diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/Manifest
new file mode 100644
index 0000000000..e5a285d2b7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/Manifest
@@ -0,0 +1 @@
+DIST tpm2-tss-4.0.1.tar.gz 1787139 BLAKE2B 627cdefeff6c64148f9da1425922a0a7a72debcee4930ffab208a3b9b66127c2d4f923e3e105bfd45410cdb13c19cb40cc15a720e9a05dd32ff622dabf5fcc32 SHA512 ed6ddc52cb0e8c1082a4bb001e1225eb9905fd2380da88db5fd69ff5b5d9d43a93eb67b634e49d53eb5d586832da3aef2c4c7e5f18d51bb730481f8913319d7d
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch
new file mode 100644
index 0000000000..ca51ab7f93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile.am b/Makefile.am
+index 2c81cfa9..2673995c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -767,13 +767,11 @@ define set_tss_permissions
+ endef
+ 
+ define make_fapi_dirs
+-    ($(call make_tss_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/) || true) && \
+     ($(call make_tss_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/))
+ endef
+ 
+ define set_fapi_permissions
+     if test -z "${DESTDIR}"; then \ e
+-        ($(call set_tss_permissions,$(DESTDIR)$(runstatedir)/tpm2-tss)) && \
+         ($(call set_tss_permissions,$(DESTDIR)$(localstatedir)/lib/tpm2-tss)) \
+     fi
+ endef
+@@ -784,7 +782,6 @@ endef
+ 
+ define check_fapi_dirs
+     if test -z "${DESTDIR}"; then \
+-        ($(call check_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/)) && \
+         ($(call check_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/)) \
+     fi;
+ endef
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.1-Make-sysusers-and-tmpfiles-optional.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.1-Make-sysusers-and-tmpfiles-optional.patch
new file mode 100644
index 0000000000..d93fcf9ef2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.1-Make-sysusers-and-tmpfiles-optional.patch
@@ -0,0 +1,50 @@
+From 75f53cf7eab591870ce735203995d01d2f577187 Mon Sep 17 00:00:00 2001
+From: Christopher Byrne <salah.coronya@gmail.com>
+Date: Tue, 13 Jun 2023 21:40:56 -0500
+Subject: [PATCH] configure.ac: Make sysusers and tmpfiles optional
+
+Signed-off-by: Christopher Byrne <salah.coronya@gmail.com>
+---
+ Makefile.am  | 6 +++++-
+ configure.ac | 4 ++--
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 2c81cfa9..98965fa7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -563,10 +563,14 @@ fapi-config.json: dist/fapi-config.json.in
+ 		-e 's|[@]sysmeasurements@|$(sysmeasurements)|g' \
+ 		< "$<" > "$@"
+ 
++if SYSD_SYSUSERS
+ sysusers_DATA = dist/sysusers.d/tpm2-tss.conf
+-tmpfiles_DATA = tpm2-tss-fapi.conf
++endif
+ 
++if SYSD_TMPFILES
++tmpfiles_DATA = tpm2-tss-fapi.conf
+ CLEANFILES += tpm2-tss-fapi.conf
++endif
+ 
+ # We have to do this ourselves, in order to get absolute paths
+ tpm2-tss-fapi.conf: dist/tmpfiles.d/tpm2-tss-fapi.conf.in
+diff --git a/configure.ac b/configure.ac
+index b6550278..2d478147 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -550,9 +550,9 @@ AS_IF([test "x$enable_integration" = "xyes" && test "x$enable_self_generated_cer
+ 
+ # Check for systemd helper tools used by make install
+ AC_CHECK_PROG(systemd_sysusers, systemd-sysusers, yes)
+-AM_CONDITIONAL(SYSD_SYSUSERS, test "x$systemd_sysusers" = "xyes")
++AM_CONDITIONAL([SYSD_SYSUSERS], [test "x$systemd_sysusers" = "xyes" && test "x$sysusersdir" != "xno"])
+ AC_CHECK_PROG(systemd_tmpfiles, systemd-tmpfiles, yes)
+-AM_CONDITIONAL(SYSD_TMPFILES, test "x$systemd_tmpfiles" = "xyes")
++AM_CONDITIONAL([SYSD_TMPFILES], [test "x$systemd_tmpfiles" = "xyes" && test "x$tmpfilesdir" != "xno"])
+ 
+ # Check all tools used by make install
+ AS_IF([test "$HOSTOS" = "Linux" && test "x$systemd_sysusers" != "xyes"],
+-- 
+2.39.3
+
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/metadata.xml b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/metadata.xml
new file mode 100644
index 0000000000..ada5791c33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person" proxied="yes">
+		<email>salah.coronya@gmail.com</email>
+		<name>Christopher Byrne</name>
+	</maintainer>
+	<maintainer type="project" proxied="proxy">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
+	<use>
+		<flag name="fapi">Enable feature API (requires openssl as crypto backend)</flag>
+		<flag name="mbedtls">Use <pkg>net-libs/mbedtls</pkg> as crypto engine</flag>
+		<flag name="openssl">Use <pkg>dev-libs/openssl</pkg> as crypto engine</flag>
+		<flag name="policy">Enable policy library (requires openssl as crypto backend)</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">tpm2-software/tpm2-tss</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.0.1.ebuild
new file mode 100644
index 0000000000..3e27adc524
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.0.1.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic linux-info multilib-minimal tmpfiles udev
+
+DESCRIPTION="TCG Trusted Platform Module 2.0 Software Stack"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tss"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0/4"
+KEYWORDS="amd64 arm arm64 ~loong ppc64 ~riscv x86"
+IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="^^ ( mbedtls openssl )
+		fapi? ( openssl !mbedtls )
+		policy? ( openssl !mbedtls )"
+
+RDEPEND="acct-group/tss
+	acct-user/tss
+	sys-apps/util-linux:=[${MULTILIB_USEDEP}]
+	fapi? ( dev-libs/json-c:=[${MULTILIB_USEDEP}]
+		>=net-misc/curl-7.80.0[${MULTILIB_USEDEP}] )
+	mbedtls? ( net-libs/mbedtls:=[${MULTILIB_USEDEP}] )
+	openssl? ( dev-libs/openssl:=[${MULTILIB_USEDEP}] )"
+
+DEPEND="${RDEPEND}
+	test? ( app-crypt/swtpm
+		dev-libs/uthash
+		dev-util/cmocka
+		fapi? ( >=net-misc/curl-7.80.0 ) )"
+BDEPEND="sys-apps/acl
+	virtual/pkgconfig
+	doc? ( app-doc/doxygen )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.0-Dont-install-files-into-run.patch"
+	"${FILESDIR}/${PN}-4.0.1-Make-sysusers-and-tmpfiles-optional.patch"
+	)
+
+pkg_setup() {
+	local CONFIG_CHECK=" \
+		~TCG_TPM
+	"
+	linux-info_pkg_setup
+	kernel_is ge 4 12 0 || ewarn "At least kernel 4.12.0 is required"
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# tests fail with LTO enabbled. See bug 865275 and 865279
+	filter-lto
+
+	ECONF_SOURCE=${S} econf \
+		--localstatedir=/var \
+		$(multilib_native_use_enable doc doxygen-doc) \
+		$(use_enable fapi) \
+		$(use_enable policy) \
+		$(use_enable static-libs static) \
+		$(multilib_native_use_enable test unit) \
+		$(multilib_native_use_enable test integration) \
+		$(multilib_native_use_enable test self-generated-certificate) \
+		--disable-tcti-libtpms \
+		--disable-defaultflags \
+		--disable-weakcrypto \
+		--with-crypto="$(usex mbedtls mbed ossl)" \
+		--with-runstatedir=/run \
+		--with-udevrulesdir="$(get_udevdir)/rules.d" \
+		--with-udevrulesprefix=60- \
+		--without-sysusersdir \
+		--with-tmpfilesdir="/usr/lib/tmpfiles.d"
+}
+
+multilib_src_install() {
+	default
+	keepdir /var/lib/tpm2-tss/system/keystore
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process tpm2-tss-fapi.conf
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}