3af94f025c664c5fa0b276cdb SHA512 1eb9128f32432e9ccccf26f326946a734ad09416587ea0ba191f602e3335deb83cb1c45bbae08ee4ba711ac3ee6ca2de628efd008a4d6f39f6268dbfaec17dd1
+DIST rust-1.88.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 283a3b9555499e5bc2f8d422e120802c5566593ac1aae625bc1d9ffefa7a746a53f1da5535c79a5b64eafccb112ebf0af50c6f04d83f9dcf7d2a15e9a83a8760 SHA512 62b75696fa82dd41677fbf878bcf36d9f5de489a2f2eb4733b800fa9b28009ad59287d72d5f9333fa9c67b1f68963d4295a376d2800c6392b60c0d55d7f715ad
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz 250151976 BLAKE2B 04b732c4d251af2d8279620a3a7da81a31161ec8f143396fc3cf39a5b6fa8dec5ff569253126b709a0ec147dfe7902a1748b313324173f0ef76ee89f54d1292c SHA512 389d92297915cce0155a8a96c0052df655768987fa1846e1e7f71a2f3da3e29e6b256f85f0d77f816b53cc33ddb7394f472f7ce92b81d40baad4c7fa0d2b2883
 DIST rust-1.88.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B f3602574232fe5e0af2e21e2a3178a227070aca5163230ba2a229d7ca63a798f0fa8564d2b16fb912493ef1d8d925cee5a21448c69843411c0df65f4454ad716 SHA512 b3036020032c51e6b739475c4c2c21aaaa742018ee6cad2a0b7f7a6eff193977eb93450cba01a5ef6c436d6b4ba491c79787c980a465306f42c85ed0dcc034ff
+DIST rust-1.88.0-riscv64gc-unknown-linux-musl.tar.xz 87040024 BLAKE2B 760b06ca652654f51268a9fef8e8eb026e6b0c6e22eecb161693b8d62f3f2fc1df34e4ab896d6d7d18e2a3d065fad6a133abb918a94dfe4b016b3251de87da13 SHA512 25db6caef2823b93bf7bfde00676ccb06344b500bf0a4013567354fa94002770ca8457e8f461b79944f506a6243091f8ac5162a79818d538c874e022ce34dfad
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz 239909412 BLAKE2B e92e9f51f2af3c638b82fa8e7ed1c553b7f7537f32a67bd875ade77a04ba646e3b22a7ff88c28bdb3f02b6ddd753efa400962b4dbe36bda58ac5ae8326b9b35b SHA512 01d914bfcbfbe061ee2269445376112ca61fb87fff8acda07c3183aa051a50f270425d2a9761bf036a3d14c7b9cdabf392d3d532bce8a7e0d2ac9b5c22cc212e
 DIST rust-1.88.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 7a85b49f5e311bd3261ac0f6d967fe5505f73589c1d218481270adf00e72ee6bf57158d0da86f8289da7f4bce1452b3ba7447e1cf116175573eea8c07e58b0bd SHA512 349d119bbc4c12cc005e3ea9780b259413d93e4b052f5f7fc677a2e2bf71e7cbafa5db9770ed8378ec4a3053a2d590562c354c1db924247a74e20d1dcd4abdbe
+DIST rust-1.88.0-sparc64-unknown-linux-gnu.tar.xz 76772328 BLAKE2B 4958a6846edb1531793acdfaf3df064b17ebacc94d6485834c895cf4e1eff15bbc1e40645688ab981b0a1a0ea200bcf4256f182437377fe9339f27d7c096307b SHA512 e8225d15889cb82276ccf6490a6f2d534755b33d701a22501ac33ec4069eb8b47213d86ca7d2116d63702901780cc481935b4e6985c7a847bc4b92189cb64e9b
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz 197237052 BLAKE2B 5ce55a2b5faa41ccdb365764e1a3a10d46b385b678460de6dbaf3ef816e4f36164040070ef8c56183bdfe90389c1f81017bd7c411906d0a7b39899432f710e8d SHA512 ce97eb4697415bdb1fc33438ad62d9c410b00bfdb7c78c8c80e5887e6a23d3299302694918cbe259851c85b971f0ae3198ab6a89e26c94836a82bbf9e77cd80d
 DIST rust-1.88.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d3bd096b1d1c7fce42f60cbd5f3b3a459c0063430366adc78c026a0159f379d2537d74d4f1fd768ea5b666a33cc28aa185a867aeed04ef1ae735a3eb794baa47 SHA512 62a5a9ffac0e95fbb547c504336b3aa160698e20b8ba322769c2233972c6ace48b2afdc42e84559b244099f9d8115cb96ba3c8f0923806559c53f80d3e248d04
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz 291407088 BLAKE2B 17c8144b9acf12f190ed8bd3367a9602535ecea365a402e1248b26457f263103680b3d55d4b670aa381de816db76d263fa1c3d9715f60a3100c96765dac4d61d SHA512 d4da2f9cfeb50377616a48437ddab836717de94fc0362e6b8f4afcd7b4ca939be1c902db54b7204fb35863189e1f8b8d9b7bd4713e4e4729e42db9db2d249711
 DIST rust-1.88.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 31f344b4f8cb6beb58e2cbd62d7891abe764bb6a8a473b805ad55a7ef2b0952677e32481c22a2ec81146b61f74dafcbd384f629bdb7f7799ee642ce926f80953 SHA512 64824b1f927080e8272d29e4fee56e2237621a48b3178c2b4a5ae580519d1c954a85ce383232d0fcd98468a6530579353ae65f84b4205f90c4fc144188f3adb0
+DIST rust-1.89.0_beta20250726-aarch64-unknown-linux-gnu.tar.xz 167750184 BLAKE2B 6a8f0bd431bf450b11d40cfec22f71a03a4222ac2f699e6b5c4d86728e759ef4ed14b9b63c0ac1cb151ddaefe9c7d309771cf97b76e43d11ff879cc02422d842 SHA512 e83c523ecaf27708305fcd18f1657e64644839185e2297a42c5f68469dc7cd61b077c289a06bac393c11ac2a53c5579b49117e8aa2ec66a132c413c4ce3eaebf
+DIST rust-1.89.0_beta20250726-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B cb049080cd23d7d963fe7b1a82379773560185252a4943444ebbaf3d5ded39c725b2544968e0cea8d59b91dfc8e6d769f82370c2fa54131bfd6d5fa71e99f06f SHA512 605c5d18eac8c5396bdba39c3df578f12bda9a8cb616af70e0c17d10a2bb38b805446875eed0c3c3413cf6b717046e38ac4f79a7a71c74bb5f8adce78bb8fa43
+DIST rust-1.89.0_beta20250726-aarch64-unknown-linux-musl.tar.xz 245112752 BLAKE2B 4ba7ca5dc911d46cb1dbeffaa0eaf1fe622783d8f69fbfb9ab80ed797d3d9a63eb6db0ae1510b8a02e85fcfbc8006e9d4a1b84375ce47be97466db7e7f06032d SHA512 dcdd7a6f880f2da7ddef26abffca16a24646eca350162c4edd1ccd0505188aa99b02b7cb42caccaf2112988ab5947bdd91d334e9061b868ab6ae0fa97ea04f3e
+DIST rust-1.89.0_beta20250726-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 924ed752d03da5fb38ea99c2948a7ce0b82125671280dba779ec5c830a3c58a2222ec76aac7ae2576a97b9f5089e766fc9041d0ff1e266f33e60797225d51349 SHA512 05be35cf66bb1d5c6be44db79f6dddc37cbc5f6342c355b5d0127977004a68b4e538dba1ef8a401e4cc02a11fa573fadd570545376ef3fbebc43b5044dd0f384
+DIST rust-1.89.0_beta20250726-arm-unknown-linux-gnueabi.tar.xz 230178744 BLAKE2B 7f5a7a1ec5fc1c801ac3ad916edb6477eb608da560076a12df14f3609800378b1409ccd601f7fac8c8969bb7d6d8f6094bbcf42fef8b285c07d2712c953f58d4 SHA512 01d20497d7d8cb57a96677cda82a8a7144bee4fd9f025d7f216110c9480fb2bfbe65b962d1ddbd35536a1e975b312c22c07b17c62a2482dbcaf3ff9bd30e573d
+DIST rust-1.89.0_beta20250726-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B 852fe0e47f3ec5463366057847329b399b9b18181ea714b01d0eec6f42d9e9bc79deea2969a3ded6470aca2827f10d23e392dcbd6bfa8c12d486504c77ffd632 SHA512 763663754024596a6f99262ed56a9f828fdb6edb64623cdd6e32ae81859985d8f0d8856b8429fa24fa4f147650d9e0b30360db824c72a48f1ab1cd6ace4785e4
+DIST rust-1.89.0_beta20250726-arm-unknown-linux-gnueabihf.tar.xz 230323744 BLAKE2B d7d23644ea80e7f424ce9c65aef9093c753af646c99c8a782c6006cf2ea3169133ed50b88a91f7739d850bbbd294ffa702cc7e873282d0ef2216bc8ddb54fe42 SHA512 65eb18b3657d3123721ccfa535025c4c8b1ac15c175b8986908127dfb9ebe4b19cc8227acc030711c0d4c6e822cbf2d81cff95efc7e664661c600bdab7a2f08b
+DIST rust-1.89.0_beta20250726-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 973495a0399a12b5e1ca3613739c9cb249d253653d68638b9f5fba3a515fd45c8f9bd603248e2d26008d2884fd5e9ed2a266a5d0814ba1edbd2c486aa01909b6 SHA512 dca55570f91e9f19ead7b5ac072b1ec27092825e10849718046ff86306bd0ed6c255eab4d2c6b128b362c53bf35eb43914b28e6ddeab2b383e517589716ac43e
+DIST rust-1.89.0_beta20250726-armv7-unknown-linux-gnueabihf.tar.xz 236351996 BLAKE2B e56154f24fff297f08194a688874b2f2adfd61a2d1f8e407abe57fb71f8640b29999da67360eb4b8da9cf51e01f3f016952f46e324b8951f310aa1aaf81462e8 SHA512 4074222610f9e53704fe05b4d2aec2a4f2e7bdc3a2337145f56fd20a5da68da2d22225b8e805ab73aa2a8714e61896e46f3de01edde39c8419b6890d534379d7
+DIST rust-1.89.0_beta20250726-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B f793230b5930baff24a2a8b99e91de5646ada1db92e174e6054fe132e37013ecb43036425044aad9a0cb5cde72cc35702d5f61e735f5a8c640d461e09fc09a03 SHA512 158dcc558c87afa93bc6996684c4e2756c20df797b434e825211872d4813eadbf10df0c4a5af102c07d6c32b7d3459c26497e1cf5b41700b8587c532bdfa5d2d
+DIST rust-1.89.0_beta20250726-i686-unknown-linux-gnu.tar.xz 263024872 BLAKE2B 2d2cf62a62ddc4fef5dfd981e3420107b854671089eff0e8d3467c064ac3bcac3e4fe359aa28e3e48a3e797108b310ebfff9abbddfeefcab2b6725d3d2fcb49b SHA512 339b580fc26531e621ea1d34e42df13bd5faee2a7f17f297ad25c10b6fa893dc3d501e43bff31dc601c1bd58a783ae688a4b8093506bdeebe00a982a7ff5d795
+DIST rust-1.89.0_beta20250726-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B ec8b26c5732bc900179bcc6c4bc567b77551295f962fee2a1e6fd312a7691778f98649ff3912ebbe30732f2ddc7119c0026391122d91f3ca3ae6d5b4a0a53c70 SHA512 7211ce1757ac84b417d75f83474d8d8f72f7e3452c88ce7155f17469240b57c6075235a305cce661c85318ad0d5bd8e6f170b4fe35163090859e0641f503d84f
+DIST rust-1.89.0_beta20250726-loongarch64-unknown-linux-gnu.tar.xz 262373800 BLAKE2B 2d94374b6a7998a865e23a259b513e28613d25e47ea69bef31a56060f370656fb79dbf87a618cff23214aa126774bd6a0333d338471721c22d29b8210270bdc1 SHA512 324bf90d43ecfee851bcacec733b7300c58df9189e35a4b36799c9db84761fad137b0cd4bfe20f83fb7d816c63ffb541b1d97998e9b2ff41143d786238de2259
+DIST rust-1.89.0_beta20250726-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d29631a452729cdbef09529e5af3a6c9d370efec8c84c81e401ca6d171651d3dded9501f1faf755ccb550926ccfc947d7f080157ee64ff937606288e14c19444 SHA512 23e16e235d8271fd6885b4603f999decf01ae09ffc0d605a26b5be37fa9c2c51f11d5960ef38b175a114911f377d0818c3d95cf7c35f0fc69efbe3541b4e4d9b
+DIST rust-1.89.0_beta20250726-powerpc-unknown-linux-gnu.tar.xz 257000228 BLAKE2B d20cd3beb74f77df28a4799632ac33c8bfcbce203469bad19b8393b1b0f480ac70f4bca060214b3ded94de3f909311d8511def175de579a6ed8e651d3dbd76ee SHA512 bb1ecdc43e2972c3738f249526459d653187a48f9ef3d63add1813ff5164348c83bc1c0d60444138f52a4afa6e433379421ba0540f8c725c039792e758f4ef8b
+DIST rust-1.89.0_beta20250726-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0cda4de341ef7b0f81bbb7c0b6f55ec132f808618071c2e17ab6f512db2f2203e6f843e992a773935ba8b2561ae05e238ba51d2974826171be5db7db1cbfcc0e SHA512 c53f9bf64d851e5ac1840ccd819a7d749a5de4c9d13ae254a8aa7711e2d4a2edd236230587c3d45e3d567798449efcb40809f28412e65643e284c5a30eb556a2
+DIST rust-1.89.0_beta20250726-powerpc64-unknown-linux-gnu.tar.xz 256532660 BLAKE2B 26b90a154b7513d742527c028c7d15f271e38cee45c51ce9a89ee474ff76abae74812d0aa9356567bb2457d8c868f4a0c1de88bcb5ac028a08a494fb69d6ed28 SHA512 2a116c13ee400deca150a3bd0e526d2a5d424b7ec7fb747a7e164b187cf686ec87ba41bb41359d3707d0c0b07c00fed6b502cfc93be03389426d6ec9d8280d0f
+DIST rust-1.89.0_beta20250726-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B eb4687af032f07091359f34d8c5ed23cdd207e8188ad5484e7b5d920003b1518c2fa46d90695a79f9954c693edc0df92551555ea64fe96c02991248b4b9e5cc8 SHA512 4a7d2dd63198e76f0db4a299eabd3fad3bea3fe6da101f298ffea2c024dd39d8b9c47f8ef181f8f5fb08962c3ca5c1581b393334b2ef19ab615c661bf144a37f
+DIST rust-1.89.0_beta20250726-powerpc64le-unknown-linux-gnu.tar.xz 271780768 BLAKE2B 9060e42f96b5f08b9755fac2bfa5e3d655f87454b884172c83f2450a73370e1dc220aa1ff248d015c4e5a06e8fd02b92076a699f1b9454ec2d25aa38943304d2 SHA512 aa0c6dc8ab2e23c694d3f0fbd56e1941d442ea019883c0aa9cd53db0ff84b33abf119f9aa653236494a4ed3a3f8f058b33fc5918ddb9d9fab10baa530437711a
+DIST rust-1.89.0_beta20250726-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 2a0d6e846ad156f5dc6bc437cf4b064f1d6b5a0fe5f062f15351d84f399a45ebb9f6d8c900eecb12a38557e73a0de38773d604c2b18a345c1e5dfde7c138e6e5 SHA512 7588c40e9987c301c1de4aac49d985646e16fff42b0d028efe300ea07d9bbd8ab565f1093fa6052a0f432e3216664a6d0876d1f176abab05573828bad5a1e0a6
+DIST rust-1.89.0_beta20250726-riscv64gc-unknown-linux-gnu.tar.xz 251392712 BLAKE2B 6b848beffe5504c2f5e08cc58fd95ff5183c3aef4b3c1832ba53af1b679e9ced8bf647c90ae1c3373634e2916572493edad3f58bc72d14465a08abfcbaea7036 SHA512 462af06b6cc210c945c3bb484396d56fb894cd3090b4ed8b9457c165ea07f333294cb3b78fd4ccf2acd92fa0e3bb924be507ecaf994229c8811790955ef8c065
+DIST rust-1.89.0_beta20250726-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B d5f54505f6a36a76bd0e65fed39a133251789b11d3a83352140d47c34db9c3aed4296a1a1e625584dc064af5ef944ca13468348a8c3c0381a84b7c6ad82870fa SHA512 4e0edd6d9c7f892dd7cc9d92159634b0671dde82d22faabd67b4c368dcb60dc37fc0d9186f85ea9793ea42d7ab56d8b38e0826873ffa2f47e49d1485f5c43077
+DIST rust-1.89.0_beta20250726-s390x-unknown-linux-gnu.tar.xz 240818916 BLAKE2B d5565269505b017c66a75f12010e29b8c7aa15fa926b97125297d5643b8bee53db3e10193e143f3194dc9d88e1546df4a8ffc5c4279a29ef8bc269c979135681 SHA512 8b669ea7a7655573a7f38af7f78fc9fc870a11e2cc1d743b845d7434186f75029912ef30bfa71aa89c531a4d3ac74696780f22605518a85b6bdbcf19afea86ef
+DIST rust-1.89.0_beta20250726-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 44316c9604adaa00a656bccc5b8eb1340fc4b1ef81ed3865e7652f03ad979729111db6f7bb364ad2fe574a123d8cf256f42659405816911f5cc1c25c79d3e0d8 SHA512 0e0e8ad9d98cdba11874d4347841fba7064cd6f1250615d5a79650d9d571af4561e8e0bc329b003d69c48a4acfacc34d9e46b8fd93e8b29019b8077479de510d
+DIST rust-1.89.0_beta20250726-x86_64-unknown-linux-gnu.tar.xz 201173284 BLAKE2B 515fc10b703f5fd3507e0cd2b5b48afbda932c965dc653c53dbbc9422f8f60789d081c65dd01e4a7b82cf16d85835f37877eab7ca9c7b33ac698c9adf34e4eff SHA512 f3142453b80c4a535b0c09c50b66a943abe4dbf0f88de7dd96524679b4c1982f3ff1632c587a055cbf0d41cb3d0234c87615a3ec30e70497235eb12af8f09d80
+DIST rust-1.89.0_beta20250726-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3b6c0f7b371532114f5e8a86199c52c104289877e6863e9a83c3221f2cb141d20e82b73bc7653967c70031eca0b27f74642d799a32848d84db6c9ca6506c172a SHA512 e715f78366ce7695456ea538e37d9f7764926267f580ce93990ae039eccce8ad5dbea90744c95ec1ac1064f2af026fd1fd9488002227072438d40cc90b160129
+DIST rust-1.89.0_beta20250726-x86_64-unknown-linux-musl.tar.xz 291959320 BLAKE2B 3bc4fb7c1dc618bfb80ec977ac278a30cc116df79af90720c14ab9ca23a2ddf04484d7d8b06e2dce522fecd48e3c3e383a28e8fb8f77bb2b5bde88344f872647 SHA512 1e0aebb8f73699811934eb9cfd20570c3073b35d64bb500f7f6f7e9b7ba08c55f7cece48656610317f5862f19cf13ec71087a47b579d450ef81bd979cfe63c3b
+DIST rust-1.89.0_beta20250726-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 098065ba6b0f08dde98694af2832edf3d2b73033052ea6a793526a6d6f081287f2513288f774d066bff64fd56c680289681ace612d1dee343777ae85f63124ea SHA512 0b800f74e74c3c0e89ca61b50174548c8cf34b5438e36062d355be08caefcd46c23f530e99714cec73a172441f27093bcbc4b439572215128fc4834048010562
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
 DIST rust-src-1.76.0.tar.xz 2590884 BLAKE2B d1a6215dab34d7b10c3177d2b248f997d3a846388f3442567572880aa5c5bc51b56398f5d4dc32727cee7c9dbef494430d6534a76b66c4ae5ac4fed07266644d SHA512 39d2fe58fae8c8c5a6cb3fb1ef2a1c7548c018fef6ccea531659fdfecd68a4aa77125299d2cbe5b58e500337b4d074928318fa9ebce358af500d0ef27260e3ca
@ -596,3 +635,4 @@ DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a0
 DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
 DIST rust-src-1.87.0.tar.xz 3119800 BLAKE2B 6429eb419f17109537a2a5463b0c68f504b3cb0f55766e18f73cf053883b06eedc934ab4598756790cec147ff41c4eb30a807d2ce0b7e6af33310710fdc5a8c1 SHA512 9747c60268d772b7c6e7694260c0808d2b8a42028f5606499c81595d76f5bc32c9acf6b4b9aad168235f8fd77d980c56bc4afc3d40f5d0374b23d3e66e3de390
 DIST rust-src-1.88.0.tar.xz 3155272 BLAKE2B bca923d2264337366b8013c45f3a40cbdfc1e1b746775161eaa66a1db653aa4ccb2a55980368ecf9808d6f4885194e2dfbf1f678d0500a43f7b2fcc0f79d27c8 SHA512 6dfe1fc3565927a9ac2ff9821ef3222cca170ff538833e1969ebe662af2cad5257c1ab3d82f5ca10aeaab40f54916a25dd96fd16449cd59e4d104b631911931b
+DIST rust-src-1.89.0_beta20250726.tar.xz 3461328 BLAKE2B e1f79c83dd84d603f22cdbea1edaff8aa2fd8cc4718da86e323feb95ff552b2c567ec9c311565100085ef9922a4167f532a06231e45eda0f41978f4e9c0909e0 SHA512 887eba04133d5b6f5f2a672819c2dd830161aaccaf90ecfb8f9b50a8cb60b6a4a4a5a55c87945adc12fc6f9e2dac36a1b6f64b6e018941ea2f840f0ffe71dc04
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.87.0.ebuild
@ -24,6 +24,9 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/rust-}/2025-05-15/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl ${PV})
+		) ) )
 	"
 	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.88.0.ebuild
@ -23,8 +23,11 @@ else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
 	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
 		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-06-26/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
 	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi

 GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
@ -32,7 +35,7 @@ GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/$
 DESCRIPTION="Systems programming language from Mozilla"
 HOMEPAGE="https://www.rust-lang.org/"

-if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
 	# Keep this separate to allow easy commenting out if not yet built
 	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
 	SRC_URI+=" mips? (
@ -50,7 +53,6 @@ if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
 	)"
 	SRC_URI+=" ppc64? ( elibc_musl? (
 		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
 	) )"
 fi

@ -58,9 +60,11 @@ LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
 SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"

+# net-misc/curl is needed for our own bootstrapped rustc, since cross-compiling bundled curl is not supported
 RDEPEND="
 	>=app-eselect/eselect-rust-20190311
 	dev-libs/openssl
+	net-misc/curl
 	sys-apps/lsb-release
 	|| (
 		llvm-runtimes/libgcc
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0_beta20250726.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.89.0_beta20250726.ebuild
@ -0,0 +1,314 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-06-26/rust-src-${PV}.tar.xz )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] && false ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${PN}-${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@ -14,3 +14,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0_beta20250726-src.tar.xz 267425764 BLAKE2B 2a6802d5458eedb66fa2bd28d1a0d4c2104b1a734d9f7ec35fe989d210496d09a6db1a655a99970d68cbaab395741e3ddab24999c1150e9e64e8e72e1e3d9912 SHA512 f1a7524f46675f574b22ec00d4ce0c42ae272be7265e0665bc81cf3803ce1b286e4f7eb64e1850a7aa7b7e05c1cecae7011ac43964138d3679c19f0008b27fc4
+DIST rustc-1.89.0_beta20250726-src.tar.xz.asc 801 BLAKE2B 9cac60bbe248e5c63e703549efed39cd66978d926ffda52c9578492194df8d7a592d16f606547039222ffb0baa375ac7bce98bda7a5388e4d03cffe8a25c4356 SHA512 49e2e90ee69155d2b28fa2e88a809fb2642ecde72618ce20bb3bbd56afa921fc1e228cdb6ef8bd22346cb5e106945df26a9b5b8acef8f3f8c343fed8694b95e8
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0_beta20250726.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.89.0_beta20250726.ebuild
@ -0,0 +1,73 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+inherit shell-completion verify-sig
+
+DESCRIPTION="Common files shared between multiple slots of Rust"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	# In case cargo is not in sync we'll fetch it as a submodule
+	# Nightly users will probably already have the repo cloned and up-to-date anyway.
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=( "-*" "src/tools/cargo" )
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	MY_PV=beta
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+else
+	MY_PV=${PV}
+	SRC_URI="https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/rustc-${MY_PV}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="0"
+
+# Legacy non-slotted versions bash completions will collide.
+RDEPEND="
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-rust )"
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz "${DISTDIR}"/rustc-${PV}-src.tar.xz.asc
+		fi
+
+		# Avoid unpacking the whole tarball which would need check-reqs
+		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz \
+			"rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
+	fi
+}
+
+src_configure() {
+	:
+}
+
+src_compile() {
+	:
+}
+
+src_install() {
+	newbashcomp src/tools/cargo/src/etc/cargo.bashcomp.sh cargo
+	dozshcomp src/tools/cargo/src/etc/_cargo
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@ -12,9 +12,10 @@ DIST rust-patches-1.84.0-r2.tar.bz2 2507 BLAKE2B ffe4e5fc49deebdb8b8b3022f951dfe
 DIST rust-patches-1.84.1-r2.tar.bz2 2982 BLAKE2B 2f7addfa4530f3eab79f55ea44eee6390970874ae5ed40ef8706224024db47c861326dc5a79ed9bffcffbad5b27d44b6a3aebab7987fdb61124be3083fbabd71 SHA512 cc852e1e679827390134b47bfaa68567a75a5e8559a3caa24ab3931955050bac59f4fe6a4c249d83bde0aa25667ea04749f3763ff3566daa2999df8cbf2d0981
 DIST rust-patches-1.85.0-r2.tar.bz2 4462 BLAKE2B 61cfde8688fecab1a5c3c80f29b37b691581f3f8be1648f9db34fff15026dab426458cba3b9f06fc5606a0a878b0527698ea6f94c7dff014e4339154ac907d13 SHA512 317ab0bcbb792faa1a761893264a29bd650b0d6c5ab17aa762075daccfda684bc6cdd20c0ef89b51bde1a7384fb1df576b18b5303115a8cf04877b435b2d6491
 DIST rust-patches-1.85.1-r1.tar.bz2 4473 BLAKE2B fad2fe3222e2625b5cbc60ea1fb805080ce70f751c930c0e3bde9cf043059e1fc3ba4d8e618166fe99a7fcf12d5cccb684c05d4c2542a89c9794869204cbcb09 SHA512 edf680a1d3a29ae5d8140031dc8b232b747d08494db2f3393ccc286d9197139583bcaf536d5125b8c896a610c075115b9a16a6e6f3f6b5da60e58433f000dba6
-DIST rust-patches-1.86.0-r2.tar.bz2 5980 BLAKE2B 179d6acc8c7006eac4d00e073ec1f5496756ef51d465bc098daf1cfe650f469f4341893c72a65e21d84ecb3ccaeb46f5204ef517ae942482d835f89c0a934391 SHA512 31e902661d5ee2da82858910551393890583d9702303fed5652122c852e9384fb88a42eddd0b968558865e16b5bd4ac2a13a35bd01ec3f8c3adbb673bc465596
-DIST rust-patches-1.87.0-r1.tar.bz2 4635 BLAKE2B d813ec4a602d3bb879927a44a0b9f752aac255e31dfd13c56ab71b3fae7ce46a742c1d2e7494a7e17728f1edb2327ddd6ad6ebabc0c47d66326b766bbd323fbd SHA512 596ffe744a5849b443f077bbd4edbcbb240b9ac51c9d53e0e436e46d7c93a6734477d22eba4a066a0cf474503a6357a72dfa124e594f645be6f50d9bd25bdb10
+DIST rust-patches-1.86.0-r2-1.tar.bz2 6308 BLAKE2B eca644026942bd729a748df57dd67465bbec96b2d18a71c58fe04bb8e2514aabb1ca02cbd3761be5283328a3b728e063b1b85ea78f4f242c182071c44b8cb148 SHA512 1f1edcf76c64b0555366253e21d759e904a752746c2e5d88aba6e31f5ee2a2b0b06275674d2fc3acc42f589905eddc006d788f95b48a5d79a6ab767251d934da
+DIST rust-patches-1.87.0-r1-1.tar.bz2 5116 BLAKE2B 783ad21464a7e393d0aee506119be12b0137a7d360402b74f36b6fde154c2804cc0779da63875977d09f7e9f2d273ff41dd189bbe4eb239a314fea27bbaa704c SHA512 8c67e4e43bf2afb226f70bb2a03aad0abfd525cd484c8c9ff663da06d63b471f4f1b48169d952a6a6c14258c0029dedea14aadaaca2ee75389df65b806188363
 DIST rust-patches-1.88.0.tar.bz2 4062 BLAKE2B 64168ffa608f2edf2e0b3d079152c3b5dd59d0cea29078894f286bf91488e2e7769c55ede2d43769368d2147b46699d1bf981190d6800dc3d41c736289122eaf SHA512 b565acfb4d1146e52b1fb66b4a242927407cc34f1b38c2a100135cbbde24c8374af1997bc22069cca25f33cc8d747e56391f3d98a2d4e13dc0abcec0d6f88b0b
+DIST rust-patches-1.89.0_beta20250726.tar.bz2 4126 BLAKE2B 643e6fda1f15d7b9e064d974929fbd97396edafd65f7eaaa3a7f0365e1929746deea800700022111e0e55a2f77a5153e90efd408b5398c34c15d81f2dc147625 SHA512 1021c1836d0a14f064a87e98b95d2a265ea0f8bdacb2cd0d7e08986d011371403faca4bf2d561e48bd089ba9f36aeff9f31f055dfeb9b613921b69eef329ee45
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
 DIST rustc-1.74.1-src.tar.xz.asc 801 BLAKE2B ddf73175b164233babf31ca3a381b03e20c0f36d017c1d5f85d6ab11f0986d861ab23b11c061e6b2444ced70c3d6a494cc3de4ec86f0deb221a805491bd75420 SHA512 9a96ff9ba9a4e2af4e267b2ec126fc0675c78d0eb767703daa2f28491c3d85c2ab00fbd8584390bf658812ec6c4ab6c57e43b386db59fd505bd3134a8873a09e
 DIST rustc-1.75.0-src.tar.xz 159624388 BLAKE2B 8937b80585eddaa3e1f1ef948899d14a170308518c6fef9fe569560cdd870053776956743f796055f2119399b9ca6c0df12fedd789ae46324d071e5126c4e495 SHA512 7b0f25d91b1b5c317980fc88e059200bd43b56a70b445fbc72fb9b96e09775bfd3a98e9bd9d662af80f0ce3aef527c777ee82777e96ca876f47a972d63da8606
@ -49,3 +50,5 @@ DIST rustc-1.87.0-src.tar.xz 283604208 BLAKE2B 7ede723121ff8df3908674631ceaec757
 DIST rustc-1.87.0-src.tar.xz.asc 801 BLAKE2B c9740c03baedcd70defba3fd37831692adaf0e984ef6b11d259244330d044fcacf935e6dd76caf126848da0c40f38e5368c60e8aabed5d3c2655a61fdbdc7564 SHA512 ebc13374381839a997c63455b733fd2a7960b4fd497f19c29be948cce8bb59a31ddda5da54ca154c16f7de43dd1bacd6c6bd76f3b6b36c5b43f4cfaf1746b952
 DIST rustc-1.88.0-src.tar.xz 283294344 BLAKE2B fc17efbc8b2e54f2da61384097dcb3b8f595f27f7853f56cef034913f6b46a718113af0fe66f0e3b0afd184ec506b35f3b74172926cf727ddc061f567d54fa4c SHA512 e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
 DIST rustc-1.88.0-src.tar.xz.asc 801 BLAKE2B 858e987ad1fc49c1e1cbc5ea709f835c60fce907e89205e431c843bfad97dc0ccbcf399fc7d87319b8455561cbc24020bd88cb572cbe932cb8b80a8adec39687 SHA512 64ab398dc602fed3ad7bf232249e80cc0a9831aa90c7eb37658f7dc5b2af04ee391f9633aae7a1d90f743d019cec531318384f71384ecbe4f6169e6e88b7ba0e
+DIST rustc-1.89.0_beta20250726-src.tar.xz 267425764 BLAKE2B 2a6802d5458eedb66fa2bd28d1a0d4c2104b1a734d9f7ec35fe989d210496d09a6db1a655a99970d68cbaab395741e3ddab24999c1150e9e64e8e72e1e3d9912 SHA512 f1a7524f46675f574b22ec00d4ce0c42ae272be7265e0665bc81cf3803ce1b286e4f7eb64e1850a7aa7b7e05c1cecae7011ac43964138d3679c19f0008b27fc4
+DIST rustc-1.89.0_beta20250726-src.tar.xz.asc 801 BLAKE2B 9cac60bbe248e5c63e703549efed39cd66978d926ffda52c9578492194df8d7a592d16f606547039222ffb0baa375ac7bce98bda7a5388e4d03cffe8a25c4356 SHA512 49e2e90ee69155d2b28fa2e88a809fb2642ecde72618ce20bb3bbd56afa921fc1e228cdb6ef8bd22346cb5e106945df26a9b5b8acef8f3f8c343fed8694b95e8
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
@ -1,18 +0,0 @@
-diff '--color=auto' -Nuar rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs
--- rustc-1.86.0-src.orig/src/bootstrap/src/utils/helpers.rs	2025-03-31 22:37:24.000000000 +0100
-+++ rustc-1.86.0-src/src/bootstrap/src/utils/helpers.rs	2025-04-17 12:31:37.651607535 +0100
-@@ -451,12 +451,12 @@
-     if !builder.is_lld_direct_linker(target) && builder.config.lld_mode.is_used() {
-         match builder.config.lld_mode {
-             LldMode::External => {
-                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
-                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
@ -1,29 +0,0 @@
-From 76e13020767e7ff783284b5bcf7a7509259ceb51 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jakub=20Ber=C3=A1nek?= <berykubik@gmail.com>
-Date: Fri, 4 Apr 2025 18:29:20 +0200
-Subject: [PATCH] Use target-agnostic LLD flags in bootstrap for use-lld
-
---
- src/bootstrap/src/utils/helpers.rs | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/bootstrap/src/utils/helpers.rs b/src/bootstrap/src/utils/helpers.rs
-index f8e4d4e04717d..78dcdcbd1874a 100644
--- a/src/bootstrap/src/utils/helpers.rs
-+++ b/src/bootstrap/src/utils/helpers.rs
-@@ -474,13 +474,13 @@ pub fn linker_flags(
-                 if stage == 0 && target.is_windows() {
-                     args.push("-Clink-arg=-fuse-ld=lld".to_string());
-                 } else {
-                    args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                    args.push("-Zlinker-features=+lld".to_string());
-                 }
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
-             }
-             LldMode::SelfContained => {
-                args.push("-Clinker-flavor=gnu-lld-cc".to_string());
-+                args.push("-Zlinker-features=+lld".to_string());
-                 args.push("-Clink-self-contained=+linker".to_string());
-                 // FIXME(kobzol): remove this flag once MCP510 gets stabilized
-                 args.push("-Zunstable-options".to_string());
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.74.1-r101.ebuild
@ -264,6 +264,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.75.0-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.76.0-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.77.1-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.78.0-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.79.0-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.80.1-r101.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.81.0-r101.ebuild
@ -244,6 +244,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.82.0-r103.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.83.0-r3.ebuild
@ -243,6 +243,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r2.ebuild
@ -249,6 +249,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r2.ebuild
@ -249,6 +249,8 @@ src_unpack() {
 }

 src_prepare() {
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r2.ebuild
@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1-r1.ebuild
@ -306,6 +306,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r2.ebuild
@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 PYTHON_COMPAT=( python3_{11..13} )

-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"

 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@ -307,6 +307,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@ -316,8 +318,6 @@ src_prepare() {
 	fi

 	default
-
-	eapply "${FILESDIR}"/rust-1.86.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }

 src_configure() {
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.87.0-r1.ebuild
@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 20 )
 PYTHON_COMPAT=( python3_{11..14} )

-RUST_PATCH_VER=${PVR}
+RUST_PATCH_VER="${PVR}-1"

 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
@ -308,6 +308,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@ -317,8 +319,6 @@ src_prepare() {
 	fi

 	default
-
-	eapply "${FILESDIR}"/rust-1.87.0-issue-139372-bgo-953956-fix-hardcoded-gnu-linker-flags.patch
 }

 src_configure() {
@ -446,6 +446,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@ -483,7 +484,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.88.0.ebuild
@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0_beta20250726.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.89.0_beta20250726.ebuild
@ -0,0 +1,837 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 20 )
+PYTHON_COMPAT=( python3_{11..14} )
+
+RUST_PATCH_VER=${PVR}
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		https://gitweb.gentoo.org/proj/rust-patches.git/snapshot/rust-patches-${RUST_PATCH_VER}.tar.bz2
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}=]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+# dev-libs/oniguruma is used for documentation
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	dev-libs/oniguruma
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	lto? ( system-llvm? (
+		|| (
+			$(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}')
+			sys-devel/mold
+		)
+	) )
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+rust_live_get_sources() {
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/rust-patches.git
+	"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/rust-patches-${RUST_PATCH_VER}"
+	git-r3_src_unpack
+
+	EGIT_REPO_URI="
+		https://github.com/rust-lang/rust.git
+	"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+	S="${WORKDIR}/rust"
+	EGIT_CHECKOUT_DIR="${S}"
+	git-r3_src_unpack
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		rust_live_get_sources
+
+		# Vendor dependencies
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/bootstrap.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-bootstrap.toml"
+			# Suppresses a warning about tracking changes which we don't care about.
+			change-id = "ignore"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -v --config="${T}"/vendor-bootstrap.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	elif use verify-sig ; then
+		# Patch tarballs are not signed (but we trust Gentoo infra)
+		verify-sig_verify_detached "${DISTDIR}"/rustc-${PV}-src.tar.xz{,.asc}
+		default
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
+	fi
+
+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
+	PATCHES=(
+		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
+	)
+
+	if use lto && tc-is-clang && ! tc-ld-is-lld && ! tc-ld-is-mold; then
+		export RUSTFLAGS+=" -C link-arg=-fuse-ld=lld"
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	# Avoid bundled copies of libraries
+	export RUSTONIG_SYSTEM_LIBONIG=1
+	# Need to check if these can be optional
+	#export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
+	#export LIBSSH2_SYS_USE_PKG_CONFIG=1
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/bootstrap.toml
+		# Suppresses a warning about tracking changes which we don't care about.
+		change-id = "ignore"
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"${CHOST}-cc\""
+		fi)
+		channel = "${build_channel}"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		omit-git-hash = false
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		$(if use lto && tc-is-clang && ! tc-ld-is-mold; then
+			echo "use-lld = true"
+		fi)
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/bootstrap.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/bootstrap.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" bootstrap.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "bootstrap.toml contents:"
+	cat "${S}"/bootstrap.toml || die
+	echo
+}
+
+src_compile() {
+	# -v will show invocations, -vv "very verbose" is overkill, -vvv "very very verbose" is insane
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/bootstrap.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -v --config="${S}"/bootstrap.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@ -10,7 +10,7 @@ RUST_PATCH_VER=${PVR}

 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
-	RUST_MIN_VER="1.88.0" # Update this as new `beta` releases come out.
+	RUST_MIN_VER="1.89.0" # Update this as new `beta` releases come out.
 elif [[ ${PV} == *beta* ]]; then
 	RUST_MAX_VER="$(ver_cut 1).$(ver_cut 2).0"
 	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
@ -320,6 +320,8 @@ src_prepare() {
 		${CARGO} generate-lockfile --offline || die "Failed to generate lockfiles"
 	fi

+	# Commit patches to the appropriate branch in proj/rust-patches.git
+	# then cut a new tag / tarball. Don't add patches to ${FILESDIR}
 	PATCHES=(
 		"${WORKDIR}/rust-patches-${RUST_PATCH_VER}/"
 	)
@ -458,6 +460,7 @@ src_configure() {
 		cargo = "${rust_stage0_root}/bin/cargo"
 		rustc = "${rust_stage0_root}/bin/rustc"
 		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		description = "gentoo"
 		docs = $(toml_usex doc)
 		compiler-docs = false
 		submodules = false
@ -495,7 +498,6 @@ src_configure() {
 			echo "default-linker = \"${CHOST}-cc\""
 		fi)
 		channel = "${build_channel}"
-		description = "gentoo"
 		rpath = true
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.1.ebuild
@ -101,6 +101,9 @@ src_configure() {
 	# least solve it the ebuild see https://bugs.gentoo.org/959349
 	use x86 && filter-flags -mfpmath=sse

+	# Temporary workaround for build failures with gcc-15, see bug 951267
+	append-cflags -std=gnu17
+
 	# Hardcodes the path to FGREP in libgcrypt-config
 	export ac_cv_path_SED="sed"
 	export ac_cv_path_EGREP="grep -E"
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libmspack/metadata.xml
@ -1,10 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>reavertm@gentoo.org</email>
-		<name>Maciej Mrozowski</name>
-	</maintainer>
+	<!-- maintainer-needed -->
 	<upstream>
 		<remote-id type="github">kyz/libmspack</remote-id>
 	</upstream>
--- a/Show More
+++ b/Show More