Merge pull request #2070 from flatcar/buildbot/weekly-portage-stable-package-updates-2024-07-01

Weekly portage-stable package updates 2024-07-01

.github/workflows/portage-stable-packages-list

@@ -97,9 +97,19 @@ app-arch/zstd
 
 app-cdr/cdrtools
 
+app-containers/aardvark-dns
+app-containers/catatonit
+app-containers/conmon
+app-containers/containers-common
+app-containers/containers-image
+app-containers/containers-shortnames
+app-containers/containers-storage
 app-containers/cri-tools
+app-containers/crun
 app-containers/docker
 app-containers/docker-cli
+app-containers/netavark
+app-containers/podman
 app-containers/runc
 
 app-crypt/adcli
@@ -107,6 +117,7 @@ app-crypt/argon2
 app-crypt/ccid
 app-crypt/efitools
 app-crypt/gnupg
+app-crypt/gpgme
 app-crypt/libb2
 app-crypt/libmd
 app-crypt/mhash
@@ -174,6 +185,7 @@ dev-build/meson
 dev-build/meson-format-array
 dev-build/ninja
 
+dev-cpp/abseil-cpp
 dev-cpp/gtest
 
 dev-db/sqlite
@@ -181,6 +193,8 @@ dev-db/sqlite
 dev-debug/gdb
 dev-debug/strace
 
+dev-go/go-md2man
+
 dev-lang/duktape
 dev-lang/go-bootstrap
 dev-lang/lua
@@ -240,6 +254,7 @@ dev-libs/libxslt
 dev-libs/libyaml
 dev-libs/lzo
 dev-libs/mpc
+dev-libs/mpdecimal
 dev-libs/mpfr
 dev-libs/nettle
 dev-libs/npth
@@ -250,11 +265,13 @@ dev-libs/popt
 dev-libs/protobuf
 dev-libs/userspace-rcu
 dev-libs/xmlsec
+dev-libs/yajl
 
 dev-perl/File-Slurp
 dev-perl/Parse-Yapp
 
 dev-python/autocommand
+dev-python/backports-tarfile
 dev-python/crcmod
 dev-python/cython
 dev-python/distro
@@ -268,7 +285,6 @@ dev-python/flit-core
 dev-python/gentoo-common
 dev-python/gpep517
 dev-python/hatchling
-dev-python/inflect
 dev-python/installer
 dev-python/jaraco-context
 dev-python/jaraco-functools
@@ -278,9 +294,11 @@ dev-python/lazy-object-proxy
 dev-python/lxml
 dev-python/markupsafe
 dev-python/more-itertools
+dev-python/olefile
 dev-python/ordered-set
 dev-python/packaging
 dev-python/pathspec
+dev-python/pillow
 dev-python/platformdirs
 dev-python/pluggy
 dev-python/pydecomp
@@ -289,9 +307,7 @@ dev-python/setuptools
 dev-python/setuptools-scm
 dev-python/six
 dev-python/snakeoil
-dev-python/tomli
 dev-python/trove-classifiers
-dev-python/typing-extensions
 dev-python/wheel
 
 dev-util/bpftool
@@ -350,6 +366,7 @@ eclass/lua-utils.eclass
 eclass/meson-multilib.eclass
 eclass/meson.eclass
 eclass/mount-boot.eclass
+eclass/mount-boot-utils.eclass
 eclass/multibuild.eclass
 eclass/multilib-build.eclass
 eclass/multilib-minimal.eclass
@@ -384,6 +401,7 @@ eclass/toolchain-autoconf.eclass
 eclass/toolchain-funcs.eclass
 eclass/toolchain.eclass
 eclass/udev.eclass
+eclass/unpacker.eclass
 eclass/user-info.eclass
 # This file is modified by us to be an empty file, so can't be synced for now.
 #
@@ -465,6 +483,7 @@ sec-policy/selinux-base
 sec-policy/selinux-base-policy
 sec-policy/selinux-container
 sec-policy/selinux-dbus
+sec-policy/selinux-policykit
 sec-policy/selinux-sssd
 sec-policy/selinux-unconfined
 
@@ -550,6 +569,7 @@ sys-fs/dosfstools
 sys-fs/e2fsprogs
 sys-fs/fuse
 sys-fs/fuse-common
+sys-fs/fuse-overlayfs
 sys-fs/lsscsi
 sys-fs/mtools
 sys-fs/multipath-tools
@@ -559,7 +579,6 @@ sys-fs/udisks
 sys-fs/xfsprogs
 sys-fs/zfs
 sys-fs/zfs-kmod
-app-containers/podman
 net-misc/passt
 
 sys-kernel/linux-headers

changelog/security/2024-07-05-weekly-updates.md

@@ -0,0 +1,7 @@
+- libarchive ([CVE-2024-26256](https://nvd.nist.gov/vuln/detail/CVE-2024-26256), [CVE-2024-37407](https://nvd.nist.gov/vuln/detail/CVE-2024-37407))
+- mit-krb5 ([CVE-2024-26461](https://nvd.nist.gov/vuln/detail/CVE-2024-26461), [CVE-2024-26462](https://nvd.nist.gov/vuln/detail/CVE-2024-26462), [CVE-2024-37370](https://nvd.nist.gov/vuln/detail/CVE-2024-37370), [CVE-2024-37371](https://nvd.nist.gov/vuln/detail/CVE-2024-37371))
+- tpm2-tools ([CVE-2024-29038](https://nvd.nist.gov/vuln/detail/CVE-2024-29038), [CVE-2024-29039](https://nvd.nist.gov/vuln/detail/CVE-2024-29039), [CVE-2024-29040](https://nvd.nist.gov/vuln/detail/CVE-2024-29040))
+- glib ([CVE-2024-34397](https://nvd.nist.gov/vuln/detail/CVE-2024-34397))
+- libxml2 ([CVE-2024-34459](https://nvd.nist.gov/vuln/detail/CVE-2024-34459))
+- git ([CVE-2024-32002](https://nvd.nist.gov/vuln/detail/CVE-2024-32002), [CVE-2024-32004](https://nvd.nist.gov/vuln/detail/CVE-2024-32004), [CVE-2024-32020](https://nvd.nist.gov/vuln/detail/CVE-2024-32020), [CVE-2024-32021](https://nvd.nist.gov/vuln/detail/CVE-2024-32021), [CVE-2024-32465](https://nvd.nist.gov/vuln/detail/CVE-2024-32465))
+- intel-microcode ([CVE-2023-45733](https://nvd.nist.gov/vuln/detail/CVE-2023-45733), [CVE-2023-45745](https://nvd.nist.gov/vuln/detail/CVE-2023-45745), [CVE-2023-46103](https://nvd.nist.gov/vuln/detail/CVE-2023-46103), [CVE-2023-47855](https://nvd.nist.gov/vuln/detail/CVE-2023-47855))

changelog/updates/2024-07-05-weekly-updates.md

@@ -0,0 +1,49 @@
+- audit ([3.1.2](https://github.com/linux-audit/audit-userspace/releases/tag/v3.1.2))
+- binutils ([2.42](https://sourceware.org/pipermail/binutils/2024-January/132213.html))
+- bpftool ([6.8.2](https://kernelnewbies.org/Linux_6.8#Tracing.2C_perf_and_BPF))
+- c-ares ([1.28.1](https://github.com/c-ares/c-ares/releases/tag/cares-1_28_1) (includes [1.28.0](https://github.com/c-ares/c-ares/releases/tag/cares-1_28_0)))
+- cJSON ([1.7.18](https://github.com/DaveGamble/cJSON/releases/tag/v1.7.18))
+- containers-common ([0.59.1](https://github.com/containers/common/releases/tag/v0.59.1))
+- git ([2.44.2](https://github.com/git/git/blob/v2.44.2/Documentation/RelNotes/2.44.2.txt) (includes [2.44.1](https://github.com/git/git/blob/v2.44.1/Documentation/RelNotes/2.44.1.txt), [2.44.0](https://github.com/git/git/blob/v2.44.0/Documentation/RelNotes/2.44.0.txt)))
+- glib ([2.78.6](https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.6) (includes [2.78.5](https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.5), [2.78.4](https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.4)))
+- gnupg ([2.4.5](https://lists.gnupg.org/pipermail/gnupg-announce/2024q1/000482.html))
+- hwdata ([0.382](https://github.com/vcrhonek/hwdata/commits/v0.382))
+- intel-microcode ([20240514_p20240514](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240514))
+- iproute2 ([6.8.0](https://lwn.net/Articles/965125/) (includes [6.7.0](https://lwn.net/Articles/957171/)))
+- kexec-tools ([2.0.28](https://github.com/horms/kexec-tools/commits/v2.0.28/))
+- kmod ([32](https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/tree/NEWS?h=v32))
+- libarchive ([3.7.4](https://github.com/libarchive/libarchive/releases/tag/v3.7.4) (includes [3.7.3](https://github.com/libarchive/libarchive/releases/tag/v3.7.3)))
+- libassuan ([2.5.7](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libassuan.git;a=blob;f=NEWS;h=047f12b7c3ee0c8c1718a2da8b5a6bb9dd541fd8;hb=cc2f776904e0b5e56e2b81b2672ca98d7787ed1b))
+- libcap ([2.70](https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.hde102t8xd0v))
+- libcap-ng ([0.8.5](https://github.com/stevegrubb/libcap-ng/releases/tag/v0.8.5))
+- libdnet ([1.18.0](https://github.com/ofalk/libdnet/releases/tag/libdnet-1.18.0))
+- libgpg-error ([1.49](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=8ac4bf36113fe9254a361e2bc8d0ed52383839ce;hb=faed9c271ad22bbd2ed265d8e11badb53b7a2f32))
+- libnl ([3.9.0](http://lists.infradead.org/pipermail/libnl/2023-December/002436.html))
+- libnvme ([1.9](https://github.com/linux-nvme/libnvme/releases/tag/v1.9))
+- libpcre2 ([10.43](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.43/NEWS))
+- libunwind ([1.8.1](https://github.com/libunwind/libunwind/releases/tag/v1.8.1) (includes [1.8.0](https://github.com/libunwind/libunwind/releases/tag/v1.8.0)))
+- libusb ([1.0.27](https://github.com/libusb/libusb/blob/v1.0.27/ChangeLog))
+- libxml2 ([2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) (includes [2.12.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.6)))
+- lshw ([02.20.2b](https://www.ezix.org/project/wiki/HardwareLiSter#Changes))
+- mit-krb5 ([1.21.3](https://web.mit.edu/kerberos/krb5-1.21/README-1.21.3.txt))
+- multipath-tools ([0.9.8](https://github.com/opensvc/multipath-tools/blob/0.9.8/NEWS.md))
+- nmap ([7.95](https://nmap.org/changelog.html#7.95))
+- nvme-cli ([2.9.1](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.9.1) (includes [2.9](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.9)))
+- pciutils ([3.12.0](https://github.com/pciutils/pciutils/blob/v3.12.0/ChangeLog))
+- SDK: portage ([3.0.63](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.63))
+- SDK: qemu ([8.2.3](https://wiki.qemu.org/ChangeLog/8.2))
+- qemu-guest-agent ([8.2.0](https://wiki.qemu.org/ChangeLog/8.2#Guest_agent))
+- rsync ([3.3.0](https://github.com/RsyncProject/rsync/blob/v3.3.0/NEWS.md))
+- sqlite ([3.45.3](https://www.sqlite.org/releaselog/3_45_3.html))
+- talloc ([2.4.1](https://gitlab.com/samba-team/samba/-/commit/791e2817e13182344447590313f7e372a27c1d48))
+- tdb ([1.4.9](https://gitlab.com/samba-team/samba/-/commit/b649c7d3c2b1e13e900c80ff7a20959a70b1c528))
+- tevent ([0.15.0](https://gitlab.com/samba-team/samba/-/commit/6a80d170bca0c938f78ab12e37481b52792a9d83))
+- tpm2-tools ([5.6.1](https://github.com/tpm2-software/tpm2-tools/releases/tag/5.6.1) (includes [5.6](https://github.com/tpm2-software/tpm2-tools/releases/tag/5.6)))
+- tpm2-tss ([4.0.2](https://github.com/tpm2-software/tpm2-tss/releases/tag/4.0.2))
+- vim ([9.1.0366](https://github.com/vim/vim/commits/v9.1.0366/) (includes [9.1](https://www.vim.org/vim-9.1-released.php)))
+- wget ([1.24.5](https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00002.html))
+- whois ([5.5.21](https://github.com/rfc1036/whois/blob/v5.5.21/debian/changelog))
+- xfsprogs ([6.6.0](https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/tree/doc/CHANGES?h=v6.6.0))
+- zfs ([2.2.3](https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3))
+- zlib ([1.3.1](https://github.com/madler/zlib/releases/tag/v1.3.1))
+- zstd ([1.5.6](https://github.com/facebook/zstd/releases/tag/v1.5.6))

sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild

@@ -150,6 +150,7 @@ RDEPEND="${RDEPEND}
 	sec-policy/selinux-base-policy
 	sec-policy/selinux-container
 	sec-policy/selinux-dbus
+	sec-policy/selinux-policykit
 	sec-policy/selinux-unconfined
 	sys-apps/acl
 	sys-apps/attr

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/kmod

@@ -0,0 +1,20 @@
+# sbin and bin are still separate directories and the build system of
+# kmod puts the tool symlinks into bin, whereas most places that use
+# absolute paths to the tools expect them to be in sbin. Move them
+# there. This can be removed if we merge bin and sbin directories
+# (likely to happen when we migrate to 23.0 profiles).
+cros_post_src_install_move_kmod_tools_symlinks() {
+    local kmod tool
+
+    # path to kmod relative to sbin
+    if [[ -x "${ED}/usr/sbin/kmod" ]]; then
+        kmod=kmod
+    else
+        kmod=../bin/kmod
+    fi
+    mkdir -p "${ED}/usr/sbin"
+    for tool in modprobe rmmod insmod depmod; do
+        rm -f "${ED}/usr/bin/${tool}" "${ED}/bin/${tool}"
+        ln -sf "${kmod}" "${ED}/usr/sbin/${tool}"
+    done
+}

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-fs/xfsprogs/0001-libfrog-Fix-cross-compilation-issue-with-randbytes.patch

@@ -1,43 +0,0 @@
-From 0b3f711bd7a9f47412f28b77a4a268f3ab1ba5ad Mon Sep 17 00:00:00 2001
-From: Krzesimir Nowak <knowak@microsoft.com>
-Date: Fri, 4 Aug 2023 11:49:18 +0200
-Subject: [PATCH] libfrog: Fix cross-compilation issue with randbytes
-
-randbytes.c was mostly split off from crc32.c and, like crc32.c, is
-used for selftests, which are run on the build host. As such it should
-not include platform_defs.h which in turn includes urcu.h from
-userspace-rcu library, because the build host might not have the
-library installed.
----
- libfrog/randbytes.c | 1 -
- libfrog/randbytes.h | 2 ++
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/libfrog/randbytes.c b/libfrog/randbytes.c
-index f22da0d3..2023b601 100644
---- a/libfrog/randbytes.c
-+++ b/libfrog/randbytes.c
-@@ -6,7 +6,6 @@
-  *
-  * This is the buffer of random bytes used for self tests.
-  */
--#include "platform_defs.h"
- #include "libfrog/randbytes.h"
- 
- /* 4096 random bytes */
-diff --git a/libfrog/randbytes.h b/libfrog/randbytes.h
-index 00fd7c4c..fddea9c7 100644
---- a/libfrog/randbytes.h
-+++ b/libfrog/randbytes.h
-@@ -6,6 +6,8 @@
- #ifndef __LIBFROG_RANDBYTES_H__
- #define __LIBFROG_RANDBYTES_H__
- 
-+#include <stdint.h>
-+
- extern uint8_t randbytes_test_buf[];
- 
- #endif /* __LIBFROG_RANDBYTES_H__ */
--- 
-2.25.1
-

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-fs/xfsprogs/README.md

@@ -1 +0,0 @@
-Drop `0001-libfrog-Fix-cross-compilation-issue-with-randbytes.patch` when updating to 6.5 or greater.

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -10,8 +10,17 @@
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 dev-util/catalyst ~amd64 ~arm64
 
+# Handled by automation
 =app-containers/containerd-1.7.19 ~amd64 ~arm64 # DO NOT EDIT THIS LINE. Added by containerd-apply-patch.sh on 2024-07-05 08:17:23
+
+# Handled by automation?
 =app-containers/cri-tools-1.27.0 ~amd64 ~arm64
+
+# These seem to be the versions we initially got, but the
+# modifications made to the ebuilds were clobbered, so these are here
+# to keep using the same version. Can be dropped when these or newer
+# get stabilized in Gentoo.
+=app-containers/podman-5.0.2 ~amd64 ~arm64
 =app-containers/runc-1.1.13 ~amd64 ~arm64
 
 # Seems to be the only available ebuild in portage-stable right now.
@@ -26,24 +35,28 @@ dev-util/catalyst ~amd64 ~arm64
 # Needed by arm64-native SDK.
 =app-crypt/efitools-1.9.2-r1 ~arm64
 
+# Needed to fix CVE-2024-26461, CVE-2024-26462, CVE-2024-37370,
+# CVE-2024-37371.
+=app-crypt/mit-krb5-1.21.3 ~arm64
+
 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
-# Required for addressing CVE-2022-3715.
+# Keep versions on both arches in sync.
-=app-shells/bash-5.2_p26 ~amd64 ~arm64
+=dev-cpp/abseil-cpp-20230125.3-r3 ~arm64
 
 # Needed by arm64-native SDK.
 =dev-embedded/u-boot-tools-2021.04_rc2 ~arm64
 
-# Keep versions on both arches in sync.
-=dev-lang/python-3.11.9 ~amd64
-
 # Accept unstable host Rust compilers.
 =dev-lang/rust-1.79.0 ~amd64 ~arm64
 
 # Needed by arm64-native SDK.
 =dev-lang/yasm-1.3.0-r1 ~arm64
 
+# Keep versions on both arches in sync.
+=dev-libs/ding-libs-0.6.2-r1 ~arm64
+
 # Needed to fix CVE-2023-52425 and CVE-2024-28757.
 =dev-libs/expat-2.6.2 ~amd64 ~arm64
 
@@ -54,76 +67,53 @@ dev-util/catalyst ~amd64 ~arm64
 =dev-libs/luksmeta-9-r1 **
 
 # Keep versions on both arches in sync.
-=dev-libs/ding-libs-0.6.2-r1 ~arm64
+=dev-libs/libp11-0.4.12-r6 ~arm64
+=dev-libs/protobuf-23.3-r4 ~arm64
 
-# Needed to fix a build issue introduced by a wrong change in an older
+# These seem to be the versions we initially got, but the
-# version of the ebuild.
+# modifications made to the ebuilds were clobbered, so these are here
-=dev-libs/libdnet-1.16.4 ~arm64
+# to keep using the same version. Can be dropped when these or newer
+# get stabilized in Gentoo.
+=dev-libs/yajl-2.1.0-r5 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
-=dev-libs/libp11-0.4.12-r6 ~arm64
-=dev-libs/opensc-0.24.0 ~arm64
-=dev-python/cython-3.0.10 ~arm64
 =dev-python/lxml-5.2.1 ~arm64
 =dev-util/pahole-1.26 ~arm64
 
 # Needed for the MIT License
 =net-analyzer/netperf-2.7.0_p20210121 ~amd64 ~arm64
 
-# Needed for addressing CVE-2024-25629
-=net-dns/c-ares-1.27.0 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.6-r1 ~arm64
 
 # Required for addressing CVE-2023-0361, CVE-2023-5981, CVE-2024-0567,
 # CVE-2024-0553, CVE-2024-28834 and CVE-2024-28835.
-=net-libs/gnutls-3.8.5 ~amd64 ~arm64
+=net-libs/gnutls-3.8.5-r1 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
-# Keep versions on both arches in sync.
-=net-misc/curl-8.7.1-r3 ~arm64
-
-# Required to allow us to override the sftp subsystem in sshd config.
-=net-misc/openssh-9.4_p1 ~amd64 ~arm64
-
 # Required to address coreutils-2024-03-28
 =sys-apps/coreutils-9.5 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
-=sys-apps/kexec-tools-2.0.24 ~arm64
+=sys-apps/kexec-tools-2.0.28 ~arm64
-=sys-apps/nvme-cli-2.8 ~arm64
+=sys-apps/nvme-cli-2.9.1 ~arm64
 
 sys-apps/zram-generator ~amd64 ~arm64
 
+# Upgrade to latest version for secureboot
+=sys-boot/mokutil-0.6.0 ~amd64
+
 # Enable ipvsadm for arm64.
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
 =sys-firmware/edk2-aarch64-18.02 **
 
-# Needed to fix CVE-2023-22655, CVE-2023-28746, CVE-2023-38575,
-# CVE-2023-39368 and CVE-2023-43490.
-=sys-firmware/intel-microcode-20240312_p20240312 ~amd64
-
-# Needed to fix CVE-2023-29491.
-=sys-libs/ncurses-6.4_p20230527 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
-=sys-libs/libnvme-1.8 ~arm64
+=sys-libs/libnvme-1.9 ~arm64
-
-# A dependency of app-shells/bash version that we need for security
-# fixes.
-=sys-libs/readline-8.2_p10 ~amd64 ~arm64
-
-# Needed to fix CVE-2023-4016.
-=sys-process/procps-4.0.4 ~amd64
 
 # Accept unstable host Rust compilers.
 =virtual/rust-1.79.0 ~amd64 ~arm64
-
-# Upgrade to latest version for secureboot
-=sys-boot/mokutil-0.6.0 ~amd64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask

@@ -14,3 +14,10 @@
 # Python 3.12 is in portage-stable (currently testing), so avoid picking it
 # up. Update this to mask later versions when we switch to 3.11.
 >=dev-lang/python-3.12
+
+# Samba sticks with the old ldb for now. Can be dropped when we update
+# samba to 4.19.x.
+>=sys-libs/ldb-2.8
+
+# Update engine needs updating to use a newer version of protobuf.
+>=dev-libs/protobuf-22.0

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use

@@ -162,3 +162,6 @@ sys-fs/zfs minimal -rootfs
 # Do not pull in LLVM into production images. Also, we didn't use it
 # before anyway.
 dev-util/bpftool -llvm
+
+# Do not tinker with /boot partition at installation time.
+sys-firmware/intel-microcode -initramfs

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask

@@ -19,3 +19,9 @@ app-editors/nano unicode
 
 # Pulls dev-python/sphinx, which in turn pulls a lot of other python stuff.
 sys-fs/btrfs-progs man
+
+# The dev-python/pillow package is pulled in by dev-python/docutils.
+# As the name suggests, it's for generating docs, which we don't even
+# put anywhere. Thus avoid pulling more dependencies than necessary
+# for throw-away things.
+dev-python/pillow jpeg

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask

@@ -12,6 +12,8 @@ python_targets_python3_10
 python_single_target_python3_10
 python_targets_python3_12
 python_single_target_python3_12
+python_targets_python3_13
+python_single_target_python3_13
 
 # Unmask selinux so it can be enabled selectively in package.use
 -selinux

sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided

@@ -5,7 +5,7 @@
 # disable them and we have no need/use for them in prod images.
 
 # pulled in by app-crypt/pinentry
-app-eselect/eselect-pinentry-0.7.3
+app-eselect/eselect-pinentry-0.7.4
 
 # pulled in by app-editors/vim
 app-eselect/eselect-vi-1.2

sdk_container/src/third_party/coreos-overlay/sys-apps/kmod/Manifest

@@ -1,2 +1 @@
-DIST kmod-31.tar.xz 570936 BLAKE2B 0dc8572da570315cf0aadd87fa7e83d0f88dea91c8566749e6f3004f9a6df916dce337ca99ea5929d41f45b408c1e3effa50f9d24615d7fa28688150a5ce91cf SHA512 05ca70381808bec5f262b94db625662c385408988178a35e4aaf4960ee0716dc0cbfc327160ea4b61098d0c2130ab1b5142ea8156bea8e06ded7f4d288b6d085
 DIST kmod-32.tar.xz 511988 BLAKE2B 5b5dac4639406549b23bb1da44bedd86a42885304ef4c7c67344dc8fd70b9e0ca3f83d033c6b80f6e00371d7188e205f4b68fadc56a9ddbf9d6a9d28e9b1e9a4 SHA512 29162135aabd025dff178a4147a754b5da5964855dbeee65ca867dec3b84437f35c1c97f0f027e974a021d3ee9a4940309a716859cc3cfe93c7ed0aada338f24

sdk_container/src/third_party/coreos-overlay/sys-apps/kmod/kmod-32-r2.ebuild

@@ -6,14 +6,14 @@ EAPI=8
 inherit autotools libtool bash-completion-r1
 
 DESCRIPTION="Library and tools for managing linux kernel modules"
-HOMEPAGE="https://git.kernel.org/?p=utils/kernel/kmod/kmod.git"
+HOMEPAGE="https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git"
 
 if [[ ${PV} == 9999* ]]; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/kernel/${PN}/${PN}.git"
 	inherit git-r3
 else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/kernel/kmod/${P}.tar.xz"
+	SRC_URI="https://mirrors.edge.kernel.org/pub/linux/utils/kernel/kmod/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 LICENSE="LGPL-2"

sdk_container/src/third_party/coreos-overlay/sys-apps/kmod/kmod-9999.ebuild

@@ -6,19 +6,19 @@ EAPI=8
 inherit autotools libtool bash-completion-r1
 
 DESCRIPTION="Library and tools for managing linux kernel modules"
-HOMEPAGE="https://git.kernel.org/?p=utils/kernel/kmod/kmod.git"
+HOMEPAGE="https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git"
 
 if [[ ${PV} == 9999* ]]; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/kernel/${PN}/${PN}.git"
 	inherit git-r3
 else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/kernel/kmod/${P}.tar.xz"
+	SRC_URI="https://mirrors.edge.kernel.org/pub/linux/utils/kernel/kmod/${P}.tar.xz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 LICENSE="LGPL-2"
 SLOT="0"
-IUSE="debug doc +lzma pkcs7 split-usr static-libs +tools +zlib +zstd"
+IUSE="debug doc +lzma pkcs7 static-libs +tools +zlib +zstd"
 
 # Upstream does not support running the test suite with custom configure flags.
 # I was also told that the test suite is intended for kmod developers.
@@ -79,6 +79,8 @@ src_prepare() {
 
 src_configure() {
 	local myeconfargs=(
+		--bindir="${EPREFIX}/bin"
+		--sbindir="${EPREFIX}/sbin"
 		--enable-shared
 		--with-bashcompletiondir="$(get_bashcompdir)"
 		$(use_enable debug)
@@ -99,10 +101,12 @@ src_install() {
 
 	find "${ED}" -type f -name "*.la" -delete || die
 
-	if use tools && use split-usr; then
+	if use tools; then
-		# Move modprobe to /sbin to match CONFIG_MODPROBE_PATH from kernel
+		local cmd
-		rm "${ED}/usr/bin/modprobe" || die
+		for cmd in depmod insmod modprobe rmmod; do
-		dosym ../usr/bin/kmod /sbin/modprobe
+			rm "${ED}"/bin/${cmd} || die
+			dosym ../bin/kmod /sbin/${cmd}
+		done
 	fi
 
 	cat <<-EOF > "${T}"/usb-load-ehci-first.conf

sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-2.31-r2.ebuild

@@ -0,0 +1,43 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit prefix
+
+DESCRIPTION="User land tool for cleaning up old perl installs"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Perl"
+
+if [[ "${PV}" == "9999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/gentoo-perl/perl-cleaner.git"
+else
+	SRC_URI="https://dev.gentoo.org/~dilfridge/distfiles/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="pkgcore"
+
+[[ "${PV}" == "9999" ]] && BDEPEND="sys-apps/help2man"
+
+RDEPEND="
+	app-shells/bash
+	dev-lang/perl
+	pkgcore? ( sys-apps/pkgcore )
+	!pkgcore? (
+		app-portage/portage-utils
+		sys-apps/portage
+	)
+"
+
+src_prepare() {
+	default
+	eprefixify ${PN}
+}
+
+src_install() {
+	dosbin perl-cleaner
+	doman perl-cleaner.1
+}

sdk_container/src/third_party/portage-stable/app-admin/perl-cleaner/perl-cleaner-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8

sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-1.0.8-r4.ebuild

@@ -1,135 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# XXX: atm, libbz2.a is always PIC :(, so it is always built quickly
-#      (since we're building shared libs) ...
-
-EAPI=7
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bzip2.gpg
-inherit toolchain-funcs multilib multilib-minimal usr-ldscript verify-sig
-
-DESCRIPTION="A high-quality data compressor used extensively by Gentoo Linux"
-HOMEPAGE="https://sourceware.org/bzip2/"
-SRC_URI="https://sourceware.org/pub/${PN}/${P}.tar.gz"
-SRC_URI+=" verify-sig? ( https://sourceware.org/pub/${PN}/${P}.tar.gz.sig )"
-
-LICENSE="BZIP2"
-SLOT="0/1" # subslot = SONAME
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos"
-IUSE="static static-libs"
-
-BDEPEND="
-	verify-sig? ( sec-keys/openpgp-keys-bzip2 )
-"
-PDEPEND="
-	app-alternatives/bzip2
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.0.4-makefile-CFLAGS.patch
-	"${FILESDIR}"/${PN}-1.0.8-saneso.patch
-	"${FILESDIR}"/${PN}-1.0.4-man-links.patch #172986
-	"${FILESDIR}"/${PN}-1.0.6-progress.patch
-	"${FILESDIR}"/${PN}-1.0.3-no-test.patch
-	"${FILESDIR}"/${PN}-1.0.8-mingw.patch #393573
-	"${FILESDIR}"/${PN}-1.0.8-out-of-tree-build.patch
-)
-
-DOCS=( CHANGES README{,.COMPILATION.PROBLEMS,.XML.STUFF} manual.pdf )
-HTML_DOCS=( manual.html )
-
-src_prepare() {
-	default
-
-	# - Use right man path
-	# - Generate symlinks instead of hardlinks
-	# - pass custom variables to control libdir
-	sed -i \
-		-e 's:\$(PREFIX)/man:\$(PREFIX)/share/man:g' \
-		-e 's:ln -s -f $(PREFIX)/bin/:ln -s -f :' \
-		-e 's:$(PREFIX)/lib:$(PREFIX)/$(LIBDIR):g' \
-		Makefile || die
-}
-
-bemake() {
-	emake \
-		VPATH="${S}" \
-		CC="$(tc-getCC)" \
-		AR="$(tc-getAR)" \
-		RANLIB="$(tc-getRANLIB)" \
-		"$@"
-}
-
-multilib_src_compile() {
-	bemake -f "${S}"/Makefile-libbz2_so all
-	# Make sure we link against the shared lib #504648
-	ln -s libbz2.so.${PV} libbz2.so || die
-	bemake -f "${S}"/Makefile all LDFLAGS="${LDFLAGS} $(usex static -static '')"
-}
-
-multilib_src_test() {
-	cp "${S}"/sample* "${BUILD_DIR}" || die
-	bemake -f "${S}"/Makefile check
-}
-
-multilib_src_install() {
-	into /usr
-
-	# Install the shared lib manually.  We install:
-	#  .x.x.x - standard shared lib behavior
-	#  .x.x   - SONAME some distros use #338321
-	#  .x     - SONAME Gentoo uses
-	dolib.so libbz2.so.${PV}
-	local v
-	for v in libbz2.so{,.{${PV%%.*},${PV%.*}}} ; do
-		dosym libbz2.so.${PV} /usr/$(get_libdir)/${v}
-	done
-
-	use static-libs && dolib.a libbz2.a
-
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a bz2
-
-		dobin bzip2recover$(get_exeext)
-		into /
-		newbin bzip2$(get_exeext) bzip2-reference$(get_exeext)
-	fi
-}
-
-multilib_src_install_all() {
-	# `make install` doesn't cope with out-of-tree builds, nor with
-	# installing just non-binaries, so handle things ourselves.
-	insinto /usr/include
-	doins bzlib.h
-	into /usr
-	dobin bz{diff,grep,more}
-	doman bz{diff,grep,more}.1
-	newman bzip2.1 bzip2-reference.1
-
-	dosym bzdiff /usr/bin/bzcmp
-	dosym bzdiff.1 /usr/share/man/man1/bzcmp.1
-
-	dosym bzmore /usr/bin/bzless
-	dosym bzmore.1 /usr/share/man/man1/bzless.1
-
-	dosym bzip2-reference.1 /usr/share/man/man1/bzip2recover.1
-	local x
-	for x in bz{e,f}grep ; do
-		dosym bzgrep /usr/bin/${x}
-		dosym bzgrep.1 /usr/share/man/man1/${x}.1
-	done
-
-	einstalldocs
-}
-
-pkg_postinst() {
-	# ensure to preserve the symlinks before app-alternatives/bzip2
-	# is installed
-	local x
-	for x in bzip2 bunzip2 bzcat; do
-		if [[ ! -h ${EROOT}/bin/${x} ]]; then
-			ln -s bzip2-reference$(get_exeext) "${EROOT}/bin/${x}$(get_exeext)" || die
-		fi
-	done
-}

sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest

@@ -1,4 +1,2 @@
-DIST libarchive-3.7.2.tar.xz 5237056 BLAKE2B 7221db4811a965ee61d879a2603480363628a19995a351b572d099be9f35576d76f0b0822f9a5a47d9929bc094d4444fd8eafcb4a073e39bb3aa797d4b926ca5 SHA512 a21bebb27b808cb7d2ed13a70739904a1b7b55661d8dea83c9897a0129cf71e20c962f13666c571782ff0f4f753ca885619c2097d9e7691c2dee4e6e4b9a2971
+DIST libarchive-3.7.4.tar.xz 5417660 BLAKE2B 128f72235da61e112201046c0cfe62a8c580cf73b426c4cfe270ae913356f6ad430ba33a663dcd617b082c7baf45ada8d1c9928c45fea16fd57e8020693a60bc SHA512 84bc346ba15861ab10aa54a3d687de955178e4efbe12bf3a49a467181e7f819673949f131f4c8338de8ed6e319a8565af376e5a540380bda08e60dffbc7c8686
-DIST libarchive-3.7.2.tar.xz.asc 659 BLAKE2B 7141baf007b89b7ee38ec817b648cef5efb4d694953fcd49f6ed2dc95cf4da2d9259262b9eb4f01ff5d4ecee1257b266a8c6687a8e8ef8790121048229f1ad22 SHA512 c2ce850088245d7723720737d74d1cc1819984d01b3f9e4ed96b0757f4c6d6d511b78792181a12400c563632d74edcd0c2c3a4b7527cba40ada7ef74488078fc
+DIST libarchive-3.7.4.tar.xz.asc 659 BLAKE2B 77e705194f6e9a9f97da0ac43c9b3157e1a8a490d26da34079e4ef3f2bcf98d6f6e95567e110287fab0ec26d3fc27e5bbeff7569c9ca138de2caf47af737c6d0 SHA512 82caa18a78661ea717ce93cdcb0806eed48450c20fb4d45cb4c33001f2d4d0fb5a791552acbb24ad8c41772e1d0b66c76c9cb86946bc862109721a0c986f5331
-DIST libarchive-3.7.3.tar.xz 5428992 BLAKE2B c53672c8cdbe8f406f00bf4fc6b36e4dffcd23a33909dbec6ef06b86dceefc6062840eff629ba3bd19c36121720e16a8ba10dfa1a35ebed186cc92eb144f55d0 SHA512 984e7c61010b9555bafe54d5f52ff2d089e28afe5cea3a14615e2aca8539075293789d18f17f8915882ec328bcbdca7b3d1536d6dc19620ca226e8b6d802ef63
-DIST libarchive-3.7.3.tar.xz.asc 659 BLAKE2B bfe18e36ef2e96ad46ab2cd1236701b4b80f41ebb840681c1baf7eac72f38444cc0619645fac17d3acdda6553b294483d87f0a92d9575138d117934e838d85d2 SHA512 9f340b41fc9db34f1c4e0823d559b666196d3031249e05981cfb43a401aa8a85710f14ba1cc784ab3ca367439e4c485668dffe7020f38f50b3ed35810df504a1

sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.2-32bit-test.patch

@@ -1,29 +0,0 @@
-From 3bd918d92f8c34ba12de9c6604d96f9e262a59fc Mon Sep 17 00:00:00 2001
-From: Martin Matuska <martin@matuska.de>
-Date: Tue, 12 Sep 2023 08:54:47 +0200
-Subject: [PATCH] tests: fix zstd long option test for 32-bit architectures
-
-Fixes #1968
----
- libarchive/test/test_write_filter_zstd.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/libarchive/test/test_write_filter_zstd.c b/libarchive/test/test_write_filter_zstd.c
-index 3cdbd812a..c9731f1b6 100644
---- a/libarchive/test/test_write_filter_zstd.c
-+++ b/libarchive/test/test_write_filter_zstd.c
-@@ -161,8 +161,12 @@ DEFINE_TEST(test_write_filter_zstd)
- 	    archive_write_set_filter_option(a, NULL, "max-frame-size", "1048576"));
- #endif
- #if ZSTD_VERSION_NUMBER >= MINVER_LONG
--	assertEqualIntA(a, ARCHIVE_OK,
--	    archive_write_set_filter_option(a, NULL, "long", "27"));
-+	if ((int)(sizeof(size_t) == 4))
-+		assertEqualIntA(a, ARCHIVE_OK,
-+		    archive_write_set_filter_option(a, NULL, "long", "26"));
-+	else
-+		assertEqualIntA(a, ARCHIVE_OK,
-+		    archive_write_set_filter_option(a, NULL, "long", "27"));
- 	assertEqualIntA(a, ARCHIVE_FAILED,
- 	    archive_write_set_filter_option(a, NULL, "long", "-1")); /* negative */
- #endif

sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.2-safe-fprintf.patch

@@ -1,27 +0,0 @@
-From 6110e9c82d8ba830c3440f36b990483ceaaea52c Mon Sep 17 00:00:00 2001
-From: Ed Maste <emaste@freebsd.org>
-Date: Fri, 29 Mar 2024 18:02:06 -0400
-Subject: [PATCH] tar: make error reporting more robust and use correct errno
- (#2101)
-
-As discussed in #1609.
----
- tar/read.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/tar/read.c b/tar/read.c
-index af3d3f423..a7f14a07b 100644
---- a/tar/read.c
-+++ b/tar/read.c
-@@ -371,8 +371,9 @@ read_archive(struct bsdtar *bsdtar, char mode, struct archive *writer)
- 			if (r != ARCHIVE_OK) {
- 				if (!bsdtar->verbose)
- 					safe_fprintf(stderr, "%s", archive_entry_pathname(entry));
--				fprintf(stderr, ": %s: ", archive_error_string(a));
--				fprintf(stderr, "%s", strerror(errno));
-+				safe_fprintf(stderr, ": %s: %s",
-+				    archive_error_string(a),
-+				    strerror(archive_errno(a)));
- 				if (!bsdtar->verbose)
- 					fprintf(stderr, "\n");
- 				bsdtar->return_value = 1;

sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r1.ebuild

@@ -1,158 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit multilib-minimal toolchain-funcs verify-sig
-
-DESCRIPTION="Multi-format archive and compression library"
-HOMEPAGE="
-	https://www.libarchive.org/
-	https://github.com/libarchive/libarchive/
-"
-SRC_URI="
-	https://www.libarchive.de/downloads/${P}.tar.xz
-	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
-"
-
-LICENSE="BSD BSD-2 BSD-4 public-domain"
-SLOT="0/13"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="
-	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
-	static-libs test xattr +zstd
-"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	sys-libs/zlib[${MULTILIB_USEDEP}]
-	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
-	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
-	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
-	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
-	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
-	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
-	kernel_linux? (
-		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
-	)
-	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
-	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
-	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
-	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}
-	kernel_linux? (
-		virtual/os-headers
-		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
-	)
-	test? (
-		lzma? ( app-arch/xz-utils[extra-filters(+)] )
-	)
-"
-BDEPEND="
-	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
-	elibc_musl? ( sys-libs/queue-standalone )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
-
-# false positives (checks for libc-defined hash functions)
-QA_CONFIG_IMPL_DECL_SKIP=(
-	SHA256_Init SHA256_Update SHA256_Final
-	SHA384_Init SHA384_Update SHA384_Final
-	SHA512_Init SHA512_Update SHA512_Final
-)
-
-PATCHES=(
-	# https://github.com/libarchive/libarchive/issues/1968
-	"${FILESDIR}/${P}-32bit-test.patch"
-	# https://github.com/libarchive/libarchive/issues/2069
-	# (we can simply update the command since we don't support old lrzip)
-	"${FILESDIR}/${P}-lrzip.patch"
-)
-
-multilib_src_configure() {
-	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
-
-	local myconf=(
-		$(use_enable acl)
-		$(use_enable static-libs static)
-		$(use_enable xattr)
-		$(use_with blake2 libb2)
-		$(use_with bzip2 bz2lib)
-		$(use_with expat)
-		$(use_with !expat xml2)
-		$(use_with iconv)
-		$(use_with lz4)
-		$(use_with lzma)
-		$(use_with lzo lzo2)
-		$(use_with nettle)
-		--with-zlib
-		$(use_with zstd)
-
-		# Windows-specific
-		--without-cng
-	)
-	if multilib_is_native_abi ; then
-		myconf+=(
-			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
-		)
-	else
-		myconf+=(
-			--disable-bsdcat
-			--disable-bsdcpio
-			--disable-bsdtar
-			--disable-bsdunzip
-		)
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi ; then
-		emake
-	else
-		emake libarchive.la
-	fi
-}
-
-src_test() {
-	mkdir -p "${T}"/bin || die
-	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
-	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
-	local -x PATH=${T}/bin:${PATH}
-	multilib-minimal_src_test
-}
-
-multilib_src_test() {
-	# sandbox is breaking long symlink behavior
-	local -x SANDBOX_ON=0
-	local -x LD_PRELOAD=
-	# some locales trigger different output that breaks tests
-	local -x LC_ALL=C
-	emake check
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi ; then
-		emake DESTDIR="${D}" install
-	else
-		local install_targets=(
-			install-includeHEADERS
-			install-libLTLIBRARIES
-			install-pkgconfigDATA
-		)
-		emake DESTDIR="${D}" "${install_targets[@]}"
-	fi
-
-	# Libs.private: should be used from libarchive.pc instead
-	find "${ED}" -type f -name "*.la" -delete || die
-	# https://github.com/libarchive/libarchive/issues/1766
-	sed -e '/Requires\.private/s:iconv::' \
-		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
-}

sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r3.ebuild

@@ -1,180 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit libtool multilib-minimal toolchain-funcs verify-sig
-
-DESCRIPTION="Multi-format archive and compression library"
-HOMEPAGE="
-	https://www.libarchive.org/
-	https://github.com/libarchive/libarchive/
-"
-SRC_URI="
-	https://www.libarchive.de/downloads/${P}.tar.xz
-	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
-"
-
-LICENSE="BSD BSD-2 BSD-4 public-domain"
-SLOT="0/13"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="
-	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
-	static-libs test xattr +zstd
-"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	sys-libs/zlib[${MULTILIB_USEDEP}]
-	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
-	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
-	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
-	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
-	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
-	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
-	kernel_linux? (
-		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
-	)
-	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
-	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
-	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
-	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}
-	kernel_linux? (
-		virtual/os-headers
-		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
-	)
-	test? (
-		app-arch/lrzip
-		app-arch/lz4
-		app-arch/lzip
-		app-arch/lzop
-		app-arch/xz-utils
-		app-arch/zstd
-		lzma? ( app-arch/xz-utils[extra-filters(+)] )
-	)
-"
-BDEPEND="
-	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
-	elibc_musl? ( sys-libs/queue-standalone )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
-
-# false positives (checks for libc-defined hash functions)
-QA_CONFIG_IMPL_DECL_SKIP=(
-	SHA256_Init SHA256_Update SHA256_Final
-	SHA384_Init SHA384_Update SHA384_Final
-	SHA512_Init SHA512_Update SHA512_Final
-)
-
-PATCHES=(
-	# https://github.com/libarchive/libarchive/issues/1968
-	"${FILESDIR}/${P}-32bit-test.patch"
-	# https://github.com/libarchive/libarchive/issues/2069
-	# (we can simply update the command since we don't support old lrzip)
-	"${FILESDIR}/${P}-lrzip.patch"
-	# https://github.com/libarchive/libarchive/pull/2101
-	"${FILESDIR}/${P}-safe-fprintf.patch"
-)
-
-src_prepare() {
-	default
-
-	# Needed for flags to be respected w/ LTO
-	elibtoolize
-}
-
-multilib_src_configure() {
-	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
-
-	local myconf=(
-		$(use_enable acl)
-		$(use_enable static-libs static)
-		$(use_enable xattr)
-		$(use_with blake2 libb2)
-		$(use_with bzip2 bz2lib)
-		$(use_with expat)
-		$(use_with !expat xml2)
-		$(use_with iconv)
-		$(use_with lz4)
-		$(use_with lzma)
-		$(use_with lzo lzo2)
-		$(use_with nettle)
-		--with-zlib
-		$(use_with zstd)
-
-		# Windows-specific
-		--without-cng
-	)
-	if multilib_is_native_abi ; then
-		myconf+=(
-			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
-		)
-	else
-		myconf+=(
-			--disable-bsdcat
-			--disable-bsdcpio
-			--disable-bsdtar
-			--disable-bsdunzip
-		)
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi ; then
-		emake
-	else
-		emake libarchive.la
-	fi
-}
-
-src_test() {
-	mkdir -p "${T}"/bin || die
-	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
-	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
-	# workaround lrzip broken on 32-bit arches with >= 10 threads
-	# https://bugs.gentoo.org/927766
-	cat > "${T}"/bin/lrzip <<-EOF || die
-		#!/bin/sh
-		exec "$(type -P lrzip)" -p1 "\${@}"
-	EOF
-	chmod +x "${T}/bin/lrzip" || die
-	local -x PATH=${T}/bin:${PATH}
-	multilib-minimal_src_test
-}
-
-multilib_src_test() {
-	# sandbox is breaking long symlink behavior
-	local -x SANDBOX_ON=0
-	local -x LD_PRELOAD=
-	# some locales trigger different output that breaks tests
-	local -x LC_ALL=C
-	emake check
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi ; then
-		emake DESTDIR="${D}" install
-	else
-		local install_targets=(
-			install-includeHEADERS
-			install-libLTLIBRARIES
-			install-pkgconfigDATA
-		)
-		emake DESTDIR="${D}" "${install_targets[@]}"
-	fi
-
-	# Libs.private: should be used from libarchive.pc instead
-	find "${ED}" -type f -name "*.la" -delete || die
-	# https://github.com/libarchive/libarchive/issues/1766
-	sed -e '/Requires\.private/s:iconv::' \
-		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
-}

sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.4.ebuild

@@ -16,7 +16,7 @@ SRC_URI="
 
 LICENSE="BSD BSD-2 BSD-4 public-domain"
 SLOT="0/13"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="
 	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
 	static-libs test xattr +zstd

sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p27-r1.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ MY_P="${PN}${MY_PV}"
 
 DESCRIPTION="unzipper for pkzip-compressed files"
 HOMEPAGE="https://infozip.sourceforge.net/UnZip.html"
-SRC_URI="mirror://sourceforge/infozip/${MY_P}.tar.gz
+SRC_URI="https://downloads.sourceforge.net/infozip/${MY_P}.tar.gz
 	mirror://debian/pool/main/u/${PN}/${PN}_${PV/_p/-}.debian.tar.xz"
 
 LICENSE="Info-ZIP"

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest

@@ -1,4 +1,6 @@
 DIST xz-5.4.2.tar.gz 2799022 BLAKE2B 3c622b0823f0cbb5fbc5eaa0372fc2f0fefe0950d131417f831bce47b6d9747d145429f0649de106819331f9ae6a289c497182c7b6d1e211513308dd083a9b72 SHA512 149f980338bea3d66de1ff5994b2b236ae1773135eda68b62b009df0c9dcdf5467f8cb2c06da95a71b6556d60bd3d21f475feced34d5dfdb80ee95416a2f9737
 DIST xz-5.4.2.tar.gz.sig 566 BLAKE2B 95c9c70fdd25b92095dd9691e4d9d4306a3f982becfe7bd42ca6132a76f29be2c2bc66f4fc2bda547058c18e227292f4185799eb905084fc3ab415ae867b4b1b SHA512 30e965c228ed3a8ecb804db8eb11703a765b7ee934030ea69bb3940b630811eb71bf74fd20371ef7759761904ece4f0144a0b00be4d843cf98299fd016f161aa
-DIST xz-5.4.6.tar.gz 2889306 BLAKE2B f0bbd33ea7cd64d475c3501f6e76080c8c0080e377f23462f5f76459935f4e621538ddaa8452d2feaed278d62a596e38ed2aca18ed9e76512c4ec77fa2f4cc5f SHA512 b08a61d8d478d3b4675cb1ddacdbbd98dc6941a55bcdd81a28679e54e9367d3a595fa123ac97874a17da571c1b712e2a3e901c2737099a9d268616a1ba3de497
+DIST xz-5.4.7.tar.gz 2798247 BLAKE2B e02f3a62c81882c83254e1c94f002aadcd59479dbd031a4d5ea68ce3303c066c298c2709845f2d4ef436511b21d35ab66a080542ac70aaf6c0a0daf448a47d02 SHA512 82c3e5d39fbaa5dcd61b45d5db99d740d811323456a9af3b1acfccbe66b074d1650bc810ee8272a8ae0a1bcf116fc73fc09297b8acb4c6568cf912708306e8ea
-DIST xz-5.4.6.tar.gz.sig 566 BLAKE2B 808f1b5e2a17729f36a05ba88a9c00210cda2afa02923e6f289d13dc2a48f7674cafec6e25660e142d67f01dd941c7390cee2757b054df3a3193dde0791363a1 SHA512 d5e32b944e7492a32c40f675d918796e077f63490a23c6fce5c4d6d1eebc443f129d27a2e888913c5a36c3ffdac75b9c96c1749402283445e0ba9ff72b965741
+DIST xz-5.4.7.tar.gz.sig 566 BLAKE2B 525eeeddb219c6e46ef2079af0cd28c8514969ce33b2ab61ccae59ae26289e7ddbd29dd492f88f4e4da9db750dd60ce1831a23a0275cdac39bd5b29c663d1a72 SHA512 00e9004739a168fd8a1ca4bb8b8a9de456bbef2576565722158140f341e94f461dab05c6e457f62a1613229419a978898e878007872571afdc1bb8a9582fa00a
+DIST xz-5.6.2.tar.gz 2355785 BLAKE2B d2d5f9772714b5b5993ec26c313bd27dc10d88928d9d3a1c71b78f80797e376cf065dcdd0c2c7977a83b67cbe2558140c74c5df44a9408e5a72529212c2205ad SHA512 c32c32c95e3541b906e0284e66a953ace677e0ce6af2084e7b122600047bf7542c1b0fabb5909b19ff79fba6def530be674df1c675b22a47a8d57f3f0b736a82
+DIST xz-5.6.2.tar.gz.sig 566 BLAKE2B 9b1f19d0449de18057eb5bd3cceaa073fc245e9a05fb19fabdac98b1d2e708b39c8070130c522b78ff75df724e207f978d8da65e2ccb1c6fa295aa892eda0d23 SHA512 f3d1055a2a6e96eec2fd5c0b733f2ab5e150bac9645f1fe9a7558ed6f34a241b4f57e17fd4504f311be26cf1e2b9b797f2e78b1b9d2db02e9cd0c1548cb6160b

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild

@@ -26,7 +26,7 @@ else
 	MY_P="${PN/-utils}-${PV/_}"
 	SRC_URI="
 		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
-		mirror://sourceforge/lzmautils/${MY_P}.tar.gz
+		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
 		https://tukaani.org/xz/${MY_P}.tar.gz
 		verify-sig? (
 			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild

@@ -20,13 +20,13 @@ if [[ ${PV} == 9999 ]] ; then
 	# bug #272880 and bug #286068
 	BDEPEND="sys-devel/gettext >=dev-build/libtool-2"
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jiatan.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lassecollin.asc
 	inherit verify-sig
 
 	MY_P="${PN/-utils}-${PV/_}"
 	SRC_URI="
 		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
-		mirror://sourceforge/lzmautils/${MY_P}.tar.gz
+		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
 		https://tukaani.org/xz/${MY_P}.tar.gz
 		verify-sig? (
 			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -50,7 +50,7 @@ SLOT="0"
 IUSE="doc +extra-filters pgo nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-jiatan )"
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
 fi
 
 src_prepare() {
@@ -66,6 +66,10 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
+	# uses newer libtool with the fix.
+	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
+
 	local myconf=(
 		--enable-threads
 		$(multilib_native_use_enable doc)
@@ -123,6 +127,17 @@ multilib_src_compile() {
 	fi
 }
 
+multilib_src_install() {
+	default
+
+	# bug #934370 and bug #450436
+	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma.so" ]] ; then
+		eerror "Sanity check for liblzma.so failed."
+		eerror "Shared library wasn't built, possible libtool bug"
+		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma.so not found in build, aborting"
+	fi
+}
+
 multilib_src_install_all() {
 	find "${ED}" -type f -name '*.la' -delete || die
 

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.2-r1.ebuild

@@ -0,0 +1,203 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Remember: we cannot leverage autotools in this ebuild in order
+#           to avoid circular deps with autotools
+
+EAPI=8
+
+inherit flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
+
+if [[ ${PV} == 9999 ]] ; then
+	# Per tukaani.org, git.tukaani.org is a mirror of github and
+	# may be behind.
+	EGIT_REPO_URI="
+		https://github.com/tukaani-project/xz
+		https://git.tukaani.org/xz.git
+	"
+	inherit git-r3 autotools
+
+	# bug #272880 and bug #286068
+	BDEPEND="sys-devel/gettext >=dev-build/libtool-2"
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lassecollin.asc
+	inherit verify-sig
+
+	MY_P="${PN/-utils}-${PV/_}"
+	SRC_URI="
+		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
+		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
+		https://tukaani.org/xz/${MY_P}.tar.gz
+		verify-sig? (
+			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
+			https://tukaani.org/xz/${MY_P}.tar.gz.sig
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+fi
+
+DESCRIPTION="Utils for managing LZMA compressed files"
+HOMEPAGE="https://tukaani.org/xz/"
+
+# See top-level COPYING file as it outlines the various pieces and their licenses.
+LICENSE="0BSD LGPL-2.1+ GPL-2+ doc? ( CC-BY-SA-4.0 )"
+SLOT="0"
+IUSE="cpu_flags_arm_crc32 doc +extra-filters pgo nls static-libs"
+
+if [[ ${PV} != 9999 ]] ; then
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautopoint
+		eautoreconf
+	else
+		# Allow building shared libs on Solaris/x64
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
+	# uses newer libtool with the fix.
+	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
+
+	local myconf=(
+		--enable-threads
+		$(multilib_native_use_enable doc)
+		$(use_enable nls)
+		$(use_enable static-libs static)
+		$(use_enable cpu_flags_arm_crc32 arm64-crc32)
+	)
+
+	if ! multilib_is_native_abi ; then
+		myconf+=(
+			--disable-{xz,xzdec,lzmadec,lzmainfo,lzma-links,scripts}
+		)
+	fi
+
+	if ! use extra-filters ; then
+		myconf+=(
+			# LZMA1 + LZMA2 for standard .lzma & .xz files
+			--enable-encoders=lzma1,lzma2
+			--enable-decoders=lzma1,lzma2
+
+			# those are used by default, depending on preset
+			--enable-match-finders=hc3,hc4,bt4
+
+			# CRC64 is used by default, though some (old?) files use CRC32
+			--enable-checks=crc32,crc64
+		)
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
+
+		# Undo Solaris-based defaults pointing to /usr/xpg5/bin
+		myconf+=( --disable-path-for-script )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
+
+	if use pgo ; then
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
+
+		local tar_pgo_args=()
+
+		if has_version -b "app-alternatives/tar[gnu]" ; then
+			tar_pgo_args+=(
+				--mtime=@2718281828
+				--sort=name
+			)
+		fi
+
+		if multilib_is_native_abi ; then
+			(
+				shopt -s globstar
+
+				tar \
+					"${tar_pgo_args[@]}" \
+					-cf xz-pgo-test-01.tar \
+					{"${S}","${BUILD_DIR}"}/**/*.[cho] \
+					{"${S}","${BUILD_DIR}"}/**/.libs/* \
+					{"${S}","${BUILD_DIR}"}/**/**.txt \
+					{"${S}","${BUILD_DIR}"}/tests/files
+
+				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar || die
+				md5sum xz-pgo-test-01.tar || die
+			)
+
+			local test_variants=(
+				# Borrowed from ALT Linux
+				# https://packages.altlinux.org/en/sisyphus/srpms/xz/specfiles/#line-80
+				'-0 -C none'
+				'-2 -C crc32'
+				"$(usev extra-filters '-6 --arm --lzma2 -C crc64')"
+				"$(usev extra-filters '-6 --x86 --lzma2=lc=4 -C sha256')"
+				'-7e --format=lzma'
+
+				# Our own variants
+				''
+				'-9e'
+				"$(usev extra-filters '--x86 --lzma2=preset=9e')"
+			)
+			local test_variant
+			for test_variant in "${test_variants[@]}" ; do
+				"${BUILD_DIR}"/src/xz/xz -c ${test_variant} xz-pgo-test-01.tar | "${BUILD_DIR}"/src/xz/xz -c -d - > /dev/null
+				assert "Testing '${test_variant}' variant failed"
+			done
+		fi
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/${ABI}-pgo --output="${T}"/${ABI}-pgo/default.profdata || die
+		fi
+
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	# bug #934370 and bug #450436 (and bug #934515)
+	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma$(get_libname)" ]] ; then
+		eerror "Sanity check for liblzma$(get_libname) failed."
+		eerror "Shared library wasn't built, possible libtool bug"
+		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma$(get_libname) not found in build, aborting"
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use doc ; then
+		rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
+	fi
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/liblzma$(get_libname 0)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/liblzma$(get_libname 0)
+}

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild

@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -26,7 +26,7 @@ else
 	MY_P="${PN/-utils}-${PV/_}"
 	SRC_URI="
 		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
-		mirror://sourceforge/lzmautils/${MY_P}.tar.gz
+		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
 		https://tukaani.org/xz/${MY_P}.tar.gz
 		verify-sig? (
 			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
@@ -50,7 +50,7 @@ SLOT="0"
 IUSE="cpu_flags_arm_crc32 doc +extra-filters pgo nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20230213 )"
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
 fi
 
 src_prepare() {
@@ -66,6 +66,10 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
+	# uses newer libtool with the fix.
+	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
+
 	local myconf=(
 		--enable-threads
 		$(multilib_native_use_enable doc)
@@ -89,7 +93,9 @@ multilib_src_configure() {
 			# those are used by default, depending on preset
 			--enable-match-finders=hc3,hc4,bt4
 
-			# CRC64 is used by default, though some (old?) files use CRC32
+			# CRC64 is used by default, though 7-Zip uses CRC32 by default.
+			# Also, XZ Embedded in Linux doesn't support CRC64, so
+			# kernel modules and friends are CRC32.
 			--enable-checks=crc32,crc64
 		)
 	fi
@@ -97,7 +103,7 @@ multilib_src_configure() {
 	if [[ ${CHOST} == *-solaris* ]] ; then
 		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
 
-		# Undo Solaris-based defaults pointing to /usr/xpg5/bin
+		# Undo Solaris-based defaults pointing to /usr/xpg4/bin
 		myconf+=( --disable-path-for-script )
 	fi
 
@@ -105,31 +111,37 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	# TODO: revisit that now we have the tar/xz loop below?
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
-	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
 	if use pgo ; then
 		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
 
+		local tar_pgo_args=()
+
+		if has_version -b "app-alternatives/tar[gnu]" ; then
+			tar_pgo_args+=(
+				--mtime=@2718281828
+				--sort=name
+			)
+		fi
+
 		if multilib_is_native_abi ; then
 			(
 				shopt -s globstar
 
 				tar \
-					--sort=name --mtime=@2718281828 \
+					"${tar_pgo_args[@]}" \
 					-cf xz-pgo-test-01.tar \
 					{"${S}","${BUILD_DIR}"}/**/*.[cho] \
-					{"${S}","${BUILD_DIR}"}/**/*.so* \
+					{"${S}","${BUILD_DIR}"}/**/.libs/* \
 					{"${S}","${BUILD_DIR}"}/**/**.txt \
-					{"${S}","${BUILD_DIR}"}/tests/files \
+					{"${S}","${BUILD_DIR}"}/tests/files
 
-				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar
+				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar || die
-				md5sum xz-pgo-test-01.tar
+				md5sum xz-pgo-test-01.tar || die
 			)
 
 			local test_variants=(
@@ -137,17 +149,18 @@ multilib_src_compile() {
 				# https://packages.altlinux.org/en/sisyphus/srpms/xz/specfiles/#line-80
 				'-0 -C none'
 				'-2 -C crc32'
-				'-6 --arm --lzma2 -C crc64'
+				"$(usev extra-filters '-6 --arm --lzma2 -C crc64')"
-				'-6 --x86 --lzma2=lc=4 -C sha256'
+				"$(usev extra-filters '-6 --x86 --lzma2=lc=4 -C sha256')"
 				'-7e --format=lzma'
 
 				# Our own variants
 				''
-				'-9e'
+				'-e'
-				'--x86 --lzma2=preset=9e'
+				"$(usev extra-filters '--x86 --lzma2=preset=6e')"
 			)
 			local test_variant
 			for test_variant in "${test_variants[@]}" ; do
+				einfo "Testing '${test_variant}' variant"
 				"${BUILD_DIR}"/src/xz/xz -c ${test_variant} xz-pgo-test-01.tar | "${BUILD_DIR}"/src/xz/xz -c -d - > /dev/null
 				assert "Testing '${test_variant}' variant failed"
 			done
@@ -162,6 +175,17 @@ multilib_src_compile() {
 	fi
 }
 
+multilib_src_install() {
+	default
+
+	# bug #934370 and bug #450436 (and bug #934515)
+	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma$(get_libname)" ]] ; then
+		eerror "Sanity check for liblzma$(get_libname) failed."
+		eerror "Shared library wasn't built, possible libtool bug"
+		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma$(get_libname) not found in build, aborting"
+	fi
+}
+
 multilib_src_install_all() {
 	find "${ED}" -type f -name '*.la' -delete || die
 

sdk_container/src/third_party/portage-stable/app-arch/zip/zip-3.0-r7.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -8,7 +8,7 @@ inherit edo toolchain-funcs flag-o-matic
 MY_P="${PN}${PV//.}"
 DESCRIPTION="Info ZIP (encryption support)"
 HOMEPAGE="https://infozip.sourceforge.net/Zip.html"
-SRC_URI="mirror://sourceforge/infozip/${MY_P}.zip"
+SRC_URI="https://downloads.sourceforge.net/infozip/${MY_P}.zip"
 S="${WORKDIR}"/${MY_P}
 
 LICENSE="Info-ZIP"

sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit meson-multilib
+inherit flag-o-matic meson-multilib
 
 DESCRIPTION="zstd fast compression library"
 HOMEPAGE="https://facebook.github.io/zstd/"
@@ -12,7 +12,7 @@ S="${WORKDIR}"/${P}/build/meson
 
 LICENSE="|| ( BSD GPL-2 )"
 SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+lzma lz4 static-libs test zlib"
 RESTRICT="!test? ( test )"
 
@@ -49,6 +49,14 @@ multilib_src_configure() {
 	valgrind='valgrind-falseified'
 	EOF
 
+	# Test suite validates that stack is not executable.  Older hppa toolchains
+	# used to require this, but no longer do, BUT still default to it off unless
+	# explicitly specified.  See #903923
+	# The cmake build sets these, but the meson build doesn't, so set it manually.
+	# https://github.com/facebook/zstd/blob/979b047/build/cmake/CMakeModules/AddZstdCompilationFlags.cmake#L77-L82
+	append-flags $(test-flags-CCLD "-Wa,--noexecstack")
+	append-ldflags $(test-flags-CCLD "-Wl,-z,noexecstack")
+
 	local emesonargs=(
 		-Ddefault_library=$(multilib_native_usex static-libs both shared)
 
@@ -65,3 +73,7 @@ multilib_src_configure() {
 
 	meson_src_configure
 }
+
+multilib_src_test() {
+	meson_src_test --timeout-multiplier=2
+}

sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r3.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -9,7 +9,9 @@ MY_P="${P/_alpha/a}"
 
 DESCRIPTION="A set of tools for CD/DVD reading and recording, including cdrecord"
 HOMEPAGE="https://sourceforge.net/projects/cdrtools/"
-SRC_URI="mirror://sourceforge/${PN}/$([[ -z ${PV/*_alpha*} ]] && echo 'alpha')/${MY_P}.tar.bz2"
+SRC_URI="https://downloads.sourceforge.net/${PN}/$([[ -z ${PV/*_alpha*} ]] && echo 'alpha')/${MY_P}.tar.bz2"
+
+S=${WORKDIR}/${P/_alpha[0-9][0-9]}
 
 LICENSE="GPL-2 LGPL-2.1 CDDL-Schily"
 SLOT="0"
@@ -30,8 +32,6 @@ DEPEND="
 	${RDEPEND}
 "
 
-S=${WORKDIR}/${P/_alpha[0-9][0-9]}
-
 FILECAPS=(
 	cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
 	cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --

sdk_container/src/third_party/portage-stable/app-cdr/cdrtools/cdrtools-3.02_alpha09-r5.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -9,7 +9,9 @@ MY_P="${P/_alpha/a}"
 
 DESCRIPTION="A set of tools for CD/DVD reading and recording, including cdrecord"
 HOMEPAGE="https://sourceforge.net/projects/cdrtools/"
-SRC_URI="mirror://sourceforge/${PN}/$([[ -z ${PV/*_alpha*} ]] && echo 'alpha')/${MY_P}.tar.bz2"
+SRC_URI="https://downloads.sourceforge.net/${PN}/$([[ -z ${PV/*_alpha*} ]] && echo 'alpha')/${MY_P}.tar.bz2"
+
+S=${WORKDIR}/${P/_alpha[0-9][0-9]}
 
 LICENSE="GPL-2 LGPL-2.1 CDDL-Schily"
 SLOT="0"
@@ -30,8 +32,6 @@ DEPEND="
 	${RDEPEND}
 "
 
-S=${WORKDIR}/${P/_alpha[0-9][0-9]}
-
 FILECAPS=(
 	cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep usr/bin/cdrecord --
 	cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep usr/bin/cdda2wav --

sdk_container/src/third_party/portage-stable/app-containers/catatonit/catatonit-9999.ebuild

@@ -0,0 +1,31 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A container init that is so simple it's effectively brain-dead"
+HOMEPAGE="https://github.com/openSUSE/catatonit"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/openSUSE/catatonit.git"
+else
+	SRC_URI="https://github.com/openSUSE/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym -r /usr/bin/"${PN}" /usr/libexec/podman/"${PN}"
+}

sdk_container/src/third_party/portage-stable/app-containers/conmon/Manifest

@@ -1 +1,4 @@
 DIST conmon-2.1.10.tar.gz 121047 BLAKE2B 14b4c2d541607eac0af6b335f35bd506c9a6c3d2b4e4e3ad79f32550385e90b6f7533f505565f90fb4bb1f42d528c41e9ddc7ec275c16ee982a6d0afe1c65bff SHA512 ecf1a961f431b005b54faa68b5c1bcf31d448f994ca66a56f13002216074dba79b53b52a377d4f8dab08141d6c6cf44467352fbff37175135d3da84081b27a18
+DIST conmon-2.1.11-make-docs-target-not-depend-on-install.tools.patch 985 BLAKE2B f2f34ca9a6f067f88f39726b52c5d476946413e84a93bfff2b9d4e9a0b9b117bf25a903455c3a762895746c5bca6eb93bf2ac7c2c6123d7b9bca9c345aba6230 SHA512 a9716057b0127d2b5aaca303e6d26484a5dbe91b9114259b2fded2a0c803568749b725e816004c80cb8b47ddff7a2fbcc231edd2df1d78a56ecaf6d3020c7fd7
+DIST conmon-2.1.11.tar.gz 121573 BLAKE2B 600a3e13eee5f71ef5f7aa21d9cf0184dd01c8e5e68d31aa35efcb08c3cf4305313fcfcf0aba3eedb243fe36f0e1e27f68a71627e2050c8ed4a73de273b98131 SHA512 47952f6cbbb810591d78c67856100be0edbf96d30328a10f22c3ec927bc6d1187540824c388d1fc7f3bb16fb7414339f3f20311d1baffb1fae1e38c4d5e7249c
+DIST conmon-2.1.8.tar.gz 120541 BLAKE2B 8ae12e674edf49f233f7423f2566a1ddea793bd4fc888618a8903a84309cb4aacea9d200bb0f8e0895c96796dca9bc2e6e73c9c8a7dcc5f2c540b05f7a73a21e SHA512 a277de8f8adf001c3e3ef6ef19d4bade36d48c5395a624ee99cb22708ea26a9954df76362006a1331efc06265cb790883b43e84f0006f80c1725a7470ff244c3

sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.11.ebuild

@@ -0,0 +1,59 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="
+		https://github.com/containers/conmon/archive/v${PV}.tar.gz
+			-> ${P}.tar.gz
+		https://github.com/Flowdalic/conmon/commit/ff8794c5bc0805cc430229728befde16da47b68c.patch
+			-> ${PN}-2.1.11-make-docs-target-not-depend-on-install.tools.patch
+	"
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	# https://github.com/containers/conmon/pull/507
+	"${DISTDIR}"/${PN}-2.1.11-make-docs-target-not-depend-on-install.tools.patch
+)
+
+src_prepare() {
+	# https://github.com/containers/conmon/pull/505
+	echo "${PV}" > VERSION || die
+
+	default
+	sed -i -e "s|shell.*--exists libsystemd.* && echo \"0\"|shell echo $(usex systemd 0 1)|g;" Makefile || die
+	echo -e "#!/usr/bin/env bash\necho $(usex seccomp 0 1)" > hack/seccomp-notify.sh || die
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX="${EPREFIX}/usr" GOMD2MAN=$(command -v go-md2man)
+	default
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/"${PN}"
+}

sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.8.ebuild

@@ -0,0 +1,63 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="https://github.com/containers/conmon/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+	GIT_COMMIT="00e08f4a9ca5420de733bf542b930ad58e1a7e7d"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+PATCHES=(
+	"${FILESDIR}/conmon-2.1.8-Makefile.patch"
+)
+
+src_prepare() {
+	default
+	if use systemd; then
+		sed -i -e 's|shell $(PKG_CONFIG) --exists libsystemd.* && echo "0"|shell echo "0"|g;' Makefile || die
+	else
+		sed -i -e 's|shell $(PKG_CONFIG) --exists libsystemd.* && echo "0"|shell echo "1"|g;' Makefile || die
+	fi
+
+	if use seccomp; then
+		echo -e '#!/usr/bin/env bash\necho "0"' > hack/seccomp-notify.sh || die
+	else
+		echo -e '#!/usr/bin/env bash\necho "1"' > hack/seccomp-notify.sh || die
+	fi
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX=${EPREFIX}/usr GOMD2MAN=go-md2man
+	if [[ ${PV} == *9999* ]]; then
+		default
+	else
+		emake GIT_COMMIT="${GIT_COMMIT}"
+	fi
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/conmon
+}

sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-9999.ebuild

@@ -0,0 +1,46 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="https://github.com/containers/conmon/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+src_prepare() {
+	default
+	sed -i -e "s|shell.*--exists libsystemd.* && echo \"0\"|shell echo $(usex systemd 0 1)|g;" Makefile || die
+	echo -e "#!/usr/bin/env bash\necho $(usex seccomp 0 1)" > hack/seccomp-notify.sh || die
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX="${EPREFIX}/usr" GOMD2MAN=$(command -v go-md2man)
+	default
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/"${PN}"
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-common/Manifest

@@ -1 +1,3 @@
+DIST containers-common-0.57.0.tar.gz 12700958 BLAKE2B 8432a7d839b94b59eabd75d4978a4d0c1340a64ed626db74e74a8318e08c61172bfba5e4f4c4b0dfffec302c5a310bb5be8fad3ab4d91a6d89ced373a0a6f297 SHA512 b993821040788085ff44e48023a64cea4e3e7e50731c359087bd287168e6849a543d930acbdaff2437fc7951acc46f7183f337dd977215eca814332e6869d1e3
 DIST containers-common-0.58.0.tar.gz 13164567 BLAKE2B 17795eec2d38b4d8b9d6afeb20e249208c5ae2ac767a365ef7313d1e7c36eadb9a9eb284a657dfe3f4fcb0577448d4883fabbad76e0318425fdc03809e27cd7c SHA512 6f569d68d3b0e5ead304c7f23341808d66a47b6352c772d353d50c5f4777cd8a5a5b85d6faaf2887f828c17ec49b9c5f929177a67294b5bbb69baa80656982a8
+DIST containers-common-0.59.1.tar.gz 13131960 BLAKE2B 5b3b947789f889955716816fa15a84eb2f398d6cfb59c85bd969442fb8f55715f2c17c78d963ae913d96e6a109f69da745cfc7db8d23e2ed6516f992b982dda0 SHA512 452c9b84f7631afdf39b7b1fcaf2f721bede312d8fb55b89a953f16ca3546c0df11bb23c99588a592b6375275516d1364570261fbc15301ca3ad486ee66eae32

sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.57.0-r1.ebuild

@@ -12,16 +12,17 @@ if [[ ${PV} == 9999* ]]; then
 else
 	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${P#containers-}"
-	KEYWORDS="~amd64 ~arm64 ~riscv"
+	KEYWORDS="amd64 arm64 ~riscv"
 fi
 
 LICENSE="Apache-2.0"
 SLOT="0"
 RESTRICT="test"
 RDEPEND="
-	app-containers/containers-image
+	>=app-containers/containers-image-5.29.2
 	app-containers/containers-storage
 	app-containers/containers-shortnames
+	!<app-containers/podman-4.5.0-r1
 	net-firewall/nftables
 	net-firewall/iptables[nftables]
 	|| ( app-containers/crun app-containers/runc )
@@ -32,18 +33,17 @@ RDEPEND="
 "
 
 BDEPEND="
-	>=dev-go/go-md2man-2.0.3
+	>=dev-go/go-md2man-2.0.2
 "
 
-PATCHES=(
-	"${FILESDIR}/examplify-mounts-conf.patch"
-)
-
 src_prepare() {
 	default
 
 	[[ -f docs/Makefile && -f Makefile ]] || die
 	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+
+	# add comments to mounts.conf
+	eapply "${FILESDIR}/examplify-mounts-conf.patch"
 }
 
 src_compile() {

sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.58.0-r1.ebuild

@@ -14,7 +14,7 @@ if [[ ${PV} == 9999* ]]; then
 else
 	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${P#containers-}"
-	KEYWORDS="amd64 arm64 ~riscv"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
 fi
 
 LICENSE="Apache-2.0"

sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.59.1.ebuild

@@ -0,0 +1,75 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="Common config files and docs for Containers stack"
+HOMEPAGE="https://github.com/containers/common"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/common.git"
+else
+	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+RESTRICT="test"
+RDEPEND="
+	>=app-containers/aardvark-dns-1.10.0
+	>=app-containers/crun-1.14.3
+	>=app-containers/containers-image-5.30.0
+	>=app-containers/containers-storage-1.53.0
+	app-containers/containers-shortnames
+	>=app-containers/netavark-1.10.3
+	net-firewall/nftables
+	net-firewall/iptables[nftables]
+	>=net-misc/passt-2024.03.20
+	>=sys-fs/fuse-overlayfs-1.13
+"
+
+BDEPEND="
+	>=dev-go/go-md2man-2.0.3
+"
+
+PATCHES=(
+	"${FILESDIR}/examplify-mounts-conf.patch"
+)
+
+DOC_CONTENTS="\n
+For rootless operations, one needs to configure subuid(5) and subgid(5)\n
+See /etc/sub{uid,gid} to check whether rootless user is already configured\n
+If not, quickly configure it with:\n
+usermod --add-subuids 1065536-1131071 <rootless user>\n
+usermod --add-subgids 1065536-1131071 <rootless user>\n
+"
+
+src_prepare() {
+	default
+
+	[[ -f docs/Makefile && -f Makefile ]] || die
+	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+}
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+	readme.gentoo_create_doc
+
+	insinto /usr/share/containers
+	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
+
+	keepdir /etc/containers/certs.d /etc/containers/oci/hooks.d /etc/containers/systemd /var/lib/containers/sigstore
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-9999.ebuild

@@ -0,0 +1,75 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="Common config files and docs for Containers stack"
+HOMEPAGE="https://github.com/containers/common"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/common.git"
+else
+	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+RESTRICT="test"
+RDEPEND="
+	>=app-containers/aardvark-dns-1.10.0
+	>=app-containers/crun-1.14.3
+	>=app-containers/containers-image-5.30.0
+	>=app-containers/containers-storage-1.53.0
+	app-containers/containers-shortnames
+	>=app-containers/netavark-1.10.3
+	net-firewall/nftables
+	net-firewall/iptables[nftables]
+	>=net-misc/passt-2024.03.20
+	>=sys-fs/fuse-overlayfs-1.13
+"
+
+BDEPEND="
+	>=dev-go/go-md2man-2.0.3
+"
+
+PATCHES=(
+	"${FILESDIR}/examplify-mounts-conf.patch"
+)
+
+DOC_CONTENTS="\n
+For rootless operations, one needs to configure subuid(5) and subgid(5)\n
+See /etc/sub{uid,gid} to check whether rootless user is already configured\n
+If not, quickly configure it with:\n
+usermod --add-subuids 1065536-1131071 <rootless user>\n
+usermod --add-subgids 1065536-1131071 <rootless user>\n
+"
+
+src_prepare() {
+	default
+
+	[[ -f docs/Makefile && -f Makefile ]] || die
+	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+}
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+	readme.gentoo_create_doc
+
+	insinto /usr/share/containers
+	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
+
+	keepdir /etc/containers/certs.d /etc/containers/oci/hooks.d /etc/containers/systemd /var/lib/containers/sigstore
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-common/files/default.yaml

@@ -1,28 +0,0 @@
-# This is a default registries.d configuration file.  You may
-# add to this file or create additional files in registries.d/.
-#
-# lookaside: for reading/writing simple signing signatures
-# lookaside-staging: for writing simple signing signatures, preferred over lookaside
-#
-# lookaside and lookaside-staging take a value of the following:
-#   lookaside:  {schema}://location
-#
-# For reading signatures, schema may be http, https, or file.
-# For writing signatures, schema may only be file.
-
-# The default locations are built-in, for both reading and writing:
-# /var/lib/containers/sigstore for root, or
-# ~/.local/share/containers/sigstore for non-root users.
-default-docker:
-#  lookaside: https://…
-#  lookaside-staging: file:///…
-
-# The 'docker' indicator here is the start of the configuration
-# for docker registries.
-#
-# docker:
-#
-#   privateregistry.com:
-#    lookaside: https://privateregistry.com/sigstore/
-#    lookaside-staging: /mnt/nfs/privateregistry/sigstore
-

sdk_container/src/third_party/portage-stable/app-containers/containers-common/files/policy.json

@@ -1,14 +0,0 @@
-{
-    "default": [
-        {
-            "type": "insecureAcceptAnything"
-        }
-    ],
-    "transports":
-        {
-            "docker-daemon":
-                {
-                    "": [{"type":"insecureAcceptAnything"}]
-                }
-        }
-}

sdk_container/src/third_party/portage-stable/app-containers/containers-image/Manifest

@@ -1 +1,2 @@
+DIST containers-image-5.29.2.tar.gz 707618 BLAKE2B f1556cbb26ceedd74a338355caf8b557c43286726f4be63544cebc9a8f4b92be78d7a0cddbedaba7352d13e9fc399f62ee114caba6c8b1ecc334dab1379e523b SHA512 f3f6e09670dc393067992a78303f01e2584dabe79ba156973a50d7a460c011e5a27d0ccdf0ff6b399099a9a3a4c57f3badf24fb5d0704efd645ab7196a544d8f
 DIST containers-image-5.30.0.tar.gz 719070 BLAKE2B 5952ab703b6df793f326dd4fc82f50c5f672e2b9d142e0bc706014092420e3563599d9f1c1f65f743e1a8144b91f92b2326d7bf4c3024b5efb466d777a8ad613 SHA512 89cd0d482bb5d70037ff51413b7abca01d36bc7f39e9dc130c78462e501dae32193137a367d81532afd216a7432e127728147e6e839d5d99eeb6b6680f31d4dc

sdk_container/src/third_party/portage-stable/app-containers/containers-image/containers-image-5.29.2-r1.ebuild

@@ -0,0 +1,39 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/moving-policy-json-default-yaml.patch
+	"${FILESDIR}"/prevent-downloading-mods-5.29.2.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-image/containers-image-5.30.0.ebuild

@@ -21,6 +21,7 @@ SLOT="0"
 # https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
 RESTRICT='test'
 BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
 PATCHES=(
 	"${FILESDIR}"/fix-warnings.patch
 )

sdk_container/src/third_party/portage-stable/app-containers/containers-image/containers-image-9999.ebuild

@@ -0,0 +1,38 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/fix-warnings.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-shortnames/containers-shortnames-9999.ebuild

@@ -0,0 +1,36 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Configures default shortnames (aliases) for Containers"
+HOMEPAGE="https://github.com/containers/shortnames"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/shortnames.git"
+else
+	SRC_URI="https://github.com/containers/shortnames/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+src_configure() {
+	return
+}
+
+src_compile() {
+	return
+}
+
+src_test() {
+	return
+}
+
+src_install() {
+	insinto /etc/containers/registries.conf.d
+	newins shortnames.conf 000-shortnames.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-storage/Manifest

@@ -1 +1,3 @@
+DIST containers-storage-1.51.0.tar.gz 4283732 BLAKE2B 108401d68e617e6237e68cf2147113680e0452a8d15ee099da9872508800f3e7b8f2c5508e17d9c5f3d58fec4efc1c20f23f1a567fe592533c0e63efd05ae5c8 SHA512 89916b49438bce8bb774b4aa799676d4b3a946a0b5207a1b5241b1a3ac0875b06b3cd8e81d7e23332ceae6010b693516fc31d8c7f75a37e7ad3056a83c75b6c1
 DIST containers-storage-1.53.0.tar.gz 4291738 BLAKE2B 939ecca8a948165c42453d5461429d46249d73582869793969f9d4ae52d0a9fec25e6c39cd13190dad0730d9a17de7af1f237b3cf5434fd30f442c78e57ee7b3 SHA512 ea4a1d1899208eb8861e36beba206724b1f55cfd6007bc5a90c3a6a5e02835b4a2985814dc9363c31dcdc81a3fb331b29f51f5523628edb8d9c64c465d6dcaa3
+DIST containers-storage-1.54.0.tar.gz 4165066 BLAKE2B 30f3e4287e9db46fca81ae6c08d3016ec4be6f38a4981d310f06cbc72e4125b458446fe49675f53232efdf0bec58e9cd18aa90424677e1b726338f1fb62b7172 SHA512 e3535ab378bcb7b852d1ebf431e94696f53da469278f618c07dde2d3c8c6b5b3a4c71d65a9c14d1c1b4fa1e41a0550029468ef9ba1f24c1d3294a5aeec55b5fd

sdk_container/src/third_party/portage-stable/app-containers/containers-storage/containers-storage-1.51.0.ebuild

@@ -0,0 +1,37 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_prepare() {
+	default
+	eapply "${FILESDIR}"/system-md2man-path.patch
+}
+
+src_compile() {
+	emake -C docs containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /etc/containers
+	doins storage.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-storage/containers-storage-1.54.0.ebuild

@@ -0,0 +1,32 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /etc/containers
+	doins storage.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/containers-storage/containers-storage-9999.ebuild

@@ -0,0 +1,32 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /etc/containers
+	doins storage.conf
+}

sdk_container/src/third_party/portage-stable/app-containers/crun/Manifest

@@ -1 +1,3 @@
+DIST crun-1.11.2.tar.xz 738176 BLAKE2B ef13475089c87599159ce00dd26fbb19c7f2bb9564352c1f8040925e521bb924cf28a8d1f37cc95ce7d1b2797b8654740e9ad08352e357c8c9e2d176466101e0 SHA512 ae35ffb9bd1c7acebfd7f6236fa6a7ad524593d8f2cea1203f0e89023e9791d2d5bbc5c5cfc32ee5f18ad80662a1659076ab5f4d5ff74c6026842f2dd12be977
 DIST crun-1.14.3.tar.xz 750456 BLAKE2B 5a63b5da2f85ff1a83d4589be224c5b7a1123b6d7714b90a63c1907b78d42392aff25ffe5d9a4127173ac47026d57e9c93a39f5ba4b07de7f9f3722c14e6d203 SHA512 d6645c519ff00dda5def6d58240600d15e76969489918d51c0def2fee7dbad6374f83e5afc14a998d176aa2944765df5cd84c3031b265a1931ab23f2fc965fc1
+DIST crun-1.8.4.tar.xz 729552 BLAKE2B 8169518a0ddd8deb3820f7030d03dec6941d5d34fb73a036b82f15b0d8f2f702e117de00b829a16cb9976e118f5a5ca732b1cd572708f664cfeafc564f883824 SHA512 2ed80db2e7ddd1438bbe33e99ec2cdbcc55c4869504f719ff9302e834929752af09a59cd905accb37ee5f6cae3b9b16fd4f4c3fdab31db5fc38b007c1505bfa0

sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.11.2.ebuild

@@ -0,0 +1,76 @@
+# Copyright 2019-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+
+inherit python-any-r1
+
+DESCRIPTION="A fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.xz"
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/libgcrypt:=
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	# merged upstream: https://github.com/containers/crun/pull/1345
+	# drop when we get 1.11.3
+	"${FILESDIR}/${P}-caps.patch"
+)
+
+src_configure() {
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		$(usex static-libs '--enable-shared --enable-static' '--enable-shared --disable-static' '' '')
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake git-version.h
+	emake -C libocispec
+	emake crun
+}
+
+# the crun test suite is comprehensive to the extent that tests will fail
+# within a sandbox environment, due to the nature of the privileges
+# required to create linux "containers".
+# due to this we disable most of the core test suite by unsetting PYTHON_TESTS
+src_test() {
+	emake check PYTHON_TESTS=
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	einfo "Cleaning up .la files"
+	find "${ED}" -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.14.3.ebuild

@@ -15,7 +15,7 @@ if [[ "$PV" == *9999* ]]; then
 	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
 else
 	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.xz"
-	KEYWORDS="amd64 ~arm arm64 ~ppc64 ~riscv"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv"
 fi
 
 LICENSE="GPL-2+ LGPL-2.1+"
@@ -27,6 +27,7 @@ DEPEND="
 	sys-kernel/linux-headers
 	caps? ( sys-libs/libcap )
 	criu? ( >=sys-process/criu-3.15 )
+	elibc_musl? ( sys-libs/argp-standalone[static-libs] )
 	seccomp? ( sys-libs/libseccomp )
 	systemd? ( sys-apps/systemd:= )
 "

sdk_container/src/third_party/portage-stable/app-containers/crun/crun-1.8.4.ebuild

@@ -0,0 +1,73 @@
+# Copyright 2019-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{9..11} )
+
+# Can drop autotools/eautoreconf after next release & glibc patch gone
+inherit autotools python-any-r1
+
+DESCRIPTION="A fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.xz"
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/libgcrypt:=
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+# the crun test suite is comprehensive to the extent that tests will fail
+# within a sandbox environment, due to the nature of the privileges
+# required to create linux "containers".
+RESTRICT="test"
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		$(usex static-libs '--enable-shared --enable-static' '--enable-shared --disable-static' '' '')
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake git-version.h
+	emake -C libocispec
+	emake crun
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	einfo "Cleaning up .la files"
+	find "${ED}" -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/app-containers/podman/Manifest

@@ -1 +1,4 @@
+DIST podman-4.9.4.tar.gz 21733620 BLAKE2B 17d099c0a13fbbb77556742313c39995127fc97b4086ef3c2d74a92cc0a4f825a6c729dd099c6d4f4cd3d2ebfd470494babdeaa85a5653b327ea1a16fb5ea993 SHA512 7b52555789a1c214fcf26b0826bdda6cf0ccca588f87c0f15ac5e8358ddac625e17cafbe6a43de07cad964e1418b5ee0d2e38a5cb5dc6f6d4e638399749a7f7b
 DIST podman-5.0.2.tar.gz 23811875 BLAKE2B e943eb36eb0b80332223afc5d971c0886f6eaffeb7133c634d28c0a38e9aae6a54266691067dbca7684882f8b6dad72c3d5de2287ec5a7e8fb4b1cfd96df0b4d SHA512 70dbac9fc81d66eb9b0a5174f5776b805397005cacca917674d2b001591fadd05a776c956e693bad932e9eefe591c35da5c566e8e9e01db8be42bc454cd03104
+DIST podman-5.0.3.tar.gz 23814179 BLAKE2B 46385710e4d24f8eca3a7c98c18a97b96ecd4691b3c965c5a5e7bc690d40d892a6d5fb71c1dd8ec56cc907a2167ab5ee795b4d2c2279c58cef3a5a1cece8b678 SHA512 c605a52cc5aba43d485796c4986f2d1be704e5c931473bf5ba1cf77f703cdb3d16f41d33da0b25287e8d001077f77caf117d3ea5dbd7c56a744274025d9ab07d
+DIST podman-5.1.1.tar.gz 23794366 BLAKE2B 0612a148972c96f532e96a8eb1ab388d80b32fe2ca7c5626e615748ef269a853407aeb39f34686d9eb75de239882e524cf5ee7c97152caccf5f77eb6ecfd54d8 SHA512 e896ee97980da4a522eb865d2eacb6876dd8bc5be1488aed8bd81a81af95faa1383b176b5d236d4af0f76bc30ddad5230df3e11c59ffc6f86e5b4cf3876ff184

sdk_container/src/third_party/portage-stable/app-containers/podman/podman-4.9.4.ebuild

@@ -0,0 +1,162 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11,12} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	if [[ ${PV} != *rc* ]] ; then
+		KEYWORDS="amd64 arm64 ~riscv"
+	fi
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs cgroup-hybrid wrapper +fuse +init +rootless +seccomp selinux systemd"
+RESTRICT="test"
+
+RDEPEND="
+	app-crypt/gpgme:=
+	>=app-containers/conmon-2.0.0
+	>=app-containers/containers-common-0.56.0
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	cgroup-hybrid? ( >=app-containers/runc-1.0.0_rc6  )
+	!cgroup-hybrid? ( app-containers/crun )
+	wrapper? ( !app-containers/docker-cli )
+	fuse? ( sys-fs/fuse-overlayfs )
+	init? ( app-containers/catatonit )
+	rootless? ( app-containers/slirp4netns )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${FILESDIR}/seccomp-toggle-4.7.0.patch"
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag btrfs_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	echo -e "#!/usr/bin/env bash\n echo" > hack/btrfs_installed_tag.sh || die
+	cat <<-EOF > hack/btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+}
+
+src_compile() {
+	export PREFIX="${EPREFIX}/usr"
+
+	# bug 906073
+	use elibc_musl && export CGO_CFLAGS="-D_LARGEFILE64_SOURCE"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	# BUILD_SECCOMP is used in the patch to toggle seccomp
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" BUILD_SECCOMP="$(usex seccomp)" all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install install.completions $(usev wrapper install.docker-full)
+
+	insinto /etc/cni/net.d
+	doins cni/87-podman-bridge.conflist
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_preinst() {
+	PODMAN_ROOTLESS_UPGRADE=false
+	if use rootless; then
+		has_version 'app-containers/podman[rootless]' || PODMAN_ROOTLESS_UPGRADE=true
+	fi
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+
+	local want_newline=false
+	if [[ ${PODMAN_ROOTLESS_UPGRADE} == true ]] ; then
+		${want_newline} && elog ""
+		elog "For rootless operation, you need to configure subuid/subgid"
+		elog "for user running podman. In case subuid/subgid has only been"
+		elog "configured for root, run:"
+		elog "usermod --add-subuids 1065536-1131071 <user>"
+		elog "usermod --add-subgids 1065536-1131071 <user>"
+		want_newline=true
+	fi
+}

sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.0.2.ebuild

@@ -5,7 +5,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{11,12} )
 
-inherit go-module python-any-r1 tmpfiles linux-info
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
 
 DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
 HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
@@ -17,7 +17,7 @@ else
 	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/${P/_rc/-rc}"
 	[[ ${PV} != *rc* ]] && \
-		KEYWORDS="amd64 arm64 ~riscv"
+		KEYWORDS="~amd64 ~arm64 ~riscv"
 fi
 
 # main pkg
@@ -48,7 +48,6 @@ DEPEND="${RDEPEND}"
 BDEPEND="
 	${PYTHON_DEPS}
 	dev-go/go-md2man
-	app-crypt/gpgme:=
 "
 
 PATCHES=(
@@ -96,6 +95,12 @@ src_compile() {
 	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
 	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
 
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
 	# BUILD_SECCOMP is used in the patch to toggle seccomp
 	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" BUILD_SECCOMP="$(usex seccomp)" \
 		  all $(usev wrapper docker-docs)

sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.0.3.ebuild

@@ -0,0 +1,134 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11,12} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	[[ ${PV} != *rc* ]] && \
+		KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs +seccomp selinux systemd wrapper"
+RESTRICT="test"
+
+RDEPEND="
+	app-containers/catatonit
+	>=app-containers/conmon-2.1.10
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	wrapper? ( !app-containers/docker-cli )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${FILESDIR}/seccomp-toggle-4.7.0.patch"
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag btrfs_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	echo -e "#!/usr/bin/env bash\n echo" > hack/btrfs_installed_tag.sh || die
+	cat <<-EOF > hack/btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+}
+
+src_compile() {
+	export PREFIX="${EPREFIX}/usr"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	# BUILD_SECCOMP is used in the patch to toggle seccomp
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" BUILD_SECCOMP="$(usex seccomp)" \
+		  all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install install.completions $(usev wrapper install.docker-full)
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+}

sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.1.1.ebuild

@@ -0,0 +1,146 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	[[ ${PV} != *rc* ]] && \
+		KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs +seccomp selinux systemd wrapper"
+RESTRICT="test"
+
+RDEPEND="
+	app-containers/catatonit
+	>=app-containers/conmon-2.1.10
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	wrapper? ( !app-containers/docker-cli )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${T}"/togglable-seccomp.patch
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
+--- a/Makefile
++++ b/Makefile
+@@ -56,7 +56,6 @@ BUILDTAGS ?= \
+	$(shell hack/systemd_tag.sh) \
+	$(shell hack/libsubid_tag.sh) \
+	exclude_graphdriver_devicemapper \
+-	seccomp
+ # allow downstreams to easily add build tags while keeping our defaults
+ BUILDTAGS += ${EXTRA_BUILDTAGS}
+ # N/B: This value is managed by Renovate, manual changes are
+EOF
+
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag btrfs_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	echo -e "#!/usr/bin/env bash\n echo" > hack/btrfs_installed_tag.sh || die
+	cat <<-EOF > hack/btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+}
+
+src_compile() {
+	export PREFIX="${EPREFIX}/usr"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" EXTRA_BUILDTAGS="$(usev seccomp)" \
+		  all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install install.completions $(usev wrapper install.docker-full)
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+}

sdk_container/src/third_party/portage-stable/app-containers/podman/podman-9999.ebuild

@@ -0,0 +1,146 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	[[ ${PV} != *rc* ]] && \
+		KEYWORDS="~amd64 ~arm64 ~riscv"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs +seccomp selinux systemd wrapper"
+RESTRICT="test"
+
+RDEPEND="
+	app-containers/catatonit
+	>=app-containers/conmon-2.1.10
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	wrapper? ( !app-containers/docker-cli )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${T}"/togglable-seccomp.patch
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
+--- a/Makefile
++++ b/Makefile
+@@ -56,7 +56,6 @@ BUILDTAGS ?= \
+	$(shell hack/systemd_tag.sh) \
+	$(shell hack/libsubid_tag.sh) \
+	exclude_graphdriver_devicemapper \
+-	seccomp
+ # allow downstreams to easily add build tags while keeping our defaults
+ BUILDTAGS += ${EXTRA_BUILDTAGS}
+ # N/B: This value is managed by Renovate, manual changes are
+EOF
+
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag btrfs_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	echo -e "#!/usr/bin/env bash\n echo" > hack/btrfs_installed_tag.sh || die
+	cat <<-EOF > hack/btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+}
+
+src_compile() {
+	export PREFIX="${EPREFIX}/usr"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" EXTRA_BUILDTAGS="$(usev seccomp)" \
+		  all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install install.completions $(usev wrapper install.docker-full)
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+}

sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest

@@ -1,2 +1 @@
-DIST runc-1.1.12.tar.gz 2522196 BLAKE2B 14fe8d5f82d5b4d7f6b4bb9111c5d258e74f6a44aeb51fc87c69104e95b9bf24a3d503f4cc5dedb40d542fbd4b6e27273f456bda4fcf3bc298eb93ae292d9663 SHA512 92e8ac54a77d7ebcc76b5a9cc08d9a064211f12e9d26f064070cc203a5afb11c3af28d8f556f297513f797a2933d50bf10a8f22e307724041d66aa8c5ca1d9d3
 DIST runc-1.1.13.tar.gz 2532849 BLAKE2B f3d3171ffce2bb833bfb5cc21d0dc034fd7e38c47ee098cc1fc75c06fd4dfae21dfe25c2e69a1ca93b29d36e8799727ea41725eee8aca3a059c14dab6c8a435f SHA512 644bf9e6359bf49bbdec667c0f7c69ded78c7eacfc2d1b730d52fdcf7348571c6406b8e5790811fe3662a458c878e4225c3559885f0d95f8905273e7e40e55ad

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.13.ebuild

@@ -16,7 +16,7 @@ SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P
 
 LICENSE="Apache-2.0 BSD-2 BSD MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor hardened +kmem +seccomp selinux test"
 
 DEPEND="seccomp? ( sys-libs/libseccomp )"

sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.4.ebuild

@@ -29,7 +29,7 @@ PATCHES=(
 src_prepare() {
 	default
 
-	eautoconf
+	eautoreconf
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild

@@ -29,7 +29,7 @@ PATCHES=(
 src_prepare() {
 	default
 
-	eautoconf
+	eautoreconf
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.4-remove-flex-configure-dependency.patch

@@ -1,16 +1,71 @@
-Bug: https://bugs.gentoo.org/221361
+From 5bd94d9670ad10df9f14349dfa098d0a2e40ab08 Mon Sep 17 00:00:00 2001
-Reverts upstream commit eec7cdf0
+From: Eli Schwartz <eschwartz93@gmail.com>
+Date: Mon, 10 Jun 2024 22:02:37 -0400
+Subject: [PATCH] make building work again when flex is not installed
 
+This explicitly reverts commit eec7cdf03dda2bd26e320ead73b91da5a9d86443
+because it was a bad idea.
+
+The motivating bug report was https://github.com/LudovicRousseau/PCSC/issues/124
+and the issue there occurred when building from a git clone, running
+./bootstrap && ./configure && make, and having:
+
+- configure succeed
+- make "succeeeds" at having $LEX run, do nothing and fail to generate
+  required sources
+- compiling nonexistent files fail with highly confusing errors
+
+The autoconf manual has always documented the correct way to handle this
+is to check if lex is unavailable, and set it to the famous automake
+wrapper "missing", which checks if a program is missing at build time
+rather than at ./configure time, and fails the build if the rule cannot
+be run. This means:
+
+When building from a git clone, if flex is not available then
+- configure succeeds
+- make fails to run $LEX, and tells you to install flex
+
+The previous attempt to fix the highly confusing error instead resulted
+in configure erroring out, and saying flex is required, even when it is
+*not* required because a `make dist` tarball was used, which contains
+pregenerated tokenparser.c for the express purpose of making flex
+unnecessary.
+
+See autoconf documentation on $LEX:
+https://www.gnu.org/software/autoconf/manual/autoconf-2.72/html_node/Particular-Programs.html#index-AC_005fPROG_005fLEX-1
+
+And automake documentation on why to use "missing":
+https://www.gnu.org/software/automake/manual/html_node/maintainer_002dmode.html
+
+Signed-off-by: Eli Schwartz <eschwartz93@gmail.com>
+---
+ configure.ac | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d291f2b..a5af2eb 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -32,11 +32,6 @@ AC_PROG_CPP
+@@ -33,10 +33,10 @@ AC_PROG_INSTALL
- AC_PROG_INSTALL
  AC_PROG_MAKE_SET
  AC_PROG_LN_S
--AC_PROG_LEX([noyywrap])
+ AC_PROG_LEX([noyywrap])
 -if test $LEX = ":"
 -then
 -    AC_MSG_ERROR([no lex or flex found])
 -fi
++AS_IF([test $LEX = ":"], [
++       AM_MISSING_PROG(MISSINGLEX, [flex])
++       LEX=$MISSINGLEX]
++)
  AM_PROG_AR
  PKG_PROG_PKG_CONFIG
+ 
+@@ -354,4 +354,3 @@ AC_CONFIG_FILES(Makefile
+ 	examples/Makefile)
+ 
+ AC_OUTPUT
+-
+-- 
+2.44.2
+

sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.5-remove-flex-configure-dependency.patch

@@ -1,13 +1,68 @@
-Bug: https://bugs.gentoo.org/221361
+From 7e2207a07979b6c1b206024e83e22ca2bbd4e17c Mon Sep 17 00:00:00 2001
-Reverts upstream commit eec7cdf0 & 41270c2
+From: Eli Schwartz <eschwartz93@gmail.com>
+Date: Mon, 10 Jun 2024 22:02:37 -0400
+Subject: [PATCH] make building work again when flex is not installed
 
+This explicitly reverts commit eec7cdf03dda2bd26e320ead73b91da5a9d86443
+because it was a bad idea.
+
+The motivating bug report was https://github.com/LudovicRousseau/PCSC/issues/124
+and the issue there occurred when building from a git clone, running
+./bootstrap && ./configure && make, and having:
+
+- configure succeed
+- make "succeeeds" at having $LEX run, do nothing and fail to generate
+  required sources
+- compiling nonexistent files fail with highly confusing errors
+
+The autoconf manual has always documented the correct way to handle this
+is to check if lex is unavailable, and set it to the famous automake
+wrapper "missing", which checks if a program is missing at build time
+rather than at ./configure time, and fails the build if the rule cannot
+be run. This means:
+
+When building from a git clone, if flex is not available then
+- configure succeeds
+- make fails to run $LEX, and tells you to install flex
+
+The previous attempt to fix the highly confusing error instead resulted
+in configure erroring out, and saying flex is required, even when it is
+*not* required because a `make dist` tarball was used, which contains
+pregenerated tokenparser.c for the express purpose of making flex
+unnecessary.
+
+See autoconf documentation on $LEX:
+https://www.gnu.org/software/autoconf/manual/autoconf-2.72/html_node/Particular-Programs.html#index-AC_005fPROG_005fLEX-1
+
+And automake documentation on why to use "missing":
+https://www.gnu.org/software/automake/manual/html_node/maintainer_002dmode.html
+
+Signed-off-by: Eli Schwartz <eschwartz93@gmail.com>
+---
+ configure.ac | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index eb2370f..c012f2a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -33,7 +33,5 @@
+@@ -33,7 +33,10 @@ AC_PROG_INSTALL
  AC_PROG_MAKE_SET
  AC_PROG_LN_S
--AC_PROG_LEX([noyywrap])
+ AC_PROG_LEX([noyywrap])
 -AS_IF([test $LEX = ":"], [AC_MSG_ERROR([no lex or flex found])])
++AS_IF([test $LEX = ":"], [
++       AM_MISSING_PROG(MISSINGLEX, [flex])
++       LEX=$MISSINGLEX]
++)
  AM_PROG_AR
  PKG_PROG_PKG_CONFIG
+ 
+@@ -331,4 +334,3 @@ AC_CONFIG_FILES(Makefile
+ 	examples/Makefile)
+ 
+ AC_OUTPUT
+-
+-- 
+2.44.2
 

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest

@@ -1,6 +1,6 @@
 DIST gnupg-2.2.42.tar.bz2 7434291 BLAKE2B 5f7f01f31949e5258d638fbff81fa641e5c167e6eaf32c55eb187d4a31b31cd4fe6e51c622e74d8544c4f95c75484e15117f26a8cf26055ff6813d75e54f2b8a SHA512 9c59d034f428d42323b5520e1a8984acc1505ba1d96d90f00e17b24aa91660b2dc64e1a3ceb044c56f39b4c402a77c7e0b226c65218c23c094781b4ef51e2eb5
 DIST gnupg-2.2.42.tar.bz2.sig 238 BLAKE2B 251ad0a832042ceb93b0edfda8652104bfb463e291322f22f0ab0d9b35606c3589be7a6f3e9e2aac8f6ac368a7d11840ab83b29997587dc65685de9f2dec3fee SHA512 7073bfc920c571680a1de57b4e6cd83cde24ccb3b5f592602b0c32fd762eef497027b08745044c9f41130ca99bb7ec77222568c2d0a1099d3c1c15137e0221d7
-DIST gnupg-2.4.4.tar.bz2 7886036 BLAKE2B 02661e89f0358be09fa3e71e7235b764a7dbda62a48a0c8c7a4e6c9919c3b37d54ead50b930af58f8f2fdb87861b849d3f3751e95cbedf46bdfd76caa90c4db4 SHA512 3d1a3b08d1ce2319d238d8be96591e418ede1dc0b4ede33a4cc2fe40e9c56d5bbc27b1984736d8a786e7f292ddbc836846a8bdb4bf89f064e953c37cb54b94ef
+DIST gnupg-2.2.43.tar.bz2 7435426 BLAKE2B ddf5c89d317e6ce8d1a5348f0ef81ffa1c61c995ddb312b28410f04502b01eae307cd943bee7182d28d4efccac394c91053f8e33756b00166bf66b2bf4a791a7 SHA512 0d2e733b6659c116c043db5252de4de33d6a70c16172d1fe9b779ba413ba9fcb64bbfdcc4686d0e87904561fc62d1aa765144e0586957a500287c175ee37bd49
-DIST gnupg-2.4.4.tar.bz2.sig 237 BLAKE2B 6ee5878c36fbec747a6d84a268903749d862aab50dd7f9a389aabbf7b94dec1c424615f520b5f4a6d44e02093e8d9ad0b08d0c6cf6fd8886d8c174ce9faac99c SHA512 3ae7b6833576df851901a7619459b514bb82faeed350c864a57a782719d21f694d9ced5a3445c81dfa584a0302f87fedc660b08ea97bb8b861e76d7c5b46d07f
+DIST gnupg-2.2.43.tar.bz2.sig 119 BLAKE2B 38fd3790f5065d67d6b5323ef7abbb79facf00e5b9daba98e5078302fc3887423173ba434c7eff1e64faecef88d87aab9c057c570d6e96e8d0808f07f32d8fa1 SHA512 47c5354869b1825e56fa4276826fcde1ee41c70aab9b411686cf2733f4d1df9c006049e49e066b22e475bd37b337f9ffc97f8bbca0c62c0f32296909464a0643
 DIST gnupg-2.4.5.tar.bz2 7889060 BLAKE2B a8b80cd4dfbb377066efb5c9f1b6cdc6d0cd1b18358c962781b5c06de1545117b13038a4655ae627c36bfd2e5fee127692df8729d6b23e1b31051ab6d897b733 SHA512 4d54744f09399c5899144d0cb5fdc2756e45b058db41b9ea9df3be03e80b914509e16ef35aa0248e7561185b80f7a5f9fd6afcab8ccff75ff82ed555448a38ff
-DIST gnupg-2.4.5.tar.bz2.sig 119 BLAKE2B f37fb5620bc009a5b935ac75df4235d377da4f052115c3c22c8d0887e9b21df6ea3059ac510eb2b555d825c2294e1c3ee44c86ecb371c6444a4645ca5a5c265a SHA512 53be0db371a98c930cbef9c844adcd06a8049d84dd71508f6f7427fc1736b374912c85ebf3a415748651260f65cf26f633697f4bdae2cc4a8d2c4b522db0bc71
+DIST gnupg-2.4.5.tar.bz2.sig 238 BLAKE2B b236e7d62f49c8385f4fb81389bf10715d9c0a0cb5c0b4c20fb6ff1465d05a3c3657061284db23af988a1ca16c9fa393af3ce5cbd27934501eb41a4f448fff0a SHA512 5a06970e499d1eb5213b142a8a182e46f5f21b7cb32785a9e5069378797c124e151ce74727382003820042d60fd7a2f909143f44aa9ef282605875e1cab04aef

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/files/gnupg-2.4.4-dirmngr-proxy.patch

@@ -1,202 +0,0 @@
-https://bugs.gentoo.org/924606
-https://dev.gnupg.org/T6997
-https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=04cbc3074aa98660b513a80f623a7e9f0702c7c9
-https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=848546b05ab0ff6abd47724ecfab73bf32dd4c01
-https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2810b934647edd483996bee1f5f9256a162b2705
-
-From 6236978d78886cbb476ed9fbc49ff99c7582b2d7 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Thu, 15 Feb 2024 15:38:34 +0900
-Subject: [PATCH 1/3] dirmngr: Fix proxy with TLS.
-
-* dirmngr/http.c (proxy_get_token, run_proxy_connect): Always
-available regardless of USE_TLS.
-(run_proxy_connect): Use log_debug_string.
-(send_request): Remove USE_TLS.
-
---
-
-Since the commit of
-
-	1009e4e5f71347a1fe194e59a9d88c8034a67016
-
-Building with TLS library is mandatory.
-
-GnuPG-bug-id: 6997
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
----
- dirmngr/http.c | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
-diff --git a/dirmngr/http.c b/dirmngr/http.c
-index 4899a5d55..10eecfdb0 100644
---- a/dirmngr/http.c
-+++ b/dirmngr/http.c
-@@ -2362,7 +2362,6 @@ run_gnutls_handshake (http_t hd, const char *server)
-  * NULL, decode the string and use this as input from teh server.  On
-  * success the final output token is stored at PROXY->OUTTOKEN and
-  * OUTTOKLEN.  IF the authentication succeeded OUTTOKLEN is zero. */
--#ifdef USE_TLS
- static gpg_error_t
- proxy_get_token (proxy_info_t proxy, const char *inputstring)
- {
-@@ -2530,11 +2529,9 @@ proxy_get_token (proxy_info_t proxy, const char *inputstring)
- 
- #endif /*!HAVE_W32_SYSTEM*/
- }
--#endif /*USE_TLS*/
- 
- 
- /* Use the CONNECT method to proxy our TLS stream.  */
--#ifdef USE_TLS
- static gpg_error_t
- run_proxy_connect (http_t hd, proxy_info_t proxy,
-                    const char *httphost, const char *server,
-@@ -2586,7 +2583,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-   hd->keep_alive = !auth_basic; /* We may need to send more requests.  */
- 
-   if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
--    log_debug_with_string (request, "http.c:proxy:request:");
-+    log_debug_string (request, "http.c:proxy:request:");
- 
-   if (!hd->fp_write)
-     {
-@@ -2743,7 +2740,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-   xfree (tmpstr);
-   return err;
- }
--#endif /*USE_TLS*/
- 
- 
- /* Make a request string using a standard proxy.  On success the
-@@ -2903,7 +2899,6 @@ send_request (ctrl_t ctrl,
-       goto leave;
-     }
- 
--#if USE_TLS
-   if (use_http_proxy && hd->uri->use_tls)
-     {
-       err = run_proxy_connect (hd, proxy, httphost, server, port);
-@@ -2915,7 +2910,6 @@ send_request (ctrl_t ctrl,
-        * clear the flag to indicate this.  */
-       use_http_proxy = 0;
-     }
--#endif	/* USE_TLS */
- 
- #if HTTP_USE_NTBTLS
-   err = run_ntbtls_handshake (hd);
--- 
-2.43.2
-
-From 68650eb6999e674fd2f1c78f47b68d3cd1d37ff0 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Fri, 16 Feb 2024 11:31:37 +0900
-Subject: [PATCH 2/3] dirmngr: Fix the regression of use of proxy for TLS
- connection.
-
-* dirmngr/http.c (run_proxy_connect): Don't set keep_alive, since it
-causes resource leak of FP_WRITE.
-Don't try to read response body to fix the hang.
-
---
-
-GnuPG-bug-id: 6997
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
----
- dirmngr/http.c | 14 ++------------
- 1 file changed, 2 insertions(+), 12 deletions(-)
-
-diff --git a/dirmngr/http.c b/dirmngr/http.c
-index 10eecfdb0..7ce01bacd 100644
---- a/dirmngr/http.c
-+++ b/dirmngr/http.c
-@@ -2553,6 +2553,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-    * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
-    */
-   auth_basic = !!proxy->uri->auth;
-+  hd->keep_alive = 0;
- 
-   /* For basic authentication we need to send just one request.  */
-   if (auth_basic
-@@ -2574,13 +2575,12 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-                          httphost ? httphost : server,
-                          port,
-                          authhdr ? authhdr : "",
--                         auth_basic? "" : "Connection: keep-alive\r\n");
-+                         hd->keep_alive? "Connection: keep-alive\r\n" : "");
-   if (!request)
-     {
-       err = gpg_error_from_syserror ();
-       goto leave;
-     }
--  hd->keep_alive = !auth_basic; /* We may need to send more requests.  */
- 
-   if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
-     log_debug_string (request, "http.c:proxy:request:");
-@@ -2607,16 +2607,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-   if (err)
-     goto leave;
- 
--  {
--    unsigned long count = 0;
--
--    while (es_getc (hd->fp_read) != EOF)
--      count++;
--    if (opt_debug)
--      log_debug ("http.c:proxy_connect: skipped %lu bytes of response-body\n",
--                 count);
--  }
--
-   /* Reset state.  */
-   es_clearerr (hd->fp_read);
-   ((cookie_t)(hd->read_cookie))->up_to_empty_line = 1;
--- 
-2.43.2
-
-From 7c7cbd94549d08780fc3767d6de8336b3f44e7d7 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Fri, 16 Feb 2024 16:24:26 +0900
-Subject: [PATCH 3/3] dirmngr: Fix keep-alive flag handling.
-
-* dirmngr/http.c (run_proxy_connect): Set KEEP_ALIVE if not Basic
-Authentication.  Fix resource leak of FP_WRITE.
-
---
-
-GnuPG-bug-id: 6997
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
----
- dirmngr/http.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/dirmngr/http.c b/dirmngr/http.c
-index 7ce01bacd..da0c89ae5 100644
---- a/dirmngr/http.c
-+++ b/dirmngr/http.c
-@@ -2553,7 +2553,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-    * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
-    */
-   auth_basic = !!proxy->uri->auth;
--  hd->keep_alive = 0;
-+  hd->keep_alive = !auth_basic; /* We may need to send more requests.  */
- 
-   /* For basic authentication we need to send just one request.  */
-   if (auth_basic
-@@ -2717,6 +2717,14 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
-     }
- 
-  leave:
-+  if (hd->keep_alive)
-+    {
-+      es_fclose (hd->fp_write);
-+      hd->fp_write = NULL;
-+      /* The close has released the cookie and thus we better set it
-+       * to NULL.  */
-+      hd->write_cookie = NULL;
-+    }
-   /* Restore flags, destroy stream, reset state.  */
-   hd->flags = saved_flags;
-   es_fclose (hd->fp_read);
--- 
-2.43.2
-

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/files/gnupg-2.4.5-revert-rfc4880bis.patch

@@ -0,0 +1,196 @@
+https://lwn.net/Articles/953797/
+https://security.stackexchange.com/questions/275883/should-one-really-disable-aead-for-recent-gnupg-created-pgp-keys
+https://lists.gnupg.org/pipermail/librepgp-discuss/2023/000001.html
+https://bugs.gentoo.org/926186
+
+From 1e4f1550996334d2a631a5d769e937d29ace47bb Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 9 Feb 2023 16:38:58 +0100
+Subject: [PATCH gnupg] Revert the introduction of the RFC4880bis draft into
+ defaults
+
+This reverts commit 4583f4fe2 (gpg: Merge --rfc4880bis features into
+--gnupg, 2022-10-31).
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -636,6 +637,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -978,7 +980,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2227,7 +2228,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2243,8 +2244,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2288,6 +2309,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2491,6 +2513,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3033,6 +3056,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3862,6 +3886,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4078,7 +4107,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.42-r4.ebuild

@@ -30,7 +30,7 @@ RESTRICT="!test? ( test )"
 # Existence of executables is checked during configuration.
 # Note: On each bump, update dep bounds on each version from configure.ac!
 DEPEND="
-	>=dev-libs/libassuan-2.5.0
+	>=dev-libs/libassuan-2.5.0:=
 	>=dev-libs/libgcrypt-1.8.0:=
 	>=dev-libs/libgpg-error-1.38
 	>=dev-libs/libksba-1.3.5

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.43-r1.ebuild

@@ -23,17 +23,17 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test tofu tools usb user-socket wks-server"
 RESTRICT="!test? ( test )"
 
 # Existence of executables is checked during configuration.
 # Note: On each bump, update dep bounds on each version from configure.ac!
 DEPEND="
-	>=dev-libs/libassuan-2.5.0
+	>=dev-libs/libassuan-2.5.0:=
 	>=dev-libs/libgcrypt-1.8.0:=
 	>=dev-libs/libgpg-error-1.38
-	>=dev-libs/libksba-1.3.5
+	>=dev-libs/libksba-1.4.0
 	>=dev-libs/npth-1.2
 	>=net-misc/curl-7.10
 	sys-libs/zlib
@@ -67,7 +67,6 @@ DOCS=(
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
-	"${FILESDIR}"/${PN}-2.2.42-bug923248-insecure-backup.patch
 )
 
 src_prepare() {

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r1.ebuild

@@ -31,7 +31,7 @@ REQUIRED_USE="test? ( tofu )"
 # Existence of executables is checked during configuration.
 # Note: On each bump, update dep bounds on each version from configure.ac!
 DEPEND="
-	>=dev-libs/libassuan-2.5.0
+	>=dev-libs/libassuan-2.5.0:=
 	>=dev-libs/libgcrypt-1.9.1:=
 	>=dev-libs/libgpg-error-1.46
 	>=dev-libs/libksba-1.6.3
@@ -69,7 +69,6 @@ DOCS=(
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
-	"${FILESDIR}"/${P}-dirmngr-proxy.patch #924606
 )
 
 src_prepare() {

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.5-r2.ebuild

@@ -31,7 +31,7 @@ REQUIRED_USE="test? ( tofu )"
 # Existence of executables is checked during configuration.
 # Note: On each bump, update dep bounds on each version from configure.ac!
 DEPEND="
-	>=dev-libs/libassuan-2.5.0
+	>=dev-libs/libassuan-2.5.0:=
 	>=dev-libs/libgcrypt-1.9.1:=
 	>=dev-libs/libgpg-error-1.46
 	>=dev-libs/libksba-1.6.3
@@ -69,6 +69,7 @@ DOCS=(
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
+	"${FILESDIR}"/${PN}-2.4.5-revert-rfc4880bis.patch # bug #926186
 )
 
 src_prepare() {

sdk_container/src/third_party/portage-stable/app-crypt/mhash/mhash-0.9.9.9-r3.ebuild

@@ -7,7 +7,7 @@ inherit autotools
 
 DESCRIPTION="Library providing a uniform interface to a large number of hash algorithms"
 HOMEPAGE="https://mhash.sourceforge.net/"
-SRC_URI="mirror://sourceforge/mhash/${P}.tar.gz"
+SRC_URI="https://downloads.sourceforge.net/mhash/${P}.tar.gz"
 
 LICENSE="GPL-2+"
 SLOT="0"

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest

@@ -1 +1,2 @@
 DIST krb5-1.21.2.tar.gz 8622513 BLAKE2B 2afb3ff962a343bc07182fdab0c0ffb221632ff38baab74278cfc721ae72deacc260221470de36e420584f00b780e13221d2e511d4831bca8e1270b7f3d9e824 SHA512 4e09296b412383d53872661718dbfaa90201e0d85f69db48e57a8d4bd73c95a90c7ec7b6f0f325f6bc967f8d203b256b071c0191facf080aca0e2caec5d0ac49
+DIST krb5-1.21.3.tar.gz 9136145 BLAKE2B e909a55eaedab68e5c829bb7bbd26cec5db2d7b8d97f3b034de94d8f957003f16977ac619afee3b862f288e59f05c5e44f41e65b8883961c8b22a26e2f4733bc SHA512 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service

@@ -5,4 +5,3 @@ Conflicts=mit-krb5kpropd.service
 [Service]
 ExecStart=/usr/sbin/kpropd
 StandardInput=socket
-StandardError=syslog

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.21.3.ebuild

@@ -0,0 +1,154 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+inherit autotools flag-o-matic python-any-r1 systemd toolchain-funcs multilib-minimal
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+S=${WORKDIR}/${MY_P}/src
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux test xinetd"
+
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb:= )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-alternatives/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? ( dev-util/cmocka )
+	"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# lto-type-mismatch (bug #854225)
+	filter-lto
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--enable-thread-support \
+		--disable-rpath
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif"
+		dodoc "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif"
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+}

sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r7.ebuild

@@ -17,7 +17,7 @@ KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv
 IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
 
 DEPEND="
-	>=dev-libs/libassuan-2.1
+	>=dev-libs/libassuan-2.1:=
 	>=dev-libs/libgcrypt-1.6.3
 	>=dev-libs/libgpg-error-1.17
 	efl? ( dev-libs/efl[X] )
@@ -58,6 +58,9 @@ src_prepare() {
 
 	unset FLTK_CONFIG
 
+	# bug #934771
+	rm m4/libassuan.m4 || die
+
 	eautoreconf
 }
 

sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r8.ebuild

@@ -17,7 +17,7 @@ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~
 IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
 
 DEPEND="
-	>=dev-libs/libassuan-2.1
+	>=dev-libs/libassuan-2.1:=
 	>=dev-libs/libgcrypt-1.6.3
 	>=dev-libs/libgpg-error-1.17
 	efl? ( dev-libs/efl[X] )
@@ -59,6 +59,9 @@ src_prepare() {
 
 	unset FLTK_CONFIG
 
+	# bug #934771
+	rm m4/libassuan.m4 || die
+
 	eautoreconf
 }
 

sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.0-r3.ebuild

@@ -13,11 +13,11 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="caps efl emacs gtk keyring ncurses qt5 qt6 wayland X"
 
 DEPEND="
-	>=dev-libs/libassuan-2.1
+	>=dev-libs/libassuan-2.1:=
 	>=dev-libs/libgcrypt-1.6.3
 	>=dev-libs/libgpg-error-1.17
 	efl? ( dev-libs/efl[X] )

sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.3.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -7,7 +7,7 @@ inherit flag-o-matic toolchain-funcs multilib-minimal
 
 DESCRIPTION="Console utility and library for computing and verifying file hash sums"
 HOMEPAGE="https://rhash.sourceforge.net/"
-SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.gz"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
 
 LICENSE="0BSD"
 SLOT="0"

sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4-r1.ebuild

@@ -7,7 +7,7 @@ inherit flag-o-matic toolchain-funcs multilib-minimal
 
 DESCRIPTION="Console utility and library for computing and verifying file hash sums"
 HOMEPAGE="https://rhash.sourceforge.net/"
-SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.gz"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
 
 LICENSE="0BSD"
 SLOT="0/1"

sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -7,7 +7,7 @@ inherit flag-o-matic toolchain-funcs multilib-minimal
 
 DESCRIPTION="Console utility and library for computing and verifying file hash sums"
 HOMEPAGE="https://rhash.sourceforge.net/"
-SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.gz"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
 
 LICENSE="0BSD"
 SLOT="0/1"

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/Manifest

@@ -1,3 +1,5 @@
 DIST tpm2-tools-5.5.tar.gz 1241390 BLAKE2B 2225f9e0835988351f84ed06f914616e25fd65bacaa93b51d0bb04185314efb9a6f60eb3539b250f54b2c2ba590f1b76594df3e625e45c8d37e38d13371bea26 SHA512 24f72a3e9840d531d900e96771a863baae1c71a76fcad0fda8020dff06acd8e3b65b86401ace21f034766403caf9ae97ce710ff6013bb7ed25657a6ecf325470
 DIST tpm2-tools-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch.xz 47916 BLAKE2B 1bbc84f58ad46507417c89be1b4ce2450fb33cf3abe8f080c23890d96be85379f135ef1dbf4b580e1a386fa6d5ebc4fbaab351b5238bbf1011bb97b0f49a847b SHA512 3db0daa39a8dc756d7cb25e3673149dc3eeafd7410f2c6537464431b501e3704a886d9b7a9acd71440d6d419649dd471fd6f9247d593c89a30b05774a8d1b3de
+DIST tpm2-tools-5.6.1.tar.gz 1255474 BLAKE2B 7fda0084283bbd592c3323605f598ebb77ba267ebb900e62b2eff2742257378d95f99b48aab090f80438a6c86f168e1863f9350c18571a23e17eea90a1b9bdd9 SHA512 7a5903db0578a1364c44ca8ac3672c3cae745e2b0ab66ddf6a91fdb75146441af32dfe4ccad6825bea343fea74bed97f9e45bf752594ee56f32e4cb7be2bed33
 DIST tpm2-tools-5.6.tar.gz 1266731 BLAKE2B fe88722c26d62128cd6dfbdd8ef2568656a75fe27b1443fed28387d0db1f50b7d0651819d34dfa98acde785b4cfb4e7c11420b110bb5333ed2bb6b67cdd4fc70 SHA512 14216f29ed3ecca5fbe356ed3744c8b6b25a62ff11b2aed596d11101328c8bfd29a02f6ca5a218f9a4477a5e9648c50f0ae96e71de0b4ff5ea1f98ebeeb73cd7
+DIST tpm2-tools-5.7.tar.gz 1339035 BLAKE2B 3984f25176e0b092793a33a0b40b396bc650de989e0b600989d11439cccdf7bc410535c01e1a0e985ab67b36b63eb02d392342aa1746b86727ba22d67d522389 SHA512 629b0b1826815877f452935285f7b3fe0f32bd24fe9130eb169a2dc9b7b254a737797043af9eea68be706b87c32ab2b7189151360c9c00bc5c31dce62a799670

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6.1.ebuild

@@ -0,0 +1,87 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit autotools bash-completion-r1 flag-o-matic python-any-r1
+
+DESCRIPTION="Tools for the TPM 2.0 TSS"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tools"
+SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/tpm2-tools-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch.xz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~ppc64 x86"
+IUSE="+fapi test"
+
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=app-crypt/tpm2-tss-3.0.1:=[fapi?]
+	dev-libs/openssl:=
+	net-misc/curl
+	sys-libs/efivar:="
+DEPEND="${RDEPEND}
+	test? (
+		app-crypt/swtpm
+		app-crypt/tpm2-abrmd
+		dev-util/cmocka
+	)"
+BDEPEND="virtual/pkgconfig
+	dev-build/autoconf-archive
+	test? (
+		app-editors/vim-core
+		dev-tcltk/expect
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	)
+	${PYTHON_DEPS}"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-5.6-test-eventlog-fix-check-eventlog.sh-if-efivar.h-exis.patch"
+	"${WORKDIR}/${PN}-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch"
+	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
+	"${FILESDIR}/${PN}-5.6-test-eventlog.sh-Fix-accidental-deletions.patch"
+)
+
+python_check_deps() {
+	python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# tests fail with LTO enabbled. See bug 865275 and 865277
+	filter-lto
+	econf \
+		$(use_enable fapi) \
+		$(use_enable test unit) \
+		--with-bashcompdir=$(get_bashcompdir) \
+		--enable-hardening
+}
+
+src_install() {
+	default
+	mv "${ED}"/$(get_bashcompdir)/tpm2{_completion.bash,} || die
+	local utils=( "${ED}"/usr/bin/tpm2_* )
+	utils=("${utils[@]##*/}")
+	# these utiltites don't have bash completions
+	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest\
+			   tpm2_sessionconfig tpm2_tr_encode)
+	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
+	bashcomp_alias tpm2 "${utils[@]}"
+}
+
+src_test() {
+# This hook doesn't get invoked consisently, so call it manually
+# else one of the tests will fail
+	emake prepare-check
+	default
+}

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild

@@ -0,0 +1,83 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit autotools bash-completion-r1 flag-o-matic python-any-r1
+
+DESCRIPTION="Tools for the TPM 2.0 TSS"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tools"
+SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
+IUSE="+fapi test"
+
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=app-crypt/tpm2-tss-3.0.1:=[fapi?]
+	dev-libs/openssl:=
+	net-misc/curl
+	sys-libs/efivar:="
+DEPEND="${RDEPEND}
+	test? (
+		app-crypt/swtpm
+		app-crypt/tpm2-abrmd
+		dev-util/cmocka
+	)"
+BDEPEND="virtual/pkgconfig
+	dev-build/autoconf-archive
+	test? (
+		app-editors/vim-core
+		dev-tcltk/expect
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	)
+	${PYTHON_DEPS}"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
+)
+
+python_check_deps() {
+	python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# tests fail with LTO enabbled. See bug 865275 and 865277
+	filter-lto
+	econf \
+		$(use_enable fapi) \
+		$(use_enable test unit) \
+		--with-bashcompdir=$(get_bashcompdir) \
+		--enable-hardening
+}
+
+src_install() {
+	default
+	mv "${ED}"/$(get_bashcompdir)/tpm2{_completion.bash,} || die
+	local utils=( "${ED}"/usr/bin/tpm2_* )
+	utils=("${utils[@]##*/}")
+	# these utiltites don't have bash completions
+	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest\
+			   tpm2_sessionconfig tpm2_tr_encode)
+	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
+	bashcomp_alias tpm2 "${utils[@]}"
+}
+
+src_test() {
+# This hook doesn't get invoked consisently, so call it manually
+# else one of the tests will fail
+	emake prepare-check
+	default
+}

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/Manifest

@@ -1 +1,3 @@
 DIST tpm2-tss-4.0.1.tar.gz 1787139 BLAKE2B 627cdefeff6c64148f9da1425922a0a7a72debcee4930ffab208a3b9b66127c2d4f923e3e105bfd45410cdb13c19cb40cc15a720e9a05dd32ff622dabf5fcc32 SHA512 ed6ddc52cb0e8c1082a4bb001e1225eb9905fd2380da88db5fd69ff5b5d9d43a93eb67b634e49d53eb5d586832da3aef2c4c7e5f18d51bb730481f8913319d7d
+DIST tpm2-tss-4.0.2.tar.gz 1833499 BLAKE2B 91e70bcc66099fe5d7d53cf98a2c46582e96f204fc7bcb89c46497cc811ca1eb39c752be077a6e8132fc980a6581a2df075fcc6670d646d1270e642c144f043c SHA512 e92038de985ac928bf87a707b0f9b190aaa936827923ea5e3cbdda216cbc6cf8590af650c59c2e1e420ad9914dc6c1f14232ab7930ffc1a50fb0c49fdef6d3f0
+DIST tpm2-tss-4.1.3.tar.gz 1902009 BLAKE2B d8592f4797a4254883667476efb2fdf3c95547d9c472fe3557031e934c725e20e3cc70a9b7b41eaddac71e8d9f94beb5fbb39aec5d81b3eeb1b612df27312923 SHA512 c9a5e1e90f6545a466d43790ab2d67c52c4b788a0b21f8212575e27e04e0ac663105863fe00824e08a4e56a4f8c6b00c48c1a1c132531b8569cd5042c3bb9e69

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.2-Dont-install-files-into-run.patch

@@ -0,0 +1,26 @@
+diff --git a/Makefile.am b/Makefile.am
+index 07b7a2bf..e478fc77 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -770,13 +770,11 @@ define set_tss_permissions
+ endef
+ 
+ define make_fapi_dirs
+-    ($(call make_tss_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/) || true) && \
+     ($(call make_tss_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/))
+ endef
+ 
+ define set_fapi_permissions
+     if test -z "${DESTDIR}"; then \
+-        ($(call set_tss_permissions,$(DESTDIR)$(runstatedir)/tpm2-tss)) && \
+         ($(call set_tss_permissions,$(DESTDIR)$(localstatedir)/lib/tpm2-tss)) \
+     fi
+ endef
+@@ -787,7 +785,6 @@ endef
+ 
+ define check_fapi_dirs
+     if test -z "${DESTDIR}"; then \
+-        ($(call check_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/)) && \
+         ($(call check_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/)) \
+     fi;
+ endef

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/files/tpm2-tss-4.0.2-Hide-write-all-function.patch

@@ -0,0 +1,24 @@
+diff --git a/src/util/io.c b/src/util/io.c
+index c6446826..50c0fd6c 100644
+--- a/src/util/io.c
++++ b/src/util/io.c
+@@ -81,6 +81,7 @@ read_all (
+     return recvd_total;
+ }
+ 
++__attribute__ ((visibility("hidden")))
+ ssize_t
+ write_all (
+     SOCKET fd,
+diff --git a/src/util/io.h b/src/util/io.h
+index 25dd5c45..fec391d8 100644
+--- a/src/util/io.h
++++ b/src/util/io.h
+@@ -70,6 +70,7 @@ read_all (
+  * are detected. This is currently limited to interrupted system calls and
+  * short writes.
+  */
++__attribute__ ((visibility("hidden")))
+ ssize_t
+ write_all (
+     SOCKET fd,

sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.0.2-r1.ebuild

@@ -0,0 +1,110 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic linux-info multilib-minimal tmpfiles udev
+
+DESCRIPTION="TCG Trusted Platform Module 2.0 Software Stack"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tss"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0/4"
+KEYWORDS="amd64 arm arm64 ~loong ppc64 ~riscv x86"
+IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	^^ ( mbedtls openssl )
+	fapi? ( openssl !mbedtls )
+	policy? ( openssl !mbedtls )
+"
+
+RDEPEND="
+	acct-group/tss
+	acct-user/tss
+	sys-apps/util-linux:=[${MULTILIB_USEDEP}]
+	fapi? (
+		dev-libs/json-c:=[${MULTILIB_USEDEP}]
+		>=net-misc/curl-7.80.0[${MULTILIB_USEDEP}]
+	)
+	mbedtls? ( net-libs/mbedtls:=[${MULTILIB_USEDEP}] )
+	openssl? ( dev-libs/openssl:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="
+	${RDEPEND}
+	test? ( app-crypt/swtpm
+		dev-libs/uthash
+		dev-util/cmocka
+		fapi? ( >=net-misc/curl-7.80.0 ) )
+"
+
+BDEPEND="
+	sys-apps/acl
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.2-Dont-install-files-into-run.patch"
+	"${FILESDIR}/${PN}-4.0.1-Make-sysusers-and-tmpfiles-optional.patch"
+	"${FILESDIR}/${PN}-4.0.1-Do-not-consider-failures-to-write-files-in-sys-hard.patch"
+	"${FILESDIR}/${PN}-4.0.2-Hide-write-all-function.patch"
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~TCG_TPM"
+	linux-info_pkg_setup
+	kernel_is ge 4 12 0 || ewarn "At least kernel 4.12.0 is required"
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# Fails with inlining
+	filter-flags -fno-semantic-interposition
+	# tests fail with LTO enabbled. See bug 865275 and 865279
+	filter-lto
+
+	local myconf=(
+		--localstatedir=/var
+		$(multilib_native_use_enable doc doxygen-doc)
+		$(use_enable fapi)
+		$(use_enable policy)
+		$(use_enable static-libs static)
+		$(multilib_native_use_enable test unit)
+		$(multilib_native_use_enable test integration)
+		$(multilib_native_use_enable test self-generated-certificate)
+		--disable-tcti-libtpms
+		--disable-defaultflags
+		--disable-weakcrypto
+		--with-crypto="$(usex mbedtls mbed ossl)"
+		--with-runstatedir=/run
+		--with-udevrulesdir="$(get_udevdir)/rules.d"
+		--with-udevrulesprefix=60-
+		--without-sysusersdir
+		--with-tmpfilesdir="/usr/lib/tmpfiles.d"
+	)
+
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	default
+	keepdir /var/lib/tpm2-tss/system/keystore
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process tpm2-tss-fapi.conf
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}