diff --git a/changelog/updates/2025-03-03-weekly-updates.md b/changelog/updates/2025-03-03-weekly-updates.md
new file mode 100644
index 0000000000..91a14c39a2
--- /dev/null
+++ b/changelog/updates/2025-03-03-weekly-updates.md
@@ -0,0 +1 @@
+- sysext-python: pip ([25.0.1](https://github.com/pypa/pip/blob/25.0.1/NEWS.rst) (includes [25.0](https://github.com/pypa/pip/blob/25.0/NEWS.rst)))
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index c7b28ba2f8..1bd462daa0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -31,9 +31,7 @@
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-8.2.0 ~arm64
 =dev-build/meson-1.6.1 ~arm64
-=dev-cpp/glog-0.6.0 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
-=dev-lang/go-1.23.6 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
 # Needed to address CVE-2024-52533
@@ -71,9 +69,6 @@
 # Needed to address CVE-2025-0167, CVE-2025-0665, CVE-2025-0725.
 =net-misc/curl-8.12.1 ~amd64 ~arm64
 
-# Keep versions on both arches in sync.
-=net-misc/openssh-9.9_p2 ~arm64
-
 # Needed to address CVE-2024-54661
 =net-misc/socat-1.8.0.2 ~amd64 ~arm64
 
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containers-common/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/containers-common/Manifest
index 37f5f98f89..4d45605d60 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/containers-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containers-common/Manifest
@@ -1,2 +1 @@
-DIST containers-common-0.59.1.tar.gz 13131960 BLAKE2B 5b3b947789f889955716816fa15a84eb2f398d6cfb59c85bd969442fb8f55715f2c17c78d963ae913d96e6a109f69da745cfc7db8d23e2ed6516f992b982dda0 SHA512 452c9b84f7631afdf39b7b1fcaf2f721bede312d8fb55b89a953f16ca3546c0df11bb23c99588a592b6375275516d1364570261fbc15301ca3ad486ee66eae32
 DIST containers-common-0.60.4.tar.gz 13106900 BLAKE2B 1afb428044bc8eebd002b884f2a2072971cd83fca561fd509b83088ccdf82b3a62d63ff32ec5ef856c3d0ee0ffac316201fa8f1d7956153ce30e2244cc860f02 SHA512 5d61415d4959486223a36ff98304363a558e6da9ccbdca94f976649a37d404ac00c8454019f60a79360029c91c9565d22868b109dbb84c19f13377e0e23dcc4d
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.59.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.59.1.ebuild
deleted file mode 100644
index abc1bd846c..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-containers/containers-common/containers-common-0.59.1.ebuild
+++ /dev/null
@@ -1,75 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit readme.gentoo-r1
-
-DESCRIPTION="Common config files and docs for Containers stack"
-HOMEPAGE="https://github.com/containers/common"
-
-if [[ ${PV} == 9999* ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/containers/common.git"
-else
-	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	S="${WORKDIR}/${P#containers-}"
-	KEYWORDS="amd64 arm64 ~loong ~riscv"
-fi
-
-LICENSE="Apache-2.0"
-SLOT="0"
-RESTRICT="test"
-RDEPEND="
-	>=app-containers/aardvark-dns-1.10.0
-	>=app-containers/crun-1.14.3
-	>=app-containers/containers-image-5.30.0
-	>=app-containers/containers-storage-1.53.0
-	app-containers/containers-shortnames
-	>=app-containers/netavark-1.10.3
-	net-firewall/nftables
-	net-firewall/iptables[nftables]
-	>=net-misc/passt-2024.03.20
-	>=sys-fs/fuse-overlayfs-1.13
-"
-
-BDEPEND="
-	>=dev-go/go-md2man-2.0.3
-"
-
-PATCHES=(
-	"${FILESDIR}/examplify-mounts-conf.patch"
-)
-
-DOC_CONTENTS="\n
-For rootless operations, one needs to configure subuid(5) and subgid(5)\n
-See /etc/sub{uid,gid} to check whether rootless user is already configured\n
-If not, quickly configure it with:\n
-usermod --add-subuids 1065536-1131071 <rootless user>\n
-usermod --add-subgids 1065536-1131071 <rootless user>\n
-"
-
-src_prepare() {
-	default
-
-	[[ -f docs/Makefile && -f Makefile ]] || die
-	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
-}
-
-src_compile() {
-	emake docs
-}
-
-src_install() {
-	emake DESTDIR="${ED}" install
-	readme.gentoo_create_doc
-
-	insinto /usr/share/containers
-	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
-
-	keepdir /etc/containers/certs.d /etc/containers/oci/hooks.d /etc/containers/systemd /var/lib/containers/sigstore
-}
-
-pkg_postinst() {
-	readme.gentoo_print_elog
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
index 36bd6c357a..839bedb526 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
@@ -4,3 +4,5 @@ DIST docker-cli-27.5.0-man.tar.xz 70224 BLAKE2B 4c2a4025721fbfbb63c24e20bdbc68f3
 DIST docker-cli-27.5.0.tar.gz 7462649 BLAKE2B 89ae65834c606d9ef4f8ebc9fee5052d3e12b8aa6d9f4df7c0415157b24a55e89d0758b4f5cf0e4f3f5b6ea2f9c46bfc010c604995cb5cf1d162c068ba679787 SHA512 3c7c709f38fffd4d4e134d2abd7e6dc606e1cba765d36924a53f9470d6077be2282983eb23995bd56d772da253a69a854fe3112fea1a7ed2c9a1b70d2cc45b57
 DIST docker-cli-27.5.1-man.tar.xz 70236 BLAKE2B 82bf35e1b2ec149aa64ee5c72691a1af790e02e85c02c7078f6d2cff0c52143f64270467b00cf6410b6b80cf5088b15dc0bf87b98df0091bc61fa000b4dcec29 SHA512 6cec8418851dd4226e38319038b621e4697458b18496a0a4bacf1473007d5242a56af66d2a0d90f64bd5a9ccce1777c6c0788bc649c0e6cc38be1ecf63bd64da
 DIST docker-cli-27.5.1.tar.gz 7462515 BLAKE2B cd2970ac46092bc040ebb663d1dc3bcd488f1c2e8dfc81b36f937c22cb4becbf79f8d4f537cf482d59fa032e86a183b3c4c781ccda09de68be217347320ad9d6 SHA512 165bd5984786fe6fa6398d6e2b1757ce013a91434317339b360721327d4f74bd52fe0ec3936ae3a0665f0fbbf2cd2c49bd2c503783c25651f8d91a172e1c2d3e
+DIST docker-cli-28.0.1-man.tar.xz 70360 BLAKE2B 395736a74b314530fbbd6bf4016f7f211a3ee4754179cde0d8edf16f489c3fd92565cf73033defb80fd8280e4ef1e2add15541102944401123cfb251b06492f9 SHA512 b72e4f35a80d72d18f701edcace46eb11fbcf1ba40a1ab8efa913edc74e265dafbdc58c7c0d442293d71ce2cfc952fcbed5afee5d5f3ba52d9d25741d5a12593
+DIST docker-cli-28.0.1.tar.gz 7413092 BLAKE2B 69075ba24eb7c46593d7c4ab80499b67994119af8096409f55eec9524173cb8d37263159cd834e3cfaf4e8d169b568232d400633b2d9b08112ced05c78338f92 SHA512 c3d7ca21b88c5f6925f6c99519a67581fd6c264cc96e6c0bc00751f87de6580a2d443cbe59b2e36771e37a78fe05ea054e292675e19bc4d73fcacfda047e0490
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
new file mode 100644
index 0000000000..540abf0655
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.1.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=068a01ea9470df6494cc92d9e64e240805ae47a7
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="hardened selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	insinto /usr/share/fish/vendor_completions.d/
+	doins contrib/completion/fish/docker.fish
+	insinto /usr/share/zsh/site-functions
+	doins contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
index caad1a0c5f..28925755b1 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
@@ -1,3 +1,4 @@
 DIST docker-27.4.1.tar.gz 16837429 BLAKE2B da2e915944a0260619b1e036b43d40f5cbff66f07182153c0ae238ecbcecdfe2066473887882fdaaffa5ef29e2328211f1d07ba3a5239381f9e82d34d9da43fe SHA512 3d77708f7373c1b58b1c46428c2cfc9e8985076e494e40ab86709f37a686cf92b9e2c9db5aa34293f728bb7ccd6a7e08e0cbb1c6d20acfd025c4c787d5908dc0
 DIST docker-27.5.0.tar.gz 17076981 BLAKE2B 20dfdb9fb3d594520f063352c28ccc7a936ec2dc0cd6d04737c2d8c78c54db024ac33fc986ddf06cbe4f496b27bd6e63cc3a2532f3c36b83cf8f9eca0dbae3a2 SHA512 89245805edebd7d43d5b47a38aba115239c20448fc10bce5a1605f99951a303ba360456a54815ffc5346cdd97ddd08657df1881c97f79066e9e2bd075af542da
 DIST docker-27.5.1.tar.gz 17077765 BLAKE2B dc6bfa960fc5c8c45629284dcdaddd6df3295dea2259ebf003900efbb24a4f4719030b5e12baaa87e4c1e3ecf27e1c4ef9e3f9b2fccef1541908fbee4ebecbc8 SHA512 6080fa59efa5b35b23bbd363569df7261783ab2527cda9c391f0853b58b55e34824b4a6019e0366aaed5cfaba5ff70b253dcc90b1b77149a85eea0c282d05bdf
+DIST docker-28.0.1.tar.gz 17553228 BLAKE2B 8c172d58fb75d307983ace06b509e86ed533729d75a27af114939cad9022980f692368249f6ef514912aa90f1fa09998fd658377e28d2e2577d53b6f745cf5db SHA512 58c77ae139e5d32c4c263fa14ec4457f50240a15cd7934b4d2576af0295bfb5b62abbeef0ba78815f9041a01dbe3a8b35351eaebea1f584f54ef0d4192734048
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.1.ebuild
new file mode 100644
index 0000000000..d8ee083521
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.1.ebuild
@@ -0,0 +1,333 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=bbd0a17ccc67e48d4a69393287b7fcc4f0578683
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.0.2[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.3[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/files/podman-5.2.5-togglable-seccomp.patch b/sdk_container/src/third_party/portage-stable/app-containers/podman/files/podman-5.2.5-togglable-seccomp.patch
new file mode 100644
index 0000000000..dcfe449568
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/files/podman-5.2.5-togglable-seccomp.patch
@@ -0,0 +1,10 @@
+--- a/Makefile
++++ b/Makefile
+@@ -56,7 +56,6 @@ BUILDTAGS ?= \
+	$(shell hack/systemd_tag.sh) \
+	$(shell hack/libsubid_tag.sh) \
+	exclude_graphdriver_devicemapper \
+-	seccomp
+ # allow downstreams to easily add build tags while keeping our defaults
+ BUILDTAGS += ${EXTRA_BUILDTAGS}
+ # N/B: This value is managed by Renovate, manual changes are
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.2.5.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.2.5.ebuild
index 91caafc195..091242e4a4 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.2.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.2.5.ebuild
@@ -51,7 +51,7 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${T}"/togglable-seccomp.patch
+	"${FILESDIR}"/${PN}-5.2.5-togglable-seccomp.patch
 )
 
 CONFIG_CHECK="
@@ -65,19 +65,6 @@ pkg_setup() {
 }
 
 src_prepare() {
-	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
---- a/Makefile
-+++ b/Makefile
-@@ -56,7 +56,6 @@ BUILDTAGS ?= \
-	$(shell hack/systemd_tag.sh) \
-	$(shell hack/libsubid_tag.sh) \
-	exclude_graphdriver_devicemapper \
--	seccomp
- # allow downstreams to easily add build tags while keeping our defaults
- BUILDTAGS += ${EXTRA_BUILDTAGS}
- # N/B: This value is managed by Renovate, manual changes are
-EOF
-
 	default
 
 	# assure necessary files are present
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.0.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.0.ebuild
index 365a368d76..0d75458d62 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.0.ebuild
@@ -51,7 +51,7 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${T}"/togglable-seccomp.patch
+	"${FILESDIR}"/${PN}-5.2.5-togglable-seccomp.patch
 )
 
 CONFIG_CHECK="
@@ -65,19 +65,6 @@ pkg_setup() {
 }
 
 src_prepare() {
-	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
---- a/Makefile
-+++ b/Makefile
-@@ -56,7 +56,6 @@ BUILDTAGS ?= \
-	$(shell hack/systemd_tag.sh) \
-	$(shell hack/libsubid_tag.sh) \
-	exclude_graphdriver_devicemapper \
--	seccomp
- # allow downstreams to easily add build tags while keeping our defaults
- BUILDTAGS += ${EXTRA_BUILDTAGS}
- # N/B: This value is managed by Renovate, manual changes are
-EOF
-
 	default
 
 	# assure necessary files are present
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.2.ebuild
index 38cbb5a51f..72735a9d4f 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.3.2.ebuild
@@ -51,7 +51,7 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${T}"/togglable-seccomp.patch
+	"${FILESDIR}"/${PN}-5.2.5-togglable-seccomp.patch
 )
 
 CONFIG_CHECK="
@@ -65,19 +65,6 @@ pkg_setup() {
 }
 
 src_prepare() {
-	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
---- a/Makefile
-+++ b/Makefile
-@@ -56,7 +56,6 @@ BUILDTAGS ?= \
-	$(shell hack/systemd_tag.sh) \
-	$(shell hack/libsubid_tag.sh) \
-	exclude_graphdriver_devicemapper \
--	seccomp
- # allow downstreams to easily add build tags while keeping our defaults
- BUILDTAGS += ${EXTRA_BUILDTAGS}
- # N/B: This value is managed by Renovate, manual changes are
-EOF
-
 	default
 
 	# assure necessary files are present
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-9999.ebuild
index 1deb45b196..d1269c1493 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-9999.ebuild
@@ -51,7 +51,7 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${T}"/togglable-seccomp.patch
+	"${FILESDIR}"/${PN}-5.2.5-togglable-seccomp.patch
 )
 
 CONFIG_CHECK="
@@ -65,19 +65,6 @@ pkg_setup() {
 }
 
 src_prepare() {
-	cat <<'EOF' > "${T}"/togglable-seccomp.patch || die
---- a/Makefile
-+++ b/Makefile
-@@ -56,7 +56,6 @@ BUILDTAGS ?= \
-	$(shell hack/systemd_tag.sh) \
-	$(shell hack/libsubid_tag.sh) \
-	exclude_graphdriver_devicemapper \
--	seccomp
- # allow downstreams to easily add build tags while keeping our defaults
- BUILDTAGS += ${EXTRA_BUILDTAGS}
- # N/B: This value is managed by Renovate, manual changes are
-EOF
-
 	default
 
 	# assure necessary files are present
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
index 34d4e0724d..d3e2e40f67 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
@@ -1 +1,2 @@
 DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
+DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild
new file mode 100644
index 0000000000..04a7f0d9ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=59923ef18c98053ddb1acf23ecba10344056c28e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.5.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.5.ebuild
index b8bcdf82c2..0502bfdcb1 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.5.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+libffi gtk-doc nls systemd test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1-r1.ebuild
similarity index 80%
rename from sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1-r1.ebuild
index 058af5e6c9..17fcbffc56 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="caps efl emacs gtk keyring ncurses qt5 qt6 wayland X"
+IUSE="caps efl emacs gtk keyring ncurses qt6 wayland X"
 
 DEPEND="
 	>=dev-libs/libassuan-2.1:=
@@ -23,16 +23,6 @@ DEPEND="
 	efl? ( dev-libs/efl[X] )
 	keyring? ( app-crypt/libsecret )
 	ncurses? ( sys-libs/ncurses:= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-		wayland? ( kde-plasma/kwayland:5 )
-		X? (
-			dev-qt/qtx11extras:5
-			x11-libs/libX11
-		)
-	)
 	qt6? (
 		dev-qt/qtbase:6[gui,widgets]
 		wayland? (
@@ -76,35 +66,21 @@ src_configure() {
 		$(use_enable gtk pinentry-gnome3)
 		$(use_enable ncurses fallback-curses)
 		$(use_enable ncurses pinentry-curses)
-		$(use_enable qt5 pinentry-qt5)
 		$(use_enable qt6 pinentry-qt)
-		# TODO: could split this up into qt5/qt6?
-		$(use_enable X qtx11extras)
 		$(use_with X x)
 
 		--enable-pinentry-tty
+		--disable-kf5-wayland
 		--disable-pinentry-fltk
 		--disable-pinentry-gtk2
+		--disable-pinentry-qt5
+		--disable-qtx11extras
 
 		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
 
 		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
 	)
 
-	if use qt5 ; then
-		export PATH="$(qt5_get_bindir):${PATH}"
-		export QTLIB="$(qt5_get_libdir):${QTLIB}"
-		export MOC5="$(qt5_get_bindir)"/moc
-
-		myeconfargs+=(
-			$(use_enable wayland kf5-wayland)
-		)
-	else
-		myeconfargs+=(
-			--disable-kf5-wayland
-		)
-	fi
-
 	if use qt6 ; then
 		export PATH="$(qt6_get_bindir):${PATH}"
 		export QTLIB="$(qt6_get_libdir):${QTLIB}"
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.3-r1.ebuild
index 77da1bd61f..087f82b40d 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.3-r1.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	MY_P="${PN}-${PV/_}"
 	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="GNU GPL'd Pico clone with more functionality"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 15844fb414..f82cf755de 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -2,15 +2,15 @@ DIST berkeley-softfloat-3-b64af41c3276f97f0e181920400ee056b9c88037.tar.bz2 84094
 DIST berkeley-testfloat-3-e7af9751d9f9fd3b47911f51a5cfd08af256a9ab.tar.bz2 90020 BLAKE2B 3dda1ba90c4a5ad5cbce2acf35e93f7adbd387ae0e0f929b2cd4cbdf263f95183103118f32be38e8c80de49d7df44c26319ee2f465061d004ae7e64e43eeeb3e SHA512 65f41f42ea563b2cdceb6c71633f41e6694a79ffd02afed4540353a8e73668ae40118dfc108163aae751acbaa7c49630ed99f423465089503c03aee76b07f221
 DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B 0ed69ad24c53bd459c8753565814bcc1cd858f20d3a046c38912a35bcb0ba6d388ef5d2b93157cd028959284b330caf5467d82071c3df56a405dd8e08fd177c7 SHA512 8f2cc14e8bd46cb045e3ebfe32e463793ab7472ebda9b57b8ea0b06fa107a1a99c3ebcacb9c4548e30698d8ec154c0e56f789385201182b680819b8068a103f2
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
-DIST qemu-7.2.14.tar.xz 124392436 BLAKE2B bf4141a910ebd393edc2df3b105c18bbb1d91241a6e2992ceb591b5097dc846fd74171b9c8ffe71e6a7c847277dd17600286da411ae7750e8eae39c0180b5264 SHA512 3fedf9b55ec97faec449f483433e616d8a384933556997bee50b170bb854faa1eb89e43400cc97acea268575bc92b57d8e921e00d4858bc8991fe04a2c2893ff
 DIST qemu-7.2.15.tar.xz 124418604 BLAKE2B 629cb5158cdd790947687a06f4c16bf838ae7b0eb5596bc16bb510dfe838bfcc6ed8e7776962bb6d5ab14379cba1a1f6b12683be370eb4e5debce1ecc446b156 SHA512 e8acc9ea6e70bd4dfb0956e01ee212c592c7b99f5dc0676824eb7cba0aeeb863c1d41df9174771fa775f58ca368c745b2fd7356a3c3fa901a11a33dae24d781a
+DIST qemu-7.2.16.tar.xz 124427328 BLAKE2B 25b69d3f47eef164b5bcb990edad7634f4602d08867cf62470b05005c5de496126064ad2eedfdf9b2d78eb724ae7832b93bc4d302140f14e5d77246cd04086eb SHA512 75623733f39396222e549498fd5dbbc1430593033f7480aa3a34c7e1c765eb5f7776d8827ee47b4b9c52cc1061232637742a8e31c5e5a9019945171d0c65ca7e
 DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
-DIST qemu-8.2.3.tar.xz 130106716 BLAKE2B 2ec91b5111952434686064bd603880d87c4f56774d2478ee953eb0454e2b14235b1d1cca484e015b96bceae3182f90b856d222ca590059032b4989babf1dffe8 SHA512 28c789d84754b26cd86ded9db8464ec82f07cdc3b1025a988e74b8c5b05df8839a3e9990ff96cfba50e032dd967e9dc18cf75f3525baeadd0fa019cb69108d0a
 DIST qemu-8.2.7.tar.xz 132676368 BLAKE2B 92235f1a30e1d44cf9f7e40e71e9df0375c5eb2d8b267c35df51e102e560f399e4d3f70c674d7b9e206728d9c4a1bafee5ae8f1a91cda900b422f9a6a48c15a8 SHA512 9806bae62d2bdf0781b6bd1c4d7e88bb97019ca5e85140714d7818912603aed1d522a5d29f3434888974ab73e0cfae8b4136ea018b05dcc2d6f6c8b6252075cd
 DIST qemu-8.2.8.tar.xz 132682628 BLAKE2B 04ed01c70e0b786f513b0cc7f4db572f93b65ec2a94368d7175efd8eeca62262bcd4dec66f9e0971a1be3ac6686e8cf59479d1ba35b686aee31f2a1840d21b44 SHA512 b89f0939c4b381c5b7d1d23be48e0319c02552f9a1bf2a2399671bc33fd6855d48901ffe26d97c1a547dd50431a0b9c998d4ae1f0c90b2cd990b00c42b711d0b
-DIST qemu-9.0.0-docs.tar.xz 2290196 BLAKE2B 82d22637ff2629bee372550e86651f12051ea6b4a57e314ef83f290425d4973ef01827eaf28a85b635788f22cb7cc1c747438b7525c92c99b90b234fb8f7655c SHA512 7c0ba1f3e7bbaa4e3feebc33a1946a5c190f2c14b9ed78b15c1f642668c8124960f8c85bcf36fe54a10d4edef47d2256e500f06d9173b92b03c599811a15a073
-DIST qemu-9.0.4.tar.xz 132422348 BLAKE2B 8e7bb46462d924fa0a2bbe0fc5ddf5901732444e9fdfecb15e7ce2ff4717c71bd51fccc684b68171c03335c1a4d998fa660a22457f514ae51a3671975ad4d6a5 SHA512 48e0e7850c064c6517552f93db551ad31bd88c159b241ccfbdb205e018dae8d27ae8fe76a0767cbaf4f151649f8848536f1963e4976e16a6d97f429995028d67
+DIST qemu-8.2.9.tar.xz 132695608 BLAKE2B 0c10feba46e917cd3110bd5926223068d635be0eea7d3f76ae96d631b7fd4cace9d9023aa589d26a6d4ea27d052f7f0a1c27f47175853cd558e5744d10d20aa6 SHA512 3981ff1f58cb88c9325b0c89d7a5f38e069b2a1d14e2cbd887b39382310a004bcd75c5c601fa0f60eba3e1c020b9f3d56000af0be9fbe99546237c30e3277e54
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
 DIST qemu-9.1.2.tar.xz 132481332 BLAKE2B 2cbc55e09a8d46fe0c9e3e7e54b6cf4490bef01e8d6fc295158e8f823678cfaedf2f95b8256205cdb14db6e11b932378dee9f653c35c2f1d7e843304336aa2e0 SHA512 ff6ed9bc784f1aa7cf06604d0e38e26ebb2685885893a2cb7d044297f26d7efd0fa6cbb034dc1c422b58504ca1081b46ffe00dd8f9fab928cafa8cfc0d7d1747
+DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
 DIST qemu-9.2.0.tar.xz 135188800 BLAKE2B 5800556f356e4324124e250c02a07857eef3a6f22995a819fe972061fa750ebf7233da64ae4c0a3e775b1639c870be4b7312d86d9866fedf2bc99074aad0a10a SHA512 f92548623e4e31400c823a2d78417a8a4ecfccb07f3ee4883e2f2ad33054539d2a37d076dbc64df42c6c86c08fa7c2c975cd6e823aa14d5f20cef83348006813
+DIST qemu-9.2.2.tar.xz 134756816 BLAKE2B fe341d25010b02c47c263e6b1bf1a64f72226e188bd79901ec0072005994e305f5c75b8e5b3f36af1e3b3f776a04cd18b4084dc044952f34b131f3b94134f5b8 SHA512 b010876da9f91da01dbb9e06705a1358d5f062d0fdd4ad5c8cd8ce3fd43adcefcf72a61216eb8d415281f6607b945ce1cfb6b5fc5692ada9163e8f05b7fb5533
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
new file mode 100644
index 0000000000..a81302f4cd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
@@ -0,0 +1,37 @@
+https://mail.gnu.org/archive/html/qemu-devel/2025-02/msg04327.html
+
+From eca5286f01652fd5801ba89b7752a7895620a852 Mon Sep 17 00:00:00 2001
+Message-ID: <eca5286f01652fd5801ba89b7752a7895620a852.1740071281.git.sam@gentoo.org>
+From: Sam James <sam@gentoo.org>
+Date: Thu, 20 Feb 2025 17:05:59 +0000
+Subject: [PATCH] optionrom: pass -Wl,--no-error-rwx-segments
+
+If GNU Binutils is configured with --enable-error-rwx-segments=yes, one
+gets the following for optionrom:
+```
+.../bin/ld: error: pvh.img has a LOAD segment with RWX permissions
+.../bin/ld: final link faile
+```
+
+Pass -Wl,--no-error-rwx-segments to suppress that.
+---
+ pc-bios/optionrom/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/pc-bios/optionrom/Makefile b/pc-bios/optionrom/Makefile
+index 30d07026c7..4d3ce75af3 100644
+--- a/pc-bios/optionrom/Makefile
++++ b/pc-bios/optionrom/Makefile
+@@ -37,6 +37,7 @@ config-cc.mak: Makefile
+ -include config-cc.mak
+ 
+ override LDFLAGS = -nostdlib -Wl,--build-id=none,-T,$(SRC_DIR)/flat.lds
++override LDFLAGS += -Wl,--no-error-rwx-segments
+ 
+ pvh.img: pvh.o pvh_main.o
+ 
+
+base-commit: 40efe733e10cc00e4fb4f9f5790a28e744e63c62
+-- 
+2.48.1
+
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.0.0-capstone-include-path.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.0.0-capstone-include-path.patch
deleted file mode 100644
index 3e0408d6b2..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.0.0-capstone-include-path.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 67a8b35e98f5c0853f7cdf26db0ebc6ce20b929c Mon Sep 17 00:00:00 2001
-Message-ID: <67a8b35e98f5c0853f7cdf26db0ebc6ce20b929c.1714317553.git.mprivozn@redhat.com>
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Sun, 28 Apr 2024 17:10:46 +0200
-Subject: [PATCH] Forward ported from qemu-7.1.0-capstone-include-path.patch.
-
-Bug: https://bugs.gentoo.org/873157
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
----
- include/disas/capstone.h | 2 +-
- meson.build              | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/disas/capstone.h b/include/disas/capstone.h
-index e29068dd97..d8fdc5d537 100644
---- a/include/disas/capstone.h
-+++ b/include/disas/capstone.h
-@@ -3,7 +3,7 @@
- 
- #ifdef CONFIG_CAPSTONE
- 
--#include <capstone.h>
-+#include <capstone/capstone.h>
- 
- #else
- 
-diff --git a/meson.build b/meson.build
-index ea3ccff968..c3a2be7b2d 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1712,7 +1712,7 @@ if not get_option('capstone').auto() or have_system or have_user
-   # that reports a wrong -I path, causing the #include to
-   # fail later. If the system has such a broken version
-   # do not use it.
--  if capstone.found() and not cc.compiles('#include <capstone.h>',
-+  if capstone.found() and not cc.compiles('#include <capstone/capstone.h>',
-                                           dependencies: [capstone])
-     capstone = not_found
-     if get_option('capstone').enabled()
--- 
-2.43.2
-
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
index a76a8cce20..a5d4038377 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -315,6 +315,8 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.3.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
index c846c2c1cc..b2853795f0 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.9.ebuild
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -241,7 +241,7 @@ SOFTMMU_TOOLS_DEPEND="
 "
 
 EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
+SEABIOS_VERSION="1.16.3"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
@@ -320,6 +320,8 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.4.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3.ebuild
index c26e1853f6..132cd09361 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3.ebuild
@@ -84,7 +84,6 @@ COMMON_TARGETS="
 	mips64
 	mips64el
 	mipsel
-	nios2
 	or1k
 	ppc
 	ppc64
@@ -318,12 +317,12 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-9.0.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-9.1.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
-
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
new file mode 100644
index 0000000000..dbf0d977e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.2.ebuild
@@ -0,0 +1,995 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-text/asciidoc/asciidoc-10.2.1.ebuild b/sdk_container/src/third_party/portage-stable/app-text/asciidoc/asciidoc-10.2.1.ebuild
index 05447dff31..221a78ed97 100644
--- a/sdk_container/src/third_party/portage-stable/app-text/asciidoc/asciidoc-10.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-text/asciidoc/asciidoc-10.2.1.ebuild
@@ -1,11 +1,11 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_SINGLE_IMPL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 inherit distutils-r1 optfeature readme.gentoo-r1
 
 DESCRIPTION="A plain text human readable/writable document format"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild
index 12f7549746..ac6f9937d6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -35,7 +35,7 @@ else
 				mirror://gnu/${PN}/${P}.tar.xz.sig
 			)
 		"
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild
new file mode 100644
index 0000000000..add36e6de7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/automake-1.17-r2.ebuild
@@ -0,0 +1,153 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Bumping notes:
+# * Remember to modify LAST_KNOWN_AUTOMAKE_VER 'upstream' in dev-build/automake-wrapper
+# on new automake (major) releases, as well as the dependency in RDEPEND below too.
+# * Update _WANT_AUTOMAKE and _automake_atom case statement in autotools.eclass.
+
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit python-any-r1 verify-sig
+
+MANGLED_SLOT=${PV:0:4}
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_MIN_CLONE_TYPE=single
+	EGIT_REPO_URI="https://git.savannah.gnu.org/r/${PN}.git"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jimmeyering.asc
+	if [[ $(ver_cut 3) -ge 90 ]] ; then
+		MANGLED_SLOT=$(ver_cut 1).$(($(ver_cut 2) + 1))
+		SRC_URI="
+			https://alpha.gnu.org/pub/gnu/${PN}/${P}.tar.xz
+			verify-sig? (
+				https://alpha.gnu.org/pub/gnu/${PN}/${P}.tar.xz.sig
+			)
+		"
+	else
+		SRC_URI="
+			mirror://gnu/${PN}/${P}.tar.xz
+			verify-sig? (
+				mirror://gnu/${PN}/${P}.tar.xz.sig
+			)
+		"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Used to generate Makefile.in from Makefile.am"
+HOMEPAGE="https://www.gnu.org/software/automake/"
+
+LICENSE="GPL-2"
+# Use Gentoo versioning for slotting.
+SLOT="${MANGLED_SLOT}"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-lang/perl-5.6
+	>=dev-build/automake-wrapper-20240607
+	>=dev-build/autoconf-2.69:*
+	sys-devel/gnuconfig
+"
+BDEPEND="
+	app-alternatives/gzip
+	sys-apps/help2man
+	dev-build/autoconf-wrapper
+	dev-build/autoconf
+	test? (
+		${PYTHON_DEPS}
+		dev-util/dejagnu
+		sys-devel/bison
+		sys-devel/flex
+	)
+	verify-sig? ( sec-keys/openpgp-keys-jimmeyering )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-perl-5.41.patch
+	"${FILESDIR}"/${P}-perl-no-werror.patch
+)
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	export WANT_AUTOCONF=2.5
+	# Don't try wrapping the autotools - this thing runs as it tends
+	# to be a bit esoteric, and the script does `set -e` itself.
+	./bootstrap || die
+	sed -i -e "/APIVERSION=/s:=.*:=${SLOT}:" configure || die
+
+	# bug #628912
+	if ! has_version -b sys-apps/texinfo ; then
+		touch doc/{stamp-vti,version.texi,automake.info} || die
+	fi
+}
+
+src_configure() {
+	# Also used in install.
+	infopath="${EPREFIX}/usr/share/automake-${PV}/info"
+	econf --infodir="${infopath}"
+}
+
+src_test() {
+	# Fails with byacc/flex
+	emake YACC="bison -y" LEX="flex" check
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/share/aclocal/README || die
+	rmdir "${ED}"/usr/share/aclocal || die
+	rm \
+		"${ED}"/usr/bin/{aclocal,automake} \
+		"${ED}"/usr/share/man/man1/{aclocal,automake}.1 || die
+
+	# remove all config.guess and config.sub files replacing them
+	# w/a symlink to a specific gnuconfig version
+	local x
+	for x in guess sub ; do
+		dosym ../gnuconfig/config.${x} \
+			/usr/share/${PN}-${SLOT}/config.${x}
+	done
+
+	# Avoid QA message about pre-compressed file in docs
+	local tarfile="${ED}/usr/share/doc/${PF}/amhello-1.0.tar.gz"
+	if [[ -f "${tarfile}" ]] ; then
+		gunzip "${tarfile}" || die
+	fi
+
+	pushd "${D}/${infopath}" >/dev/null || die
+	for f in *.info*; do
+		# Install convenience aliases for versioned Automake pages.
+		ln -s "$f" "${f/./-${PV}.}" || die
+	done
+	popd >/dev/null || die
+
+	if [[ ${PV} == 9999 ]]; then
+		local major="89"
+		local minor="999"
+	else
+		local major="$(ver_cut 1)"
+		if [[ $(ver_cut 3) -ge 90 ]] ; then
+			local minor=$(($(ver_cut 2) + 1))
+		else
+			local minor="$(ver_cut 2)"
+		fi
+	fi
+	local idx="$((99999-(major*1000+minor)))"
+	newenvd - "06automake${idx}" <<-EOF
+	INFOPATH="${infopath}"
+	EOF
+
+	docompress "${infopath}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-5.16.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-5.16.patch
index 19fe249e0c..b35fb39a3f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-5.16.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-5.16.patch
@@ -17,14 +17,6 @@ instead of "&func(ARGS...)").
 * THANKS, NEWS: Update.
 
 Signed-off-by: Stefano Lattarini <stefano.lattarini@gmail.com>
----
- NEWS       |  4 ++++
- THANKS     |  1 +
- aclocal.in | 42 ++++++++++++++++++++++++++++++++++--------
- 3 files changed, 39 insertions(+), 8 deletions(-)
-
-diff --git a/aclocal.in b/aclocal.in
-index dfb851b..e8855d5 100644
 --- a/aclocal.in
 +++ b/aclocal.in
 @@ -152,8 +152,34 @@ my $erase_me;
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-escape-curly-bracket-r1.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-escape-curly-bracket-r1.patch
index bf8819adcf..4bd7ab16fb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-escape-curly-bracket-r1.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.11.6-perl-escape-curly-bracket-r1.patch
@@ -15,12 +15,6 @@ https://bugzilla.redhat.com/1239379
 
 * bin/automake.in (substitute_ac_subst_variables): Escape the
 occurrence of '{' character.
----
- bin/automake.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/automake.in b/bin/automake.in
-index 0c29184..c294ced 100644
 --- a/automake.in
 +++ b/automake.in
 @@ -3898,7 +3898,7 @@ sub substitute_ac_subst_variables_worker
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-5.41.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-5.41.patch
new file mode 100644
index 0000000000..425ce723e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-5.41.patch
@@ -0,0 +1,25 @@
+https://git.savannah.gnu.org/cgit/automake.git/commit/?id=b5403ee7a035872a21135c2ee4871a6c284c91dd
+
+From b5403ee7a035872a21135c2ee4871a6c284c91dd Mon Sep 17 00:00:00 2001
+From: Collin Funk <collin.funk1@gmail.com>
+Date: Thu, 30 Jan 2025 15:34:52 -0800
+Subject: automake: avoid precedence error when using Perl 5.41+.
+
+Reported by Igor Todorovski <itodorov@ca.ibm.com> in
+<https://lists.gnu.org/archive/html/automake/2025-01/msg00000.html>.
+
+* bin/automake.in (transform): Parentheses the '!' operators so
+Perl 5.41.8 doesn't warn about "possible precedence problem".
+--- a/bin/automake.in
++++ b/bin/automake.in
+@@ -6871,7 +6871,7 @@ sub transform ($\%)
+     {
+       my $neg = ($1 eq '!') ? 1 : 0;
+       my $val = transform_token ($token, %$transform, $2);
+-      return (!!$val == $neg) ? '##%' : '';
++      return ((!!$val) == $neg) ? '##%' : '';
+     }
+   else
+     {
+-- 
+cgit v1.1
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-no-werror.patch b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-no-werror.patch
new file mode 100644
index 0000000000..ff0fb79014
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake/files/automake-1.17-perl-no-werror.patch
@@ -0,0 +1,460 @@
+https://git.savannah.gnu.org/cgit/automake.git/commit/?id=fc1c3f658517be4fe70bdf33bc6cd594d3faa0b2
+
+From fc1c3f658517be4fe70bdf33bc6cd594d3faa0b2 Mon Sep 17 00:00:00 2001
+From: Karl Berry <karl@freefriends.org>
+Date: Fri, 31 Jan 2025 09:20:47 -0800
+Subject: automake: just use warnings, with no => FATAL.
+
+Per Perl recommendation:
+  https://perldoc.perl.org/warnings#Fatal-Warnings
+Suggested by Collin Funk:
+  https://lists.gnu.org/archive/html/automake/2025-01/msg00003.html
+And in the Perl discussion:
+  https://github.com/Perl/perl5/issues/22954#issuecomment-2622966302
+
+* bin/aclocal.in: just use warnings, not making them fatal.
+* bin/automake.in:
+* contrib/tap-driver.pl:
+* gen-testsuite-part:
+* lib/Automake/ChannelDefs.pm:
+* lib/Automake/Channels.pm:
+* lib/Automake/Condition.pm:
+* lib/Automake/Config.in:
+* lib/Automake/Configure_ac.pm:
+* lib/Automake/DisjConditions.pm:
+* lib/Automake/FileUtils.pm:
+* lib/Automake/General.pm:
+* lib/Automake/Getopt.pm:
+* lib/Automake/Item.pm:
+* lib/Automake/ItemDef.pm:
+* lib/Automake/Language.pm:
+* lib/Automake/Location.pm:
+* lib/Automake/Options.pm:
+* lib/Automake/Rule.pm:
+* lib/Automake/RuleDef.pm:
+* lib/Automake/VarDef.pm:
+* lib/Automake/Variable.pm:
+* lib/Automake/Version.pm:
+* lib/Automake/Wrap.pm:
+* lib/Automake/XFile.pm:
+* t/ax/deltree.pl:
+* t/ax/extract-testsuite-summary.pl:
+* t/check-fd-redirect.sh:
+* t/tap-signal.tap:
+* t/tests-environment-fd-redirect.sh:
+* t/testsuite-summary-count-many.sh:
+--- a/bin/aclocal.in
++++ b/bin/aclocal.in
+@@ -19,9 +19,7 @@
+ # Written by Tom Tromey <tromey@redhat.com>, and
+ # Alexandre Duret-Lutz <adl@gnu.org>.
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ BEGIN
+ {
+--- a/bin/automake.in
++++ b/bin/automake.in
+@@ -22,9 +22,7 @@
+ 
+ package Automake;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ BEGIN
+ {
+--- a/contrib/tap-driver.pl
++++ b/contrib/tap-driver.pl
+@@ -27,12 +27,12 @@
+ #  Imports, static data, and setup.  #
+ # ---------------------------------- #
+ 
+-use warnings FATAL => 'all';
+-use strict;
++use strict; use warnings;
+ use Getopt::Long ();
++
+ use TAP::Parser;
+ 
+-my $VERSION = '2013-12-24.15'; # UTC
++my $VERSION = '2024-12-03.03'; # UTC
+ 
+ my $ME = "tap-driver.pl";
+ 
+--- a/gen-testsuite-part
++++ b/gen-testsuite-part
+@@ -20,8 +20,8 @@
+ 
+ #--------------------------------------------------------------------------
+ 
+-use warnings FATAL => "all";
+ use strict;
++use warnings;
+ use File::Basename ();
+ use constant TRUE => 1;
+ use constant FALSE => 0;
+--- a/lib/Automake/ChannelDefs.pm
++++ b/lib/Automake/ChannelDefs.pm
+@@ -49,10 +49,7 @@ shorthand function to output on specific channels.
+ 
+ =cut
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Exporter;
+ 
+ use Automake::Channels;
+--- a/lib/Automake/Channels.pm
++++ b/lib/Automake/Channels.pm
+@@ -66,10 +66,7 @@ etc.) that can also be overridden on a per-message basis.
+ 
+ =cut
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ use File::Basename;
+--- a/lib/Automake/Condition.pm
++++ b/lib/Automake/Condition.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::Condition;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ 
+--- a/lib/Automake/Config.in
++++ b/lib/Automake/Config.in
+@@ -17,9 +17,7 @@
+ 
+ package Automake::Config;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Exporter;
+ 
+--- a/lib/Automake/Configure_ac.pm
++++ b/lib/Automake/Configure_ac.pm
+@@ -20,9 +20,7 @@
+ 
+ package Automake::Configure_ac;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Exporter;
+ 
+--- a/lib/Automake/DisjConditions.pm
++++ b/lib/Automake/DisjConditions.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::DisjConditions;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Carp;
+ use Automake::Condition qw (TRUE FALSE);
+--- a/lib/Automake/FileUtils.pm
++++ b/lib/Automake/FileUtils.pm
+@@ -34,9 +34,7 @@ This perl module provides various general purpose file handling functions.
+ 
+ =cut
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ BEGIN
+ {
+--- a/lib/Automake/General.pm
++++ b/lib/Automake/General.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::General;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Exporter;
+ use File::Basename;
+--- a/lib/Automake/Getopt.pm
++++ b/lib/Automake/Getopt.pm
+@@ -35,9 +35,7 @@ line options in conformance to the GNU Coding standards.
+ 
+ =cut
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Carp qw (confess croak);
+ use Exporter ();
+--- a/lib/Automake/Item.pm
++++ b/lib/Automake/Item.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::Item;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Carp;
+ 
+--- a/lib/Automake/ItemDef.pm
++++ b/lib/Automake/ItemDef.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::ItemDef;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ 
+ =head1 NAME
+--- a/lib/Automake/Language.pm
++++ b/lib/Automake/Language.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::Language;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Class::Struct ();
+ 
+--- a/lib/Automake/Location.pm
++++ b/lib/Automake/Location.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::Location;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ =head1 NAME
+ 
+--- a/lib/Automake/Options.pm
++++ b/lib/Automake/Options.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::Options;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Exporter;
+ 
+ use Automake::Config;
+--- a/lib/Automake/Rule.pm
++++ b/lib/Automake/Rule.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::Rule;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ 
+--- a/lib/Automake/RuleDef.pm
++++ b/lib/Automake/RuleDef.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::RuleDef;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ 
+--- a/lib/Automake/VarDef.pm
++++ b/lib/Automake/VarDef.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::VarDef;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ 
+--- a/lib/Automake/Variable.pm
++++ b/lib/Automake/Variable.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::Variable;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Carp;
+ use Exporter;
+ 
+--- a/lib/Automake/Version.pm
++++ b/lib/Automake/Version.pm
+@@ -15,9 +15,7 @@
+ 
+ package Automake::Version;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
++use 5.006; use strict; use warnings;
+ 
+ use Automake::ChannelDefs;
+ 
+--- a/lib/Automake/Wrap.pm
++++ b/lib/Automake/Wrap.pm
+@@ -15,10 +15,7 @@
+ 
+ package Automake::Wrap;
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Exporter;
+ 
+ our @ISA = qw (Exporter);
+--- a/lib/Automake/XFile.pm
++++ b/lib/Automake/XFile.pm
+@@ -69,10 +69,7 @@ and C<getlines> methods to translate C<\r\n> to C<\n>.
+ 
+ =cut
+ 
+-use 5.006;
+-use strict;
+-use warnings FATAL => 'all';
+-
++use 5.006; use strict; use warnings;
+ use Errno;
+ use Exporter;
+ use IO::File;
+--- a/t/ax/deltree.pl
++++ b/t/ax/deltree.pl
+@@ -17,8 +17,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+-use strict;
+-use warnings FATAL => 'all';
++use strict; use warnings;
+ use File::Path qw/rmtree/;
+ 
+ my $exit_status = 0;
+--- a/t/ax/extract-testsuite-summary.pl
++++ b/t/ax/extract-testsuite-summary.pl
+@@ -17,8 +17,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+-use warnings FATAL => 'all';
+-use strict;
++use strict; use warnings;
+ 
+ my $br = '=' x 76;
+ my @sections = ('');
+--- a/t/check-fd-redirect.sh
++++ b/t/check-fd-redirect.sh
+@@ -81,8 +81,7 @@ do_check
+ 
+ echo "#! $PERL -w" > foo.test
+ cat >> foo.test <<'END'
+-use warnings FATAL => 'all';
+-use strict;
++use strict; use warnings;
+ 
+ open (FD3, "<&=3") or die "opening FD3: $!";
+ open (FD4, ">&=4") or die "opening FD4: $!";
+--- a/t/tap-signal.tap
++++ b/t/tap-signal.tap
+@@ -52,7 +52,7 @@ for sig in $all_signals; do
+     # We need autoflush to avoid losing output, which could cause spurious
+     # "no test plan seen" in the TAP driver.
+     BEGIN { $| = 1 }
+-    use warnings FATAL => "all";
++    use warnings;
+     print "1..1\\n";
+     print "ok 1\\n";
+     kill $sig, \$\$;
+--- a/t/tests-environment-fd-redirect.sh
++++ b/t/tests-environment-fd-redirect.sh
+@@ -44,8 +44,8 @@ END
+ 
+ echo "#! $PERL -w" > bar.test
+ cat >>bar.test <<'END'
+-use warnings FATAL => 'all';
+ use strict;
++use warnings;
+ open(FD8, ">&=8") or die "$!";
+ open(FD9, ">&=9") or die "$!";
+ print FD8 "  $0: 8888\n";
+--- a/t/testsuite-summary-count-many.sh
++++ b/t/testsuite-summary-count-many.sh
+@@ -52,8 +52,8 @@ END
+ chmod a+x all.test
+ 
+ $PERL -w -e '
+-  use warnings FATAL => "all";
+   use strict;
++  use warnings;
+ 
+   my $base = 1000;
+   my %count = (
+-- 
+cgit v1.1
+
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index bb185c875b..ac36fd1546 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -3,9 +3,6 @@ DIST cmake-3.28.5-SHA-256.txt 1646 BLAKE2B 763cbec9ede58cc43a7435e3fe97a9a9f28b2
 DIST cmake-3.28.5-SHA-256.txt.asc 833 BLAKE2B bde735a577b556bc30ae1a5de0df8533243c955cc5d222537b3323e7108900af2f01799a4bfa843d953b141cc76a19aed77bfba15cf4e2c3cc36a0e7e844e853 SHA512 d495afd2ce4e16f8d3ecc0b319d59c3634aae71c26110d14225f9dd628bfe173cdd94818c69c930ef5cfff3b331445e192db0082188e0822155184e3f6f80e7d
 DIST cmake-3.28.5.tar.gz 11076017 BLAKE2B 7da653e42fca4848362a97e80320ffcc85ced4951dfe475f48f1619a40dc674d2828a78df2ef09589868f41f1da86970074186f730e675851cd9e7c1b099ba4c SHA512 d8f1c056e94c835c2078a5e68b23a3918f0e2cc40ef9dacaf5df4f2c26106149d85364c01528fcc2d6a4b6c2182ba420d938c519fa98757a5fc375cf152c7f82
 DIST cmake-3.30.0-docs.tar.xz 572276 BLAKE2B 0c258f8dd0a518bb7bf97d35a778d8e406c986e123fc8acafb174a750ad0883d346254d12e8134dd9d030faefddc13b8260e7b43e405272157ada742c75b5fc2 SHA512 9d534b0efc30829f1144fb32c4f10ba25749e238c8ceeb4399b6d1eb8421b9fb1363972a497757ef84689bb987840619cbb4333ae95fd2397eea07eebed112c1
-DIST cmake-3.30.5-SHA-256.txt 1646 BLAKE2B a91c0663dd11a6f854a4acdc5902b67811a311fd5161dc86140f1a39fb1f3aadce0df348e27569936c6e51def096ab6572635e00ce3d2b7554fadea4a3d4287f SHA512 a5a2285049fae435f53d0dfdfaea9a740d2f6e08dd1b149ab1f0d5e3ddc8afb2c3fac4a8018a7eb24ec90155535362160abe5ca2681808a96d19d191a3aa3713
-DIST cmake-3.30.5-SHA-256.txt.asc 833 BLAKE2B cb7db2d0263d77cbc6798aa916a4584ccc7e7e9724c362c1471cda4b87c53ed1d1cbacf84573768844d16c3356ad32dae4500a6704fc22b8b1e824e2be6a0435 SHA512 fdd31e5b872c3dba1c66dd2ae077721f7054f6df9f261548fce86f9d4d4d403130511c4ce7ce57bcb3501abd87ab506177b513d160592db6e09d70d34e4a24e5
-DIST cmake-3.30.5.tar.gz 11502354 BLAKE2B 47eb5abcd9d634b10053b2052dae11fc85e74f78ca2489d72088eba8ca84ecaf22a248b27a92bf50666b76e8cba40ba9b952d3d76d8e57112d136e26087f5696 SHA512 968ad4769e869378049b1d82ace98db25a6cb234b6362a51737f0d2978b8914ad42967ba112741850b23631e73b8a8876cd4f99dd0285b9da1c2bb5ea4c4ee4e
 DIST cmake-3.30.6-SHA-256.txt 1646 BLAKE2B 370ec5fecb60a7ee6bf36503553a7478b66cfabbd48ea2ab17ae44841b371f5892c33bc9c64388ac84ea07e86f3bee9a82b9dc378ff4624f3a7c5025716b82bf SHA512 6049a237f0904a48c4658352ea0f0fb007bccd30886a1eb9e026ba85d15d892502e2ed6763023c61712e370d68b209f83e7e6c7d236f169603fc85e0f8c286ef
 DIST cmake-3.30.6-SHA-256.txt.asc 833 BLAKE2B 73b841a2eb1d476696506706d95f371e5c46c2b777c012bf1d930f072c242bb431cde282ab371bf62a7845c92ba014270e3599d3c30d8503335ce249aa3ecb5c SHA512 34374445ecb012c4607fcf65fc6719dda16af189c0d2d38898a5cd506fc6c24462437556810c693ca45773cb8824cd0a03445ee07b69e010d1b7c509e32c617d
 DIST cmake-3.30.6.tar.gz 11503061 BLAKE2B a381bea86b7cedb5dfae3598a4a243e74b0b34e78c105fe7ee17343593700c30f1dc42b06cbd872894a043f68e23853e7b1fdc6cb2161584f57e4aa89515e23a SHA512 8349d522ae098d72df625ef44700b672a5f85e7bd6c44ee9c0c3ba3f07561348f715f4d5a6f4a9b0e92bd9984e590473bc684160841f94842b5ee128fcc0bb07
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.5.ebuild
deleted file mode 100644
index 72c321e1fc..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.5.ebuild
+++ /dev/null
@@ -1,293 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
-	toolchain-funcs xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == 9999 ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	gui? (
-		!qt6? (
-			dev-qt/qtcore:5
-			dev-qt/qtgui:5
-			dev-qt/qtwidgets:5
-		)
-		qt6? ( dev-qt/qtbase:6[gui,widgets] )
-	)
-	ncurses? ( sys-libs/ncurses:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	# Cuda
-	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
-
-	# Upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-		# Disable system integration, bug #933744
-		sed -i -e 's/__APPLE__/__DISABLED__/' \
-			Source/cmFindProgramCommand.cxx \
-			Source/CPack/cmCPackGeneratorFactory.cxx || die
-		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
-			Source/cmMachO.cxx || die
-		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
-			Source/CMakeLists.txt || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
-	## handle them as part of bootstrapping, sadly.
-
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-		-DBUILD_QtDialog=$(usex gui)
-	)
-
-	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
-
-	cmake_src_configure
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actualy bootstrap it every time so why test it.
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	local -x QT_QPA_PLATFORM=offscreen
-
-	cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	if use gui; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r100.ebuild
index 816b063046..6c103414ba 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r100.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r100.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -93,7 +93,7 @@ src_compile() {
 }
 
 src_install() {
-	use doc && HTML_DOCS=( doc/make.html/. ) DOCS="$DOCS doc/make.pdf"
+	use doc && HTML_DOCS=( doc/make.html/. ) DOCS="${DOCS} doc/make.pdf"
 	default
 
 	dosym gmake /usr/bin/make
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
index 274fa4a9c4..f23c2c0c37 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -93,7 +93,7 @@ src_compile() {
 }
 
 src_install() {
-	use doc && HTML_DOCS=( doc/make.html/. ) DOCS="$DOCS doc/make.pdf"
+	use doc && HTML_DOCS=( doc/make.html/. ) DOCS="${DOCS} doc/make.pdf"
 	default
 
 	dosym gmake /usr/bin/make
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
index d668b8b551..bec1d446b8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
@@ -33,7 +33,7 @@ else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
index d668b8b551..05aa3dd4f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0.ebuild
index ed6817c726..7cc2500137 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/glog/glog-0.6.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2011-2024 Gentoo Authors
+# Copyright 2011-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -21,7 +21,7 @@ fi
 
 LICENSE="BSD"
 SLOT="0/1"
-KEYWORDS="amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="amd64 ~arm arm64 ~hppa ~loong ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="gflags +libunwind llvm-libunwind test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index 3a300e66af..12e9aee540 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,8 +1,6 @@
 DIST sqlite-doc-3460100.zip 10851427 BLAKE2B 7462e83ca84e3e9aac7236f575fd2bdddac7744ae700a63fe8fdc9d2df3157c59fd374d99a0526bd4d9f742005ee7a90f3d78057861d3c3fcba9f897630e48db SHA512 1ad7dfc938d182f69ea9367b4f5ead1d48b991626521249e8b58c9fb4c2553e348ce402de9cc81b0ad699d4c45c467de56a98ee39f9c3555c6fafff15fba41ce
 DIST sqlite-doc-3470200.zip 10957830 BLAKE2B cbc40dd440d1c5af4ad4333090a7306bd54ec43250a478b6900b8f74bd721035018ea7647f3a208d42cc0639827325be26a9412d17af7d390f4e584d4c6acf44 SHA512 48349d512b7cd9bc6f6a5da3a2b2285de159d4653667311adb0f5e6a970060db940a590c2d01b529afc1614065b22434d5b3ac4d8d0122d003d74926745ba56e
-DIST sqlite-doc-3490000.zip 11327988 BLAKE2B ecabc9b9217953874cc575ef06d93f3ef5da25d82c0837b827daca3ca1da54968d7f3f2498ec7fee22d43fb2a2bcc2077be396dfc5f6e4ee62e1493d7be20e9e SHA512 89823a426aba9db78597f99df6fe2162601d0133d7490c83c939414372c293e9f313bd2e46c5e5d4b19dd3846337f53eb788208c91a1fa7ffc768a0a5966da03
 DIST sqlite-doc-3490100.zip 11333315 BLAKE2B 28fe302820898861e404f5c6dd1c05c3ff3ff10a8b713604f0ccec6b21ca7b82d61ba720903d7e9d8e9ec5de701900c5972037c23627ddd1a2734e95a92c5d6a SHA512 0eb6af0483bca7f6efd6baf00210adcca1d23ea5b474728aa96614a93a868ec6f9257d9b5f29c452fed5323c64fc180ee3845695ddbbcd7836dac69aecdfc833
 DIST sqlite-src-3460100.zip 14276926 BLAKE2B df16ea944e317df8ed64fdfab289e3699ec71725ce55e2b30450adaeb41c061b4fba1eb8c41ba638b0edcd12b23264a1f9e413b69fd593c2b65fb1037d3fc8b2 SHA512 6d32a0db9f95d3cec34f02f3fd45b453bf7c422d4d4d9570790f641e7d190b8b31be8e8715afacc1b6e4417f15a4d15a0b28e608ae0b4b5f3054b075783b916e
 DIST sqlite-src-3470200.zip 14421983 BLAKE2B dcaea5be0099b2dad1b53403933f0037ace48b1f248040c1b5cc116ac2ad6c9b44c71b8efe3afd16bef01119b440d1a2ec9d553a22f855e0ba55793684f53d8d SHA512 a6280a02304bfae173d9e9ebf376b2d3624658f04af4d8e95d5a042e24cf0405a47c0a4023f4dbc2790716cd85e16b97fcc0a83c1534e6d554f4eb0bfb0a3ed3
-DIST sqlite-src-3490000.zip 14371111 BLAKE2B 895d8869b3bc0abeb5faf8cdd0de29e0d86f44fa6eafb154e0df4373161fe79c5e35d360100064778f0a3f57a232e15dc8ec73ef5e75d23a4c8ffc880d2c571d SHA512 a414c544ca4288ab475c449327b3e2136e9d01145fc8b9c723ccfd30e356cc90411ca74ae969f3fe4c8212cad4d0969b2f3a72922ee073049c25e4984336eb7c
 DIST sqlite-src-3490100.zip 14372402 BLAKE2B c7f6a574698512e2fde44e54ed2a101e7307821b0015287bbf5ab151f5f59432fe051fda1d1caec865928717f51c42f1161187fb768180088574ca225cd29250 SHA512 24c81cee52e5655f4e9d6496a366e4787352b5108ea27eb5ce3dc07ef3e1975205bb250584b0758fb2832add84ca922b09a4d925e0dc2f55dd3613a58b414ec3
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.0-cppflags.patch b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.0-cppflags.patch
deleted file mode 100644
index 13c6eafc39..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.0-cppflags.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 3e06f2d79b15754999892a4ded6a7585520294a6 Mon Sep 17 00:00:00 2001
-From: stephan <stephan@noemail.net>
-Date: Sun, 9 Feb 2025 01:25:00 +0000
-Subject: [PATCH] configure: when transfering ENABLE/OMIT flags from CFLAGS to
- OPT_FEATURE_FLAGS, also do the same for CPPFLAGS and remove those ENABLE/OMIT
- flags from CFLAGS/CPPFLAGS to mimic legacy build behavior. Strip ENABLE/OMIT
- flags from BUILD_CFLAGS but do not transfer those to OPT_FEATURE_FLAGS, also
- to mimic legacy behavior. This is the second part of a fix discussed at
- [forum:9801e54665afd728|forum post 9801e54665afd728].
-
-FossilOrigin-Name: 16d307cc6c1e203900e7a2dc0730fc0e453946622a2114a07d64ebb99045cfbf
----
- autosetup/sqlite-config.tcl | 36 ++++++++++++++++++++++++++++++------
- manifest                    | 14 +++++++-------
- manifest.uuid               |  2 +-
- 3 files changed, 38 insertions(+), 14 deletions(-)
-
-diff --git a/autosetup/sqlite-config.tcl b/autosetup/sqlite-config.tcl
-index cabb32aac0..2a73548662 100644
---- a/autosetup/sqlite-config.tcl
-+++ b/autosetup/sqlite-config.tcl
-@@ -230,23 +230,47 @@ proc sqlite-setup-default-cflags {} {
-   # BUILD_CFLAGS is the CFLAGS for CC_FOR_BUILD.
-   define BUILD_CFLAGS [proj-get-env BUILD_CFLAGS {-g}]
- 
--  # Copy all CFLAGS entries matching -DSQLITE_OMIT* and
-+  # Copy all CFLAGS and CPPFLAGS entries matching -DSQLITE_OMIT* and
-   # -DSQLITE_ENABLE* to OPT_FEATURE_FLAGS. This behavior is derived
-   # from the legacy build and was missing the 3.48.0 release (the
-   # initial Autosetup port).
-   # https://sqlite.org/forum/forumpost/9801e54665afd728
-   #
-+  # Handling of CPPFLAGS, as well as removing ENABLE/OMIT from
-+  # CFLAGS/CPPFLAGS, was missing in the 3.49.0 release as well.
-+  #
-   # If any configure flags for features are in conflict with
--  # CFLAGS-specified feature flags, all bets are off.  There are no
--  # guarantees about which one will take precedence.
--  foreach cf [get-define CFLAGS ""] {
-+  # CFLAGS/CPPFLAGS-specified feature flags, all bets are off.  There
-+  # are no guarantees about which one will take precedence.
-+  foreach flagDef {CFLAGS CPPFLAGS} {
-+    set tmp ""
-+    foreach cf [get-define $flagDef ""] {
-+      switch -glob -- $cf {
-+        -DSQLITE_OMIT* -
-+        -DSQLITE_ENABLE* {
-+          sqlite-add-feature-flag $cf
-+        }
-+        default {
-+          lappend tmp $cf
-+        }
-+      }
-+    }
-+    define $flagDef $tmp
-+  }
-+
-+  # Strip all SQLITE_ENABLE/OMIT flags from BUILD_CFLAGS,
-+  # for compatibility with the legacy build.
-+  set tmp ""
-+  foreach cf [get-define BUILD_CFLAGS ""] {
-     switch -glob -- $cf {
-       -DSQLITE_OMIT* -
--      -DSQLITE_ENABLE* {
--        sqlite-add-feature-flag $cf
-+      -DSQLITE_ENABLE* {}
-+      default {
-+        lappend tmp $cf
-       }
-     }
-   }
-+  define BUILD_CFLAGS $tmp
- }
- 
- ########################################################################
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.1-jimsh.patch b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.1-jimsh.patch
index 68203390c7..8f7f082a6d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.1-jimsh.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/files/sqlite-3.49.1-jimsh.patch
@@ -1,14 +1,27 @@
 # https://bugs.gentoo.org/949981
-# https://github.com/msteveb/jimtcl/commit/9b754b8033b9f2a1dc8ba1227df2e5d75185dda7
+# https://www2.sqlite.org/src/info/ffd05de8a3b7cab1
+From 09591b78ae28c6bb385ae96fef44edfb52454830 Mon Sep 17 00:00:00 2001
+From: stephan <stephan@noemail.net>
+Date: Mon, 24 Feb 2025 04:47:34 +0000
+Subject: [PATCH] Update jimsh0.c from upstream autosetup to address
+ [https://github.com/msteveb/autosetup/issues/75|autosetup ticket #75],
+ triggered by this build in the Gentoo project.
+
+FossilOrigin-Name: ffd05de8a3b7cab1b8e91b99da74b43ec5a7b91c78dcfd7cf338b66126e30a56
+---
+ autosetup/jimsh0.c | 20 ++++++++------------
+ manifest           | 12 ++++++------
+ manifest.uuid      |  2 +-
+ 3 files changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/autosetup/jimsh0.c b/autosetup/jimsh0.c
+index 0526b9a446..1a6453d0c8 100644
 --- a/autosetup/jimsh0.c
 +++ b/autosetup/jimsh0.c
-@@ -2088,9 +2088,13 @@ enum wbuftype {
- #define UNIX_SOCKETS 0
+@@ -1252,6 +1252,14 @@ int Jim_OpenForRead(const char *filename);
+ 
  #endif
  
--#ifndef MAXPATHLEN
--#define MAXPATHLEN JIM_PATH_LEN
--#endif
 +# ifndef MAXPATHLEN
 +# ifdef PATH_MAX
 +# define MAXPATHLEN PATH_MAX
@@ -16,6 +29,18 @@
 +# define MAXPATHLEN JIM_PATH_LEN
 +# endif
 +# endif
++
+ 
+ int Jim_FileStoreStatData(Jim_Interp *interp, Jim_Obj *varName, const jim_stat_t *sb);
+ 
+@@ -2088,10 +2096,6 @@ enum wbuftype {
+ #define UNIX_SOCKETS 0
+ #endif
+ 
+-#ifndef MAXPATHLEN
+-#define MAXPATHLEN JIM_PATH_LEN
+-#endif
+-
  
  
  
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.0.ebuild
deleted file mode 100644
index 12a1086d07..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.0.ebuild
+++ /dev/null
@@ -1,434 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic multilib-minimal toolchain-funcs
-
-DESCRIPTION="SQL database engine"
-HOMEPAGE="https://sqlite.org/"
-
-# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
-# for hints regarding test failures, backports, etc.
-if [[ ${PV} == 9999 ]]; then
-	S="${WORKDIR}"/${PN}
-	PROPERTIES="live"
-else
-	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
-	DOC_PV="${SRC_PV}"
-	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
-
-	SRC_URI="
-		https://sqlite.org/2025/${PN}-src-${SRC_PV}.zip
-		doc? ( https://sqlite.org/2025/${PN}-doc-${DOC_PV}.zip )
-	"
-	S="${WORKDIR}/${PN}-src-${SRC_PV}"
-
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="public-domain"
-SLOT="3"
-IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	sys-libs/zlib:=[${MULTILIB_USEDEP}]
-	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
-	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
-	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
-	tools? ( dev-lang/tcl:= )
-"
-DEPEND="
-	${RDEPEND}
-	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
-"
-if [[ ${PV} == 9999 ]]; then
-	BDEPEND+=" dev-vcs/fossil"
-else
-	BDEPEND+=" app-arch/unzip"
-fi
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
-	# https://sqlite.org/forum/forumpost/3c2014fea4
-	"${FILESDIR}"/${PN}-3.49.0-cppflags.patch
-	# https://sqlite.org/forum/forumpost/f93323a743
-	"${FILESDIR}"/${PN}-3.49.0-icu-tests.patch
-)
-
-_fossil_fetch() {
-	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
-	local repo_id="${1}"
-	local repo_uri="${2}"
-
-	local -x FOSSIL_HOME="${HOME}"
-
-	mkdir -p "${T}/fossil/${repo_id}" || die
-	pushd "${T}/fossil/${repo_id}" > /dev/null || die
-
-	if [[ -n "${EVCS_OFFLINE}" ]]; then
-		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
-			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
-		fi
-	else
-		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
-			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
-			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
-			echo
-		else
-			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
-			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
-			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
-			echo
-		fi
-
-		(
-			addwrite "${distdir}"
-			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
-			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
-		)
-	fi
-
-	popd > /dev/null || die
-}
-
-_fossil_checkout() {
-	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
-	local repo_id="${1}"
-	local branch_or_commit="${2}"
-	local target_directory="${3}"
-
-	local -x FOSSIL_HOME="${HOME}"
-
-	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
-		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
-	fi
-
-	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
-		mkdir -p "${T}/fossil/${repo_id}" || die
-		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
-	fi
-
-	mkdir "${target_directory}" || die
-	pushd "${target_directory}" > /dev/null || die
-
-	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
-	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
-	echo
-
-	popd > /dev/null || die
-}
-
-fossil_fetch() {
-	local repo_id="${1}"
-	local repo_uri="${2}"
-	local target_directory="${3}"
-
-	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
-
-	_fossil_fetch "${repo_id}" "${repo_uri}"
-	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]]; then
-		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
-		if use doc; then
-			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
-		fi
-	else
-		default
-	fi
-}
-
-src_prepare() {
-	default
-
-	multilib_copy_sources
-}
-
-multilib_src_configure() {
-	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
-	local options=()
-
-	options+=(
-		--enable-load-extension
-		--enable-threadsafe
-	)
-
-	# Support detection of misuse of SQLite API.
-	# https://sqlite.org/compile.html#enable_api_armor
-	append-cppflags -DSQLITE_ENABLE_API_ARMOR
-
-	# Support bytecode and tables_used virtual tables.
-	# https://sqlite.org/compile.html#enable_bytecode_vtab
-	# https://sqlite.org/bytecodevtab.html
-	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
-
-	# Support column metadata functions.
-	# https://sqlite.org/compile.html#enable_column_metadata
-	# https://sqlite.org/c3ref/column_database_name.html
-	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
-
-	# Support sqlite_dbpage virtual table.
-	# https://sqlite.org/compile.html#enable_dbpage_vtab
-	# https://sqlite.org/dbpage.html
-	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
-
-	# Support dbstat virtual table.
-	# https://sqlite.org/compile.html#enable_dbstat_vtab
-	# https://sqlite.org/dbstat.html
-	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
-
-	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
-	# https://sqlite.org/compile.html#enable_deserialize
-	# https://sqlite.org/c3ref/serialize.html
-	# https://sqlite.org/c3ref/deserialize.html
-	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
-
-	# Support comments in output of EXPLAIN.
-	# https://sqlite.org/compile.html#enable_explain_comments
-	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
-
-	# Support Full-Text Search versions 3, 4 and 5.
-	# https://sqlite.org/compile.html#enable_fts3
-	# https://sqlite.org/compile.html#enable_fts3_parenthesis
-	# https://sqlite.org/compile.html#enable_fts4
-	# https://sqlite.org/compile.html#enable_fts5
-	# https://sqlite.org/fts3.html
-	# https://sqlite.org/fts5.html
-	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS
-	options+=( --enable-fts4 )
-	options+=( --enable-fts5 )
-
-	# Support hidden columns.
-	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
-
-	# Support memsys5 memory allocator.
-	# https://sqlite.org/compile.html#enable_memsys5
-	# https://sqlite.org/malloc.html#memsys5
-	options+=( --enable-memsys5 )
-
-	# Support sqlite3_normalized_sql() function.
-	# https://sqlite.org/c3ref/expanded_sql.html
-	append-cppflags -DSQLITE_ENABLE_NORMALIZE
-
-	# Support sqlite_offset() function.
-	# https://sqlite.org/compile.html#enable_offset_sql_func
-	# https://sqlite.org/lang_corefunc.html#sqlite_offset
-	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
-
-	# Support pre-update hook functions.
-	# https://sqlite.org/compile.html#enable_preupdate_hook
-	# https://sqlite.org/c3ref/preupdate_count.html
-	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
-
-	# Support Resumable Bulk Update extension.
-	# https://sqlite.org/compile.html#enable_rbu
-	# https://sqlite.org/rbu.html
-	append-cppflags -DSQLITE_ENABLE_RBU
-
-	# Support R*Trees.
-	# https://sqlite.org/compile.html#enable_rtree
-	# https://sqlite.org/compile.html#enable_geopoly
-	# https://sqlite.org/rtree.html
-	# https://sqlite.org/geopoly.html
-	options+=( --enable-rtree --enable-geopoly )
-
-	# Support Session extension.
-	# https://sqlite.org/compile.html#enable_session
-	# https://sqlite.org/sessionintro.html
-	options+=( --enable-session )
-
-	# Support scan status functions.
-	# https://sqlite.org/compile.html#enable_stmt_scanstatus
-	# https://sqlite.org/c3ref/stmt_scanstatus.html
-	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
-	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
-
-	# Support sqlite_stmt virtual table.
-	# https://sqlite.org/compile.html#enable_stmtvtab
-	# https://sqlite.org/stmt.html
-	append-cppflags -DSQLITE_ENABLE_STMTVTAB
-
-	# Support unknown() function.
-	# https://sqlite.org/compile.html#enable_unknown_sql_function
-	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
-
-	# Support unlock notification.
-	# https://sqlite.org/compile.html#enable_unlock_notify
-	# https://sqlite.org/c3ref/unlock_notify.html
-	# https://sqlite.org/unlock_notify.html
-	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
-
-	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
-	# https://sqlite.org/compile.html#enable_update_delete_limit
-	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
-	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
-	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
-
-	# Support soundex() function.
-	# https://sqlite.org/compile.html#soundex
-	# https://sqlite.org/lang_corefunc.html#soundex
-	append-cppflags -DSQLITE_SOUNDEX
-
-	# Support URI filenames.
-	# https://sqlite.org/compile.html#use_uri
-	# https://sqlite.org/uri.html
-	append-cppflags -DSQLITE_USE_URI
-
-	options+=( $(use_enable debug) )
-
-	if use icu; then
-		# Support ICU extension.
-		# https://sqlite.org/compile.html#enable_icu
-		options+=( --with-icu-config )
-	fi
-
-	options+=(
-		--disable-editline
-		$(use_enable readline)
-	)
-
-	if use readline; then
-		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
-	fi
-
-	if use secure-delete; then
-		# Enable secure_delete pragma by default.
-		# https://sqlite.org/compile.html#secure_delete
-		# https://sqlite.org/pragma.html#pragma_secure_delete
-		append-cppflags -DSQLITE_SECURE_DELETE
-	fi
-
-	options+=( $(use_enable static-libs static) )
-
-	# tcl, test, tools USE flags.
-	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
-		options+=(
-			--enable-tcl
-			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
-		)
-	else
-		options+=( --disable-tcl )
-	fi
-
-	if [[ "${ABI}" == "x86" ]]; then
-		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
-			append-cflags -mfpmath=sse
-		else
-			append-cflags -ffloat-store
-		fi
-	fi
-
-	# set SONAME for the library
-	options+=( --soname=legacy )
-
-	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
-	tc-export_build_env BUILD_CC
-
-	CC_FOR_BUILD=${BUILD_CC} econf "${options[@]}"
-}
-
-multilib_src_compile() {
-	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
-
-	if use tools && multilib_is_native_abi; then
-		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
-	fi
-
-	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
-		emake tclsqlite3.c
-
-		local build_directory="$(pwd)"
-		build_directory="${build_directory##*/}"
-
-		mkdir "${WORKDIR}/${PN}-doc-build" || die
-		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
-
-		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
-		rmdir doc/matrix{/*,} || die
-
-		popd > /dev/null || die
-	fi
-}
-
-multilib_src_test() {
-	if [[ "${EUID}" -eq 0 ]]; then
-		ewarn "Skipping tests due to root permissions"
-		return
-	fi
-
-	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
-
-	# e_uri.test tries to open files in /.
-	# bug #839798
-	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
-	addpredict "/test.db"
-	addpredict "/ÿ.db"
-
-	emake -Onone $(usex debug 'fulltest' 'test')
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
-
-	if use tools && multilib_is_native_abi; then
-		install_tool() {
-			if [[ -f ".libs/${1}" ]]; then
-				newbin ".libs/${1}" "${2}"
-			else
-				newbin "${1}" "${2}"
-			fi
-		}
-
-		install_tool changeset sqlite3-changeset
-		install_tool dbdump sqlite3-db-dump
-		install_tool dbhash sqlite3-db-hash
-		install_tool dbtotxt sqlite3-db-to-txt
-		install_tool index_usage sqlite3-index-usage
-		install_tool rbu sqlite3-rbu
-		install_tool scrub sqlite3-scrub
-		install_tool showdb sqlite3-show-db
-		install_tool showjournal sqlite3-show-journal
-		install_tool showshm sqlite3-show-shm
-		install_tool showstat4 sqlite3-show-stat4
-		install_tool showwal sqlite3-show-wal
-		install_tool sqldiff sqlite3-diff
-		install_tool sqlite3_analyzer sqlite3-analyzer
-		install_tool sqlite3_checker sqlite3-checker
-		install_tool sqlite3_expert sqlite3-expert
-		install_tool sqltclsh sqlite3-tclsh
-
-		unset -f install_tool
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -name "*.la" -delete || die
-
-	doman sqlite3.1
-
-	if use doc; then
-		if [[ ${PV} == 9999 ]]; then
-			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
-		else
-			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
-		fi
-
-		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
-		if [[ ${PV} != 9999 ]]; then
-			rm search search.d/admin || die
-			rmdir search.d || die
-			find -name "*~" -delete || die
-		fi
-
-		(
-			docinto html
-			dodoc -r *
-		)
-
-		popd > /dev/null || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
index ce81dc0b27..25ab0c8a1d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit flag-o-matic multilib-minimal toolchain-funcs
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
 
 DESCRIPTION="SQL database engine"
 HOMEPAGE="https://sqlite.org/"
@@ -53,7 +53,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.47.2-hwtime.h-Don-t-use-rdtsc-on-i486.patch
 	# https://sqlite.org/forum/forumpost/f93323a743
 	"${FILESDIR}"/${PN}-3.49.0-icu-tests.patch
-	# https://bugs.gentoo.org/949981
+	# https://bugs.gentoo.org/949981, https://www2.sqlite.org/src/info/ffd05de8a3b7cab1
 	"${FILESDIR}"/${PN}-3.49.1-jimsh.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
index 2b47259e17..2d4ae2f992 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit flag-o-matic multilib-minimal toolchain-funcs
+inherit flag-o-matic multilib multilib-minimal toolchain-funcs
 
 DESCRIPTION="SQL database engine"
 HOMEPAGE="https://sqlite.org/"
@@ -318,8 +318,10 @@ multilib_src_configure() {
 		fi
 	fi
 
-	# set SONAME for the library
-	options+=( --soname=legacy )
+	if [[ ${CHOST} != *-darwin* ]] ; then
+		# set SONAME for the library
+		options+=( --soname=legacy )
+	fi
 
 	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
 	tc-export_build_env BUILD_CC
@@ -370,6 +372,15 @@ multilib_src_test() {
 multilib_src_install() {
 	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
 
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name, soname=legacy doesn't work for this (but
+		# breaks the build instead)
+		install_name_tool \
+			-id "${EPREFIX}/usr/$(get_libdir)/libsqlite3$(get_libname 0)" \
+			"${ED}/usr/$(get_libdir)/libsqlite3$(get_libname ${PV})" \
+			|| die "failed to fix install_name"
+	fi
+
 	if use tools && multilib_is_native_abi; then
 		install_tool() {
 			if [[ -f ".libs/${1}" ]]; then
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index 79f26d9c18..2691a0ab08 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,5 +1,3 @@
-DIST go1.22.11.src.tar.gz 27565913 BLAKE2B d4b8f746846f0ba45307ecf732e035c2628483d59402f0868bc42a2fd1ae3447f61d9c3a6eacbc28b1f25e0b35b99ccf8831baeba4203601810b09267d8743f6 SHA512 40c133d6008df7c7cc3bb95a41c29f7442a6af2dd78b807007daf732471c88e2c641aed32878414d57be3904e5efa580d2ecd13fff5412ee668e753e50f1356e
-DIST go1.22.12.src.tar.gz 27566409 BLAKE2B ea8ce4abd7d6548aef14c0803a07b4beba8728f40f96db5feb6eb4b48fce5866fbccd0b2d1e670dafd2e58e6ec814ef6f83a16ed6b6214be76597748bf87ec9d SHA512 de498f72c398c5587abb6e6943a21b1b9835fde16dbda4d64a1ad847f5b2399ed289fe327255dcde104ad9e7f3fd6c520ddb13ee1900ba5d5c45aa5e1c1e30c8
 DIST go1.23.5.src.tar.gz 28179014 BLAKE2B 6fe6101054a0c10ce415aea65367a48ef8397c88d66bad01b7c72107a6c60daf0b9a47f7c1cd6c8da9855ab04309f25941cc867e6a9f90ac51d1ab0c54662313 SHA512 b04317afeab2d0ced7c36b8682dd32ac085d95d874cf3f614daa34859d7f7f2b75138132e7a64e237c6b4d711d5b03a4d20533f92a44840915630f4ea7cfafa2
 DIST go1.23.6.src.tar.gz 28179132 BLAKE2B 25c988547604c35de65aedfdee5af9f35f7a1c43f634c0147373d9c86baf2bb10068463f70013ef60acd3088149eb16502958b1ca63d7cee310e32eaddf1578a SHA512 c504476d42cdbcd1b6afe53c0974e82c19eb0efac974bc06d41c1641440676891cfe6416455a0cfc81fe82902a9b82ea0a1d95089c676667d05487e45f5e04e3
 DIST go1.24.0.src.tar.gz 30663922 BLAKE2B 1a74d268ad2bcfd4773eb9d24f0618491680a5347edba60606b3f50144e2d8879509b2640046e5fa535ff126958deb49c4224443210e3bd79523e65208b616e3 SHA512 36ba9a3a541208fd33aa49b969d892578e209570541d2b6ca6ff784250d8b6777597d347b823c6026acf0c2741b4abc9012693004e623a1434b06cfecdbebaa8
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.11-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.11-r1.ebuild
deleted file mode 100644
index c9c7981b3a..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.11-r1.ebuild
+++ /dev/null
@@ -1,166 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.20.14
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	export GOROOT_FINAL="${EPREFIX}"/usr/lib/go
-	export GOROOT="${PWD}"
-	export GOBIN="${GOROOT}/bin"
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-
-	cd src
-
-	# https://github.com/golang/go/issues/42005
-	rm cmd/link/internal/ld/fallocate_test.go || die
-
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-	cd ..
-	rm -fr pkg/*_race || die
-	rm -fr pkg/obj/go-build || die
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
-	einstalldocs
-
-	insinto /usr/lib/go
-	doins go.env VERSION*
-
-	# testdata directories are not needed on the installed system
-	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-
-	# install the @golang-rebuild set for Portage
-	insinto /usr/share/portage/config/sets
-	newins "${FILESDIR}"/go-sets.conf go.conf
-}
-
-pkg_postinst() {
-	[[ -z ${REPLACING_VERSIONS} ]] && return
-	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
-	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
-	elog "due to the static linking nature of go."
-	elog "If this is not done, the packages compiled with the older"
-	elog "version of the compiler will not be updated until they are"
-	elog "updated individually, which could mean they will have"
-	elog "vulnerabilities."
-	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
-	elog "See https://bugs.gentoo.org/752153 for more info"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.12.ebuild
deleted file mode 100644
index 9ea7cd6c0f..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.22.12.ebuild
+++ /dev/null
@@ -1,166 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.20.14
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-		KEYWORDS="-* amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	export GOROOT_FINAL="${EPREFIX}"/usr/lib/go
-	export GOROOT="${PWD}"
-	export GOBIN="${GOROOT}/bin"
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-
-	cd src
-
-	# https://github.com/golang/go/issues/42005
-	rm cmd/link/internal/ld/fallocate_test.go || die
-
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-	cd ..
-	rm -fr pkg/*_race || die
-	rm -fr pkg/obj/go-build || die
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
-	einstalldocs
-
-	insinto /usr/lib/go
-	doins go.env VERSION*
-
-	# testdata directories are not needed on the installed system
-	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-
-	# install the @golang-rebuild set for Portage
-	insinto /usr/share/portage/config/sets
-	newins "${FILESDIR}"/go-sets.conf go.conf
-}
-
-pkg_postinst() {
-	[[ -z ${REPLACING_VERSIONS} ]] && return
-	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
-	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
-	elog "due to the static linking nature of go."
-	elog "If this is not done, the packages compiled with the older"
-	elog "version of the compiler will not be updated until they are"
-	elog "updated individually, which could mean they will have"
-	elog "vulnerabilities."
-	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
-	elog "See https://bugs.gentoo.org/752153 for more info"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild
index ce6eb102c4..f0e04aca4a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild
@@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.0.ebuild
index 4208235a02..733c242415 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.0.ebuild
@@ -20,12 +20,8 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-#		KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	;;
 esac
 
 DESCRIPTION="A concurrent garbage collected and typesafe programming language"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
index 4208235a02..f371daa283 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
@@ -20,12 +20,8 @@ case ${PV}  in
 *)
 	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
 	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-#		KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
+#	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	;;
 esac
 
 DESCRIPTION="A concurrent garbage collected and typesafe programming language"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
index 80fd869511..d496ffbfcf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
@@ -1,4 +1,5 @@
 DIST perl-5.40.0-patches-2.tar.xz 17072 BLAKE2B 7cc1085a0a701f72cf1fce2b7f18ac949eb03a9e40716c37082396483045df577ef13bbca58ef06f20868e52e9c78e18fa5b8a3434ceea272ff49832a086a1f5 SHA512 d31a25894e3b34c8e80f439ebd423dd8f28eac056ce42d69376882c1655b1f7289ef22f8aa8d30147eaebbe6693f4d86d1570e153b55d58d7b30e5832e7bea60
 DIST perl-5.40.0.tar.xz 13804184 BLAKE2B cf191c3ccaf6f395c0c7d08c2ad3456c1dd622d4fe78e7fb3a74c741e9a84f1d39a55f5bc6adbea54c9520b1b387e72e957f9a7544ab8f24968d233cd5b959ae SHA512 a2fb1a24c6367b4043f4e929b2d74fc3bad1415e53b791ed1f219f1701064ae21b2bd3164ba95fcf24eaf458bd54433024ccae43725c0bb82a1ec6a98dc7052d
-DIST perl-5.40.1-RC1.tar.xz 13921272 BLAKE2B bc1a51c20754c73055b785d60927585bb7a1507176f06a34c3e7c089b788408ebb4d419c380174a207f2bd5fc1ad031d7eb6f722c5f8137c0e58245efe2c24cd SHA512 ea9f19658c9154c1d37b623a329b5417828bf6b1b1f449ba41d0a3b09f91246d9c39c425e35164a02f7eeac35968cd383e674579a888be465fe3be13497e9c86
+DIST perl-5.40.1.tar.xz 13930924 BLAKE2B 2f421a9eb6c68e2f12b95e6ac70ede3819c0d31c6f25ec5e45337faa053eaf21911413573624e3e84d82e4d863ed21799dbf471865c7e04519dcb81eac9c5c36 SHA512 3ff16b3462ce43ff38dab21b3dfc20f81772b8c9eac19ab96ba2d5e6cbb390e2302fa76c4879f915249357cd11c7ec0d548bcbf3ab2c156df1b9fca95da3f545
+DIST perl-cross-1.6.1.tar.gz 124122 BLAKE2B b1b78b30f2cf8c5ba12e3df6177b7d102033c8eaceeea9f12a1aeb2bfdf97edda83842e32de797b7ffa3ef6bc66dfba6ccbbacc25367b6f7bc2d137ce58aca93 SHA512 35a4f7966f1f94ef0b6bfe7a82e8a50e0daf6e5e0c1ed99c7c4767aa4f0708db05e8cc01a883257f970703991f617a189609cd57eec63767e2e73de3d6155bdf
 DIST perl-cross-1.6.tar.gz 121973 BLAKE2B b3a17d92dd7621a3bc253a6c4e56eccd3adec2c2b52e606c956a08f48d786a16a3ac5beb056a732ba3df92227f210193b0f516fd9d73cac362a04ec52efab029 SHA512 980af804513ec126e40eb9d8200ca54ba805bbb13b38d20a45daaf8d98d6b257e2eebc1ecad56cd47f60e235fa1141f6df9518d748db4f18d5219180750ca615
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1_rc1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1.ebuild
index 760c17c59b..5c2ba503bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1_rc1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
 
 PATCH_VER=2
-CROSS_VER=1.6
+CROSS_VER=1.6.1
 PATCH_BASE="perl-5.40.0-patches-${PATCH_VER}"
 PATCH_DEV=dilfridge
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 520fd5237c..f7c192b713 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -4,20 +4,10 @@ DIST Python-3.10.16.tar.xz 19610392 BLAKE2B bcc5ff71904b8a936363c6b07b8ffbcb9816
 DIST Python-3.10.16.tar.xz.asc 833 BLAKE2B 4fd4ce76ade6d64539e5eb641c64b0d99ade71a8514f97594097207e78412bd2d09afeab6788598a3159f045b98ccd5537c6771e59eeba52d4820c0c0a6c0dcb SHA512 18032fdb60a022d6381b1137789ada1c4bb198049616ed158fb548e728dd1fb95d116a86c41c852ca2acc9127baf3cdd9644a1e2df90ae9c3ffcd66eabf454d6
 DIST Python-3.11.11.tar.xz 20085792 BLAKE2B a9a778eff94529e1029ae252ef28ecdc2f0673a4406d831865e12de3cba21ea48905542d0e806e428802b05947239ca6a44eff3573bd541469b01644790c7377 SHA512 3ff90f15f725fa8d06686158aaddb887a247b03ca4dc1fdfd81a8efb53373db3e8673bd0b3de30bb7669f3f07d9854e9d8a2dbcd49b18d15b8172787a53a0a9e
 DIST Python-3.11.11.tar.xz.asc 833 BLAKE2B 6a9d873e181d636712567ea46823ad7f972f872d038092506e67bada24187441188b8fde4672c205ce6d37e60c4e0c69a8f3cc5d1915fd8f5dd8743292a16d1b SHA512 d71b0b42537fb636e8c469d62d13ff020149e4fb9d87eb17f8c999301195e418d134dbdb7e4ab49b06de16e96f8ef6bbcf2a749956fffca2ce03185f191c181d
-DIST Python-3.12.8.tar.xz 20489808 BLAKE2B 24b9a5abafdb9fedfc371e7acf0efce50bdc6702050c4f5f0b9e97916a899e3462f928cb217c48e6ffae6fdd4d2cd7c05c5f1d73eaa9ef646f4b3281db5ca977 SHA512 406ce1146c4c2c70d252df56bbe9e5970ef469395cbaa211a96af71f32de2cf7abd944906920cc18b4a470027e63a3f64bf7679fb4954b31bf4ca4baf24fa370
-DIST Python-3.12.8.tar.xz.asc 963 BLAKE2B 5aeacf16d337949a66bb56e346447e7bbcd9166b60fc512c98bcff6862976732ef2e3ac59869cd9df29a653c2bafd4af63b1e6c14f4c6603efb85d5c3dd88357 SHA512 19493499ddb80764aa105e100585d2ef872798dc30fdff2e31d158cd7fd65b69ca133c6d9d16eb974660eed6ba474a26a2af3acd13a90522cf50e142492bd9a6
 DIST Python-3.12.9.tar.xz 20502440 BLAKE2B df1a8ba4996219c018fc14156958ca9c0e8af4854819064fbcf0c927258ecb3c5f46e562213799a87dafb35ae5bd647e1ce280affe2ac8ce6a85c351822b6693 SHA512 c840b14aa21e6a963d18c06ebaafb551d9c9a101b3866417e762fc4a2fde071a7a25fa257faba2956c7344bbc2413ed61690a712d26fba4d0dbeaa50e49b2574
 DIST Python-3.12.9.tar.xz.asc 963 BLAKE2B d90b9c1a3aafa1a942ef8d978b566829656db1114b74f1565b7cbba188cf3bf5637c1dbeec3432ae0af0f826a154c40f27fd8fc46350a757ef91f5c426908149 SHA512 b59251ca3a0a17c06ff7d165f6c025eb91127c80be0782642590f5c922297e0710544ac5a9ae977378e393f1c4861149576a0515af5ec0e54e6827c4010d544f
-DIST Python-3.13.0.tar.xz 22532980 BLAKE2B 4a4e397199402de8c9fe8e4d63443ed972cbe8a4f541743908d699c7987127d159d600fd14145b6a946e8671426279d230c9155fdc5863c1e49a945eedcbf21b SHA512 44a143c9b96b55b01885ec020c3364265bda55289615cd7d5071915b0d0178a6f35e7551a89090001fcb7f3172d38177a56bf8b8532b15c9dbc50295c9210152
-DIST Python-3.13.0.tar.xz.asc 963 BLAKE2B d05f02692a9fea42b73dbfe5dc42bd6533555e5ecb848510d2b94bb7f0e55d4a0f89bcd20b073ed2c7f7a68be35b12cb6dbff6bc16fc9a4592ded2c339ada7fd SHA512 1b8bb0fe4eb93e31ec1770e90b94d44b5864c0391aad5dcba3a30d8e505d9b17107385414353c0060007f8a536254f49b8e919f36ddf6421a6e4330f817f1a3e
-DIST Python-3.13.1.tar.xz 22589692 BLAKE2B 161d5c0a7b4cacc4ce9983f9540a7e01662a7b76cbb34c5f3681582b0e7207574bdec5ad7bf79d820d8744b69bc2fb7196cf07a2ecadbfab6a158872f562741d SHA512 056c9b5fc0a6b540f41513d045f43c1ed463d15e0f345cecec703ec9c2335e53b4beb19de9c74ab2b236b023f934d5fd9ae7727a808634eaa01cfe66018a9a35
-DIST Python-3.13.1.tar.xz.asc 963 BLAKE2B 47cbfb6bceb92716181a0ed8f41742958568e62609fa4996d341e465bd6be0ebcab586ba1ebe275aa3a99108221be047fab66ec4b7e90af27d9db7524b6b4951 SHA512 1b56b7c2f547aa39c75c18978e174debb113444ce3f9da3829ba6842e3160051e0de70bd49d306b8014299aa8aa911d7c67efe71dd648c3528cf8d7535a01599
 DIST Python-3.13.2.tar.xz 22621108 BLAKE2B 79c7dff8a15fd2487d62847a8e654c02433a89887aa4f93819020b60a30587e3ba92b101553d971b59e132677f9f74dfc41cd7c7901db78a7787607ec96c6664 SHA512 bb1c0598914c6d4326554faa568f660f10b20c701d0f36bf1fa58837b6498d728a407416b06ede39604caea1ca93f60545b83b01ae8ee65f55d4cc83242b63fe
 DIST Python-3.13.2.tar.xz.asc 963 BLAKE2B 95a36c305dd452df23b4f119de05e1d3a2b2c9e0c2778a52dc4065f82b52752b68d89eb737cc54cced70623ad4a7b48c85fdff781bf7d7e3b747dacb1ef77db0 SHA512 5f019be530f688b0adf5d5cc9f2c2243e2f1dc7338559db14c1eedd12aadc85404d42c7aafd74e41828205d85f13f278876662ac30c8f3382a1ee081ba5f29f2
-DIST Python-3.14.0a3.tar.xz 22749680 BLAKE2B 4a0457a98fe1a35c01a4607c11eefeb7ef4f4a3bc7bd8b04e129137c1f7f7ee8806fe5561e88dbf8866f461f2d7d3577618b7918fb85a0e99f7c225fd4593778 SHA512 e26c9736f00af680b5f1ff1ba0f06562c48550836088d79dd8b4c97016d52f9f76979de32fa8556e9d750a5dad488643e897807ab6cb0c1424882151fe5f3337
-DIST Python-3.14.0a3.tar.xz.sigstore 4891 BLAKE2B c251bfc3e332174c5050c2d8524aea4865e28e73c39288ac151bea10e0039c3af545a26acc48b9ae8deed9befddb11e810103620be6a7934ea79e7b1f3182eb2 SHA512 dd7d6c543ba2ba8dc8d2a6c891adcf85de7eb857ceb3ffb33f5f06fbcf0a6bcd6517502cfd35acb86ec13d85d487313eb9a396d78c42d1c506d2261e1c4b861d
-DIST Python-3.14.0a4.tar.xz 22798932 BLAKE2B 4dd8632503e142456deefa749aa8d7a93b98c988bdfe905ae650e8e72b2a22de9e88b6d7ba65ec277748b4c8b919a176ca22552e9482f4883b96bf9129dd15c2 SHA512 b70671ebbd9f777fdcb661405c538c733600470ac34992a5b3df99d2f5afecc22cd8325eeec50eeef043181e634da91e535c166b9b5ed421d4e6aa41b79da3ab
-DIST Python-3.14.0a4.tar.xz.sigstore 4895 BLAKE2B 9a1c9ef623a0b8a7469d3fb56e0f73bf28947cb04ab797086962886d6e816e90c2df59e26af952e251c69e8e42c8888aa74bf866aebd7ff1a09526f3bd0d9472 SHA512 117dee2563607e4bc4190742d341f5b088e3feb205d59144b4a50bec1ec1c6df5f0118fbf88c8e78327f59d222ca7d98f31f1e5ff1d9488c0bbf01cd95df22ac
 DIST Python-3.14.0a5.tar.xz 22850560 BLAKE2B 69d57ff07aad021fcfb626f9164529ce071e08182a4334a95b8411c451aa93db09c60d149868bbaad67d8c4bd79598ea22fa76856c3f70b9c35b04b6f48dbeb4 SHA512 ae34c994f00c36c6ce18091c63eb3469aa545ee391c6879c89f5722f7311f2e97cc997477897969777dfaf98090e3dd01dcdb655c986140e9a7796f963be9df9
 DIST Python-3.14.0a5.tar.xz.sigstore 5067 BLAKE2B c3ef20345e05763d201090756ce7e786969d8351ba567b5708ec7a20e6d348c626201fd5b63afa51c0b6740aa3406222b4e07f01d81a8e3812dfc84b751ca248 SHA512 e6755be4a974d8007519e18b9ef417129fa032c9dff508f5170622bf8e8ef0616c8395a1261e9e0e80848c739f31e8369fb5893e7b29f308ad8d62cf1033d609
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
@@ -31,15 +21,8 @@ DIST python-gentoo-patches-3.10.16_p1.tar.xz 24964 BLAKE2B 93cf5d208f80f1017e4af
 DIST python-gentoo-patches-3.10.16_p2.tar.xz 29428 BLAKE2B fa63d2fcdbb53e3b6381eaadfbcfca02a03eddd7035dd4776c706fd1aa0226a2c809260ba5a543a209a63563dab12ea109bf03a2026ea4b5797fa6afc7b45c52 SHA512 0186abf035632a3f8018052f8021c1d0dadbc28b7d03551f6992a658fe53878ac9ea86b79512e0e147efecedfda133cf7936746946238177918be9c695248f15
 DIST python-gentoo-patches-3.11.11_p1.tar.xz 11644 BLAKE2B d080e1b987ea0e1b397113f20a5c84f6a34d6619a3ed9f7389fd10d95636169563fba97d212477ca7f9b93d2bd0b66c9521fc61963bb468805a661ca3ab287a7 SHA512 f6045adf25923053fc9a60506b9164c9c062580d6886f1a3dcaca00dc4affe69aa9e138f8ce93f093798ccf33322ccca2aca674ab87457df98a93dcaca234b44
 DIST python-gentoo-patches-3.11.11_p2.tar.xz 16224 BLAKE2B d8404c8c87e109d2c699dbab63c20a319c6efd5b62dab5fcc1b53b5b291e25686e69ef92b495eed0d80491cfa29ae9f523df6b53c7c6a12c3f713c53e3c5b7c6 SHA512 f1bf897305678c2b113aef4553d14e916e83312708352765725d754dffbf2f5dd7ef0f7cd84a774e4a8c18dde8a517d7eaf8e58720d73d25430b28fe49906258
-DIST python-gentoo-patches-3.12.8.tar.xz 10772 BLAKE2B 9833b5ee6c307a4aa1335fd966fcd64a0f3732a97a190abdd3121b3496ea68ead9436af4ec5e3e8c0e781fd68df41403a1b2e5f29f264fc8569a883141e5f7f9 SHA512 d5906845a6259f7349a0299e185f569750b493c64ea1f6537dc8bfc0babc9b54de7db1c4f1b5b6ec2f7076937ad07ca0ca9c4941bbb8d542da6c687957bdbd5e
-DIST python-gentoo-patches-3.12.8_p1.tar.xz 11088 BLAKE2B 4d7ccf4759b624aafde1ef2a0a341cda8f4d3e7c4d86586201a910d77327219e61b134985f2fe85e83892ad4ba607b4e661aed675cc038e4cc193efe9fbe6f6e SHA512 6f1d6ab2b9e958ae7d2ca3f204b7c7eb1435998919cf5a577a82bbf1339232f92a2f517c248afb9e1802850acd2b59b84c41e87f4b8582e19ec88155743cdaae
 DIST python-gentoo-patches-3.12.9.tar.xz 10736 BLAKE2B 1f87d1bba8c094936e5cd3e0ef2eede0dbca3e658430f81b398735d8f02fff1f87739914014dbcb17163f8a969ffc5e7e4cce7d71557ce3c2e58487e6ed8b80f SHA512 342f11df85926e32455d52115d06b817a17f7ae104e3ea8e852046d321d829835bba7c07803c50dd5433ac8b615499428d5bc1a088b484ca0c4304eb8b2cb879
-DIST python-gentoo-patches-3.13.0.tar.xz 8316 BLAKE2B 8fb8ba8f41f310140ad7066b614952023112d5043e5d82058364125611785144c1843e87eecb7669bcbab51c40d0694069526219f7419a7009517ce0821b74ba SHA512 0eb31ebfa3411020aa70b3b66fd7eec98b4b7a686b0e8f1f7ed76a8186a7c1ee85ccd9565a86a1d7ec13b975855eeb7303036af05e2dfdce3d64e4ad99299df4
-DIST python-gentoo-patches-3.13.1.tar.xz 8320 BLAKE2B 2fef9c501df7ed7603eabb3e01a8c3bde5bcfae3a8ac9bbe772b458cb04ffa9598cf38f3a74f6dcbcda29e7bd294d664b8fb12f7ddd9e0e42ed6268300947bb0 SHA512 419e1f12daaf19ed2d2195699b5e8c2c604779562d84d6a68adb4016dcb13fc3e0383ccc4b01eb153930600e6c9cdcc518929ffce3d6343019226a6111e9d617
-DIST python-gentoo-patches-3.13.1_p1.tar.xz 8672 BLAKE2B d35b8b47c6d549753d9a764fbc3538cb6517c809e69901f3221110ccbb0ea9eed10ba1f1637a5ffe4f90d8c3932f53815c7dcf844a7350ad89458763bf0aeea1 SHA512 0505bc1f7c8e264fdcad5459900e37d12ed9bea57e615ea42492fa211d3f0641e79c3e711a6970cd34a3a6275f36a22ed7ba64fd71c988bcdaebfcefc7b6a1d2
 DIST python-gentoo-patches-3.13.2.tar.xz 8316 BLAKE2B 2367808924c83c02b8b2ca765fd4768d4f12cb8e8451eab9d084ce5950a5a81829e573d415f9a16db2e053105def90b5f52c91423fc71e57cd182a1d9c824d8c SHA512 580332ca037c1453f314d5811f96f7bf74defc16cfe515c4fe82ea08a7bf3679aa88d5456db846d988bcf4fbc9eeb4ebe7cee01d135bd55c87931206250e301a
-DIST python-gentoo-patches-3.14.0a3.tar.xz 6036 BLAKE2B bbcb3f31acb533b8291f4cedcb89c0501a7054bbf1f98ea000c43e5a99e3b8bd160c6fb81e28bad90c85dd0256d523f72b9e25f30c30b5b5e9d60a9055a612d1 SHA512 9f87b3f1f326f88c924c49e37f39f63314199cfc354d452fef860ab36e143145a2c1d832c1b7d4357ade1c1090de00086bc5d6a9d7981bad210a99ffcfa2a858
-DIST python-gentoo-patches-3.14.0a4.tar.xz 7452 BLAKE2B 5d3b0dc6f9c2f0ffeac50e4af1915a8d8ec29350c56203ec66d6580ae705a23316f4c85f28908000c50c58eb3400e63ff379ba26d219f48ca7f559633ba4c153 SHA512 0e571f6693e44f439c7ac499216f4cf70e487768116290c24ee66323c9113fc91d0b4b68c79d1d549d0a14fcee4f79ddc377dfd87932dfcf00c5c11d3784bedc
 DIST python-gentoo-patches-3.14.0a5.tar.xz 5668 BLAKE2B b12801ac5bfa50cb6e3bf4b79e70956b771e0a4c0d5d4265115cf144740a914f764655171fdbf3178ba76f91b7765aa681f0097aaa55e6aa330eeeec3320bb4e SHA512 3110f99058136e8587a4cce2f594a5fde7c575027440e9e4d3b77dba0428c6af60cd0d259833d5d46e3b9ac3f24a2ad3111e4c5436cb423079f5c1a230e47d97
 DIST python-gentoo-patches-3.8.20_p6.tar.xz 50876 BLAKE2B df0df21c75972fb73e36f66f0c90d3f953b14d7a59bf97ce4214dce6e6d937ed52fbf3db8f3eaf42cde141bfe4d7a731b06e41723285517461c790912706be9e SHA512 48ef567f6972e7975cb61d34a876d8c0db42f1a3c0b832f9366091dd5f2ca854c02887808843d314816c8cf6d7b0738c40e7835fedbba7b84e57f2515dde45e2
 DIST python-gentoo-patches-3.9.20_p2.tar.xz 36140 BLAKE2B af0a9e08f3bfd8eb631760d100ec8f54db968a6bd201820192c4ea63ec88e0f83ffe77c709fcf4da43ad8d44eeb239ca1984561c3e7846e3fe4edd757d2321a4 SHA512 d451b41401de631eed996c34f40f2146d4d2f11bfa04fffa762c9b654e690d0ef95be0f51224a964a7c33784bb9b21e58434f6fee17cf39c20b5af34200569d5
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8.ebuild
deleted file mode 100644
index 7264acf4ca..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8.ebuild
+++ /dev/null
@@ -1,609 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8_p1.ebuild
deleted file mode 100644
index 67bd154d44..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.8_p1.ebuild
+++ /dev/null
@@ -1,609 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm libedit
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		app-arch/xz-utils
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes _crypt
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_concurrent_futures
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with debug assertions)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9.ebuild
index 67bd154d44..7264acf4ca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.9.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0-r100.ebuild
deleted file mode 100644
index dc936ce985..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0-r100.ebuild
+++ /dev/null
@@ -1,665 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER="$(ver_cut 1-2)t"
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	ewarn "Freethreading build is considered experimental upstream.  Using it"
-	ewarn "could lead to unexpected breakage, including race conditions"
-	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
-	ewarn "please consider reporting freethreading problems upstream."
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-			-x test_external_inspection
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--disable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-	# Fix collision with GIL-enabled build.
-	rm "${ED}/usr/bin/python${PYVER%t}" || die
-	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
-	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if use tk; then
-		# rename to avoid collision with dev-lang/python
-		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
-	else
-		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0.ebuild
deleted file mode 100644
index 901c5d2d0b..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0.ebuild
+++ /dev/null
@@ -1,672 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs eapi9-ver flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	if use jit; then
-		ewarn "USE=jit is considered experimental upstream.  Using it"
-		ewarn "could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
-		ewarn "please consider reporting JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--enable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	if ver_replacing -lt 3.13.0_beta2; then
-		ewarn "Python 3.13.0b2 has changed its module ABI.  The .pyc files"
-		ewarn "installed previously are no longer valid and will be regenerated"
-		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-		ewarn "when installing some packages and checksum mismatches when removing"
-		ewarn "old versions.  To actively prevent this, rebuild all packages"
-		ewarn "installing Python 3.13 modules, e.g. using:"
-		ewarn
-		ewarn "  emerge -1v /usr/lib/python3.13/site-packages"
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1-r100.ebuild
deleted file mode 100644
index 8aa3e756be..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1-r100.ebuild
+++ /dev/null
@@ -1,665 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER="$(ver_cut 1-2)t"
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	ewarn "Freethreading build is considered experimental upstream.  Using it"
-	ewarn "could lead to unexpected breakage, including race conditions"
-	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
-	ewarn "please consider reporting freethreading problems upstream."
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-			-x test_external_inspection
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--disable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-	# Fix collision with GIL-enabled build.
-	rm "${ED}/usr/bin/python${PYVER%t}" || die
-	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
-	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if use tk; then
-		# rename to avoid collision with dev-lang/python
-		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
-	else
-		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1.ebuild
deleted file mode 100644
index 6afffb716b..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1.ebuild
+++ /dev/null
@@ -1,659 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	if use jit; then
-		ewarn "USE=jit is considered experimental upstream.  Using it"
-		ewarn "could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
-		ewarn "please consider reporting JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-
-			# Fails in profiling run, passes in src_test().
-			-x test_capi
-		)
-
-		# Arch-specific skips.  See #931888 for a collection of these.
-		case ${CHOST} in
-			alpha*)
-				profile_task_flags+=(
-					-x test_os
-				)
-				;;
-			hppa*)
-				profile_task_flags+=(
-					-x test_descr
-					# bug 931908
-					-x test_exceptions
-					-x test_os
-				)
-				;;
-			powerpc64-*) # big endian
-				profile_task_flags+=(
-					# bug 931908
-					-x test_exceptions
-				)
-				;;
-			riscv*)
-				profile_task_flags+=(
-					-x test_statistics
-				)
-				;;
-		esac
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--enable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1-r100.ebuild
deleted file mode 100644
index f2f4b2b6ff..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1-r100.ebuild
+++ /dev/null
@@ -1,634 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV}
-MY_P="Python-${MY_PV%_p*}"
-PYVER="$(ver_cut 1-2)t"
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	ewarn "Freethreading build is considered experimental upstream.  Using it"
-	ewarn "could lead to unexpected breakage, including race conditions"
-	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
-	ewarn "please consider reporting freethreading problems upstream."
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--disable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-	# Fix collision with GIL-enabled build.
-	rm "${ED}/usr/bin/python${PYVER%t}" || die
-	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
-	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if use tk; then
-		# rename to avoid collision with dev-lang/python
-		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
-	else
-		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1.ebuild
deleted file mode 100644
index 77efc9e367..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.1_p1.ebuild
+++ /dev/null
@@ -1,629 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 18 )
-LLVM_OPTIONAL=1
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	if use jit; then
-		ewarn "USE=jit is considered experimental upstream.  Using it"
-		ewarn "could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
-		ewarn "please consider reporting JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--enable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.2.ebuild
index 77efc9e367..65139c4ec1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.2.ebuild
@@ -32,7 +32,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm jit
 	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3-r100.ebuild
deleted file mode 100644
index 2abe01749d..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3-r100.ebuild
+++ /dev/null
@@ -1,635 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL=1
-VERIFY_SIG_METHOD=sigstore
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_alpha/a}
-MY_P="Python-${MY_PV%_p*}"
-PYVER="$(ver_cut 1-2)t"
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-# https://www.python.org/downloads/metadata/sigstore/
-VERIFY_SIG_CERT_IDENTITY=hugo@python.org
-VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	ewarn "Freethreading build is considered experimental upstream.  Using it"
-	ewarn "could lead to unexpected breakage, including race conditions"
-	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
-	ewarn "please consider reporting freethreading problems upstream."
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--disable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-	# Fix collision with GIL-enabled build.
-	rm "${ED}/usr/bin/python${PYVER%t}" || die
-	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
-	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if use tk; then
-		# rename to avoid collision with dev-lang/python
-		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
-	else
-		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3.ebuild
deleted file mode 100644
index f4da576cf9..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha3.ebuild
+++ /dev/null
@@ -1,630 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL=1
-VERIFY_SIG_METHOD=sigstore
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_alpha/a}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-# https://www.python.org/downloads/metadata/sigstore/
-VERIFY_SIG_CERT_IDENTITY=hugo@python.org
-VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	if use jit; then
-		ewarn "USE=jit is considered experimental upstream.  Using it"
-		ewarn "could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
-		ewarn "please consider reporting JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--enable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4-r100.ebuild
deleted file mode 100644
index 2abe01749d..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4-r100.ebuild
+++ /dev/null
@@ -1,635 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL=1
-VERIFY_SIG_METHOD=sigstore
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_alpha/a}
-MY_P="Python-${MY_PV%_p*}"
-PYVER="$(ver_cut 1-2)t"
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-# https://www.python.org/downloads/metadata/sigstore/
-VERIFY_SIG_CERT_IDENTITY=hugo@python.org
-VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	ewarn "Freethreading build is considered experimental upstream.  Using it"
-	ewarn "could lead to unexpected breakage, including race conditions"
-	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
-	ewarn "please consider reporting freethreading problems upstream."
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--disable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-	# Fix collision with GIL-enabled build.
-	rm "${ED}/usr/bin/python${PYVER%t}" || die
-	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
-	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if use tk; then
-		# rename to avoid collision with dev-lang/python
-		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
-	else
-		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4.ebuild
deleted file mode 100644
index f4da576cf9..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha4.ebuild
+++ /dev/null
@@ -1,630 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL=1
-VERIFY_SIG_METHOD=sigstore
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic linux-info llvm-r1
-inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
-inherit verify-sig
-
-MY_PV=${PV/_alpha/a}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-IUSE="
-	bluetooth build debug +ensurepip examples gdbm jit
-	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-libs/mpdecimal:=
-	dev-python/gentoo-common
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-pip )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	kernel_linux? ( sys-apps/util-linux:= )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? (
-		dev-python/ensurepip-pip
-		dev-python/ensurepip-setuptools
-		dev-python/ensurepip-wheel
-	)
-	valgrind? ( dev-debug/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	dev-build/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	jit? (
-		$(llvm_gen_dep '
-			llvm-core/clang:${LLVM_SLOT}
-			llvm-core/llvm:${LLVM_SLOT}
-		')
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-# https://www.python.org/downloads/metadata/sigstore/
-VERIFY_SIG_CERT_IDENTITY=hugo@python.org
-VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER%t}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-declare -rgA PYTHON_KERNEL_CHECKS=(
-	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
-	["DNOTIFY"]="test_fcntl" # bug 938662
-)
-
-pkg_pretend() {
-	if use pgo || use test; then
-		check-reqs_pkg_pretend
-	fi
-
-	if use jit; then
-		ewarn "USE=jit is considered experimental upstream.  Using it"
-		ewarn "could lead to unexpected breakage, including race conditions"
-		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
-		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
-		ewarn "please consider reporting JIT problems upstream."
-	fi
-}
-
-pkg_setup() {
-	if [[ ${MERGE_TYPE} != binary ]]; then
-		use jit && llvm-r1_pkg_setup
-		if use test || use pgo; then
-			check-reqs_pkg_setup
-
-			local CONFIG_CHECK
-			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-				CONFIG_CHECK+="~${f} "
-			done
-			linux-info_pkg_setup
-		fi
-	fi
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	# breaks tests when using --with-wheel-pkg-dir
-	rm -r Lib/test/wheeldata || die
-
-	eautoreconf
-}
-
-build_cbuild_python() {
-	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	#
-	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-	# We need to build our own Python on CBUILD first, and feed it in.
-	# bug #847910
-	local myeconfargs_cbuild=(
-		"${myeconfargs[@]}"
-
-		--prefix="${BROOT}"/usr
-		--libdir="${cbuild_libdir:2}"
-
-		# Avoid needing to load the right libpython.so.
-		--disable-shared
-
-		# As minimal as possible for the mini CBUILD Python
-		# we build just for cross to satisfy --with-build-python.
-		--without-lto
-		--without-readline
-		--disable-optimizations
-	)
-
-	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-	# Avoid as many dependencies as possible for the cross build.
-	mkdir Modules || die
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		_dbm _gdbm
-		_sqlite3
-		_hashlib _ssl
-		_curses _curses_panel
-		readline
-		_tkinter
-		pyexpat
-		zlib
-		# We disabled these for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-		# and uncommented if needed.
-		#_ctypes
-	EOF
-
-	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-	# Unfortunately, we do have to build this immediately, and
-	# not in src_compile, because CHOST configure for Python
-	# will check the existence of the --with-build-python value
-	# immediately.
-	emake
-	popd &> /dev/null || die
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	# Set baseline test skip flags.
-	COMMON_TEST_SKIPS=(
-		# this is actually test_gdb.test_pretty_print
-		-x test_pretty_print
-		# https://bugs.gentoo.org/933840
-		-x test_perf_profiler
-	)
-
-	# Arch-specific skips.  See #931888 for a collection of these.
-	case ${CHOST} in
-		alpha*)
-			COMMON_TEST_SKIPS+=(
-				-x test_builtin
-				-x test_capi
-				-x test_cmath
-				-x test_float
-				# timeout
-				-x test_free_threading
-				-x test_math
-				-x test_numeric_tower
-				-x test_random
-				-x test_statistics
-				# bug 653850
-				-x test_resource
-				-x test_strtod
-			)
-			;;
-		hppa*)
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		mips*)
-			COMMON_TEST_SKIPS+=(
-				-x test_ctypes
-				-x test_external_inspection
-				-x test_statistics
-			)
-			;;
-		powerpc64-*) # big endian
-			COMMON_TEST_SKIPS+=(
-				-x test_gdb
-			)
-			;;
-		riscv*)
-			COMMON_TEST_SKIPS+=(
-				-x test_urllib2
-			)
-			;;
-		sparc*)
-			COMMON_TEST_SKIPS+=(
-				# bug 788022
-				-x test_multiprocessing_fork
-				-x test_multiprocessing_forkserver
-				-x test_multiprocessing_spawn
-
-				-x test_ctypes
-				-x test_gdb
-				# bug 931908
-				-x test_exceptions
-			)
-			;;
-	esac
-
-	# Kernel-config specific skips
-	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
-		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
-		then
-			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
-		fi
-	done
-
-	# musl-specific skips
-	use elibc_musl && COMMON_TEST_SKIPS+=(
-		# various musl locale deficiencies
-		-x test__locale
-		-x test_c_locale_coercion
-		-x test_locale
-		-x test_re
-
-		# known issues with find_library on musl
-		# https://bugs.python.org/issue21622
-		-x test_ctypes
-
-		# fpathconf, ttyname errno values
-		-x test_os
-	)
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			--verbose3
-			-u-network
-
-			# We use a timeout because of how often we've had hang issues
-			# here. It also matches the default upstream PROFILE_TASK.
-			--timeout 1200
-
-			"${COMMON_TEST_SKIPS[@]}"
-
-			-x test_dtrace
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-
-			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
-			# bug #900429
-			-x test_tools
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		# PGO sometimes fails randomly
-		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-lto
-		--with-system-expat
-		--with-system-libmpdec
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-		--enable-gil
-
-		$(use_with debug assertions)
-		$(use_enable jit experimental-jit)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# https://bugs.gentoo.org/700012
-	if tc-is-lto; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-		myeconfargs+=(
-			--with-lto
-		)
-	fi
-
-	# Force-disable modules we don't want built.
-	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
-	cat > Modules/Setup.local <<-EOF || die
-		*disabled*
-		nis
-		$(usev !gdbm '_gdbm _dbm')
-		$(usev !sqlite '_sqlite3')
-		$(usev !ssl '_hashlib _ssl')
-		$(usev !ncurses '_curses _curses_panel')
-		$(usev !readline 'readline')
-		$(usev !tk '_tkinter')
-	EOF
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		build_cbuild_python
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	# Gentoo hack to disable accessing system site-packages
-	export GENTOO_CPYTHON_BUILD=1
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-		local -x TMPDIR=/var/tmp
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		--verbose3
-		-u-network
-		-j "$(makeopts_jobs)"
-		"${COMMON_TEST_SKIPS[@]}"
-	)
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	local -x TMPDIR=/var/tmp
-
-	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# pydoc
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index b64ba91b59..fe307814c7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -370,6 +370,42 @@ DIST rust-1.83.0-x86_64-unknown-linux-gnu.tar.xz 180329116 BLAKE2B e2c661061e21c
 DIST rust-1.83.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 1453c9047b590358731d4ea9e8d6dab0da1ea937fd9b9f6ee2137459d0a426df6333a9dc53dff65f6c82a17b93a98efc5dea33f9218145070a7605baffebc1da SHA512 f6a3636611d0bb5cb41989547388901bed0dbe54fe3d99d94391bc815718a85af52d0110747c3d7f1b6a455ebaa221b74c2c9fe11403b147325b6ec0c4bf46ef
 DIST rust-1.83.0-x86_64-unknown-linux-musl.tar.xz 260755616 BLAKE2B 0a61fad7f03645a9b4032fe4ca910663f0406a64a42cd113a09019199e6deceefce2a450ca14bc47745db08a9fe8970897fd01c2121f9b6bcb20b23652ada5de SHA512 2e219eec7b28a60e9bd160972042316460d91fe60f755c625bee30724059f4f9c4a29d567bea54718f9b8d739cc1c81cb4dedff0c868270861c866452d5cf8a3
 DIST rust-1.83.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B f87ab0bb59b5e4fa9078bb973845bf606c61faf2c728db6cc3e9a61907fc2d1c9ea3ede7ec55c3388c53b0ff06ffcbbb89f63b585c36b5bff7637acc8b8f3336 SHA512 20740272925662be9178c9c87f8184c4d0a355051fa85fd8459563bd23bde798b01d53c823726d0788f6311a4f3c7f3c8bb8a2bf4f470c8d3b7d1303090a78ad
+DIST rust-1.84.0-aarch64-unknown-linux-gnu.tar.xz 241841868 BLAKE2B 814ce6b3e7ee391fe93bdd8164a7c29c49e146eff2356c165a7cf14125c91188c8c3c89c3ccc8bcb006f1e30d3123b7332293d084b1888d11e47cfb105faa0c8 SHA512 a3b394dbe6e8a149c6d6bd18789f1b3393128c8add67c18788198d7c12c7e8a2b7d818424c6ec465d89e7423f39949258eb9c933aaaa946449540d2f8c458c86
+DIST rust-1.84.0-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B a83bd4fd2a71a9f080563427fd23bf9cb781f2728f04464a6aa44d38dec5d807eaa5b3ee3b232e58b2ed27d0185cdb546d8b2d0c8c2dc1da43cb001c5be540f9 SHA512 71fd88b65a74b2c83a8eaeb5bea37feb60339b18200a2eeba471a74ce844386a296ade9bff1c6c6413f32493fa7b1057e3a3740920ca1207bea4c02d7421b7cf
+DIST rust-1.84.0-aarch64-unknown-linux-musl.tar.xz 219144116 BLAKE2B fae31bdcaa7b7839a5e071adbe24d507c4b39ed52b413219941057fff6d8416ea68e957606b658919fdbf9cb4d1b26f01692bb01e9f967147457717a30041cc9 SHA512 89ac6b14c23958c4df2e924d78093d5c652a910ace7b9166756e6d36bc215bca301d4e3b61f54c6128cb0d4a01d6941908e5b51fd1718ad81b3c495aaa64e6a2
+DIST rust-1.84.0-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B c64496baff24d7c2a83a5884e58de952114a1cbe4e9605c837576cd09b496d9af90dad5d70685cc01340b060c31ef05fcd02f95295ce9bf16fa4dee4b86687e8 SHA512 ce2b30bbf217d039cf5824c3cfb084a467547698049e6c088b27af17af95f312d434119aac7cb9a9333fbb19654cdb2466f4686c14d42f6b6e50dcf235f5a57a
+DIST rust-1.84.0-arm-unknown-linux-gnueabi.tar.xz 203482932 BLAKE2B 409cf02ab8977b80f4fefdfaebd6f5de75182682737ffc2df8fbbb35a8d925b4b7d77867c210f206f4e3db19db5cc295e20ca24223ac55f98926a2b62564f202 SHA512 57cc5de6b72e7db5ab5051118f1e4a6a59f29256b85f9e661d7fd91e93fd961cc690a87ecebce6e39696ce7ed0e124e5fa65c6d591f31cc56d3c691c42c0528f
+DIST rust-1.84.0-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B c61e1c691426c5ec80b2b1b8a7dd63968a3a5e8421a12ac1507bf54ffe0229b8b2a8a386694e6b731a47844b6c1882eba188ae39c6eda0f79bae21891cf6f747 SHA512 3bb76c15085f4292d7bb10382df18da44c29bce03db486da22ada9eeadec5561bbf00809a8b37c4d389552c257e947f60b368502687fa7ff2d0aefdf2f51a924
+DIST rust-1.84.0-arm-unknown-linux-gnueabihf.tar.xz 203947296 BLAKE2B 12a6e18912f5c9819c76503d82490a5dd85037e5aff6bf7eb121ad433819ba0a717301102c720b8f22e43cf254c9e9974645b80cee0eb5605906d1505ca501b1 SHA512 4695723ebc0cf4d2db822593e85681faeb3968a8e86d81a7c7708fbfb328cc7c9c65534f483266b6f1358ed40e343dd9b6b35375833abd7e15a375efe01609b5
+DIST rust-1.84.0-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 2585ace544427a8539e292f78b399e1b4c3488e78922ca6335ecd857ade7b589b11c80ce1a80fab957fb5f301118745efb3ae37e43ba69407c58db5e0e8a6ed5 SHA512 d5e4ae979aa35b3d734c6397e7d1745e5d80620743eb2dc3c96ef13d31aa44db6f32088b89063f5c2f9af7f296fbfcba4f7ed277e95cc632d702cb352b1ce768
+DIST rust-1.84.0-armv7-unknown-linux-gnueabihf.tar.xz 209524676 BLAKE2B 3056c0415fa4aa71cca11f573de504eb06b350c3fa43bf17aed802e4db94f66ad38afcb9b7f8d2f8ba5665ed38e94f48a377f0194b0661d534340b5e1bdacfbf SHA512 de268b97f1b30198ad6065a4ea10fa3e6aa366f852c42413eb3c3efed971dda1e0dcb112958f56824265f8f4d205a09521ef200c3b362056f2fdca07c5558304
+DIST rust-1.84.0-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B ba8e7bf6831f78f31bb3590b87807a0fa44ceadae19e93cf76ede44d724e27c97cb27aa82f8cc9567da3f079fcea731965ef0966ddf1f93d03146d1f483cbfad SHA512 242055a1fe7232e6301633bbc81a15a649e9713c9bbd655ccce72ecedfd2e1b1f0d78de98842c2a8e40d42e760c4c040403521eabcea63be822caa54811bb7be
+DIST rust-1.84.0-i686-unknown-linux-gnu.tar.xz 235927300 BLAKE2B f0825b84374556291893d644178f09cbe58e41fbe2742474b7c6d47f9ac379d5566d92a59fdbaa336765ea9aa0112027fb1f1c80758b4b03a38091cff7d0fa0c SHA512 9dbbf55dc04e6071ff597c75e194676c4d15bffcbec559c7a7622ce19c4300ecd460c5712ecebe4a4419cd1b0206cd18ab4596a8d9963f7aa0432eda5234d7c8
+DIST rust-1.84.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 9b8d092db5f894f563bbfb45666430f231ccdebcf05a811c3546be167d851a84891122c29ba3bceb6a2bf71e87817a29d703a40cad4f8fcdf3968d391347578a SHA512 51595e120a71958ed6551ff102f7891cdf3d9a6b9adaa990525b82ec75eb1c0266dce6350775139052a27d787612596cf083e9b0c3b9e7de5db8eb65a2546c59
+DIST rust-1.84.0-loongarch64-unknown-linux-gnu.tar.xz 234981212 BLAKE2B 1e6616834440eac754ad0725ce88ec7d83e6804bf084bb2ab1c2adff1fbbbb0861780ebf57116f4fa38ad67667b89d0d7e9ca7184f0c0ee65f7b23886652ee10 SHA512 47671edf5c751bffcf87ab3a76cdb1233eb64c3d6815825ff0130bbb8956e6bc452bd75395bf8f44abd7b78c23db8d9f0047b6538a4f9c12d729d25ba43d038f
+DIST rust-1.84.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 4cb2035ed10a735a688b2b80975aa16b2a311c9ccf5c8b6ec63af4dbe30e06713621c119721cde6e44d504133343ea2aa5158dc6bbb6253aa330894161559374 SHA512 ec74e916f9479ab046f0d997f4eee99b1c23028a3aa207fa7be71762ce7cf428af53a6d172714653fb30e5d6d8d42936cc7fe3d9c7f3a33262703d15fc9baffb
+DIST rust-1.84.0-powerpc-unknown-linux-gnu.tar.xz 226162544 BLAKE2B e1bb743b29f8dffed0e5b7f83da5ec58b4977dbb7621eb1a66f7d42dc9e588eecbd51013d2bca3dd24e679ec1f57bd8d1b9d5bd44fb155b8757b75c61f2649e1 SHA512 d09d52c64c097f9e8238c64a5e69530c8e7fc72db6c48c76f5118598d0c2c1186b40b053aa78b8b1d071cc716cc50ab7d824655af777b8a76c4131edac44e813
+DIST rust-1.84.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 8eded34d62506f87d38ef3c503f62d5687a646aec8a0ff699d73d1b0907d0735aa7f7893d3b5ee481f069a01998182c70e10d48f664268bdec44655449825e78 SHA512 a3a5a6ae3ac2f210253c2eae61b0c0647cf5f526866e0f5c0141a07f9587cd614573bb2728186889483806a1a3ab5885c9abcca91a16dc36d042bc78239592d4
+DIST rust-1.84.0-powerpc64-unknown-linux-gnu.tar.xz 222899356 BLAKE2B ff9b3bc680cae85485131d23fef5d04abffa69c7d4f4ad254a868707b1206bec543faf20a0be5c287c83165680da8dfbb9a0ce8c688e4f29231df2a589125450 SHA512 16440b2c604061dff6ebdb60af6697d3064ce6ec740c617968b22d8479cdb16cfb61330b2afeadbb544826c6fe90b245eba0de3956ae2924cf77ef8565defae0
+DIST rust-1.84.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 67fd274e3315a21ed0b23fc8bcf013ab20b905c373785b74bada5431d0d1cc1b63e7ea3dcbfe4bd8def0861d08ce13cf769796e244437cc6beab6db95f01c6b6 SHA512 87ea6ead36d9dfddb5a71690f4d434978dcd73264c32e93ab7d3ef74f7c5835fd5e73316f1bb827c418492dd30f3a5bac752054ce1e27d99600249b64412d1c2
+DIST rust-1.84.0-powerpc64le-unknown-linux-gnu.tar.xz 235629500 BLAKE2B 32903240ada4cf2640814374c55d71e3351a0dcf413d54041117a3f6603ddd6c19033368382bbb18c5d1f278c9bb3f5d6d0ace966bb1fcad9cc9389fdd066135 SHA512 626476e551869a066600f459e7a6e9c8435f61b4018efba5b3102af72ec7508cbd4464d0b60adce5c669d34adf4315ec3529d0ebdac6d294de7c7437da264367
+DIST rust-1.84.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3e762822c5563db6efc128aab7ff704165dbe35cd06dda07c677ef2b94084a2ee37fdf77e8aaeaec4987de2f5bc73da9a2ab572e4e4d2b64a775a447b548e40b SHA512 113b7ef16977f24ad6acd72426ce389492aad7d8fc36bd3feeb921a21563e20c0144c3eaba3c63818556794df7904def0e83e5645cd4c766724898baca9ef208
+DIST rust-1.84.0-r1-mips-unknown-linux-gnu.tar.xz 75947332 BLAKE2B 80ffe16aa2f822e093b58990c1d2befc503148ea0a6e06a752200a412bbd4301de57d05c4b97474ecce425e3f182efd8101a60c5cad6bd47460ae2096bcce59a SHA512 b9241ba740b436945a5282d014b4fc52a66cdc2d6e20d96c344edc384154674e7f3d8c9a2de3f38d1b322d1f73b274906ad93f779603426be8945e6f3689accf
+DIST rust-1.84.0-r1-mips64-unknown-linux-gnuabi64.tar.xz 75753700 BLAKE2B a34f243cccddeab3365d219c39830eff3ab25f117cf98103648605653d2028cb574264ad372aa1d31321ca1da7b8c81653fc119df8f572aa706e02c424484910 SHA512 b65036f08ca6f448cebd4d2ada9fd760f9a7830d977583e12ea800c42bfbb59fdfd5120fa6a9f9497fdc061d20703fe3d455770ad3b1cd278c440c799c0ef1c8
+DIST rust-1.84.0-r1-mips64el-unknown-linux-gnuabi64.tar.xz 77344736 BLAKE2B 4d482f5f0b9ec5b567e6a55b5fd067997b7742a733a5ce09ec121b6c5757b2adab2dc53e787260ebc2cb45a3c5ad45c0249693dbff92324ce5c27a95be6359ba SHA512 5b30df97f3d4d7cc0c3080c49c7277f875ff60ba955bba7e9e1e0296ef45f1c9c7e71728f446b66da59f8fd8a341454a95e9cb68f7ee391d5e12adf91eff6591
+DIST rust-1.84.0-r1-mipsel-unknown-linux-gnu.tar.xz 77659468 BLAKE2B d543ac0c8836d1582b3f439b44048cb13c3a7c8c9b1a5198da94d7588316668fd8e9bbad7ba924efeaf62f908c6d8ba8e910117e9188567ef9cdfc6cb4a79d86 SHA512 7866fe762670ba8a4c375247353c1395866ca1263c1fbc7094e8e2600ef60e8311a561b81d68890fe59a029e3c9ad508fad5a51402846fe5c0e5a171e281ad45
+DIST rust-1.84.0-r1-powerpc64-unknown-linux-musl.tar.xz 78546896 BLAKE2B 0aa687d9af4e4d4a869ea5bd446f96b02181a6ac6a679b93440f5c1561b31c2d900ff26a04a7b36f35d88af6afc5b347ef54bcc68405e3405c567cd62ca7ced5 SHA512 37330dab5c45c8c04b42789cb0be801df0488d913942d70ee0d325095861cf740f6df9fdcc27cb39538944a3bcc7e6b4b988c2a9e8d72aea1c2793461d3265f2
+DIST rust-1.84.0-r1-powerpc64le-unknown-linux-musl.tar.xz 80969948 BLAKE2B 72cc650959a8552d1e551d1df4c1c1dd416af9e39978f036ec1b5134d1fdff3d9fcdf58de9605f9474ee1549d9eb195299dcf28f07e2e987086b229c157b1d5e SHA512 538f2c81dda0d78f79631d631a3668869e30fa0e494692a0056319cda72d1c646f509eb7ee1fc970ad0346577d97a41568eeb98a8b15f6b6d98fbd80d2245725
+DIST rust-1.84.0-r1-riscv64gc-unknown-linux-musl.tar.xz 82863916 BLAKE2B 1ca9d7ad04cc9d095e326b7a8668f2020428e511a7ff42cc52aeac1e315f068858e5e02fa65311acbc62c80b645bf7298ba5a0eee7e8efdd97f8a5cd95a19234 SHA512 327372b80939c6936b68dca8f18f5f10827cafdb9befff64387adc901ed4566643fa3fd9009b3b2416121fd15e25e560a15aee7825bcc9d6a9b570ec01c2a9f5
+DIST rust-1.84.0-r1-sparc64-unknown-linux-gnu.tar.xz 74128656 BLAKE2B e6efe38ba9d6b222f21e909e467dc649c6584b363ad2ca31cd67707501f1e0f58a608a1554a92dcadc91d2c7c9839caf1236bfb3fca25429f485ec02f06fec21 SHA512 bfaa4e56e79d3cadc5f4d6598c06502b97c2337217dcfb6ca9025c261e98828d2ce017ec3fa675b996db18ffa183cccbd4b5e3126db0404d0ed872f0e9325900
+DIST rust-1.84.0-riscv64gc-unknown-linux-gnu.tar.xz 221099540 BLAKE2B 0941d02fed906487753188150220c7e5a957e68b40e2e33929a74c6c520d34b2547307f74738ca6728f7e68213da81c5d2b07bc8b5ab7c0048bb222cc4aa2d6d SHA512 fe57aa11719164bb3865049ac91d1739f02e098f096db77a290f55f22423a870e1e0bc19d3ae2fd0bf32e5c6c9b10d5f3884b0070c5ffcf58b5d77598653b811
+DIST rust-1.84.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B e1100cd2dc56582472c312ce4d2a161a85cd371fc42bd281b14475f4ed922a38e8b79068aad5cf66c2c489965f782733edec1f72414f4b88628e4d661fea9014 SHA512 d54d69eca7651d166fa9c52bba562ce5008d5e6fd96eab8499a8dc9dcd178f009228e1d6788a4023478b29c2e477a379c6a2cc2b5c015072d87bbe929493eaab
+DIST rust-1.84.0-s390x-unknown-linux-gnu.tar.xz 225691648 BLAKE2B e007b7c08998a488162721b418c9bd22dcb8ffbe450da543be285d4708ed366fc01f0bc6f668b7058e544c3df7025977454e3aa98fd98d29970be28e2a6d6438 SHA512 cafcb20513a27bfdb9d4caf0e53f929f30f40592f340ee6683294ef52c438c913381c677b6c266efe85b2980ddcddf7d2f90fd22b2482a6ea7348084e5638598
+DIST rust-1.84.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 27b6afef3ca0c4df951e678469548784cbbc339772297966a449f17869ff7c47bad72c114edaca66d79dea6a63cf38755fa2c439e9283c7bb786a9c4eab02fb9 SHA512 6656f2ea30758ba23f7a1ac330695c262cea1c82d33bc64e968d8bbd5b39366e8d8e0983f6bdcbfa818225b63863fd941eeb9090d024e3d8ba254cb99f214a2e
+DIST rust-1.84.0-x86_64-unknown-linux-gnu.tar.xz 183288052 BLAKE2B 6a9bdf25e8ebdad1e8b36feee4d152235397eb3a52351a166905f350a8fccabdc4f03f4c1e490bc81d4f403f2810b37aeee964b49f4c375a9792ca8a054c61ac SHA512 4d37691577636ecd233e4c507da4aa2c6c31f965fec29a59eb22bbc6c8d765eaf95d63fc1ffe8ba9ad309f5a0a712e60c5a94a832164bae283f06b41fecc2579
+DIST rust-1.84.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3ceb1130faa28ed9caf86b0c66471b04aa2663bf6188230fd96a0c0d4ff7a4255cb0e7e3e6e71d8a3de86798bd7f53ccdafe21285ae247d1f1718fbd0aa04d31 SHA512 bb782d01731f8aeb4a54555ac2163bbf625e83a17f5d8e10fa76217b345b247b4d653b5bada065fe647c8b19e1dc66316b1ebea252525fa194cb7bdc6370c59b
+DIST rust-1.84.0-x86_64-unknown-linux-musl.tar.xz 263170948 BLAKE2B d4e43adbcc8ab3f49306d5ae624340f7e7b0844821c74140997510ca40d4bf252ff698e1295ab8138bae237d079c1e3cff6a46f895f55fbb7ba2c93054e1648c SHA512 6cf083cc2cda4591314ba49a302aba2aec8fd036eb9a72b775d16561d0739df23a1f3b0cb44d6539a068a47730142b09aeaafa1b0756703c51b539851e59bee5
+DIST rust-1.84.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 9abf6ad52601fa64e807a71bb6af5a9fd8c3ecda5589ec7232ffdbd7884db67535a5845216fe7ab9133fc114fdc12caee436bc1bb78a163f94a021060459b1e6 SHA512 f9a0c7fa85668b034f0a0891ddc0b9d8f624589c8c9485421e199abc9a82dec481ef3491a4e1286fdf6c6863221e7761cada393697ff1da93716321bcbca679c
 DIST rust-1.84.1-aarch64-unknown-linux-gnu.tar.xz 241951328 BLAKE2B 39af8e2258ee496150c12204975c44ddf8dd54f4bdd9414d774444403b9d9f997d6b0ea06c86a850ce75f8bdfb2049076b0487132d3df69fd0c36c6d290dea7c SHA512 285720f5da5eb6fc4d10c98e0d5e5961ec73fb8c99f2fdd60e7954c5fbae27f01ee1f97542af4c6181b2f8071ff0e0f4d7fb53d4019f355eedba19698af93c45
 DIST rust-1.84.1-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B b9624946128ad2d054d9f4ae3b54aa40657c4deb92a6fb44ad4f38f79ab24afa0c5a568b21ec54e62862ff7abf57102b424cc1383920f67f23be20902e1e5ab8 SHA512 23bba5bd8cf9c3ae591c6f48261b7e54be532dfcb6ffe133c6b374b831e3e00df54c89de4b6f34787dd1c5801c130b1d7b8a3168be46a97d3e412832f56c11e3
 DIST rust-1.84.1-aarch64-unknown-linux-musl.tar.xz 218987176 BLAKE2B a5ce111633f0a999754878b1ed77c5ba2fd3e3649fea2c23c85709b168bea49c110a1f04e35b67381e724c0a942837ebfce1a06f4dbe545ba2edb64943d39265 SHA512 c3d9c0c25a0a722f21cf9515ac4f9f2cdc8b37bc0c8cae2239fd9924748f92d10834a41a85672b63740a6687c0cc75be33e2aab5c982acda7cd0c0571ad89641
@@ -471,6 +507,34 @@ DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-gnu.tar.xz 182371436 BLAKE2B
 DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 56f1e00d3e7ca2092ab7a5cc3e8465af4037ba99100e0773c4a65867428fc8adbeb0a571cae36ac1dd182c24eb5e5b89e306f476ae357ab387f6d5ff4d6a6bcf SHA512 bf17821fe53a0de5bb58ab03e87a9cd326bc4c97941a306909375285014bcd1126e5e32d62dac4a522f7a72b892c8371dfa3111f25d661a5d4e1a2ea802d3cee
 DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-musl.tar.xz 262699948 BLAKE2B 2197f33e5ccbc2e31925457c3af92ffe90dc258e66e9788a7520ab7a9ff3571214f099b14f4db80dff38e519a6f57784e85f335765816c7f44ae2edd96ea04a7 SHA512 a074b931d940bbc0cefb2d56fb9437afa1d002cc599a1779422d0f215eb9382b5b0322e31e0c92408d958ee561dcc9eabe237a6f8c7158986cd10ae550f4d9f6
 DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 2b0c359da43e5b3645632f88bf6f776763571ef7d08d043ee806dc4991fc84b9d0c0b87b10cf12cf354c3a026d0665e17baf1316d00b10f3fdb1f47d834dbf6a SHA512 30013c2d6ebb6d63a49f0a54be584e7dbfe24ae4065313e70cae138c8533bc0afc2c46f05862828f1a97d3c398be91e140380b1d3d83c0a54976dfe3b5314efb
+DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-gnu.tar.xz 162271496 BLAKE2B 22059cb1174fd4fd4b603e10049e76fd2054c45352275abdf4a4183a38d4cefc7092d04d8f14329f60e9e4df0cd61cd1cd3cb46e148220a93e0484c55e7bffcd SHA512 aaa94fb98888c59da5dc59cab31d028248e15ce458b6589383a3ff54833783906580f40d2fe62e119cd7a22e1cd443724d61b4be4e81d30cb233a76afcadebbe
+DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0697cf3f3bf9e1d56ac12dd223d47ca9311569a6f2579892628217567994ea29f5e3bb13479a0cf0ca6ef52864bbeb8f59349d0de08bc56e4afe1171e87011c5 SHA512 1c179f33aaa106d4a3f28c552ca298ebe2e9015faa63d40e97f0ceea45bde9408bb3a6c5a599c5a43ab71e6fa2fea1c4f066d0b951ed08377bc8c4121c9392c9
+DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-musl.tar.xz 235432052 BLAKE2B 72bd9899a4c2cc68557e4513c164dde533fe74e1f34ab4579ad3cc595b8df5a6d93fe42d36b50e2ffc20b6bb5dcb92c6512cca63899c64b9f7664495adc4d68d SHA512 d1024147ce447b039b3a9bf09b258ee0cc4e4bc9a3e033c118e00859377766d832c2f5642116eb8a5e7f18814f7e1d459de7c30d13f284ab5e6919644a1cb248
+DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B b281059472df1c4d8667303a30a1dbc5ca3664606c44ff257015c29685f321cb0085cd89778458f510775f18cda00408ee113eec8117ee111f3f92218ebd620a SHA512 c7b5de9c70562da1e5a4c306983b7e4ce89942c46cfeae68ee622b098b389d41a0196566e16d218f5f4a3c1019c96ce04ab574a56e0ff750ee5b69b9c4ffc26f
+DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabi.tar.xz 219585140 BLAKE2B c61538b9a86311691cee13e4113416e62801b9d1e845df73e5769e14b5c400607c797e0f37bf211811d21f31af297a69800af409180ae5eb908dfc2814033ce0 SHA512 54c569ced50acc9895029eccfda0767f980e0a23066142d4b3675408b023105ccd6f706b3726bd35bb49cec4c9510adb7cd7c353e7be1cf6d1f69db4548499a5
+DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B d969bc52bc28db30754e180e3427cbb39c376c6ac1eebbaa7cc00d2016726f0adac2d39ba348f5b1ff79e2a1c728cad3eb9c4cc1c972b399ecbf15fde0486a0c SHA512 586fb0eceaf36ec9017da40365ba8fc87eaa21a5533dc30d92c62d63bb02a2b80a8e712d0b449e06ee374ff797a1c9b0902491bebc94c179d938c6cd9351eda8
+DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabihf.tar.xz 220847580 BLAKE2B 227afc76a06443fa9fe0d6295c6758760fc541f586b76378a23c88ec3bcd8bf65aed2ec4c17d448202635fc75473f907888c657392eff470b76db745f9bc5f39 SHA512 7d2a15c3dbc741240302dd08219df6171d0f7d1132e68695ab1c6a080790cff413c8824c5bddf8ffb82173f0516f47f6d0c805cbcc8565379cae7e8bbced1874
+DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 3c63b838061849ba629dd0a59b96105f2745f47066d8e61f1b201841022c3da628f325776a3f56c6cfc0bff90e7a49b008eef4d8299f05e0b2cdb4b3c1e5434b SHA512 e28d8fcd075cb3b681262cd68797b0d25d241a81b6f2617ddba4b56bfc97a1122f20874c20f3e20ac5102db8cc561d0cec6790e4ebce206b919bff96118a8911
+DIST rust-1.86.0_beta20250225-armv7-unknown-linux-gnueabihf.tar.xz 225818148 BLAKE2B 0f256ffe120a1c1b658a32b1fb00698786e36efa831cb31d8229eb48aa942ec68188e0a5065d8d6f8480081d09848d81aea1699fea4804edcf4fb14ae02bfed7 SHA512 ee275b10a1dc24d27e1215a21b633e8c8df21dbf441bae2bb8ae0e03a86e03403ddf0cf53d721e0f3af9faab4bf68d0f126fb08e1409d8e287b41231dce84efa
+DIST rust-1.86.0_beta20250225-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B dbec13daecf280cc954f8b696c258da43f8ac17ab5c2a5e33b58e38206bcc547ec07ef3ba751cde3d7e55fb78bd3894707d144749578888e42b2ab5435f94640 SHA512 458c6428dcccd6de45745c1350a9f6cb3ce13e974a5d2b8473be863cd0fed1eb504dc771b243ee19fac056b4113ea81c030a032281f5cee8372aa0c82cd5488f
+DIST rust-1.86.0_beta20250225-i686-unknown-linux-gnu.tar.xz 255115448 BLAKE2B 112a9fc6c4c6dbc022536e561b35dc89051f26eb458cf38633c7f7d2911d448d8a55a135efa0b3cead6267a9018bdc6218abffc967624f95193fe5d6dbac10ca SHA512 a60c5e3f55d30967314ec9b312a439b1302d5cd18d0dd8ca3666f3344cd9512b7cf7bccce8002af1d7eb4db082ec7ce3b3b59b9abee23a803175e6780659e89b
+DIST rust-1.86.0_beta20250225-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3b68d39f4780ac9fa2fbbf6b0c73e8d6ec91bd37951fa33564bd654ebb51c26d0726108f9ffdb39c570b73d736eeb922b17a76bfca0cd8386dde87d902d8e111 SHA512 ccf36b6f2fbdd5ad48de463164b6b5f9e53c70a7b9146295d482dc1e89c4eef79bc26306c49a73ad22c42840023cb72f520bb5a8e1c496f5025646b1530d5a59
+DIST rust-1.86.0_beta20250225-loongarch64-unknown-linux-gnu.tar.xz 251914240 BLAKE2B 99744c8f40dc90e17471995aa1d4087b40603d20f9114972cd860b00ec546c6828c364d5b7a86ace8d7f87cdc829e0711f758e495a7e188b0e264a0ef705cc44 SHA512 25cbe1f3167b560d31b7b41635343f4819b90bd83ae76dfcafe61169b7d0a37e5f68784ea3a7a659a05aa649b040f9b62864cff6139190a3e009be1f589b0d55
+DIST rust-1.86.0_beta20250225-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c49018b1dab4948842839424b62f6339253d6dd89ca3aca52bb83a337327329341824bfa7b0aed5f8450c694cf90a2ae39381ed6bda3a2ba98a0ea5021da10b1 SHA512 c2bdc1386c905ab7c0bc5cfa0eaf9aa5f45500b8889a872131ed44182839cfb447719fc6fc2f5ed6fb9aff2ba732dd640448f848e282dd532b52568641e1add8
+DIST rust-1.86.0_beta20250225-powerpc-unknown-linux-gnu.tar.xz 243643276 BLAKE2B 31291d0ee4fd5aad13d6fa05226ad5cf189627aa0abea3e1a2f540bf77ce5fc6167ffbec96a64e515baad7288559bd40e7f464fed2ced361d201df0d11880ded SHA512 110b2d9138024cdc5cc0a6e6f34961e4b3eb16409816d72d0bda63b5cc4044e7f6a4fab10c69737ad362900bac36d4721a9579e176989a9f9442eafca02219c9
+DIST rust-1.86.0_beta20250225-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B eaf72f9496626ce42a3006d31856e5da84da35573b825531c9969aeb05f6c4bddec6d771252056376c7c511ffdd0b56b95f4e5c87b29dbdfc338cf89d1976fc5 SHA512 f669a60884700029bd38602163c310854091b6658681afecb73c4b209ff91c11b79836e01758c384cd52dccf8919b37874865e7292d1f0b029c455073ae0319f
+DIST rust-1.86.0_beta20250225-powerpc64-unknown-linux-gnu.tar.xz 239855984 BLAKE2B 758f1e7b7c34cdcdd5d901616200eacedaccbfdc86de066b4b14d4e8106c4850e732ef29c530018bd6da27d1e6f3105abdd1d887a4231a35e77bc4c240c52b43 SHA512 43a77d18a640dfb6ec0bc04b67eb85b7ca40fbc27c4b165db1ff53b1caf9a024bb4a4441be3944ab1b2b4eee56c2001d076ae4c48a5aac3ee01d5df87a0ea95a
+DIST rust-1.86.0_beta20250225-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 24a8e9c459fdffe21f85af6106b691beb60a8536e33422eb3f9cba9c428cd8045f82c58766ee59860e3044e1240f1f576da5456da3df01c29fdc318b3eb2c7dd SHA512 d6b8b731057529396fb6e00891a77e27ccebf70454e3557fb56051a62feceff6d7c42564eb82772b30f5159ba736ef03173a7723bfe31222164ccc48fbc40110
+DIST rust-1.86.0_beta20250225-powerpc64le-unknown-linux-gnu.tar.xz 254298220 BLAKE2B 07d6e7fde5a6ed8191003bd52e1968fce10bc05c18a2d17d771358f329523b4edaff6773ec8c0d1182bea6f4e5644caf72305765ae2aef8a9adf0ee5ba689885 SHA512 040a81b3fb1a8f5ef9cea89a43395dd616a9671eadf1ceb7a47fdb0733bf7e26f10afae6a4000f9f2271dd8a683d508ef7c82440758dea91ac4672ccc5344012
+DIST rust-1.86.0_beta20250225-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6e1b092134967544131c707cf5d7c58a456ab5da3ac67834ec6b5cb96a9229d83c34e0fff5557c7790357e47d3d85d230362f5af786dd6c0e6e5c44e16c29799 SHA512 58e303ff074c58365b208e75107c4d5b42a4c9c9ba3546db1f792cee361b05428e5dfaac39c3a74d65b09822269e596ff97684cb43dccbee1ea47ae21c460370
+DIST rust-1.86.0_beta20250225-riscv64gc-unknown-linux-gnu.tar.xz 239076740 BLAKE2B cb669a3fdeffb8e7258beed158ecf651dde434b8efb58cbc2b3f495674e579ac9be906bc609d3274dcf8652a9277f599884ef4c06271f41a7f781bdb1faecf1b SHA512 0cb72f0ad90624e841b12553fca2244714bdfc10c3c936a85cf89660b14f9ba37fe6b067f1c9189ace57215a7e2e6fe438b8e35bc255ab9374bdf05f748997a6
+DIST rust-1.86.0_beta20250225-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B eb2cf05cbf16ff7c80fdbdef9a8f29100bccd672583e862bba97f004480664831d6f0edebf409c22fa4dba56dc9d62f3f4c2a15f1351b0b28866bf88ec702f9e SHA512 a680ad3394d3b9bccbf4024c527dee201b7c915062e891c414317575da78edb46be9c392efb94edab8a305103c806140e9dce0cc25ab9a6a3a4c8336f026d12f
+DIST rust-1.86.0_beta20250225-s390x-unknown-linux-gnu.tar.xz 241511808 BLAKE2B aae89cf0a53b5763632eca6f4b033e6254f19d0a2ca88351dea14347b52d7ebb406a899fa788cd0d402172e8af754d0a2b67ca077f93495e2f6030118f36a0f6 SHA512 92661da8e796e6a29809fd000a2353de29a4442ace6a4c42f338149066dad85e30759f7c13438a7dbbc4104639d4114a6b135143ed54f12d4a0ef2fb07357603
+DIST rust-1.86.0_beta20250225-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B a0dbaee450c0e8b9fbe4348cad60ca9bf5955f2f9c22b2580f9b43af5dcde3317647e4396266ec7e7dc8ceda4c05e0fa1cbc786e4673038ac664cc9909d5e66e SHA512 4ade36c52247a40973766b8428714f2d8d6ad2314f45f550dfdd90ce24d7445ced977723f55aec2d4d5fb162d4ad5371c25012dae64d835b6637df851d831dbb
+DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-gnu.tar.xz 192552128 BLAKE2B da3d4634b7a57a5b438b6ed8e1e37f155b7c9c141ead0e6861b173938c9e1fda3e1e6da0fc966e089645dd93d32354ae29b8b1f1f5b04a05548004692c4fc379 SHA512 0580762b898ef905739e7fcf097408737e3bd3afebc6b3bcf2db54d98eae0b0cc38121c2f22bb28524ed0b29e4c2446eafdd895283f7ff479df14a1760e979b3
+DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 615efe0198fd03883301d6e205577a05fda902d47ffbf9ef90fbb96c8275548b490c5ec2c530bd6dfdf18e1596b6c427f00724a3adc3860e107df03c864ea7ee SHA512 d10f522df9bfdb515f725acd018298fecb90a70171956f5c48e62522f596d34496d76ace0e05606cf9077c6e797e17ea4d086f6d4c055f53fa8d12aac1e93ced
+DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-musl.tar.xz 283004932 BLAKE2B e0639e06159347d160d0d90f9ecc0739cfa7da07895250d8b9debbfcfbc689e5ddbd0d8a4c1d08d61f8b5ab05b9b2f50613798ce78d57b4fa274b4a3c28d60a5 SHA512 03515dddb9820b3c159d358388a78def71879aa4e02735fc69aed6a6eddeec457f4b231b9d6ae3daac7310e6370bdb368b65749f869182640319ac983c7b7dc4
+DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 89ce6eb6a52f7bcdcf5d5001c823c2d596e1e186d7a91c834b893b7be0af1ef442dd588398b05f60eb9f94777395b59bd72e0943a2e2c3c4a1d27147a62f18fb SHA512 f58230280ed4743a8b298fe45d36fbc44742f1e0e7867b95d47d3fcfcf723de5302a489a150a011864b5cbc7707ae0d340e45d9f013a0224e8c2fcfc57f4d5bb
 DIST rust-src-1.71.1.tar.xz 2460244 BLAKE2B e3a5b5bfb808310f96e760aab55310c7a790fa551d248c9c5dbb407e0a80653563d8df73a9e0973aa63d3286aad6c755b78098dd8db2dc1a2ed3cadb926b40e1 SHA512 659cc46e1ece2ddbcf5ab748bae48843bd36353cc633b59e4ac062d843af66919e8d5c39ccb72ebdbf94a0e26a8056ade6bd1c8fe9a936469bd405122a8ae35d
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
@@ -482,6 +546,8 @@ DIST rust-src-1.80.1.tar.xz 2870456 BLAKE2B 9096fab01b38cc3ea2a32a2ab2e9052e5988
 DIST rust-src-1.81.0.tar.xz 2901440 BLAKE2B 7ad2855c21728cc323108f7e45416a425a222e550c132818b302dc2b9fabc1281e560b0f097e1fc41e682f52b4524c69737096e12cc9e97a677828efab96dc2b SHA512 d38b1afc17a4cc7ba67d2e1b7d3dfbcc2a61ad96e87b130064d6788538817c27bce06c9fd7a4733de5b5862ff5f6aa441bf71ebaaae9ff80a86c354a6ec05e14
 DIST rust-src-1.82.0.tar.xz 2966368 BLAKE2B 4162e7393ac21a095ac1541ea7b62fafa561ce2153bdd2b3723d0f2e0130fb2fb1325ac8583d87d64b6cf6b76400d12aaac144c781e89a177483adb46854c81b SHA512 4f7817eb16dbddf15ab09206738569370c42abe117086b085a7cc8f7174f9c2b42571707558642c72597236610eeeca32575b665acbc2cbc4f7709e624c16cc4
 DIST rust-src-1.83.0.tar.xz 2998424 BLAKE2B de758c5bfb29865a3ab7ab02d17b0282272fa7d1cf5da333a6a19d6a16813320317785e9bab02e3ba9ca6ee9f26e0c96b00a117f33b74c82b13ece44133e3130 SHA512 e1f0ccae1fd4202d86cde1f1e2f4491983ec49fafb2b9eaca6260e9173bea0e0cc2567946e48e3ce48f0a620f63dc44d30334f06c935628158de110d43c7d53b
+DIST rust-src-1.84.0.tar.xz 3016148 BLAKE2B e948d4edb88f81ecfb49f56a3ca6331c4e9de17bd9f56af823e1cefdc5098abebc2bb013d7c12ca1713a43fec588f33befcb7146713eeade1511914f70146d62 SHA512 ccb45d57c7cdac311478a5b4689144297717e6404f9c4fb168127804f13f72c15433b32765f90ce56e6f34435229e754241cb3656b28a4b33c6070b6f79b7c53
 DIST rust-src-1.84.1.tar.xz 3016012 BLAKE2B c9edeaf0797a22e384c54b3fe3e7c833464c09f8828474e05400a561a369d836626387caa495689e4b14fad691a85d6859098c84347211a6f79e2ef2c8d9d6f2 SHA512 564c440a05b67fd3a5dcb4dea21800d32ae65ca12230b804b5efa4bd468fe1b185bd7ed89041782018f70f60afd7554d7755edbe20e9cdc930a9fad390deb317
 DIST rust-src-1.85.0.tar.xz 3036988 BLAKE2B b7281b23eef60cf052e1641a29915c02c590166a73e5ae75890072ce80f95a2ab71cead3e3da7adf757ec0352d1dcc87ba4c3070282a27657b34420fe24a0c16 SHA512 613cfa603dc457cee34b154acef9573d766ce5757c9e8342b13d362f2e62b4cee47071a59df9fd5fa42ecade1a9efdada5784402aaf7254d5996558533bff8db
 DIST rust-src-1.86.0_beta20250218.tar.xz 3035860 BLAKE2B 506df30188382d43798c6661a8b730c10a74a230bf5ceb7c04f2892f14a45630182ee174f79b564dc5a6dd8e3bc84963b8391fc9641efc57d0ed90e69b89d545 SHA512 4c7cc4d1860f7d97f615ff5dc030754a7fb72d1eb47b27a2e25dbb5a9b0326b8a1b82b6b60a784da910c4730d3b728bb27e1d27f30dabdb7e455143550f0c424
+DIST rust-src-1.86.0_beta20250225.tar.xz 3053616 BLAKE2B 19abffb74a9926c73fd112589be340b2955e3117d4344f4185de08899be5a5ac9835395e601224f21e63fa0f91053fb39ca02e98a6442570dd54c6b0a39f85a9 SHA512 57b8eb0fa06e5ee37d89ee486375b7022d2085fcd88061a20c3e8406c312fa912bc0b52c9259bb3682bbba1e2ea4b044eab9f9ae66262a67c19657033fe918e1
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild
new file mode 100644
index 0000000000..99ff19978b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild
@@ -0,0 +1,252 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL="yes"
+
+inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+
+MY_P="rust-${PV}-r1"
+# curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
+MY_SRC_URI="${RUST_TOOLCHAIN_BASEURL%/}/2025-01-09/rust-src-${PV}.tar.xz"
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PV}-r1" # omit leading slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+SRC_URI="$(rust_all_arch_uris rust-${PV})
+	rust-src? ( ${MY_SRC_URI} )
+"
+# Keep this separate to allow easy commenting out if not yet built
+SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/${MY_P}-sparc64-unknown-linux-gnu.tar.xz ) "
+SRC_URI+=" mips? (
+	abi_mips_o32? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips-unknown-linux-gnu.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mipsel-unknown-linux-gnu.tar.xz )
+	)
+	abi_mips_n64? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64-unknown-linux-gnuabi64.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64el-unknown-linux-gnuabi64.tar.xz )
+	)
+)"
+SRC_URI+=" riscv? (
+	elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-riscv64gc-unknown-linux-musl.tar.xz )
+)"
+SRC_URI+=" ppc64? ( elibc_musl? (
+	big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-powerpc64-unknown-linux-musl.tar.xz )
+	!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-powerpc64le-unknown-linux-musl.tar.xz )
+) )"
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV}"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	sys-devel/gcc:*
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/${P}/bin/.*
+	opt/${P}/lib/.*.so*
+	opt/${P}/libexec/.*
+	opt/${P}/lib/rustlib/.*/bin/.*
+	opt/${P}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+pkg_pretend() {
+	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
+		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
+	fi
+}
+
+src_unpack() {
+	# sadly rust-src tarball does not have corresponding .asc file
+	# so do partial verification
+	if use verify-sig; then
+		for f in ${A}; do
+			if [[ -f ${DISTDIR}/${f}.asc ]]; then
+				verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+			fi
+		done
+	fi
+
+	default_src_unpack
+
+	mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+
+	# start native abi install
+	pushd "${S}" >/dev/null || die
+	local analysis std
+	analysis="$(grep 'analysis' ./components)"
+	std="$(grep 'std' ./components)"
+	local components="rustc,cargo,${std}"
+	use doc && components="${components},rust-docs"
+	use clippy && components="${components},clippy-preview"
+	use rustfmt && components="${components},rustfmt-preview"
+	use rust-analyzer && components="${components},rust-analyzer-preview,${analysis}"
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+		echo rust-src >> ./components || die
+		components="${components},rust-src"
+	fi
+	./install.sh \
+		--components="${components}" \
+		--disable-verify \
+		--prefix="${ED}/opt/${P}" \
+		--mandir="${ED}/opt/${P}/man" \
+		--disable-ldconfig \
+		|| die
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${P}/bin"
+		find "${ED}/opt/${P}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${PV}"
+		ln -v "${ED}/opt/${P}/bin/${i}" "${ED}/opt/${P}/bin/${ver_i}" || die
+		dosym "../../opt/${P}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "../../../opt/${P}/lib" "/usr/lib/rust/lib-bin-${PV}"
+	dosym "../../../opt/${P}/man" "/usr/lib/rust/man-bin-${PV}"
+	dosym "../../opt/${P}/lib/rustlib" "/usr/lib/rustlib-bin-${PV}"
+	dosym "../../../opt/${P}/share/doc/rust" "/usr/share/doc/${P}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${PV}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${P}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${P}"
+	popd >/dev/null || die
+	#end native abi install
+
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
index df7968f995..c55c998662 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
@@ -40,7 +40,7 @@ SRC_URI+=" ppc64? ( elibc_musl? (
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
 SLOT="${PV}"
-KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild
new file mode 100644
index 0000000000..e37377ab23
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild
@@ -0,0 +1,322 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-02-20/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PV}" # omit trailing slash
+	MY_P=rust-${PV}
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/${MY_P}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( big-endian? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-powerpc64-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+pkg_pretend() {
+	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
+		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild
new file mode 100644
index 0000000000..ab225d2c12
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild
@@ -0,0 +1,320 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+pkg_pretend() {
+	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
+		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild
new file mode 100644
index 0000000000..97bd2bca57
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild
@@ -0,0 +1,317 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL="yes"
+
+inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+
+if [[ ${PV} == *9999* ]]; then
+	# We need to fetch a tarball in src_unpack
+	PROPERTIES+=" live"
+elif [[ ${PV} == *beta* ]]; then
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
+	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
+	"
+else
+	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
+	SRC_URI="$(rust_all_arch_uris "${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	# Keep this separate to allow easy commenting out if not yet built
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" mips? (
+		abi_mips_o32? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+		)
+		abi_mips_n64? (
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+		)
+	)"
+	SRC_URI+=" riscv? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+	)"
+	SRC_URI+=" ppc64? ( elibc_musl? (
+		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
+		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	) )"
+fi
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
+
+RDEPEND="
+	>=app-eselect/eselect-rust-20190311
+	dev-libs/openssl
+	sys-apps/lsb-release
+	sys-devel/gcc:*
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+BDEPEND="
+	prefix? ( dev-util/patchelf )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
+
+REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
+
+# stripping rust may break it (at least on x86_64)
+# https://github.com/rust-lang/rust/issues/112286
+RESTRICT="strip"
+
+QA_PREBUILT="
+	opt/rust-bin-${SLOT}/bin/.*
+	opt/rust-bin-${SLOT}/lib/.*.so*
+	opt/rust-bin-${SLOT}/libexec/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
+	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
+
+pkg_pretend() {
+	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
+		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]]; then
+		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
+		local rust_bin_url rustc_src_url
+		# Cut down on webrequests by fetching the nightly toml once
+		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
+			die "Failed to fetch nightly revision info"
+		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
+		einfo "Using nightly Rust from: ${rust_bin_url}"
+
+		if use rust-src; then
+			einfo "Using nightly Rust-src from: ${rustc_src_url}"
+			# We need to fetch the rust-src tarball
+			einfo "Fetching nightly rust-src tarball ..."
+			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
+				die "Failed to fetch nightly rust-src tarball."
+			# no verify-sig here, just unpack it
+			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
+		fi
+
+		einfo "Fetching nightly Rust tarball ..."
+		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
+		if use verify-sig; then
+			einfo "Fetching nightly signature ..."
+			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
+			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
+				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
+		fi
+		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
+	else
+		# sadly rust-src tarball does not have corresponding .asc file
+		# so do partial verification
+		if use verify-sig; then
+			for f in ${A}; do
+				if [[ -f ${DISTDIR}/${f}.asc ]]; then
+					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
+				fi
+			done
+		fi
+
+		default_src_unpack
+
+	fi
+	case ${PV} in
+		*9999*)
+			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
+			;;
+		*beta*)
+			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
+			;;
+		*)
+			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
+			;;
+	esac
+}
+
+patchelf_for_bin() {
+	local filetype=$(file -b ${1})
+	if [[ ${filetype} == *ELF*interpreter* ]]; then
+		einfo "${1}'s interpreter changed"
+		patchelf ${1} --set-interpreter ${2} || die
+	elif [[ ${filetype} == *script* ]]; then
+		hprefixify ${1}
+	fi
+}
+
+rust_native_abi_install() {
+	pushd "${S}" >/dev/null || die
+	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+	local std="$(grep 'std' ./components || die "std not found in components")"
+	local components=( "rustc" "cargo" "${std}" )
+	use doc && components+=( "rust-docs" )
+	use clippy && components+=( "clippy-preview" )
+	use rustfmt && components+=( "rustfmt-preview" )
+	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	# Rust component 'rust-src' is extracted from separate archive
+	if use rust-src; then
+		einfo "Combining rust and rust-src installers"
+		case ${PV} in
+			*9999*)
+				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
+				;;
+			*beta*)
+				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
+				;;
+			*)
+				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
+				;;
+		esac
+		echo rust-src >> ./components || die
+		components+=( "rust-src" )
+	fi
+	edo ./install.sh \
+		--components="$(IFS=,; echo "${components[*]}")" \
+		--disable-verify \
+		--prefix="${ED}/opt/rust-bin-${SLOT}" \
+		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
+		--disable-ldconfig
+
+	docompress /opt/${P}/man/
+
+	if use prefix; then
+		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
+		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
+		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
+			while IFS=  read -r -d '' filename; do
+				patchelf_for_bin ${filename} ${interpreter} \; || die
+			done
+		eend $?
+	fi
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
+		local ver_i="${i}-bin-${SLOT}"
+		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
+		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
+	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
+
+	# make all capital underscored variable
+	local CARGO_TRIPLET="$(rust_abi)"
+	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
+	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
+	cat <<-_EOF_ > "${T}/50${P}"
+		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
+	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
+	_EOF_
+	doenvd "${T}/50${P}"
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+	/usr/bin/cargo
+	/usr/bin/rustdoc
+	/usr/bin/rust-gdb
+	/usr/bin/rust-gdbgui
+	/usr/bin/rust-lldb
+	/usr/lib/rustlib
+	/usr/lib/rust/lib
+	/usr/lib/rust/man
+	/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		rust_native_abi_install
+	else
+		local rust_target
+		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
+		dodir "/opt/${P}/lib/rustlib"
+		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
+			"${ED}/opt/${P}/lib/rustlib" || die
+	fi
+
+	# BUG: installs x86_64 binary on other arches
+	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
+}
+
+pkg_postinst() {
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
index 2e2e6314f8..6338d2da24 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
@@ -62,7 +62,10 @@ RDEPEND="
 	>=app-eselect/eselect-rust-20190311
 	dev-libs/openssl
 	sys-apps/lsb-release
-	sys-devel/gcc:*
+	|| (
+		llvm-runtimes/libgcc
+		sys-devel/gcc:*
+	)
 	!dev-lang/rust:stable
 	!dev-lang/rust-bin:stable
 "
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.84.1.ebuild
index 778c5e0324..5c676ac678 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.84.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.84.1.ebuild
@@ -27,7 +27,7 @@ S="${WORKDIR}/${MY_P}-src"
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
 
 # Legacy non-slotted versions bash completions will collide.
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index 13a4945a02..72b7226b18 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -1,4 +1,5 @@
 DIST rust-1.86.0_beta20250218-vendor-in-install-phase.patch 22553 BLAKE2B a99d31c5ceeec4c74453849d87c35969ad3924cff48861a1c3009c78ac59440c8a1bd3088f0dace262558cff27197a932f3c81872d4ede4f3c5a03c27e6dc316 SHA512 228c551b7dfd4b43e3b34a97c7d55121cfc15f4c999c15e8ee2a30b41757099ae493148aaedf86f5e4e4143e26ae02464ab725162f1dcad68a0315cfadf3ab8a
+DIST rust-1.86.0_beta20250225-vendor-in-install-phase.patch 22527 BLAKE2B 79c800e3ea5eef31e5603a6f3ec99606065f1c383751a989c9835490c2717620a71dc5bdc3613fbcc30ef45862090a8bc5049ba9ae6af861b20159a9cee96682 SHA512 cbfdcc55759c60b575808f2c6ec245d2ea271558295ea4ff4013933bf26252e00017422c286023a6f7089f2edcfe90c49cb06a07c4c41f2bf40e20c8dc85a604
 DIST rustc-1.71.1-src.tar.xz 151983068 BLAKE2B 3dfdbc246feb84a79ae94c2de978c5585ee06cf6b683d2245869b62e28f7c79f89cc589f5431537713bf088236a0b824acefc1b68e418e9eb72e1eea98054e3f SHA512 fd0e5a16bdbeb539184513583089e55f681cb772810df357b6b1464853f7022ac02edab3dd155b2262ed0047e2a25dea3808dd078dcdfce9d399384465009db4
 DIST rustc-1.71.1-src.tar.xz.asc 801 BLAKE2B a88c073a70552d73e2d7695eceabdaa478f34501b7271fabf7f4a09f3efa545181f34353e45776b05918e6aeba88adb02f9731454f7085a7abf1602fc6589983 SHA512 9dd0406cf22f1daa7fcfd015fc1c6f8d36586aa99bf14c1491ee464c1f892ab759feb83e8b55b64713170fb777fdbe038fb5fd01a59c911b6599223baaba0677
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
@@ -21,9 +22,13 @@ DIST rustc-1.82.0-src.tar.xz 219769328 BLAKE2B 611f33e134c2d459c9af1695c0a4d033d
 DIST rustc-1.82.0-src.tar.xz.asc 801 BLAKE2B 8138fb15b8d7ec15be45378fe663207a8e87e3c527348ab079995b1840a771ed6e9d5464eb8855ac9e006c0cfcf54b1a4fea489d31e6c9899cb03e6f4c737b67 SHA512 3cd6b27e72041baf9996efa10f25aca2e04f3e3727b60ecfd90c1bef9c52d216d2dc130802f935b110e35766645a27637a01661aa8d5acf02bf64b02a107c93c
 DIST rustc-1.83.0-src.tar.xz 353808388 BLAKE2B 217c85f7351a7c57a2684da2c7c81a32094187b3812dee628b327a5b2faca57235abc54d033c586c071c8bfa0c7360bb28761aaa42fe18414e388db704d81231 SHA512 64db57949c6ac1df6a3f4c6bd0938685a5fb1bc3d318b34ccfcfccb0f9eff1cffd4d8a53a190ef0409eeca9ad12bc6234c2c1de69196cc74ae02d6afa20d0ce6
 DIST rustc-1.83.0-src.tar.xz.asc 801 BLAKE2B 3bacb43d50ebba579dc2d4f1726298a7887e303e15f039ef72b840e30d90bc2cf9cdbe4617a9ee113a2b1a48f1982e72cf30323d72cdfb9a65b5b4d734ca0024 SHA512 84b252ccaddc06cb05858ff64f582dd25823818c81b1e3a00362deeda06f09e6c36948fd316d5f0ca5e24949e6f99bb14a14dbd2af1cfbb85e679e27ab0a813c
+DIST rustc-1.84.0-src.tar.xz 354993944 BLAKE2B e4697d8a9f42484556ed490390aef535b2214ccb3715ade57936211c1c637737da5f2b9a6c53a30df0fba1744fbd80d4d1382c0b74f6b36b36098bf187557201 SHA512 9e964c1b964e74083a9002fa04b072fa8fe7a520b24ad55e88a89bb2a2a2cd5727c5438d6db425b824ae7502ab215c2dd3f49777efd65f76bae09965df2e070a
+DIST rustc-1.84.0-src.tar.xz.asc 801 BLAKE2B b1846702f36b92c479499f5eb704ce1e272131fc1b6b625c8d64c873a82ed79b1de8cceb1f21ae4b9dccf81e258547debf367b7b769ac94ed10a59dee18f79f1 SHA512 5ada0e0fed9901044eaa0d7cb657f685c7e183e91245714abe4a0a8bf3062a7de281932c7de7587220df0542511f6011d057bd8bed19d98c755eab74091cdfdb
 DIST rustc-1.84.1-src.tar.xz 355078168 BLAKE2B 849e8c909493bf76ce9749b9dcb1967180223b91a41d690bc477e78557d4e24949c9a8d8276d824af8c54ad62bc4a998e7a8efbc0bbd2008a4f64f51a7690d48 SHA512 f1cc4765736551508408126e44086988e8ddc30c1a929bf7b61c6be85ad0d65928dd5fb1041cfaeee8eb37d2208f2c1917e276aef2bc9a8e40e34f6713b349e1
 DIST rustc-1.84.1-src.tar.xz.asc 801 BLAKE2B f3decd3470fd1eff33adbb376490a30eb8db28dd4176bde0fefe4f60acf79c3dd0e1a330d519b5319360136ea7d0a124f6720dea08617202d9e9298da992ccf6 SHA512 a241fe3efba293f3e872b74f09dd0d184e0239afd1416326d57bf1134d92721c65b187f5c99962b51671877a539f18e82d2d797c76af42615c11a8bb3905f796
 DIST rustc-1.85.0-src.tar.xz 274011696 BLAKE2B 9cb1c5b9fa9b0ee8a3150d634b58f4d14c38342f19cffbdcaa4e783150f9b3c516763d549d9998d90e11377cd59e9d9442a99079aafccdc005739b075574447a SHA512 3e9c933d1d9b6e5fb081837cf07eb1638b1a6b4fd1cb607dd860c5021ba7b521edbaf8ba0fa8f182f62178b72a3e1a3e6b26675e8fb6530871137852a074443c
 DIST rustc-1.85.0-src.tar.xz.asc 801 BLAKE2B 8168c984f69356898f7a51199f3250a51c58a6512463cd5011acdff8c63754ba196bb050dba95b73d37c7e6d4bbcd3d1cb471d067a6615cd81b8969394e3539a SHA512 b96fffde7eb3d98cca6abe44e671fd4752416357ab3180d2a09a60fc022ac03d10e64ae285ef6276b8d881d6154fd7398f46666f5a2ea6f3023ea38fd543f59e
 DIST rustc-1.86.0_beta20250218-src.tar.xz 280540916 BLAKE2B ed3fe1b1ce392ffd264dd78c00e43b478d14c6bf9bc7120aa484c46a72ff904abf3ed1d1d539828a22071997860d186ecf9d5d4abed25f14cbbe0068dee06a5e SHA512 bd8982d6adee08e0b39a58786741594e0c651cd107818178aca0ded3c3272239be3c4f0f6b617679bc8b1cea67e4b5924d6bb1ae8a9d5903fb77245dd8ac528b
 DIST rustc-1.86.0_beta20250218-src.tar.xz.asc 801 BLAKE2B 8a7c489f9087342074262c64089922b97e886aa6d3f89c2a0ed1185e084c8bed07d57c363608f26536ca884d764aa43e3ade214ab4fe4e67e9c6d7e1338e93aa SHA512 d34b536200fdb4c7e85af005b1753ce88f32a1faa418a01de21de992679d744ec396fd0f9aaaf851569de1f4f06f14a6481b68b1378659b3475d30818421ea3a
+DIST rustc-1.86.0_beta20250225-src.tar.xz 280546668 BLAKE2B ea1956a83175a2cda21b6ad1ead38d8d0f6c95559d2e329bf0e4ca13d0ff6562d017d5bffbb57f9d6d232b1f87f3d190718bc0b90c6938b06763526fac083ada SHA512 782fafa305b8766db3d23796014a5897470988c9447baf4bee35d98b90382b5a727d0aecc3dabbdab0f82b6d862def8be23d8a6cf3d98cc96f18cf4a2bc38f66
+DIST rustc-1.86.0_beta20250225-src.tar.xz.asc 801 BLAKE2B 517f8d88edc1ef4ebd25d66a1be4f37718bfa361f8ae1001aca85ba626dacfef6ae27a327f33dd1ae9db7e57a91eab2d8bbfe910b5789df0998dd18026c75726 SHA512 50e3c85b7c6a7f42e094e63f4ee554d2d944a8e153ab5dbd1c2a09a1f44c6ee53cb1c4985080a373c5cb09681bc5b987e8a8e2f56a0a0053ccea99f22dc92986
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.85.0-musl-dynamic-linking.patch b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.85.0-musl-dynamic-linking.patch
new file mode 100644
index 0000000000..a6ab967417
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/files/1.85.0-musl-dynamic-linking.patch
@@ -0,0 +1,271 @@
+From be965af5421e55c0032a989b220bc0da005d2272 Mon Sep 17 00:00:00 2001
+From: Michal Rostecki <vadorovsky@protonmail.com>
+Date: Tue, 25 Feb 2025 16:24:21 +0100
+Subject: [PATCH] Enable dynamic linking by default for musl
+
+---
+ .../src/spec/targets/aarch64_unknown_linux_musl.rs             | 3 ---
+ .../src/spec/targets/arm_unknown_linux_musleabi.rs             | 3 +--
+ .../src/spec/targets/arm_unknown_linux_musleabihf.rs           | 3 +--
+ .../src/spec/targets/armv5te_unknown_linux_musleabi.rs         | 3 +--
+ .../src/spec/targets/armv7_unknown_linux_musleabi.rs           | 3 +--
+ .../src/spec/targets/armv7_unknown_linux_musleabihf.rs         | 3 +--
+ .../rustc_target/src/spec/targets/i586_unknown_linux_musl.rs   | 2 --
+ .../rustc_target/src/spec/targets/i686_unknown_linux_musl.rs   | 2 --
+ .../src/spec/targets/mips64_unknown_linux_muslabi64.rs         | 3 +--
+ .../src/spec/targets/mips64el_unknown_linux_muslabi64.rs       | 2 --
+ .../src/spec/targets/powerpc64_unknown_linux_musl.rs           | 2 --
+ .../src/spec/targets/powerpc64le_unknown_linux_musl.rs         | 2 --
+ .../src/spec/targets/powerpc_unknown_linux_musl.rs             | 2 --
+ .../src/spec/targets/powerpc_unknown_linux_muslspe.rs          | 2 --
+ .../src/spec/targets/riscv32gc_unknown_linux_musl.rs           | 3 +--
+ .../rustc_target/src/spec/targets/s390x_unknown_linux_musl.rs  | 2 --
+ .../src/spec/targets/thumbv7neon_unknown_linux_musleabihf.rs   | 3 +--
+ .../rustc_target/src/spec/targets/x86_64_unknown_linux_musl.rs | 2 --
+ 18 files changed, 8 insertions(+), 37 deletions(-)
+
+diff --git a/compiler/rustc_target/src/spec/targets/aarch64_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/aarch64_unknown_linux_musl.rs
+index 4fefdfa5c5e..bb65048a56d 100644
+--- a/compiler/rustc_target/src/spec/targets/aarch64_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/aarch64_unknown_linux_musl.rs
+@@ -12,9 +12,6 @@ pub(crate) fn target() -> Target {
+         | SanitizerSet::MEMORY
+         | SanitizerSet::THREAD;
+ 
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+-
+     Target {
+         llvm_target: "aarch64-unknown-linux-musl".into(),
+         metadata: crate::spec::TargetMetadata {
+diff --git a/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabi.rs b/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabi.rs
+index 26241dd0bd4..cab79e2bf7d 100644
+--- a/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabi.rs
++++ b/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabi.rs
+@@ -20,8 +20,7 @@ pub(crate) fn target() -> Target {
+             features: "+strict-align,+v6".into(),
+             max_atomic_width: Some(64),
+             mcount: "\u{1}mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabihf.rs b/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabihf.rs
+index 4bbde7667b9..c5f6c180a95 100644
+--- a/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabihf.rs
++++ b/compiler/rustc_target/src/spec/targets/arm_unknown_linux_musleabihf.rs
+@@ -20,8 +20,7 @@ pub(crate) fn target() -> Target {
+             features: "+strict-align,+v6,+vfp2,-d32".into(),
+             max_atomic_width: Some(64),
+             mcount: "\u{1}mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/armv5te_unknown_linux_musleabi.rs b/compiler/rustc_target/src/spec/targets/armv5te_unknown_linux_musleabi.rs
+index 62619546891..680dafe6943 100644
+--- a/compiler/rustc_target/src/spec/targets/armv5te_unknown_linux_musleabi.rs
++++ b/compiler/rustc_target/src/spec/targets/armv5te_unknown_linux_musleabi.rs
+@@ -20,8 +20,7 @@ pub(crate) fn target() -> Target {
+             max_atomic_width: Some(32),
+             mcount: "\u{1}mcount".into(),
+             has_thumb_interworking: true,
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabi.rs b/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabi.rs
+index 0436e0d8df4..e862b28ca92 100644
+--- a/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabi.rs
++++ b/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabi.rs
+@@ -24,8 +24,7 @@ pub(crate) fn target() -> Target {
+             features: "+v7,+thumb2,+soft-float,-neon".into(),
+             max_atomic_width: Some(64),
+             mcount: "\u{1}mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabihf.rs b/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabihf.rs
+index 22e49f2f1b0..acb7c99cdaf 100644
+--- a/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabihf.rs
++++ b/compiler/rustc_target/src/spec/targets/armv7_unknown_linux_musleabihf.rs
+@@ -23,8 +23,7 @@ pub(crate) fn target() -> Target {
+             features: "+v7,+vfp3,-d32,+thumb2,-neon".into(),
+             max_atomic_width: Some(64),
+             mcount: "\u{1}mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/i586_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/i586_unknown_linux_musl.rs
+index 8ad93496f3a..623422a89ea 100644
+--- a/compiler/rustc_target/src/spec/targets/i586_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/i586_unknown_linux_musl.rs
+@@ -4,7 +4,5 @@ pub(crate) fn target() -> Target {
+     let mut base = super::i686_unknown_linux_musl::target();
+     base.cpu = "pentium".into();
+     base.llvm_target = "i586-unknown-linux-musl".into();
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+     base
+ }
+diff --git a/compiler/rustc_target/src/spec/targets/i686_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/i686_unknown_linux_musl.rs
+index 6ba87c732b7..b805b80b85b 100644
+--- a/compiler/rustc_target/src/spec/targets/i686_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/i686_unknown_linux_musl.rs
+@@ -6,8 +6,6 @@ pub(crate) fn target() -> Target {
+     base.max_atomic_width = Some(64);
+     base.add_pre_link_args(LinkerFlavor::Gnu(Cc::Yes, Lld::No), &["-m32", "-Wl,-melf_i386"]);
+     base.stack_probes = StackProbeType::Inline;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     // The unwinder used by i686-unknown-linux-musl, the LLVM libunwind
+     // implementation, apparently relies on frame pointers existing... somehow.
+diff --git a/compiler/rustc_target/src/spec/targets/mips64_unknown_linux_muslabi64.rs b/compiler/rustc_target/src/spec/targets/mips64_unknown_linux_muslabi64.rs
+index 32f5c79d653..9a25fe773fb 100644
+--- a/compiler/rustc_target/src/spec/targets/mips64_unknown_linux_muslabi64.rs
++++ b/compiler/rustc_target/src/spec/targets/mips64_unknown_linux_muslabi64.rs
+@@ -22,8 +22,7 @@ pub(crate) fn target() -> Target {
+             abi: "abi64".into(),
+             endian: Endian::Big,
+             mcount: "_mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/mips64el_unknown_linux_muslabi64.rs b/compiler/rustc_target/src/spec/targets/mips64el_unknown_linux_muslabi64.rs
+index 5e7c37fd46c..4f50e8b7033 100644
+--- a/compiler/rustc_target/src/spec/targets/mips64el_unknown_linux_muslabi64.rs
++++ b/compiler/rustc_target/src/spec/targets/mips64el_unknown_linux_muslabi64.rs
+@@ -5,8 +5,6 @@ pub(crate) fn target() -> Target {
+     base.cpu = "mips64r2".into();
+     base.features = "+mips64r2".into();
+     base.max_atomic_width = Some(64);
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+     Target {
+         // LLVM doesn't recognize "muslabi64" yet.
+         llvm_target: "mips64el-unknown-linux-musl".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/powerpc64_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/powerpc64_unknown_linux_musl.rs
+index a54b17c87a7..a964f417799 100644
+--- a/compiler/rustc_target/src/spec/targets/powerpc64_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/powerpc64_unknown_linux_musl.rs
+@@ -7,8 +7,6 @@ pub(crate) fn target() -> Target {
+     base.add_pre_link_args(LinkerFlavor::Gnu(Cc::Yes, Lld::No), &["-m64"]);
+     base.max_atomic_width = Some(64);
+     base.stack_probes = StackProbeType::Inline;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "powerpc64-unknown-linux-musl".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/powerpc64le_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/powerpc64le_unknown_linux_musl.rs
+index f763c37f535..d0335506f16 100644
+--- a/compiler/rustc_target/src/spec/targets/powerpc64le_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/powerpc64le_unknown_linux_musl.rs
+@@ -6,8 +6,6 @@ pub(crate) fn target() -> Target {
+     base.add_pre_link_args(LinkerFlavor::Gnu(Cc::Yes, Lld::No), &["-m64"]);
+     base.max_atomic_width = Some(64);
+     base.stack_probes = StackProbeType::Inline;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "powerpc64le-unknown-linux-musl".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_musl.rs
+index 0cd0ea96ad3..5372a83e29a 100644
+--- a/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_musl.rs
+@@ -6,8 +6,6 @@ pub(crate) fn target() -> Target {
+     base.add_pre_link_args(LinkerFlavor::Gnu(Cc::Yes, Lld::No), &["-m32"]);
+     base.max_atomic_width = Some(32);
+     base.stack_probes = StackProbeType::Inline;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "powerpc-unknown-linux-musl".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_muslspe.rs b/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_muslspe.rs
+index b86c3c2e8e0..2305db81c5e 100644
+--- a/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_muslspe.rs
++++ b/compiler/rustc_target/src/spec/targets/powerpc_unknown_linux_muslspe.rs
+@@ -6,8 +6,6 @@ pub(crate) fn target() -> Target {
+     base.add_pre_link_args(LinkerFlavor::Gnu(Cc::Yes, Lld::No), &["-mspe"]);
+     base.max_atomic_width = Some(32);
+     base.stack_probes = StackProbeType::Inline;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "powerpc-unknown-linux-muslspe".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/riscv32gc_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/riscv32gc_unknown_linux_musl.rs
+index a07429bb0c5..cf2d7669a8a 100644
+--- a/compiler/rustc_target/src/spec/targets/riscv32gc_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/riscv32gc_unknown_linux_musl.rs
+@@ -23,8 +23,7 @@ pub(crate) fn target() -> Target {
+             llvm_abiname: "ilp32d".into(),
+             max_atomic_width: Some(32),
+             supported_split_debuginfo: Cow::Borrowed(&[SplitDebuginfo::Off]),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/s390x_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/s390x_unknown_linux_musl.rs
+index fbe8c48eca7..7a78004927b 100644
+--- a/compiler/rustc_target/src/spec/targets/s390x_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/s390x_unknown_linux_musl.rs
+@@ -12,8 +12,6 @@ pub(crate) fn target() -> Target {
+     base.stack_probes = StackProbeType::Inline;
+     base.supported_sanitizers =
+         SanitizerSet::ADDRESS | SanitizerSet::LEAK | SanitizerSet::MEMORY | SanitizerSet::THREAD;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "s390x-unknown-linux-musl".into(),
+diff --git a/compiler/rustc_target/src/spec/targets/thumbv7neon_unknown_linux_musleabihf.rs b/compiler/rustc_target/src/spec/targets/thumbv7neon_unknown_linux_musleabihf.rs
+index 1149b6d16eb..e1e060c211d 100644
+--- a/compiler/rustc_target/src/spec/targets/thumbv7neon_unknown_linux_musleabihf.rs
++++ b/compiler/rustc_target/src/spec/targets/thumbv7neon_unknown_linux_musleabihf.rs
+@@ -27,8 +27,7 @@ pub(crate) fn target() -> Target {
+             features: "+v7,+thumb-mode,+thumb2,+vfp3,+neon".into(),
+             max_atomic_width: Some(64),
+             mcount: "\u{1}mcount".into(),
+-            // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-            crt_static_default: true,
++            crt_static_default: false,
+             ..base::linux_musl::opts()
+         },
+     }
+diff --git a/compiler/rustc_target/src/spec/targets/x86_64_unknown_linux_musl.rs b/compiler/rustc_target/src/spec/targets/x86_64_unknown_linux_musl.rs
+index 8dcdc5be8a9..8be0f335db9 100644
+--- a/compiler/rustc_target/src/spec/targets/x86_64_unknown_linux_musl.rs
++++ b/compiler/rustc_target/src/spec/targets/x86_64_unknown_linux_musl.rs
+@@ -14,8 +14,6 @@ pub(crate) fn target() -> Target {
+         | SanitizerSet::MEMORY
+         | SanitizerSet::THREAD;
+     base.supports_xray = true;
+-    // FIXME(compiler-team#422): musl targets should be dynamically linked by default.
+-    base.crt_static_default = true;
+ 
+     Target {
+         llvm_target: "x86_64-unknown-linux-musl".into(),
+-- 
+2.45.3
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild
new file mode 100644
index 0000000000..4414a294a3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild
@@ -0,0 +1,711 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+PYTHON_COMPAT=( python3_{10..13} )
+
+RUST_MAX_VER=${PV}
+RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *beta* ]]; then
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC="${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz"
+else
+	MY_P="rustc-${PV}"
+	SRC="${MY_P}-src.tar.xz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language from Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+SRC_URI="
+	https://static.rust-lang.org/dist/${SRC}
+	verify-sig? ( https://static.rust-lang.org/dist/${SRC}.asc )
+"
+S="${WORKDIR}/${MY_P}-src"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_LLVM_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+ALL_LLVM_EXPERIMENTAL_TARGETS=( )
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV}"
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto miri nightly parallel-compiler rustfmt rust-analyzer rust-src system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
+	for _xx in "${_ALL_LLVM_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ "${_xx}" == "${_x}" ]] ; then
+			ALL_LLVM_EXPERIMENTAL_TARGETS+=( ${_x} )
+			break
+		fi
+	done
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	miri? ( nightly )
+	parallel-compiler? ( nightly )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${PV}/bin/.*
+	usr/lib/${PN}/${PV}/libexec/.*
+	usr/lib/${PN}/${PV}/lib/lib.*.so
+	usr/lib/${PN}/${PV}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${PV}/lib/lib.*.so.*
+	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${PV}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${PV}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${PV}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+PATCHES=(
+	"${FILESDIR}"/1.78.0-musl-dynamic-linking.patch
+	"${FILESDIR}"/1.83.0-cross-compile-libz.patch
+	#"${FILESDIR}"/1.72.0-bump-libc-deps-to-0.2.146.patch  # pending refresh
+	"${FILESDIR}"/1.67.0-doc-wasm.patch
+)
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	M=$(( $(usex miri 128 0) + ${M} ))
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+src_prepare() {
+	# Rust baselines to Pentium4 on x86, this patch lowers the baseline to i586 when sse2 is not set.
+	if use x86; then
+		if ! use cpu_flags_x86_sse2; then
+			eapply "${FILESDIR}/1.82.0-i586-baseline.patch"
+			#grep -rl cmd.args.push\(\"-march=i686\" . | xargs sed  -i 's/march=i686/-march=i586/g' || die
+		fi
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use miri && tools+=',"miri"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	LLVM_EXPERIMENTAL_TARGETS=()
+	for _x in "${ALL_LLVM_EXPERIMENTAL_TARGETS[@]}"; do
+		if use llvm_targets_${_x} ; then
+			LLVM_EXPERIMENTAL_TARGETS+=( ${_x} )
+		fi
+	done
+	LLVM_EXPERIMENTAL_TARGETS=${LLVM_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	cat <<- _EOF_ > "${S}"/config.toml
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${LLVM_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${PV}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"$(tc-getCC)\""
+		fi)
+		parallel-compiler = $(toml_usex parallel-compiler)
+		channel = "$(usex nightly nightly stable)"
+		description = "gentoo"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "config.toml contents:"
+	cat "${S}"/config.toml || die
+	echo
+}
+
+src_compile() {
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${PV}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${PV}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${PV}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	use miri && symlinks+=( miri cargo-miri )
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV}"
+		if [[ -f "${ED}/usr/lib/${PN}/${PV}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${PV}/bin/${i}" "${ED}/usr/lib/${PN}/${PV}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${PV}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${PV}/lib" "/usr/lib/${PN}/lib-${PV}"
+	use rust-analyzer && dosym "${PV}/libexec" "/usr/lib/${PN}/libexec-${PV}"
+	dosym "${PV}/share/man" "/usr/lib/${PN}/man-${PV}"
+	dosym "rust/${PV}/lib/rustlib" "/usr/lib/rustlib-${PV}"
+	dosym "../../lib/${PN}/${PV}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${PV}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${PV}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${PV}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${PV}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${P}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${P}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${PV}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
index 55697833c3..ae4c72a90c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} = *beta* ]]; then
 else
 	MY_P="rustc-${PV}"
 	SRC="${MY_P}-src.tar.xz"
-	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
 fi
 
 DESCRIPTION="Systems programming language from Mozilla"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild
new file mode 100644
index 0000000000..5a2b6ef484
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild
@@ -0,0 +1,800 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+PYTHON_COMPAT=( python3_{10..13} )
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.85.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	# Enforce that `beta` is built from `stable`.
+	# While uncommon it is possible for feature changes within `beta` to result
+	# in an older snapshot being unable to build a newer one without modifying the sources.
+	# 'stable' releases should always be able to build a beta snapshot so just use those.
+	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).1"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+PATCHES=(
+	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
+	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
+	"${FILESDIR}"/1.67.0-doc-wasm.patch
+)
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/config.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		local rust_build=""
+		local rust_host=""
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-config.toml"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -vvv --config="${T}"/vendor-config.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	else
+		verify-sig_src_unpack
+	fi
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline
+
+	fi
+	# Rust baselines to Pentium4 on x86, this patch lowers the baseline to i586 when sse2 is not set.
+	if use x86; then
+		if ! use cpu_flags_x86_sse2; then
+			eapply "${FILESDIR}/1.82.0-i586-baseline.patch"
+			#grep -rl cmd.args.push\(\"-march=i686\" . | xargs sed  -i 's/march=i686/-march=i586/g' || die
+		fi
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/config.toml
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"$(tc-getCC)\""
+		fi)
+		channel = "${build_channel}"
+		description = "gentoo"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "config.toml contents:"
+	cat "${S}"/config.toml || die
+	echo
+}
+
+src_compile() {
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild
index c23793c89b..c609ba0841 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild
@@ -168,6 +168,7 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
 PATCHES=(
 	"${DISTDIR}"/${P}-vendor-in-install-phase.patch
 	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
+	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
 	"${FILESDIR}"/1.67.0-doc-wasm.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild
new file mode 100644
index 0000000000..83f444b7cb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild
@@ -0,0 +1,807 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( 19 )
+PYTHON_COMPAT=( python3_{10..13} )
+
+RUST_MAX_VER=${PV%%_*}
+if [[ ${PV} == *9999* ]]; then
+	RUST_MIN_VER="1.86.0" # Update this as new `beta` releases come out.
+elif [[ ${PV} == *beta* ]]; then
+	# Enforce that `beta` is built from `stable`.
+	# While uncommon it is possible for feature changes within `beta` to result
+	# in an older snapshot being unable to build a newer one without modifying the sources.
+	# 'stable' releases should always be able to build a beta snapshot so just use those.
+	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+else
+	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+fi
+
+inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
+	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
+
+if [[ ${PV} = *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
+	EGIT_SUBMODULES=(
+		"*"
+		"-src/gcc"
+	)
+elif [[ ${PV} == *beta* ]]; then
+	# Identify the snapshot date of the beta release:
+	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
+	betaver=${PV//*beta}
+	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
+	MY_P="rustc-beta"
+	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
+			-> rustc-${PV}-src.tar.xz.asc )
+		https://github.com/rust-lang/rust/pull/137020.patch -> ${P}-vendor-in-install-phase.patch
+	"
+	S="${WORKDIR}/${MY_P}-src"
+else
+	MY_P="rustc-${PV}"
+	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
+		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
+	"
+	S="${WORKDIR}/${MY_P}-src"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+DESCRIPTION="Systems programming language originally developed by Mozilla"
+HOMEPAGE="https://www.rust-lang.org/"
+
+# keep in sync with llvm ebuild of the same version as bundled one.
+ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
+	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
+	WebAssembly X86 XCore Xtensa )
+ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
+LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
+
+# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
+_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
+declare -A ALL_RUST_EXPERIMENTAL_TARGETS
+for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
+done
+
+LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+
+IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
+
+if [[ ${PV} = *9999* ]]; then
+	# These USE flags require nightly rust
+	IUSE+=" miri"
+fi
+
+LLVM_DEPEND=()
+# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
+for _x in "${ALL_LLVM_TARGETS[@]}"; do
+	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
+	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
+		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
+	fi
+done
+LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
+LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
+
+BDEPEND="${PYTHON_DEPS}
+	app-eselect/eselect-rust
+	|| (
+		>=sys-devel/gcc-4.7[cxx]
+		>=llvm-core/clang-3.5
+	)
+	!system-llvm? (
+		>=dev-build/cmake-3.13.4
+		app-alternatives/ninja
+	)
+	test? ( dev-debug/gdb )
+	verify-sig? ( sec-keys/openpgp-keys-rust )
+"
+
+DEPEND="
+	>=app-arch/xz-utils-5.2
+	net-misc/curl:=[http2,ssl]
+	sys-libs/zlib:=
+	dev-libs/openssl:0=
+	system-llvm? (
+		${LLVM_DEPEND[*]}
+		llvm-libunwind? ( llvm-runtimes/libunwind:= )
+	)
+	!system-llvm? (
+		!llvm-libunwind? (
+			elibc_musl? ( sys-libs/libunwind:= )
+		)
+	)
+"
+
+RDEPEND="${DEPEND}
+	app-eselect/eselect-rust
+	dev-lang/rust-common
+	sys-apps/lsb-release
+	!dev-lang/rust:stable
+	!dev-lang/rust-bin:stable
+"
+
+REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
+	rust-analyzer? ( rust-src )
+	test? ( ${ALL_LLVM_TARGETS[*]} )
+	wasm? ( llvm_targets_WebAssembly )
+	x86? ( cpu_flags_x86_sse2 )
+"
+
+# we don't use cmake.eclass, but can get a warning
+CMAKE_WARN_UNUSED_CLI=no
+
+QA_FLAGS_IGNORED="
+	usr/lib/${PN}/${SLOT}/bin/.*
+	usr/lib/${PN}/${SLOT}/libexec/.*
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_SONAME="
+	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
+"
+
+QA_PRESTRIPPED="
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
+	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
+"
+
+# An rmeta file is custom binary format that contains the metadata for the crate.
+# rmeta files do not support linking, since they do not contain compiled object files.
+# so we can safely silence the warning for this QA check.
+QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
+
+# causes double bootstrap
+RESTRICT="test"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
+
+PATCHES=(
+	"${DISTDIR}"/${P}-vendor-in-install-phase.patch
+	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
+	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
+	"${FILESDIR}"/1.67.0-doc-wasm.patch
+)
+
+clear_vendor_checksums() {
+	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
+}
+
+toml_usex() {
+	usex "${1}" true false
+}
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
+		touch "${S}/.cargo/config.toml" || die
+		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+		local rust_build=""
+		local rust_host=""
+		# Configure vendor to use the portage-provided toolchain. This prevents it from
+		# attempting to fetch a `beta` toolchain from the internet.
+		cat <<- _EOF_ > "${T}/vendor-config.toml"
+			[build]
+			build = "$(rust_abi "${CBUILD}")"
+			host = ["$(rust_abi "${CHOST}")"]
+			target = ["$(rust_abi "${CHOST}")"]
+			cargo = "${rust_stage0_root}/bin/cargo"
+			rustc = "${rust_stage0_root}/bin/rustc"
+			rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		_EOF_
+		# We're using git sources so we need to run the Vendor script
+		# to ensure that all dependencies are present and up-to-date
+		mkdir "${S}/vendor" || die
+		# This also compiles the 'build helper', there's no way to avoid this.
+		${EPYTHON} "${S}"/x.py vendor -vvv --config="${T}"/vendor-config.toml -j$(makeopts_jobs) ||
+			die "Failed to vendor dependencies"
+		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
+		cat <<- _EOF_ > "${S}/.cargo/config.toml"
+			[source.crates-io]
+			replace-with = "vendored-sources"
+
+			[source."git+https://github.com/rust-lang/team"]
+			git = "https://github.com/rust-lang/team"
+			replace-with = "vendored-sources"
+
+			[source.vendored-sources]
+			directory = "vendor"
+		_EOF_
+	else
+		# Until upstream merge this patch we can't use the default verify-sig_src_unpack
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/rustc-${PV}-src.tar.xz" \
+				"${DISTDIR}/rustc-${PV}-src.tar.xz.asc"
+		fi
+		default_src_unpack
+	fi
+}
+
+pre_build_checks() {
+	local M=9216
+	# multiply requirements by 1.3 if we are doing x86-multilib
+	if use amd64; then
+		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
+	fi
+	M=$(( $(usex clippy 128 0) + ${M} ))
+	if [[ ${PV} == *9999* ]]; then
+		M=$(( $(usex miri 128 0) + ${M} ))
+	fi
+	M=$(( $(usex rustfmt 256 0) + ${M} ))
+	# add 2G if we compile llvm and 256M per llvm_target
+	if ! use system-llvm; then
+		M=$(( 2048 + ${M} ))
+		local ltarget
+		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
+			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
+		done
+	fi
+	M=$(( $(usex wasm 256 0) + ${M} ))
+	M=$(( $(usex debug 2 1) * ${M} ))
+	eshopts_push -s extglob
+	if is-flagq '-g?(gdb)?([1-9])'; then
+		M=$(( 15 * ${M} / 10 ))
+	fi
+	eshopts_pop
+	M=$(( $(usex doc 256 0) + ${M} ))
+	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+llvm_check_deps() {
+	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
+}
+
+# Is LLVM being linked against libc++?
+is_libcxx_linked() {
+	local code='#include <ciso646>
+#if defined(_LIBCPP_VERSION)
+	HAVE_LIBCXX
+#endif
+'
+	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
+	[[ ${out} == *HAVE_LIBCXX* ]]
+}
+
+pkg_pretend() {
+	pre_build_checks
+}
+
+pkg_setup() {
+	pre_build_checks
+	python-any-r1_pkg_setup
+
+	export LIBGIT2_NO_PKG_CONFIG=1 #749381
+	if tc-is-cross-compiler; then
+		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
+		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
+		use "llvm_targets_${cross_llvm_target}" || \
+			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
+	fi
+
+	rust_pkg_setup
+
+	if use system-llvm; then
+		llvm-r1_pkg_setup
+
+		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
+		export LLVM_LINK_SHARED=1
+		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
+	fi
+}
+
+src_prepare() {
+	if [[ ${PV} = *9999* ]]; then
+		# We need to update / generate lockfiles for the workspace
+		${CARGO} generate-lockfile --offline
+
+	fi
+	# Rust baselines to Pentium4 on x86, this patch lowers the baseline to i586 when sse2 is not set.
+	if use x86; then
+		if ! use cpu_flags_x86_sse2; then
+			eapply "${FILESDIR}/1.82.0-i586-baseline.patch"
+			#grep -rl cmd.args.push\(\"-march=i686\" . | xargs sed  -i 's/march=i686/-march=i586/g' || die
+		fi
+	fi
+
+	default
+}
+
+src_configure() {
+	if tc-is-cross-compiler; then
+		export PKG_CONFIG_ALLOW_CROSS=1
+		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
+		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
+		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
+	fi
+
+	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
+
+	local rust_target="" rust_targets="" arch_cflags
+
+	# Collect rust target names to compile standard libs for all ABIs.
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
+	done
+	if use wasm; then
+		rust_targets+=",\"wasm32-unknown-unknown\""
+		if use system-llvm; then
+			# un-hardcode rust-lld linker for this target
+			# https://bugs.gentoo.org/715348
+			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
+		fi
+	fi
+	rust_targets="${rust_targets#,}"
+
+	# cargo and rustdoc are mandatory and should always be included
+	local tools='"cargo","rustdoc"'
+	use clippy && tools+=',"clippy"'
+	use rustfmt && tools+=',"rustfmt"'
+	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
+	use rust-src && tools+=',"src"'
+
+	if [[ ${PV} == *9999* ]]; then
+		use miri && tools+=',"miri"'
+	fi
+
+	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
+	# in case of prefix it will be already prefixed, as --print sysroot returns full path
+	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
+
+	rust_target="$(rust_abi)"
+	rust_build="$(rust_abi "${CBUILD}")"
+	rust_host="$(rust_abi "${CHOST}")"
+
+	RUST_EXPERIMENTAL_TARGETS=()
+	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
+		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
+			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
+		fi
+	done
+	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
+
+	local cm_btype="$(usex debug DEBUG RELEASE)"
+	local build_channel
+	local build_miri="false"
+	case "${PV}" in
+		*9999*)
+			build_channel="nightly"
+			;;
+		*beta*)
+			build_channel="beta"
+			;;
+		*)
+			build_channel="stable"
+			;;
+	esac
+	cat <<- _EOF_ > "${S}"/config.toml
+		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
+		profile = "dist"
+		[llvm]
+		download-ci-llvm = false
+		optimize = $(toml_usex !debug)
+		release-debuginfo = $(toml_usex debug)
+		assertions = $(toml_usex debug)
+		ninja = true
+		targets = "${LLVM_TARGETS// /;}"
+		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
+		link-shared = $(toml_usex system-llvm)
+		$(if is_libcxx_linked; then
+			# https://bugs.gentoo.org/732632
+			echo "use-libcxx = true"
+			echo "static-libstdcpp = false"
+		fi)
+		$(case "${rust_target}" in
+			i586-*-linux-*)
+				# https://github.com/rust-lang/rust/issues/93059
+				echo 'cflags = "-fcf-protection=none"'
+				echo 'cxxflags = "-fcf-protection=none"'
+				echo 'ldflags = "-fcf-protection=none"'
+				;;
+			*)
+				;;
+		esac)
+		enable-warnings = false
+		[llvm.build-config]
+		CMAKE_VERBOSE_MAKEFILE = "ON"
+		$(if ! tc-is-cross-compiler; then
+			# When cross-compiling, LLVM is compiled twice, once for host and
+			# once for target.  Unfortunately, this build configuration applies
+			# to both, which means any flags applicable to one target but not
+			# the other will break.  Conditionally disable respecting user
+			# flags when cross-compiling.
+			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
+			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
+			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
+			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
+		fi)
+		[build]
+		build-stage = 2
+		test-stage = 2
+		build = "${rust_build}"
+		host = ["${rust_host}"]
+		target = [${rust_targets}]
+		cargo = "${rust_stage0_root}/bin/cargo"
+		rustc = "${rust_stage0_root}/bin/rustc"
+		rustfmt = "${rust_stage0_root}/bin/rustfmt"
+		docs = $(toml_usex doc)
+		compiler-docs = false
+		submodules = false
+		python = "${EPYTHON}"
+		locked-deps = true
+		vendor = true
+		extended = true
+		tools = [${tools}]
+		verbose = 2
+		sanitizers = false
+		profiler = true
+		cargo-native-static = false
+		[install]
+		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
+		sysconfdir = "etc"
+		docdir = "share/doc/rust"
+		bindir = "bin"
+		libdir = "lib"
+		mandir = "share/man"
+		[rust]
+		# https://github.com/rust-lang/rust/issues/54872
+		codegen-units-std = 1
+		optimize = true
+		debug = $(toml_usex debug)
+		debug-assertions = $(toml_usex debug)
+		debug-assertions-std = $(toml_usex debug)
+		debuginfo-level = $(usex debug 2 0)
+		debuginfo-level-rustc = $(usex debug 2 0)
+		debuginfo-level-std = $(usex debug 2 0)
+		debuginfo-level-tools = $(usex debug 2 0)
+		debuginfo-level-tests = 0
+		backtrace = true
+		incremental = false
+		$(if ! tc-is-cross-compiler; then
+			echo "default-linker = \"$(tc-getCC)\""
+		fi)
+		channel = "${build_channel}"
+		description = "gentoo"
+		rpath = true
+		verbose-tests = true
+		optimize-tests = $(toml_usex !debug)
+		codegen-tests = true
+		dist-src = false
+		remap-debuginfo = true
+		lld = $(usex system-llvm false $(toml_usex wasm))
+		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
+		# https://github.com/rust-lang/rust/issues/74976
+		# https://github.com/rust-lang/rust/issues/76526
+		deny-warnings = $(usex wasm $(usex doc false true) true)
+		backtrace-on-ice = true
+		jemalloc = false
+		# See https://github.com/rust-lang/rust/issues/121124
+		lto = "$(usex lto thin off)"
+		[dist]
+		src-tarball = false
+		compression-formats = ["xz"]
+		compression-profile = "balanced"
+	_EOF_
+
+	for v in $(multilib_get_enabled_abi_pairs); do
+		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
+		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
+
+		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${rust_target}]
+			ar = "$(tc-getAR)"
+			cc = "$(tc-getCC)"
+			cxx = "$(tc-getCXX)"
+			linker = "$(tc-getCC)"
+			ranlib = "$(tc-getRANLIB)"
+			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
+		# but we patch it and set to false here as well
+		if use elibc_musl; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				crt-static = false
+				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
+			_EOF_
+		fi
+	done
+	if use wasm; then
+		wasm_target="wasm32-unknown-unknown"
+		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.wasm32-unknown-unknown]
+			linker = "$(usex system-llvm lld rust-lld)"
+			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
+			profiler = false
+		_EOF_
+	fi
+
+	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
+	# experimental cross support
+	# discussion: https://bugs.gentoo.org/679878
+	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
+	# it would be much better if we could split out stdlib
+	# complilation to separate ebuild and abuse CATEGORY to
+	# just install to /usr/lib/rustlib/<target>
+
+	# extra targets defined as a bash array
+	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
+	# best place would be /etc/portage/env/dev-lang/rust
+	# Example:
+	# RUST_CROSS_TARGETS=(
+	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
+	# )
+	# no extra hand holding is done, no target transformations, all
+	# values are passed as-is with just basic checks, so it's up to user to supply correct values
+	# valid rust targets can be obtained with
+	# 	rustc --print target-list
+	# matching cross toolchain has to be installed
+	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
+	# only gcc toolchains installed with crossdev are checked for now.
+
+	# BUG: we can't pass host flags to cross compiler, so just filter for now
+	# BUG: this should be more fine-grained.
+	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
+
+	local cross_target_spec
+	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
+		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
+		local cross_llvm_target="${cross_target_spec%%:*}"
+		# extracts toolchain triples, <rust-target>:<CTARGET>
+		local cross_triples="${cross_target_spec#*:}"
+		# extracts first element after before : separator
+		local cross_rust_target="${cross_triples%%:*}"
+		# extracts last element after : separator
+		local cross_toolchain="${cross_triples##*:}"
+		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
+		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
+
+		cat <<- _EOF_ >> "${S}"/config.toml
+			[target.${cross_rust_target}]
+			ar = "${cross_toolchain}-ar"
+			cc = "${cross_toolchain}-gcc"
+			cxx = "${cross_toolchain}-g++"
+			linker = "${cross_toolchain}-gcc"
+			ranlib = "${cross_toolchain}-ranlib"
+		_EOF_
+		if use system-llvm; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
+			_EOF_
+		fi
+		if [[ "${cross_toolchain}" == *-musl* ]]; then
+			cat <<- _EOF_ >> "${S}"/config.toml
+				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
+			_EOF_
+		fi
+
+		# append cross target to "normal" target list
+		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
+		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
+
+		rust_targets="${rust_targets},\"${cross_rust_target}\""
+		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
+
+		ewarn
+		ewarn "Enabled ${cross_rust_target} rust target"
+		ewarn "Using ${cross_toolchain} cross toolchain"
+		ewarn
+		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
+			ewarn "'sys-devel/binutils[multitarget]' is not installed"
+			ewarn "'strip' will be unable to strip cross libraries"
+			ewarn "cross targets will be installed with full debug information"
+			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
+			ewarn
+			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
+			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
+			ewarn
+		fi
+	done
+	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
+
+	einfo "Rust configured with the following flags:"
+	echo
+	echo RUSTFLAGS="\"${RUSTFLAGS}\""
+	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
+	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
+	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
+	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
+	env | grep "CFLAGS_.*"
+	echo
+	einfo "config.toml contents:"
+	cat "${S}"/config.toml || die
+	echo
+}
+
+src_compile() {
+	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+}
+
+src_test() {
+	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
+
+	# those are basic and codegen tests.
+	local tests=(
+		codegen
+		codegen-units
+		compile-fail
+		incremental
+		mir-opt
+		pretty
+		run-make
+	)
+
+	# fails if llvm is not built with ALL targets.
+	# and known to fail with system llvm sometimes.
+	use system-llvm || tests+=( assembly )
+
+	# fragile/expensive/less important tests
+	# or tests that require extra builds
+	# TODO: instead of skipping, just make some nonfatal.
+	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
+		tests+=(
+			rustdoc
+			rustdoc-js
+			rustdoc-js-std
+			rustdoc-ui
+			run-make-fulldeps
+			ui
+			ui-fulldeps
+		)
+	fi
+
+	local i failed=()
+	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
+	for i in "${tests[@]}"; do
+		local t="src/test/${i}"
+		einfo "rust_src_test: running ${t}"
+		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
+				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
+		then
+				failed+=( "${t}" )
+				eerror "rust_src_test: ${t} failed"
+		fi
+	done
+
+	if [[ ${#failed[@]} -ne 0 ]]; then
+		eerror "rust_src_test: failure summary: ${failed[@]}"
+		die "aborting due to test failures"
+	fi
+}
+
+src_install() {
+	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+
+	docompress /usr/lib/${PN}/${SLOT}/share/man/
+
+	# bug #689562, #689160
+	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
+	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
+
+	local symlinks=(
+		cargo
+		rustc
+		rustdoc
+		rust-gdb
+		rust-gdbgui
+		rust-lldb
+	)
+
+	use clippy && symlinks+=( clippy-driver cargo-clippy )
+	if [[ ${PV} = *9999* ]]; then
+		use miri && symlinks+=( miri cargo-miri )
+	fi
+	use rustfmt && symlinks+=( rustfmt cargo-fmt )
+	use rust-analyzer && symlinks+=( rust-analyzer )
+
+	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
+	local i
+	for i in "${symlinks[@]}"; do
+		# we need realpath on /usr/bin/* symlink return version-appended binary path.
+		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
+		# need to fix eselect-rust to remove this hack.
+		local ver_i="${i}-${PV%%_*}"
+		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
+			einfo "Installing ${i} symlink"
+			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
+		else
+			ewarn "${i} symlink requested, but source file not found"
+			ewarn "please report this"
+		fi
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+	done
+
+	# symlinks to switch components to active rust in eselect
+	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
+	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
+	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
+	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
+	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
+
+	newenvd - "50${P}" <<-_EOF_
+		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
+	_EOF_
+
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
+	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
+
+	# note: eselect-rust adds EROOT to all paths below
+	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
+		/usr/bin/cargo
+		/usr/bin/rustdoc
+		/usr/bin/rust-gdb
+		/usr/bin/rust-gdbgui
+		/usr/bin/rust-lldb
+		/usr/lib/rustlib
+		/usr/lib/rust/lib
+		/usr/lib/rust/man
+		/usr/share/doc/rust
+	_EOF_
+
+	if use clippy; then
+		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
+	fi
+	if [[ ${SLOT} == *9999* ]] && use miri; then
+		echo /usr/bin/miri >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
+	fi
+	if use rustfmt; then
+		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
+		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
+	fi
+	if use rust-analyzer; then
+		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
+		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
+	fi
+
+	insinto /etc/env.d/rust
+	doins "${T}/provider-${PN}-${SLOT}"
+
+	if use dist; then
+		"${EPYTHON}" ./x.py dist -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
+		insinto "/usr/lib/${PN}/${SLOT}/dist"
+		doins -r "${S}/build/dist/."
+	fi
+}
+
+pkg_postinst() {
+
+	eselect rust update
+
+	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
+		elog "Rust installs helper scripts for calling GDB and LLDB,"
+		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
+	fi
+
+	if has_version app-editors/emacs; then
+		optfeature "emacs support for rust" app-emacs/rust-mode
+	fi
+
+	if has_version app-editors/gvim || has_version app-editors/vim; then
+		optfeature "vim support for rust" app-vim/rust-vim
+	fi
+}
+
+pkg_postrm() {
+	eselect rust cleanup
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
index d8ef8c5ff6..97c665f782 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@@ -166,6 +166,7 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
 
 PATCHES=(
 	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
+	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
 	"${FILESDIR}"/1.67.0-doc-wasm.patch
 )
 
@@ -469,6 +470,7 @@ src_configure() {
 		verbose-tests = true
 		optimize-tests = $(toml_usex !debug)
 		codegen-tests = true
+		omit-git-hash = false
 		dist-src = false
 		remap-debuginfo = true
 		lld = $(usex system-llvm false $(toml_usex wasm))
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0-r2.ebuild
index 7daf50f7ae..12bdd28c90 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0-r2.ebuild
@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="LGPL-2.1+ GPL-2+ MIT"
 SLOT="0/20" # subslot = soname major version
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +getentropy static-libs"
 IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
 IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
index 48a551fb73..b5cb0bd4e5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -17,11 +17,6 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=dev-libs/openssl-3.0.0:=[bindist(+)]
-	!~dev-libs/openssl-3.2.0
-	!=dev-libs/openssl-3.2.1-r0
-	!=dev-libs/openssl-3.0.13-r1
-	!=dev-libs/openssl-3.0.13-r0
-	!~dev-libs/openssl-3.0.12
 "
 DEPEND="${RDEPEND}
 	test? ( dev-libs/softhsm )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.13.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.13.ebuild
index 7c7b1abc89..ab0122da1b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.13.ebuild
@@ -17,11 +17,6 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=dev-libs/openssl-3.0.0:=[bindist(+)]
-	!~dev-libs/openssl-3.2.0
-	!=dev-libs/openssl-3.2.1-r0
-	!=dev-libs/openssl-3.0.13-r1
-	!=dev-libs/openssl-3.0.13-r0
-	!~dev-libs/openssl-3.0.12
 "
 DEPEND="${RDEPEND}
 	test? ( dev-libs/softhsm )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
index 6d7eefcece..e9fc46b2c8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.16.ebuild
@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
index 89cb769782..bbe688813d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.3.ebuild
@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild
index 52bfd18062..57b4314bf5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cachecontrol/cachecontrol-0.14.1.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 RDEPEND="
 	<dev-python/msgpack-2[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
index ac7ab4a1a8..6590f0eb18 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/Manifest
@@ -12,9 +12,11 @@ DIST cfg-if-1.0.0.crate 7934 BLAKE2B e99a5589c11d79d77a4537b34ce0a45d37b981c123b
 DIST cryptography-43.0.3.tar.gz 686989 BLAKE2B 60efc12c020563aa0d229941d237a39e7d7243045433c7c4cf4c57a8f031569d32bfcd0e43316dd9eb3d6dd3b4e6ad8106b7bdca53c2e6c4ebb094391759da66 SHA512 965ecdbdac09ba4cf3d3289cb7f0997bfb9abd61aa663554f27651328e5da1c92edadba521b1bf779e245255e5db3da7ea8092496f845b73278ffcdd91076bbc
 DIST cryptography-44.0.0.tar.gz 710657 BLAKE2B fa9d89d143e6dc84d9335cae1a38493616a5ca29ac71811c636fed961eec3311e9cabd08d7187ea05588cb2d0947509ceb028922ac13796e6160aaf991e41523 SHA512 d0aaa2160a31079412ddb7be07fd170c7e54736c315b6fbb6ee5264af0eb90be392ecd1c0e3bfb4ea071c0153ad8f47604bd6b28d4297cd9774dc55647b4e97e
 DIST cryptography-44.0.1.tar.gz 710819 BLAKE2B 8c6b072b4dd59d9c5698ce07da336b51759d0b98421e0767bf92c73bffc7590b1d6ce7288683305b8724755a86df115bcfde8e34dd02bedfc90730f360c01b3d SHA512 f45bebc4e92d140859f4b5c3e505c17f5b607b5fe62eed45dd4df3981d2a20a74c192d885336a47e4f3bc6e1ed785cf3a3430f81ed14fcd89a3c750d4aae10f3
+DIST cryptography-44.0.2.tar.gz 710807 BLAKE2B 3bdfe1f6d4f44a77f8d5c2299e10e672eba2a68888fd5ee8ffae8a452d6c586c39bf5527feee60b62121dd7b18e13b1c91705df87ba0b52885e8538c56fec139 SHA512 12594fcd349b02a077d52b870af99850e275f13a561bbe9c993475f4ebfd35eccb63400c93a9629caf68195b759e2dbfddc3c60dc3066d063bb447acd7b17c03
 DIST cryptography_vectors-43.0.3.tar.gz 35306415 BLAKE2B daf21d6bc7ba81bac2b38e0459c104117c17c3b5c6d74c3f0ba5c0da961999bc2f0fc0a088e6d3498960de70b2862867c6dd10b6e05db99352c0adc9d65104f8 SHA512 7ffbf439b84ea85a8178f6b41a349c8d3ba6586cf6513a6b13d01f55bc0fa8bb5635de2ee9afd334c5660c60cd2fc286f85b2c9c364b6e85bf4164c32fb6ca7e
 DIST cryptography_vectors-44.0.0.tar.gz 35317300 BLAKE2B 3c0fc56d39447f2fbb06ffcaac82aec242e50a0341c9599c64b649ab5cf97fec740db8625269d5130a2bf20b1d34ef84b07ed451f5b221eab1acd0fee076dab1 SHA512 e6c37d7fc78c22292c04e7e6a83a5438baa13a30f724fe8bb7b72e6caf9d75a2130537e75a803c309da00f4ce30dc55a7f737415740741f384953f443c3eaf1c
 DIST cryptography_vectors-44.0.1.tar.gz 35317778 BLAKE2B e6e9b1b2db108aac983ef78fab31ed0ed12257d774d5d4e8fb742dc856543992f66db7c7ac5190f74aa176272b1337131ace70e89d0b0552f26432309c2727f1 SHA512 60d4aefc3aa7d18183993d96e203e7e94f323359a9f0824e9367548a1c33bd96982b6e619310a565290b5d1109e8310127f52c6478b392859788ba27fa6415b9
+DIST cryptography_vectors-44.0.2.tar.gz 35318019 BLAKE2B 67ed8f4af54c4469f1da21993e7220c649b1098f6e2b82fff10f8339cfd89506d6b6f64083999998408bc60fd66172e1b33844f39d41387c7ff8cc1efc52a35d SHA512 7a75078eae4a1a46d5aa87961aa2e4f28725a2feac99ea0ce00d48aa509ce00fb43176d48eab8eabaa3f7204ba8c4b2ef78b4b65187cfd5056b3c3e3116b4239
 DIST foreign-types-0.3.2.crate 7504 BLAKE2B 520818b702d990d296ecd31a8646850202509ccfa18edd0e1b260289619a6c351e758f317ec0824bd76eccb209b6f087057c25f1bd01a47897715013dd834867 SHA512 bf27b8243ed482c202d120383374f19ff09422535e24b9c1aebccc66529bf300ca17b8bbc76d67f98ac092e614497afe3add9dc68aa69c93074df05762f91232
 DIST foreign-types-shared-0.1.1.crate 5672 BLAKE2B d2e42e04b6657e7a69fe0bd20c672176629c743e49a55fd007bb30e289710b70045d445ae9cae0eeaa747ee708c90e8abd9b5fc39bad8ec0666befe1b696d4f1 SHA512 bafdb2143e136fb0818e2ffd90b5c862b7181647d6568947d4e4531012bbf7a57b597221ec7056c1b562dfc0c3b5dead26d1a4111ebc15e7863737a873518a4a
 DIST heck-0.5.0.crate 11517 BLAKE2B 5365ec43b2239a76b33a174f1a4292ece4147f9d382a68c6c60db78fdc8bad0afb1d51a65bcb25e96675372faa4ea37c318265030b0546ba51942f7c929e1835 SHA512 f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
@@ -38,19 +40,24 @@ DIST proc-macro2-1.0.92.crate 52353 BLAKE2B 9aa29fa6f1c56c0392a94a81b4c61953f4d1
 DIST pyo3-0.22.2.crate 538342 BLAKE2B faf347695117f9fe0ebe5cd7f6aa1b0dcfe718343875d6c06438046deccc1075f104d2a2413dcda41ae9827bc363aa147057b45968f6634f577a6a4510a4bb8e SHA512 e8bae09059f50ffe477dad44499cedeaf3a734665f0fd8e8bd4b44f48578d21e4bdb8d55ceea00c5a27da750761842ddf89cfcecdecb2e7a4a17ab192259be9c
 DIST pyo3-0.23.2.crate 1073639 BLAKE2B 01ddd26a4e347f3b6d7fee215a1894e779167730710373d59712f2119332fcf287d9c0e75d3d28baff8cf5000afb9d0e577947a26bdd8828428d33aa0f8be537 SHA512 b2b40809e1f26978c140b7ca4ecebb661a47fc01cd03fcd5c486076576c9b229de04f15ed55661db4e26545cb29110f1034a185abb623e4bf7fbb69188db335c
 DIST pyo3-0.23.4.crate 1087676 BLAKE2B 2c7d3530460ff687e8f60dcff0fb01465b2a4642043ebdfc927fc3824b9fbce9c4b304250808a85405d21df12d17a1d1ada7bdf8f3563710692f22223e2732f1 SHA512 0015aa75163ad0ec026d185e15c26f59aaad0eb3cc3044b146e5d703bb375fcd838df2044febbd52e6e129dfba81c8249329fc3e4805695274dac7a69eee0651
+DIST pyo3-0.23.5.crate 1088533 BLAKE2B 2efae0a42c1d33e25c5871e3f61a3cea9890d278a20e2777307752b544ab3a634059bba896a1df0df4eadd0ae3c2e63b6d637aecd6699b31fac4107e3a43a387 SHA512 efd3a86dd70c199304463c0ae18dbdf4d9176d1af13b664bdd05a1e218cffda3f29f06d868d0d852d51c3e85b7e07c39617206b3feddc913b3b622f3fcf59d5f
 DIST pyo3-build-config-0.22.2.crate 31225 BLAKE2B c2e6a3d3d23b7f2f51bcbf1214ab20a298a1e62f85c9af3dab1e77b09f20b657b576feefffb18eb49d438f0ffab525b6bcd1086d500601c327ffd4fd24a719ee SHA512 644c82d30bb27051557efcc9789a81380a64e29bc62abf97de88f42c3791dac74228c7a7d09e0d46d14f07c0475f0bc03fac6ed1367b9a616153e8820b94cbc8
 DIST pyo3-build-config-0.23.2.crate 32197 BLAKE2B 393c76b1dcb625145673736272d4cb9d96a02df87ddcc385316652f0ff1b5595a34ebe5d789f61888c2fd82de05476c85f781d21018bd99cb630fa634afee203 SHA512 29678272073e896cb0b65efb0eaba40c82977b18efd389597aef8902e32daff51f2609c6be93ecfe0336260446c3186951f770ff449823cdde5a0518a1585c81
 DIST pyo3-build-config-0.23.4.crate 33885 BLAKE2B 7f95a8a9e08d413899ff1fa64af5a52783bad4a7b4db92835464f12bd8565f152497aaeb45d25cc91eed73950abeea30ca4c7495e3b15423ae588b97038beb18 SHA512 b11442609f43d9baab79daf083caf0366987f6ae182239814ad6df6fe4ad31b95132d74f1162fa9428d229bd8c18ef9b696a4c3329b3960fd705d1705fc5e973
+DIST pyo3-build-config-0.23.5.crate 33885 BLAKE2B 14e3897186abb772bcde147a9ebf2a70f5cbd634cb0240e1dbba71079acd2f9cd61fd263a5d32bc583e188ec84b6db8b93f018ab954ac9da66f423183ad5c176 SHA512 72aac032e3026554761eb81dc9c57591abc4d0c329c46918da13a8cc93c0532eba2fe3d971699a50890c66d8853b93a67840b0e8f1c15747d184b873dec2894a
 DIST pyo3-ffi-0.22.2.crate 67749 BLAKE2B 0a4357d5f4fbcab9717d58b7a80b63a63bc329267d4725136c4eac7c0101095a50e5f840638dde79034e5df99c4f46664cfdc2ad437837643db5d475c5705cb3 SHA512 bf8b83b4790832d99de8c6a61a15a43fc189505dd843011933305f7f93c4f5f4849fb00cc2a6fa410b788645f8ed8c0df61799cf801966a925abb9756b1ab579
 DIST pyo3-ffi-0.23.2.crate 74052 BLAKE2B 085c66bae61e6059331813be77a1e4f850c4b8b12ac60b03188f2a009c9f58e062dc3ea2b9e470a480956bb8cbef645f95e53fae2638d59ebf5039aa5d41d504 SHA512 e228e473da98ce0fe4f15cf840ba1f51f66bb6fd103a7c0bb76b3218980c93b45ecf691f712333f4a27a9efc76517a85f6e13d5e9650b774eadebf59a647e493
 DIST pyo3-ffi-0.23.4-pypy3_11.patch.xz 2140 BLAKE2B 29cf1a3b340241bb323192261b11a431a0b78748819dfe05683ce51c18fb53b5e9394fd4269197475d467f6be82df1fdc92e45450a1e2416ddd459bc00174b6e SHA512 43da84518b24022b82314fc509e8125ad6a9e5c47f8e2eb20da2fa38631719759ce821253a62bdd9fc3fdbedf798e9a37168c39d913570a6cfc53aca3ec0eedb
 DIST pyo3-ffi-0.23.4.crate 74806 BLAKE2B 650784d46347c00f09c010c39e9762f778efc510ad0b99b5ddf30cab18edaba552207339ad44ed4ae6d87ddfcc56fa540a17e3a4cb331905a0988d5ba2dc682a SHA512 c12097292b4620f4fd98d61fde4a0f0c7d423a94d518fa5b1cf759089b066fede6d83e20171acc2aa7bf268de5700c9b59da32131216734626b0fa5cd5651801
+DIST pyo3-ffi-0.23.5.crate 74867 BLAKE2B 5c80f7ac77ee516a891c1cb367e27fa396e55a7504dc8f92312219a90860baba3861ca2e83a1410839b99b6b3beb4c068703b841e18ea1854f70d04fef7404bd SHA512 37c25b21acc3718eab842c04489b0c16c04d33a30fe7f3f58cd80943048203375d8788ce84153ba3720df695fc95bf9f7bccacfa02b0e669a5ddbfc44d65f86c
 DIST pyo3-macros-0.22.2.crate 8136 BLAKE2B 9dc97d2f60581db1b8ddb562dac917069525f297fe2cbb9aff3ed34d5a08ea43c112c9c7a450539da3536d753778b5ca506dd1b18e1d6b8a3649fc098e7af439 SHA512 f4f4f6af8dc3aa4bcc1698661990ab2112391ef9502e9f71d86e35bd10dc4e1be309102ebb1b7b32751817a6033168dc0486fdb16b35c626101e69f0de807a4a
 DIST pyo3-macros-0.23.2.crate 8056 BLAKE2B a87c4b8aab972eaf5e9b941db34e18be411bed8b5753d3e2d3f65e4a18723a72e70858bb34e8db949f0c6b748e122fed41e9c78f6c20150077fcc3c4eb0026ba SHA512 dba0b5bd212b6a5f38d6fc93183c8ab80bb53bfa5f03d471897014f2d3d1959804e5fdbc817845c1cef797f314b924d58eff95cfcb848eb98b283e104d24637c
 DIST pyo3-macros-0.23.4.crate 8852 BLAKE2B ba5722fd52e47aa4dc2e89bacd69326bd98943a1670ebeab08a2e9e8070a0975ebbe928a0bce8b53a700b65294fee2b00d2a1e6623a0c48ac15902cdbfcb7a97 SHA512 c36c9005db5a4b48b5fda881130f4e7da8eef46e2c363c395ccca3fe476e0204d98c2a832cd03c787fb37a2664fadd42bf8f47de71eb44d055754ab5766af934
+DIST pyo3-macros-0.23.5.crate 8856 BLAKE2B 56e7dea9cc630e21f9e8aa43319db27f3d287baad4035bf8d921b2c8e737142e5a89decf6a04bcc095f97e035cfe4a5edd7091bba79dd68bc110b7420c29477b SHA512 bf9c12b02597cf6f119e92fe827016f393d13cfa21376811ab9bf8f49cbfd6447afe9dcbef564ad2b5b72db5338520c37c77429db8ee1ccb74de3944fc9fce7f
 DIST pyo3-macros-backend-0.22.2.crate 65620 BLAKE2B 37fba9ff384373418d3a7341acafb8e33308a64e30026f828693a37c32ab4a74d058f2db84d00467a20f9f267c96fe54c0f154d1ebbae92490e8dfc0d29c042f SHA512 0517080c0d5d4ed8136521fd37aa3a192c2eb8cab58545d8543ee4df9cd0dcea19fe0678d5ab90f05fe3eb0f4a86fc2f07b76f2e12ac1fcf7e7c195c2ffa4fd8
 DIST pyo3-macros-backend-0.23.2.crate 70067 BLAKE2B 905c0e6e5ca0c0a91af8386a632cc81f4a9b08a51a22a260188078abf9ee70d60f77e2fc0df09483d8dc6b37cd455a23b7f70f41ee74a2ad9dd0dbef39cc22c2 SHA512 dc3f8780c09c63c0e0d4f26c29a9a4e29e4fc9f14254ac8a942235e480a3f4bfa3bf073d3011e043b6c22e1999d1f68bf7b0fdf212e9edb4bfb2396a97ab0ee1
 DIST pyo3-macros-backend-0.23.4.crate 70912 BLAKE2B a428c732f0b17d9a8f620d0e8d58469f2cba339c8a8307393ce252a7860808e5d50e6bbf711cafd0635c844f4b1d48e57db4dd99ef7b5e3d97d6f760164278e9 SHA512 2fe670fbf35724f489cc82f38d3f7c1e6aa15b087a2674b7a68b562572f9bb00cbb7746cccfcb62d0861a18f6d24c5739273c8302d1662a161142f4a6b532b6f
+DIST pyo3-macros-backend-0.23.5.crate 70938 BLAKE2B 20d5b00edf806ff19de3e3a03d10a23a29b16d544faf2bb5781032e51c3e07cd7f1a979e00b9f1abca36bc7cf1546b702ee83f85d021d74ac819b8b13bf8d140 SHA512 5e9a971d98a7b70424bf93b1f7fb326564010562dd376789be2fa6b13b89c3d34f760eb61ed49f0b013bbdfff2658d874d24a8a0b65d8f82d10d8f34b8ef5b53
 DIST quote-1.0.36.crate 28507 BLAKE2B b93495163ed205e33543ed45f084870240d479071d643704b6e348fb9ada6e1d8401893c13348b9964f4b6b17ddb96cb5458eec540f0d761655fcb96a4cd9129 SHA512 f1f002a912692f7ffd4912ca980ec57ff4aca3a7d9e2e42e9e3409e2105c9f59d86c05719f6af309bccaef2f8843b0848a6e3afda3356e045d8e7cc5956ae685
 DIST quote-1.0.37.crate 28558 BLAKE2B a7d007a69e619f853af94333e1066bb767013312bd99f147b1b153611242bcfa9c76768b1ba47278589db309a9acd61a772c8ec3b567e48439bb9d831f9326d4 SHA512 c4ed21428c1f89cf22b85d80720a7869831a9c129d694617b0ce8c258278114ab98846f3f653abf736d1c86bc9224bbd695e9a7b06aa3adf292d02e1ef14cc05
 DIST self_cell-1.0.4.crate 15220 BLAKE2B 9a617058652ab2a2e92434b6eef58a813ce0be5afed9525c4d4c819c25c7cd87aaa12d129c8c4ca9d74c3ea33d81e9dd295f121887070364185b9ab33021544c SHA512 042467e5f3ac0305e2a634df0b9a9379e92b54813e05c3a7652d5327a4a9a784f49e897c968c5c7a87017284d42a889b5420ad18e97ea84183e0283a46dc907a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.2.ebuild
new file mode 100644
index 0000000000..89aac38e24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cryptography/cryptography-44.0.2.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=yes
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_REQ_USE="threads(+)"
+
+CRATES="
+	asn1@0.20.0
+	asn1_derive@0.20.0
+	autocfg@1.4.0
+	base64@0.22.1
+	bitflags@2.6.0
+	cc@1.2.1
+	cfg-if@1.0.0
+	foreign-types-shared@0.1.1
+	foreign-types@0.3.2
+	heck@0.5.0
+	indoc@2.0.5
+	itoa@1.0.14
+	libc@0.2.166
+	memoffset@0.9.1
+	once_cell@1.20.2
+	openssl-macros@0.1.1
+	openssl-sys@0.9.104
+	openssl@0.10.68
+	pem@3.0.4
+	pkg-config@0.3.31
+	portable-atomic@1.10.0
+	proc-macro2@1.0.92
+	pyo3-build-config@0.23.5
+	pyo3-ffi@0.23.5
+	pyo3-macros-backend@0.23.5
+	pyo3-macros@0.23.5
+	pyo3@0.23.5
+	quote@1.0.37
+	self_cell@1.0.4
+	shlex@1.3.0
+	syn@2.0.89
+	target-lexicon@0.12.16
+	unicode-ident@1.0.14
+	unindent@0.2.3
+	vcpkg@0.2.15
+"
+
+inherit cargo distutils-r1 flag-o-matic multiprocessing pypi
+
+VEC_P=cryptography_vectors-$(ver_cut 1-3)
+DESCRIPTION="Library providing cryptographic recipes and primitives"
+HOMEPAGE="
+	https://github.com/pyca/cryptography/
+	https://pypi.org/project/cryptography/
+"
+SRC_URI+="
+	${CARGO_CRATE_URIS}
+	test? (
+		$(pypi_sdist_url cryptography_vectors "$(ver_cut 1-3)")
+	)
+"
+
+LICENSE="|| ( Apache-2.0 BSD ) PSF-2"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD MIT Unicode-3.0
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	>=dev-libs/openssl-1.0.2o-r6:0=
+	$(python_gen_cond_dep '
+		>=dev-python/cffi-1.8:=[${PYTHON_USEDEP}]
+	' 'python*')
+"
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	${RUST_DEPEND}
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/certifi[${PYTHON_USEDEP}]
+		>=dev-python/hypothesis-1.11.4[${PYTHON_USEDEP}]
+		dev-python/iso8601[${PYTHON_USEDEP}]
+		dev-python/pretend[${PYTHON_USEDEP}]
+		dev-python/pyasn1-modules[${PYTHON_USEDEP}]
+		dev-python/pytest-subtests[${PYTHON_USEDEP}]
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-python/pytz[${PYTHON_USEDEP}]
+	)
+"
+
+# Files built without CFLAGS/LDFLAGS, acceptable for rust
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/cryptography/hazmat/bindings/_rust.*.so"
+
+distutils_enable_tests pytest
+
+src_unpack() {
+	cargo_src_unpack
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	sed -i -e 's:--benchmark-disable::' pyproject.toml || die
+
+	# work around availability macros not supported in GCC (yet)
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		local darwinok=0
+		if [[ ${CHOST##*-darwin} -ge 16 ]] ; then
+			darwinok=1
+		fi
+		sed -i -e 's/__builtin_available(macOS 10\.12, \*)/'"${darwinok}"'/' \
+			src/_cffi_src/openssl/src/osrandom_engine.c || die
+	fi
+}
+
+python_configure_all() {
+	filter-lto # bug #903908
+}
+
+python_test() {
+	local -x PYTHONPATH="${PYTHONPATH}:${WORKDIR}/cryptography_vectors-${PV}"
+	local EPYTEST_IGNORE=(
+		tests/bench
+	)
+	epytest -n "$(makeopts_jobs)"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
index e2d4f1d8b9..3dae2ffb47 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
@@ -1,4 +1 @@
-DIST pip-24.1-py3-none-any.whl 1823006 BLAKE2B ca5282b1100243cc4e391ce30d5ae7d4978987e46323b7e151c87457c4ab762f909c88ae3cb72015d09bf7c1243ddb6ad791e991093713431961962fc6fdde83 SHA512 84e8318896294e5750f30a3fa55833e5e5c802066091802e05ff94fe139c825f3fe0fb5014b899f0afd844ad1129e8d04b9fedd74a7f46a1c248dac546ab16f8
-DIST pip-24.3.1-py3-none-any.whl 1822182 BLAKE2B 8ec4f45dcc84094426db053dea43d86d14d24f6f23ca8b1b094a989f08b5653a2290df24e907c3ed283a668fa6da305620b4f74a3054d67f6e048327c5f06c66 SHA512 21cb4a844b7c9216a4878639a876acdce17ffda9e7228e85e344169d548a3f4316e5ec5183a950848c7391e2a650152e4a1e1f0f020de57f895c458de5ee7b82
-DIST pip-25.0-py3-none-any.whl 1841506 BLAKE2B 35c1ca34f202f397785b3a229379e0c58c4c9733280d2283ce9c6cfd4e3190283b708f99096015b0f556e98885622cb443976763af3c077ef4bdd73403959ca4 SHA512 e6037f24540ee96016fbd59a9250692407123db0966478b5d8e50e37de157cecfedc177002e4e98e1cbcbe9fb35561d72b5d20166c2919968794033c8b688cbf
 DIST pip-25.0.1-py3-none-any.whl 1841526 BLAKE2B 928210cf0586b2e17cf96c341babbbf612eb08775af716588fad8840d04153d264b64098f97c8d2d7b219389d571cee8e4190195f8c5cc9f602749aad92df437 SHA512 48315489f2c0a76b49386228f9a2f675e71f20ff2f4aaaf65b2634ba5cac7c98facfbdebeb4651c65efdd2ade053a140d7a2a6b44587549d6663bc8bb5ef2220
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.3.1.ebuild
deleted file mode 100644
index 23904e1f43..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.3.1.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit pypi
-
-DESCRIPTION="Shared pip wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/pip/"
-SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
-S=${DISTDIR}
-
-LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-src_install() {
-	insinto /usr/lib/python/ensurepip
-	doins "${A}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.1.ebuild
index dcf21d3e39..23904e1f43 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.1.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_install() {
 	insinto /usr/lib/python/ensurepip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index 95569b2f0c..22b5aebb84 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1 +1,3 @@
 DIST setuptools-75.8.0-py3-none-any.whl 1228782 BLAKE2B 0e53d2e2d3666bce8072b23556c77a013a6db704eaa1b582a37defcd5691bb6cc66533bc9edc164911e5e5839c0c418571052a696c5c9a98b289ea232d045a38 SHA512 02760ed1215eefe7ad4beae24243fa6372d47b975a060dd69d5c521c6c53fe9ba1a6e73f39448ed9471b89371d19273824becbc8471da40cf43d3c799f0b50cf
+DIST setuptools-75.8.1-py3-none-any.whl 1228867 BLAKE2B ec0fada24a666a0a32dc4bae456e40b35c0d6f87cc389a6ad917ae330e7e509a4f1a21a5c0a38cd4a5e74890c3e8e6c6be23450cd7658803f6f037b900e11b17 SHA512 ca68002ae0fabceae31d46f5e9453582bc60fc137b6e1c58d30f834a5233eeb58c60385be4a71b0feb2f3059cec5197bf4cb50f2bb94a728ebfb80f08ece8dd3
+DIST setuptools-75.8.2-py3-none-any.whl 1229385 BLAKE2B e2890604e9acbf23aefc94ee99927bafdc189e45c84b0e4e0b48737d120ba60590438603195e180988b26e3e8fb378812507e2a0b513bf886c3b1eb673853da5 SHA512 083447a6bd375ca99e017ec4c5e3083ee4eee32b65d911b4d5ccadfa587ec213d43562d21d0f238753cc5c54354027b8425880d7248fbbd170b0c006613f4327
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.1.ebuild
similarity index 72%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.1.ebuild
index dcf21d3e39..b76c3f6972 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-25.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.1.ebuild
@@ -5,12 +5,12 @@ EAPI=8
 
 inherit pypi
 
-DESCRIPTION="Shared pip wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/pip/"
+DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
+HOMEPAGE="https://pypi.org/project/setuptools/"
 SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
 S=${DISTDIR}
 
-LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
+LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
similarity index 61%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
index 917cc77fae..b76c3f6972 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-75.8.2.ebuild
@@ -1,23 +1,19 @@
-# Copyright 2022-2024 Gentoo Authors
+# Copyright 2022-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 inherit pypi
 
-DESCRIPTION="Shared pip wheel for ensurepip Python module"
-HOMEPAGE="https://pypi.org/project/pip/"
+DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
+HOMEPAGE="https://pypi.org/project/setuptools/"
 SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
 S=${DISTDIR}
 
-LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
+LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
-RDEPEND="
-	!<dev-python/ensurepip-wheels-100
-"
-
 src_install() {
 	insinto /usr/lib/python/ensurepip
 	doins "${A}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.10.0.ebuild
index 3e33584f12..59f97e1ac6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.10.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.10.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 
 inherit distutils-r1 pypi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
index 535698fe27..73e2f4a794 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
@@ -1,3 +1,2 @@
-DIST lxml-5.2.2.gh.tar.gz 950650 BLAKE2B d9e3bd96f386a808eca58ffa9a6b5a79e43102b7161fac9b97905de2bd22d21feaddb093e27463f597ef5378d754011c2999a38953e6288595b8dd171976688b SHA512 20b87a2d6e7ac82b6979d6fd18ecd5c224fec6eeee6b69d47a5bf2947ce53e6a517d1b86ab68836a5974f78ce86551ddc2317c1a7255932b418b98dc64d59376
 DIST lxml-5.3.0.gh.tar.gz 951199 BLAKE2B 8317179c524856593b323f665c288ddddd8af7e716e1ddf1222a857c8466cfc62a6c20b21744ca418f809a3c8492216c5c9c38cfa62f2e7d51daea7343b6810b SHA512 514477bf4c865541233d73f20de816b51d265dbd75c56a0d13779e14527c73e85ca890718d06c08728da228d410459016e9cb8abdad4d03b44a81a04a198fb54
 DIST lxml-5.3.1.gh.tar.gz 951340 BLAKE2B e73cc8513cfe42d163b8475788472f00f2f3492deb7536b6556ed4f14924ffe57497947e660a161ec5a0821135b3d103799c0da0b9c647ccdcbfa9b0c5d6a1d9 SHA512 e89ada765791b67e4e83a9151c500f2e8d924c05d421a46bece1183666fc566d545d2e6b62987075e82cbafb8cd4b1f48f6f94e9ebcc0bbd7227d687b2282794
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-5.1.1-pypy.patch b/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-5.1.1-pypy.patch
deleted file mode 100644
index 2f6a75781f..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-5.1.1-pypy.patch
+++ /dev/null
@@ -1,162 +0,0 @@
-diff --git a/src/lxml/tests/test_http_io.py b/src/lxml/tests/test_http_io.py
-index 8385e393..0b259299 100644
---- a/src/lxml/tests/test_http_io.py
-+++ b/src/lxml/tests/test_http_io.py
-@@ -10,3 +10,3 @@ import gzip
- 
--from .common_imports import etree, HelperTestCase, BytesIO, _bytes
-+from .common_imports import etree, HelperTestCase, BytesIO, _bytes, IS_PYPY
- from .dummy_http_server import webserver, HTTPRequestCollector
-@@ -14,2 +14,3 @@ from .dummy_http_server import webserver, HTTPRequestCollector
- 
-+@unittest.skipIf(IS_PYPY, "broken on pypy")
- class HttpIOTestCase(HelperTestCase):
-diff --git a/src/lxml/tests/test_nsclasses.py b/src/lxml/tests/test_nsclasses.py
-index 750dc1ed..adbec11c 100644
---- a/src/lxml/tests/test_nsclasses.py
-+++ b/src/lxml/tests/test_nsclasses.py
-@@ -8,3 +8,3 @@ import unittest
- 
--from .common_imports import etree, HelperTestCase, _bytes, make_doctest
-+from .common_imports import etree, HelperTestCase, _bytes, make_doctest, IS_PYPY
- 
-@@ -45,2 +45,3 @@ class ETreeNamespaceClassesTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_ns_classes(self):
-diff --git a/src/lxml/tests/test_objectify.py b/src/lxml/tests/test_objectify.py
-index 1c8ff47c..326c5316 100644
---- a/src/lxml/tests/test_objectify.py
-+++ b/src/lxml/tests/test_objectify.py
-@@ -10,3 +10,4 @@ import unittest
- from .common_imports import (
--    etree, HelperTestCase, fileInTestDir, doctest, make_doctest, _bytes, _str, BytesIO
-+    etree, HelperTestCase, fileInTestDir, doctest, make_doctest, _bytes, _str, BytesIO,
-+    IS_PYPY
- )
-@@ -383,2 +384,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_setattr(self):
-@@ -818,2 +820,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_build_tree(self):
-@@ -847,2 +850,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_bool(self):
-@@ -884,2 +888,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str(self):
-@@ -891,2 +896,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_intliteral(self):
-@@ -898,2 +904,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_floatliteral(self):
-@@ -905,2 +912,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_mul(self):
-@@ -917,2 +925,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_add(self):
-@@ -992,2 +1001,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr(self):
-@@ -999,2 +1009,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_intliteral(self):
-@@ -1006,2 +1017,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_floatliteral(self):
-@@ -1013,2 +1025,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_mul(self):
-@@ -1025,2 +1038,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_add(self):
-@@ -1050,2 +1064,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_int(self):
-@@ -1066,2 +1081,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float(self):
-@@ -1082,2 +1098,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float_precision(self):
-@@ -1101,2 +1118,3 @@ class ObjectifyTestCase(HelperTestCase):
-   
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float_precision_consistency(self):
-@@ -1187,2 +1205,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_unregistered(self):
-@@ -1349,2 +1368,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_cmp(self):
-@@ -1376,2 +1396,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_int_cmp(self):
-@@ -1398,2 +1419,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_bool_cmp(self):
-@@ -2067,2 +2089,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_registered_type_stringify(self):
-@@ -2537,2 +2560,3 @@ class ObjectifyTestCase(HelperTestCase):
-     # type-looked-up as ObjectifiedElement (no annotations)
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_int(self):
-@@ -2542,2 +2566,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_float(self):
-@@ -2547,2 +2572,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_str(self):
-@@ -2552,2 +2578,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_unicode(self):
-@@ -2557,2 +2584,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_bool(self):
-@@ -2562,2 +2590,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_none(self):
-@@ -2567,2 +2596,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_value_concatenation(self):
-@@ -2577,2 +2607,3 @@ class ObjectifyTestCase(HelperTestCase):
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_nested(self):
-@@ -2745,3 +2776,4 @@ def test_suite():
-     suite.addTests(doctest.DocTestSuite(objectify))
--    suite.addTests([make_doctest('../../../doc/objectify.txt')])
-+    if not IS_PYPY:
-+        suite.addTests([make_doctest('../../../doc/objectify.txt')])
-     return suite
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.2.ebuild
deleted file mode 100644
index 35cb74535c..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.2.ebuild
+++ /dev/null
@@ -1,119 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
-
-inherit distutils-r1 optfeature toolchain-funcs
-
-DESCRIPTION="A Pythonic binding for the libxml2 and libxslt libraries"
-HOMEPAGE="
-	https://lxml.de/
-	https://pypi.org/project/lxml/
-	https://github.com/lxml/lxml/
-"
-SRC_URI="
-	https://github.com/lxml/lxml/archive/${P}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-S=${WORKDIR}/lxml-${P}
-
-LICENSE="BSD ElementTree GPL-2 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="doc examples +threads test"
-RESTRICT="!test? ( test )"
-
-# Note: lib{xml2,xslt} are used as C libraries, not Python modules.
-DEPEND="
-	>=dev-libs/libxml2-2.10.3
-	>=dev-libs/libxslt-1.1.38
-"
-RDEPEND="
-	${DEPEND}
-"
-BDEPEND="
-	virtual/pkgconfig
-	>=dev-python/cython-3.0.10[${PYTHON_USEDEP}]
-	doc? (
-		$(python_gen_any_dep '
-			dev-python/docutils[${PYTHON_USEDEP}]
-			dev-python/pygments[${PYTHON_USEDEP}]
-			dev-python/sphinx[${PYTHON_USEDEP}]
-			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
-		')
-	)
-	test? (
-		dev-python/cssselect[${PYTHON_USEDEP}]
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-5.1.1-pypy.patch"
-)
-
-python_check_deps() {
-	use doc || return 0
-	python_has_version -b "dev-python/docutils[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/pygments[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/sphinx[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
-}
-
-python_prepare_all() {
-	# avoid replacing PYTHONPATH in tests.
-	sed -i -e '/sys\.path/d' test.py || die
-
-	# don't use some random SDK on Darwin
-	sed -i -e '/_ldflags =/s/=.*isysroot.*darwin.*None/= None/' \
-		setupinfo.py || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_compile() {
-	local DISTUTILS_ARGS=(
-		# by default it adds -w to CFLAGS
-		--warnings
-	)
-	tc-export PKG_CONFIG
-	distutils-r1_python_compile
-}
-
-python_compile_all() {
-	use doc && emake html
-}
-
-python_test() {
-	local dir=${BUILD_DIR}/test$(python_get_sitedir)/lxml
-	local -x PATH=${BUILD_DIR}/test/usr/bin:${PATH}
-
-	cp -al "${BUILD_DIR}"/{install,test} || die
-	cp -al src/lxml/tests "${dir}/" || die
-	cp -al src/lxml/html/tests "${dir}/html/" || die
-	ln -rs "${S}"/doc "${dir}"/../../ || die
-
-	"${EPYTHON}" test.py -vv --all-levels -p ||
-		die "Tests fail on ${EPYTHON}"
-}
-
-python_install_all() {
-	if use doc; then
-		local DOCS=( README.rst *.txt doc/*.txt )
-		local HTML_DOCS=( doc/html/. )
-	fi
-	if use examples; then
-		dodoc -r samples
-	fi
-
-	distutils-r1_python_install_all
-}
-
-pkg_postinst() {
-	optfeature "Support for BeautifulSoup as a parser backend" dev-python/beautifulsoup4
-	optfeature "Translates CSS selectors to XPath 1.0 expressions" dev-python/cssselect
-	optfeature "Support for lxml.html.clean sanitizer" dev-python/lxml-html-clean
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.1.ebuild
index fafbdaa10b..8e79faafc6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.1.ebuild
@@ -23,7 +23,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
index d0ec7085b2..45ac336813 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/Manifest
@@ -1,4 +1,2 @@
 DIST pip-24.1.gh.tar.gz 9188658 BLAKE2B 4a43ff0199d811dd30461e376f655a447f3f706a48dd97fe1d0ccf630f558e72209ccd06d98949a1541cd6b2942a816db23ce8aaa7fbbf9aef429502fb91ab92 SHA512 c60ab329fe91202ff64b5f0f90209085fbf8db0f0a05f0703f952ad69e39e2e3edb5dadc006a3f317cdd4ba4fb5abe56dfbd22792249a2d139702eec272186d1
-DIST pip-24.3.1.gh.tar.gz 9198711 BLAKE2B c70524bfedf46776d5ab8da24754e8177caac6d87cc90aa86b144c0fe9718860fe3d08823f655495c059dbece6e0ecbb2ac8e655cff3124693f64a35deac512e SHA512 9cf5f18eefd559cf27bc026e5206b0028ea77fd904a61fea9a6682b519305c962dd19170b841581bd05ff72192a9c458ec0eba173fa66db0438b046111ff5856
 DIST pip-25.0.1.gh.tar.gz 9224526 BLAKE2B db729b8c75d8e15c6fed1dbc9e08adc4e82114f2bbd953859ec03c7948e521629afd8cea6adb08110b987d6adf48fd600a59a3bcc27774db61ea92675ad90d42 SHA512 a6850c8567082bbf98483a45e523c4de12132136d2b0aa388ac619c02ffd0c8f6aea7d727f7d84167dadec5f1e56dd478b2233b0caa5d9b3e5cadc9e1f3dc12c
-DIST pip-25.0.gh.tar.gz 9224545 BLAKE2B 9606eea2b08d5220f9ed7528c14251ef20499693bdb817a2280124672860cb24111999bdb67af1107006ae4dd02c52d395fddea7e6b09dbc820a41ee8618fd50 SHA512 023db908a1da1cbbd2134bb83cc69a7a35e6d010b3f846bb8abcab14ca79a8cee4d02ead9346220e05fe137039377074c732b4bf2a9e6eee5c0d9161f1754f95
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.1-unbundle.patch b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.1-unbundle.patch
deleted file mode 100644
index 676ffa3609..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.1-unbundle.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-diff --git a/src/pip/_internal/commands/debug.py b/src/pip/_internal/commands/debug.py
-index 567ca967e..427bfcf04 100644
---- a/src/pip/_internal/commands/debug.py
-+++ b/src/pip/_internal/commands/debug.py
-@@ -6,7 +6,6 @@ from optparse import Values
- from types import ModuleType
- from typing import Any, Dict, List, Optional
- 
--import pip._vendor
- from pip._vendor.certifi import where
- from pip._vendor.packaging.version import parse as parse_version
- 
-@@ -192,9 +191,7 @@ class DebugCommand(Command):
-         show_value("REQUESTS_CA_BUNDLE", os.environ.get("REQUESTS_CA_BUNDLE"))
-         show_value("CURL_CA_BUNDLE", os.environ.get("CURL_CA_BUNDLE"))
-         show_value("pip._vendor.certifi.where()", where())
--        show_value("pip._vendor.DEBUNDLED", pip._vendor.DEBUNDLED)
--
--        show_vendor_versions()
-+        show_value("pip._vendor.DEBUNDLED", True)
- 
-         show_tags(options)
- 
-diff --git a/tests/conftest.py b/tests/conftest.py
-index 35101cef2..840663fed 100644
---- a/tests/conftest.py
-+++ b/tests/conftest.py
-@@ -413,6 +413,7 @@ def _common_wheel_editable_install(
-     assert len(wheel_candidates) == 1, wheel_candidates
-     install_dir = tmpdir_factory.mktemp(package) / "install"
-     lib_install_dir = install_dir / "lib"
-+    return lib_install_dir
-     bin_install_dir = install_dir / "bin"
-     with WheelFile.open(wheel_candidates[0]) as source:
-         install(
-diff --git a/tests/functional/test_check.py b/tests/functional/test_check.py
-index 46ecdcc64..6507febfa 100644
---- a/tests/functional/test_check.py
-+++ b/tests/functional/test_check.py
-@@ -6,10 +6,8 @@ from tests.lib import PipTestEnvironment, create_test_package_with_setup
- def matches_expected_lines(string: str, expected_lines: Collection[str]) -> bool:
-     # Ignore empty lines
-     output_lines = list(filter(None, string.splitlines()))
--    # We'll match the last n lines, given n lines to match.
--    last_few_output_lines = output_lines[-len(expected_lines) :]
-     # And order does not matter
--    return set(last_few_output_lines) == set(expected_lines)
-+    return set(expected_lines).issubset(set(output_lines))
- 
- 
- def test_basic_check_clean(script: PipTestEnvironment) -> None:
-diff --git a/tests/functional/test_freeze.py b/tests/functional/test_freeze.py
-index b7af974ea..144f79483 100644
---- a/tests/functional/test_freeze.py
-+++ b/tests/functional/test_freeze.py
-@@ -80,8 +80,8 @@ def test_basic_freeze(script: PipTestEnvironment) -> None:
-     result = script.pip("freeze", expect_stderr=True)
-     expected = textwrap.dedent(
-         """\
--        ...simple==2.0
--        simple2==3.0...
-+        ...simple==2.0...
-+        ...simple2==3.0...
-         <BLANKLINE>"""
-     )
-     _check_output(result.stdout, expected)
-@@ -1014,7 +1014,7 @@ def test_freeze_skip_work_dir_pkg(script: PipTestEnvironment) -> None:
- 
-     # Freeze should not include package simple when run from package directory
-     result = script.pip("freeze", cwd=pkg_path)
--    assert "simple" not in result.stdout
-+    assert "\nsimple==" not in result.stdout
- 
- 
- def test_freeze_include_work_dir_pkg(script: PipTestEnvironment) -> None:
-diff --git a/tests/functional/test_install_check.py b/tests/functional/test_install_check.py
-index 8a8a7c93a..bbda083f7 100644
---- a/tests/functional/test_install_check.py
-+++ b/tests/functional/test_install_check.py
-@@ -57,6 +57,7 @@ def test_check_install_canonicalization(script: PipTestEnvironment) -> None:
-     )
-     assert "requires" not in result.stderr
-     assert result.returncode == 0
-+    return
- 
-     # Double check that all errors are resolved in the end
-     result = script.pip("check")
-diff --git a/tests/functional/test_list.py b/tests/functional/test_list.py
-index 5164c1d5c..ce0a81aea 100644
---- a/tests/functional/test_list.py
-+++ b/tests/functional/test_list.py
-@@ -1,5 +1,6 @@
- import json
- import os
-+import re
- from pathlib import Path
- 
- import pytest
-@@ -41,8 +42,8 @@ def test_basic_list(simple_script: PipTestEnvironment) -> None:
- 
-     """
-     result = simple_script.pip("list")
--    assert "simple     1.0" in result.stdout, str(result)
--    assert "simple2    3.0" in result.stdout, str(result)
-+    assert re.search(r"simple\s+1\.0", result.stdout), str(result)
-+    assert re.search(r"simple2\s+3\.0", result.stdout), str(result)
- 
- 
- def test_verbose_flag(simple_script: PipTestEnvironment) -> None:
-@@ -54,8 +55,8 @@ def test_verbose_flag(simple_script: PipTestEnvironment) -> None:
-     assert "Version" in result.stdout, str(result)
-     assert "Location" in result.stdout, str(result)
-     assert "Installer" in result.stdout, str(result)
--    assert "simple     1.0" in result.stdout, str(result)
--    assert "simple2    3.0" in result.stdout, str(result)
-+    assert re.search(r"simple\s+1\.0", result.stdout), str(result)
-+    assert re.search(r"simple2\s+3\.0", result.stdout), str(result)
- 
- 
- def test_columns_flag(simple_script: PipTestEnvironment) -> None:
-@@ -66,8 +67,8 @@ def test_columns_flag(simple_script: PipTestEnvironment) -> None:
-     assert "Package" in result.stdout, str(result)
-     assert "Version" in result.stdout, str(result)
-     assert "simple (1.0)" not in result.stdout, str(result)
--    assert "simple     1.0" in result.stdout, str(result)
--    assert "simple2    3.0" in result.stdout, str(result)
-+    assert re.search(r"simple\s+1\.0", result.stdout), str(result)
-+    assert re.search(r"simple2\s+3\.0", result.stdout), str(result)
- 
- 
- def test_format_priority(simple_script: PipTestEnvironment) -> None:
-@@ -79,16 +80,16 @@ def test_format_priority(simple_script: PipTestEnvironment) -> None:
-     )
-     assert "simple==1.0" in result.stdout, str(result)
-     assert "simple2==3.0" in result.stdout, str(result)
--    assert "simple     1.0" not in result.stdout, str(result)
--    assert "simple2    3.0" not in result.stdout, str(result)
-+    assert not re.search(r"simple\s+1\.0", result.stdout), str(result)
-+    assert not re.search(r"simple2\s+3\.0", result.stdout), str(result)
- 
-     result = simple_script.pip("list", "--format=freeze", "--format=columns")
-     assert "Package" in result.stdout, str(result)
-     assert "Version" in result.stdout, str(result)
-     assert "simple==1.0" not in result.stdout, str(result)
-     assert "simple2==3.0" not in result.stdout, str(result)
--    assert "simple     1.0" in result.stdout, str(result)
--    assert "simple2    3.0" in result.stdout, str(result)
-+    assert re.search(r"simple\s+1\.0", result.stdout), str(result)
-+    assert re.search(r"simple2\s+3\.0", result.stdout), str(result)
- 
- 
- def test_local_flag(simple_script: PipTestEnvironment) -> None:
-@@ -124,8 +125,8 @@ def test_multiple_exclude_and_normalization(
-     assert "Normalizable_Name" in result.stdout
-     assert "pip" in result.stdout
-     result = script.pip("list", "--exclude", "normalizablE-namE", "--exclude", "pIp")
--    assert "Normalizable_Name" not in result.stdout
--    assert "pip" not in result.stdout
-+    assert "Normalizable_Name " not in result.stdout
-+    assert "pip " not in result.stdout
- 
- 
- @pytest.mark.network
-diff --git a/tests/lib/venv.py b/tests/lib/venv.py
-index fac54d3bd..6bfe3cfdc 100644
---- a/tests/lib/venv.py
-+++ b/tests/lib/venv.py
-@@ -9,6 +9,7 @@ import venv as _venv
- from pathlib import Path
- from typing import Dict, Literal, Optional, Union
- 
-+import pytest
- import virtualenv as _virtualenv
- 
- VirtualEnvironmentType = Literal["virtualenv", "venv"]
-@@ -35,7 +36,7 @@ class VirtualEnvironment:
-             self._venv_type = venv_type
-         else:
-             self._venv_type = "virtualenv"
--        self._user_site_packages = False
-+        self._user_site_packages = True
-         self._template = template
-         self._sitecustomize: Optional[str] = None
-         self._update_paths()
-@@ -234,6 +235,8 @@ class VirtualEnvironment:
- 
-     @user_site_packages.setter
-     def user_site_packages(self, value: bool) -> None:
-+        if not value:
-+            pytest.skip("Gentoo: skipping due to lack of system site-packages")
-         self._user_site_packages = value
-         if self._legacy_virtualenv:
-             marker = self.lib / "no-global-site-packages.txt"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.3.1-rich-13.8.patch b/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.3.1-rich-13.8.patch
deleted file mode 100644
index d17ccf5b2f..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/files/pip-24.3.1-rich-13.8.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 8cfd050f615a4bad699ec55d4cb19b1f1dc4137e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
-Date: Sat, 9 Nov 2024 16:41:40 +0100
-Subject: [PATCH] Override rich.console pipe handler for rich 13.8.0+
-
-Explicitly override `rich.console.Console.on_broken_pipe()` to reraise
-the original exception, to bring the behavior of rich 13.8.0+ in line
-with older versions.  The new versions instead close output fds and exit
-with error instead, which prevents pip's pipe handler from firing.
-This is the minimal change needed to make pip's test suite pass after
-upgrading vendored rich.
-
-Bug #13006
-Bug #13072
----
- src/pip/_internal/utils/logging.py | 9 ++++++++-
- 2 files changed, 8 insertions(+), 1 deletion(-)
- create mode 100644 news/13072.trivial.rst
-
-diff --git a/src/pip/_internal/utils/logging.py b/src/pip/_internal/utils/logging.py
-index 41f6eb51a..be17add5d 100644
---- a/src/pip/_internal/utils/logging.py
-+++ b/src/pip/_internal/utils/logging.py
-@@ -137,12 +137,19 @@ class IndentedRenderable:
-             yield Segment("\n")
- 
- 
-+class PipConsole(Console):
-+    def on_broken_pipe(self) -> None:
-+        # Reraise the original exception, rich 13.8.0+ exits by default
-+        # instead, preventing our handler from firing.
-+        raise BrokenPipeError() from None
-+
-+
- class RichPipStreamHandler(RichHandler):
-     KEYWORDS: ClassVar[Optional[List[str]]] = []
- 
-     def __init__(self, stream: Optional[TextIO], no_color: bool) -> None:
-         super().__init__(
--            console=Console(file=stream, no_color=no_color, soft_wrap=True),
-+            console=PipConsole(file=stream, no_color=no_color, soft_wrap=True),
-             show_time=False,
-             show_level=False,
-             show_path=False,
--- 
-2.47.0
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-24.3.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-24.3.1-r2.ebuild
deleted file mode 100644
index 89532d77b3..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-24.3.1-r2.ebuild
+++ /dev/null
@@ -1,173 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# please bump dev-python/ensurepip-pip along with this package!
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( python3_{10..13} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 )
-PYTHON_REQ_USE="ssl(+),threads(+)"
-
-inherit bash-completion-r1 distutils-r1
-
-DESCRIPTION="The PyPA recommended tool for installing Python packages"
-HOMEPAGE="
-	https://pip.pypa.io/en/stable/
-	https://pypi.org/project/pip/
-	https://github.com/pypa/pip/
-"
-SRC_URI="
-	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
-"
-
-LICENSE="MIT"
-# bundled deps
-LICENSE+=" Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MPL-2.0 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="test-rust"
-
-# see src/pip/_vendor/vendor.txt
-RDEPEND="
-	>=dev-python/cachecontrol-0.14.0[${PYTHON_USEDEP}]
-	>=dev-python/distlib-0.3.9[${PYTHON_USEDEP}]
-	>=dev-python/distro-1.9.0[${PYTHON_USEDEP}]
-	>=dev-python/msgpack-1.0.8[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.2.1[${PYTHON_USEDEP}]
-	>=dev-python/pyproject-hooks-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/requests-2.32.0[${PYTHON_USEDEP}]
-	>=dev-python/rich-13.7.1[${PYTHON_USEDEP}]
-	>=dev-python/resolvelib-1.0.1[${PYTHON_USEDEP}]
-	>=dev-python/setuptools-69.5.1[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
-	' 3.10)
-	>=dev-python/truststore-0.10.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.12.2[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			dev-python/ensurepip-setuptools
-			dev-python/ensurepip-wheel
-			dev-python/freezegun[${PYTHON_USEDEP}]
-			dev-python/pretend[${PYTHON_USEDEP}]
-			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			dev-python/scripttest[${PYTHON_USEDEP}]
-			dev-python/tomli-w[${PYTHON_USEDEP}]
-			dev-python/virtualenv[${PYTHON_USEDEP}]
-			dev-python/werkzeug[${PYTHON_USEDEP}]
-			dev-python/wheel[${PYTHON_USEDEP}]
-			test-rust? (
-				dev-python/cryptography[${PYTHON_USEDEP}]
-			)
-			dev-vcs/git
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-distutils_enable_tests pytest
-
-python_prepare_all() {
-	local PATCHES=(
-		"${FILESDIR}/pip-23.1-no-coverage.patch"
-		# prepare to unbundle dependencies
-		"${FILESDIR}/pip-24.1-unbundle.patch"
-		# https://github.com/pypa/pip/pull/13073
-		"${FILESDIR}/pip-24.3.1-rich-13.8.patch"
-	)
-
-	distutils-r1_python_prepare_all
-
-	# unbundle dependencies
-	rm -r src/pip/_vendor || die
-	find -name '*.py' -exec sed -i \
-		-e 's:from pip\._vendor import:import:g' \
-		-e 's:from pip\._vendor\.:from :g' \
-		{} + || die
-
-	if use test; then
-		local wheels=(
-			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
-		)
-		mkdir tests/data/common_wheels/ || die
-		cp "${wheels[@]}" tests/data/common_wheels/ || die
-	fi
-}
-
-python_compile_all() {
-	# 'pip completion' command embeds full $0 into completion script, which confuses
-	# 'complete' and causes QA warning when running as "${PYTHON} -m pip".
-	# This trick sets correct $0 while still calling just installed pip.
-	local pipcmd='import sys; sys.argv[0] = "pip"; __file__ = ""; from pip._internal.cli.main import main; sys.exit(main())'
-	"${EPYTHON}" -c "${pipcmd}" completion --bash > completion.bash || die
-	"${EPYTHON}" -c "${pipcmd}" completion --zsh > completion.zsh || die
-}
-
-python_test() {
-	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
-		einfo "Skipping tests on ${EPYTHON}"
-		return 0
-	fi
-
-	local EPYTEST_DESELECT=(
-		tests/functional/test_inspect.py::test_inspect_basic
-		# Internet
-		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
-		tests/functional/test_install.py::test_double_install_fail
-		tests/functional/test_install.py::test_install_sdist_links
-		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
-		# broken by system site-packages use
-		tests/functional/test_check.py::test_basic_check_clean
-		tests/functional/test_check.py::test_check_skip_work_dir_pkg
-		tests/functional/test_check.py::test_check_complicated_name_clean
-		tests/functional/test_check.py::test_check_development_versions_are_also_considered
-		tests/functional/test_freeze.py::test_freeze_with_setuptools
-		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
-		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
-		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
-		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
-		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
-		# broken by unbundling
-		"tests/functional/test_debug.py::test_debug[vendored library versions:]"
-		tests/functional/test_debug.py::test_debug__library_versions
-		tests/functional/test_python_option.py::test_python_interpreter
-		tests/functional/test_uninstall.py::test_uninstall_non_local_distutils
-	)
-	local EPYTEST_IGNORE=(
-		# requires proxy.py
-		tests/functional/test_proxy.py
-	)
-
-	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
-		EPYTEST_DESELECT+=(
-			tests/functional/test_install.py::test_install_sends_client_cert
-			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
-			tests/functional/test_install_config.py::test_prompt_for_authentication
-			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
-		)
-	fi
-
-	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local EPYTEST_XDIST=1
-	# rerunfailures because test suite breaks if packages are installed
-	# in parallel
-	epytest -m "not network" -o tmp_path_retention_policy=all \
-		-p rerunfailures --reruns=5
-}
-
-python_install_all() {
-	local DOCS=( AUTHORS.txt docs/html/**/*.rst )
-	distutils-r1_python_install_all
-
-	newbashcomp completion.bash pip
-
-	insinto /usr/share/zsh/site-functions
-	newins completion.zsh _pip
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.1-r1.ebuild
index 24f37823be..c29b754e9b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.1-r1.ebuild
@@ -24,7 +24,7 @@ SRC_URI="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="test-rust"
 
 # see src/pip/_vendor/vendor.txt
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.ebuild
deleted file mode 100644
index 8ab316566c..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pip/pip-25.0.ebuild
+++ /dev/null
@@ -1,170 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# please bump dev-python/ensurepip-pip along with this package!
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( pypy3 python3_{10..13} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
-PYTHON_REQ_USE="ssl(+),threads(+)"
-
-inherit bash-completion-r1 distutils-r1
-
-DESCRIPTION="The PyPA recommended tool for installing Python packages"
-HOMEPAGE="
-	https://pip.pypa.io/en/stable/
-	https://pypi.org/project/pip/
-	https://github.com/pypa/pip/
-"
-SRC_URI="
-	https://github.com/pypa/pip/archive/${PV}.tar.gz -> ${P}.gh.tar.gz
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="test-rust"
-
-# see src/pip/_vendor/vendor.txt
-RDEPEND="
-	>=dev-python/cachecontrol-0.14.1[${PYTHON_USEDEP}]
-	>=dev-python/distlib-0.3.9[${PYTHON_USEDEP}]
-	>=dev-python/distro-1.9.0[${PYTHON_USEDEP}]
-	>=dev-python/msgpack-1.1.0[${PYTHON_USEDEP}]
-	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
-	>=dev-python/platformdirs-4.3.6[${PYTHON_USEDEP}]
-	>=dev-python/pyproject-hooks-1.2.0[${PYTHON_USEDEP}]
-	>=dev-python/requests-2.32.0[${PYTHON_USEDEP}]
-	>=dev-python/rich-13.9.4[${PYTHON_USEDEP}]
-	>=dev-python/resolvelib-1.0.1[${PYTHON_USEDEP}]
-	>=dev-python/setuptools-69.5.1[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.2.1[${PYTHON_USEDEP}]
-	' 3.10)
-	>=dev-python/truststore-0.10.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.12.2[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			dev-python/ensurepip-setuptools
-			dev-python/ensurepip-wheel
-			dev-python/freezegun[${PYTHON_USEDEP}]
-			dev-python/pretend[${PYTHON_USEDEP}]
-			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
-			dev-python/pytest-xdist[${PYTHON_USEDEP}]
-			dev-python/scripttest[${PYTHON_USEDEP}]
-			dev-python/tomli-w[${PYTHON_USEDEP}]
-			dev-python/virtualenv[${PYTHON_USEDEP}]
-			dev-python/werkzeug[${PYTHON_USEDEP}]
-			dev-python/wheel[${PYTHON_USEDEP}]
-			test-rust? (
-				dev-python/cryptography[${PYTHON_USEDEP}]
-			)
-			dev-vcs/git
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-distutils_enable_tests pytest
-
-python_prepare_all() {
-	local PATCHES=(
-		"${FILESDIR}/pip-23.1-no-coverage.patch"
-		# prepare to unbundle dependencies
-		"${FILESDIR}/pip-24.1-unbundle.patch"
-	)
-
-	distutils-r1_python_prepare_all
-
-	# unbundle dependencies
-	rm -r src/pip/_vendor || die
-	find -name '*.py' -exec sed -i \
-		-e 's:from pip\._vendor import:import:g' \
-		-e 's:from pip\._vendor\.:from :g' \
-		{} + || die
-
-	if use test; then
-		local wheels=(
-			"${BROOT}"/usr/lib/python/ensurepip/{setuptools,wheel}-*.whl
-		)
-		mkdir tests/data/common_wheels/ || die
-		cp "${wheels[@]}" tests/data/common_wheels/ || die
-	fi
-}
-
-python_compile_all() {
-	# 'pip completion' command embeds full $0 into completion script, which confuses
-	# 'complete' and causes QA warning when running as "${PYTHON} -m pip".
-	# This trick sets correct $0 while still calling just installed pip.
-	local pipcmd='import sys; sys.argv[0] = "pip"; __file__ = ""; from pip._internal.cli.main import main; sys.exit(main())'
-	"${EPYTHON}" -c "${pipcmd}" completion --bash > completion.bash || die
-	"${EPYTHON}" -c "${pipcmd}" completion --zsh > completion.zsh || die
-}
-
-python_test() {
-	local EPYTEST_DESELECT=(
-		tests/functional/test_inspect.py::test_inspect_basic
-		# Internet
-		tests/functional/test_config_settings.py::test_backend_sees_config_via_sdist
-		tests/functional/test_install.py::test_double_install_fail
-		tests/functional/test_install.py::test_install_sdist_links
-		tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
-		# broken by system site-packages use
-		tests/functional/test_freeze.py::test_freeze_with_setuptools
-		tests/functional/test_pip_runner_script.py::test_runner_work_in_environments_with_no_pip
-		tests/functional/test_uninstall.py::test_basic_uninstall_distutils
-		tests/unit/test_base_command.py::test_base_command_global_tempdir_cleanup
-		tests/unit/test_base_command.py::test_base_command_local_tempdir_cleanup
-		tests/unit/test_base_command.py::test_base_command_provides_tempdir_helpers
-		# broken by unbundling
-		"tests/functional/test_debug.py::test_debug[vendored library versions:]"
-		tests/functional/test_debug.py::test_debug__library_versions
-		tests/functional/test_python_option.py::test_python_interpreter
-		tests/functional/test_uninstall.py::test_uninstall_non_local_distutils
-	)
-	local EPYTEST_IGNORE=(
-		# requires proxy.py
-		tests/functional/test_proxy.py
-	)
-
-	case ${EPYTHON} in
-		pypy3)
-			EPYTEST_DESELECT+=(
-				# unexpected tempfiles?
-				tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
-				tests/functional/test_install_config.py::test_prompt_for_authentication
-			)
-			;;
-	esac
-
-	if ! has_version "dev-python/cryptography[${PYTHON_USEDEP}]"; then
-		EPYTEST_DESELECT+=(
-			tests/functional/test_install.py::test_install_sends_client_cert
-			tests/functional/test_install_config.py::test_do_not_prompt_for_authentication
-			tests/functional/test_install_config.py::test_prompt_for_authentication
-			tests/functional/test_install_config.py::test_prompt_for_keyring_if_needed
-		)
-	fi
-
-	local -x PIP_DISABLE_PIP_VERSION_CHECK=1
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local EPYTEST_XDIST=1
-	# rerunfailures because test suite breaks if packages are installed
-	# in parallel
-	epytest -m "not network" -o tmp_path_retention_policy=all \
-		-p rerunfailures --reruns=5 --use-venv
-}
-
-python_install_all() {
-	local DOCS=( AUTHORS.txt docs/html/**/*.rst )
-	distutils-r1_python_install_all
-
-	newbashcomp completion.bash pip
-
-	insinto /usr/share/zsh/site-functions
-	newins completion.zsh _pip
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
index 26a4727140..c700abef86 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/resolvelib/resolvelib-1.1.0.ebuild
@@ -21,7 +21,7 @@ SRC_URI="
 
 LICENSE="ISC"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 1e8dbbf9fd..f7aae64dee 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1 +1,3 @@
 DIST setuptools-75.8.0.tar.gz 1343222 BLAKE2B a71cba4c11ede52aae24e8a8045f2733f93001b896ea4dd46ebdfa0dd639fccfcc24b038cf4f9b6363b768e98d66cbeac2331cbcd4bb38767ea73f1811a11837 SHA512 4afa657c5259f9f405c39d82d8c264236749861ba2b104e8b26dd49da8ffb27ad3089ea894f2bb65208f480d7a4042114b93228f1cf2b224dc248774d7681a3d
+DIST setuptools-75.8.1.tar.gz 1343534 BLAKE2B c68a054bbb9367416b9c801d330699f96016e5e22459dfd833a8d1f62d908473f3909083261e8fe41c2ac0cbbdd571800321ad133c4821837be618cb46c8b5cb SHA512 6177074601f10b4d1eff52aa9be80eb52f4f2fc74f0e54d10d556a0812b2de9568ab9d7bc3692fc286b54070728fe41c41d2271403403d0d757733fe2ac74a8f
+DIST setuptools-75.8.2.tar.gz 1344083 BLAKE2B 7d4dff2c0948bb411ef5f70e5f5f91bc0e230b155a97419d263f88e54a94390fd7dcadad14105f4d886a25024bf4c95e776ae7b25e4b1d6f17e45e6060b99da2 SHA512 adf7f5d2eab7621b03c86e3f96857b176631108dc8a0eba2b16b87e394bff0b607998bc24cc074cd3f7b0ed6dbe0bd753cce5af2f108fce2473fb50b22f32913
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.1.ebuild
new file mode 100644
index 0000000000..dac8b7007e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.1.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!<dev-python/setuptools-rust-1.8.0
+	dev-python/jaraco-collections[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
+	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	' 3.10)
+	!<=dev-libs/gobject-introspection-1.76.1-r0
+	!=dev-libs/gobject-introspection-1.78.1-r0
+	!=dev-libs/gobject-introspection-1.80.1-r1
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
+			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+# setuptools-scm is here because installing plugins apparently breaks stuff at
+# runtime, so let's pull it early. See bug #663324.
+#
+# trove-classifiers are optionally used in validation, if they are
+# installed.  Since we really oughtn't block them, let's always enforce
+# the newest version for the time being to avoid errors.
+# https://github.com/pypa/setuptools/issues/4459
+PDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
+"
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
+		# https://github.com/abravalheri/validate-pyproject/pull/221
+		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	# breaks tests
+	sed -i -e '/--import-mode/d' pytest.ini || die
+
+	# remove bundled dependencies
+	rm -r */_vendor || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
+		# broken by unbundling
+		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
+		# fails on normalized metadata, perhaps different dep version?
+		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
+		# TODO
+		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
+		# relies on -Werror
+		setuptools/_static.py::setuptools._static.Dict
+		setuptools/_static.py::setuptools._static.List
+	)
+
+	local EPYTEST_XDIST=1
+	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
+	epytest -o tmp_path_retention_policy=all \
+		-m "not uses_network" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
new file mode 100644
index 0000000000..dac8b7007e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-75.8.2.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_13t )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!<dev-python/setuptools-rust-1.8.0
+	dev-python/jaraco-collections[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-functools-4[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-24.2[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-4.2.2[${PYTHON_USEDEP}]
+	>=dev-python/wheel-0.44.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	' 3.10)
+	!<=dev-libs/gobject-introspection-1.76.1-r0
+	!=dev-libs/gobject-introspection-1.78.1-r0
+	!=dev-libs/gobject-introspection-1.80.1-r1
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.7.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-test-5.5[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
+			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+# setuptools-scm is here because installing plugins apparently breaks stuff at
+# runtime, so let's pull it early. See bug #663324.
+#
+# trove-classifiers are optionally used in validation, if they are
+# installed.  Since we really oughtn't block them, let's always enforce
+# the newest version for the time being to avoid errors.
+# https://github.com/pypa/setuptools/issues/4459
+PDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	>=dev-python/trove-classifiers-2024.10.16[${PYTHON_USEDEP}]
+"
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
+		# https://github.com/abravalheri/validate-pyproject/pull/221
+		"${FILESDIR}/setuptools-75.6.0-disable-trove-classifiers.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	# breaks tests
+	sed -i -e '/--import-mode/d' pytest.ini || die
+
+	# remove bundled dependencies
+	rm -r */_vendor || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
+		# broken by unbundling
+		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
+		# fails on normalized metadata, perhaps different dep version?
+		setuptools/tests/test_build_meta.py::TestBuildMetaBackend::test_build_with_pyproject_config
+		# TODO
+		setuptools/tests/test_sdist.py::test_sanity_check_setuptools_own_sdist
+		# relies on -Werror
+		setuptools/_static.py::setuptools._static.Dict
+		setuptools/_static.py::setuptools._static.List
+	)
+
+	local EPYTEST_XDIST=1
+	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
+	epytest -o tmp_path_retention_policy=all \
+		-m "not uses_network" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.10.ebuild
index c593770336..934da720bb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.10.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
index d030290784..086b0670ec 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 PYTHON_REQ_USE="threads(+)"
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.1.ebuild
index e60e771233..facdc87187 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.1.ebuild
@@ -73,6 +73,9 @@ src_prepare() {
 		# uv does not work easily w/ network-sandbox, force virtualenv
 		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
 
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
 		# used by *git_sdist_generator tests
 		git init -q || die
 		git config --global user.email "larry@gentoo.org" || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.2.ebuild
index a9f9ffc5c5..777f8cad3d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.2.ebuild
@@ -77,6 +77,9 @@ src_prepare() {
 		# uv does not work easily w/ network-sandbox, force virtualenv
 		sed -i 's/"uv"/"uv-not-found"/' tests/common/mod.rs || die
 
+		# increase timeouts for tests (bug #950332)
+		sed -i '/^#\[timeout/s/secs(60)/secs(300)/' tests/run.rs || die
+
 		# used by *git_sdist_generator tests
 		git init -q || die
 		git config --global user.email "larry@gentoo.org" || die
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
index ea14b7f705..7b1555628f 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
@@ -1,3 +1,2 @@
-DIST traceroute-2.1.1.tar.gz 73063 BLAKE2B 89a828f7a0fec30ece599ee7fdd13fd93db0668f6c9f930f1d6d7d94140bcfdf0c75d2d8c5cc52d699e5c4377239f1a4123ad73a98b619968955d029d0842d9f SHA512 f3358e57ffb4a8dc40650e941da879c60407414e44f9887ae65820d1089491dbfac579bd06c1df296738af89a6c61c1e7944ae4495464f8c9ae21afb19b8f296
 DIST traceroute-2.1.3.tar.gz 73171 BLAKE2B a723bdc8ed5f12f6b53552cf7d330eb028deb55ae85c785451d282be1946cdc57ff428a755cc2bbd71495b49cbc89c1707d2686a553029220f8a089fed1c1fc2 SHA512 db96214e6957fffe17c013044fdc20be6cf94fe5249c9adac77e62e20327c4d582b2ddf4b511f93f30be0cba9f67b0f3f61490745f35ff5a32c63ed66cb0c444
 DIST traceroute-2.1.5.tar.gz 75453 BLAKE2B b2e99398b23d064f96319c9ca677589175f4bde64bce1f1d3236fc94f0ae3aa00499a2ef4a5c66c3a5815e09e16c534d049c36745119850c90c8af879ef66c6b SHA512 4557e6091cd34edd9761ffa5c75e13d63e7ae17c9d060f18306487cd5c1e7eece8a7ef3ddc6bf40f78d1014ed38ce2411c14d839251412978b2da0915180be93
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.1.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.1.ebuild
deleted file mode 100644
index 6fe13cb6e9..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.1.ebuild
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic toolchain-funcs
-
-DESCRIPTION="Utility to trace the route of IP packets"
-HOMEPAGE="http://traceroute.sourceforge.net/"
-SRC_URI="https://downloads.sourceforge.net/traceroute/${P}.tar.gz"
-
-LICENSE="GPL-2 LGPL-2.1"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="static"
-
-RDEPEND="!net-misc/iputils[traceroute6(-)]"
-
-src_compile() {
-	use static && append-ldflags -static
-	append-ldflags -L../libsupp #432116
-	tc-export AR CC RANLIB
-	emake env=yes
-}
-
-src_install() {
-	emake DESTDIR="${D}" prefix="${EPREFIX}/usr" install
-	dodoc ChangeLog CREDITS README TODO
-	dosym traceroute /usr/bin/traceroute6
-	dosym traceroute.8 /usr/share/man/man8/traceroute6.8
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.4.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.4.ebuild
index 1f186ead73..71d5a1f90d 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.34.4.ebuild
@@ -18,7 +18,7 @@ SRC_URI="
 LICENSE="MIT ISC"
 # Subslot = SONAME of libcares.so.2
 SLOT="0/2"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild
index 58e72e44cc..cc333a91ca 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild
@@ -21,7 +21,7 @@ else
 		https://curl.se/download/${P}.tar.xz
 		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
index d4a77468b7..7ddef4fb2b 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
@@ -1,5 +1,3 @@
-DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b SHA512 0cafc17d22851605a4a5495a1d82c2b3fbbe6643760aad226dbf2a25b5f49d4375c3172833706ea3cb6c05d5d02a40feb9a7e790eae5c4570dd344a43e94ca55
-DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf
 DIST openssh-9.8p1.tar.gz 1910393 BLAKE2B 3bf983c4ef5358054ed0104cd51d3e0069fbc2b80d8522d0df644d5508ec1d26a67bf061b1b5698d1cdf0d2cbba16b4cdca12a4ce30da24429094576a075e192 SHA512 95dec2f18e58eb47994f3de4430253e0665e185564b65088ca5f4108870e05feddef8cda8d3c0a4b75f18b98cc2c024df0e27de53b48c1a16da8da483cb8292a
 DIST openssh-9.8p1.tar.gz.asc 833 BLAKE2B 5291e8c03ab9a75acb44285cd7fc010f4a33551f142499624165dac708fc05a6d077df81555aa41037b45f6301e4e5db3161a7a23404473f8a233a877fc55cc3 SHA512 4df1f1be2c6ab7f3aebaedd0a773b0e8c8929abb30cd3415873ad55d012cfa113f792e888e5e772dd468c394aeb7e35d62893a514dbc0ab1a03acd79918657f7
 DIST openssh-9.9p1.tar.gz 1964864 BLAKE2B 817d267e42b8be74a13e0cfd7999bdb4dab6355c7f62c1a4dd89adad310c5fb7fe3f17109ce1a36cd269a3639c1b8f1d18330c615ab3b419253ec027cfa20997 SHA512 3cc0ed97f3e29ecbd882eca79239f02eb5a1606fce4f3119ddc3c5e86128aa3ff12dc85000879fccc87b60e7d651cfe37376607ac66075fede2118deaa685d6d
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/ssh-agent.initd b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/ssh-agent.initd
new file mode 100644
index 0000000000..49d3b125b8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/files/ssh-agent.initd
@@ -0,0 +1,7 @@
+#!/sbin/openrc-run
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License, v2 or later
+
+supervisor=supervise-daemon
+command="/usr/bin/ssh-agent"
+command_args="-D -a ${XDG_RUNTIME_DIR}/ssh-agent.sock"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild
deleted file mode 100644
index 010b1c7eaa..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.7_p1-r6.ebuild
+++ /dev/null
@@ -1,400 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="
-	mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
-"
-S="${WORKDIR}/${PARCH}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
-
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="
-	ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	xmss? ( ssl  )
-	test? ( ssl )
-"
-
-# tests currently fail with XMSS
-REQUIRED_USE+="test? ( !xmss )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		net-libs/ldns[ecdsa(+),ssl(+)]
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
-	virtual/libcrypt:=[static-libs(+)]
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]
-"
-RDEPEND="
-	acct-group/sshd
-	acct-user/sshd
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( sys-libs/pam )
-	kerberos? ( virtual/krb5 )
-"
-DEPEND="
-	${RDEPEND}
-	virtual/os-headers
-	kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
-	static? ( ${LIB_DEPEND} )
-"
-RDEPEND="
-	${RDEPEND}
-	!net-misc/openssh-contrib
-	pam? ( >=sys-auth/pambase-20081028 )
-	!prefix? ( sys-apps/shadow )
-"
-BDEPEND="
-	dev-build/autoconf
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-openssh )
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
-	"${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
-	"${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
-	"${FILESDIR}/${PN}-9.6_p1-CVE-2024-6387.patch"
-	"${FILESDIR}/${PN}-9.6_p1-chaff-logic.patch"
-)
-
-pkg_pretend() {
-	local i enabled_eol_flags disabled_eol_flags
-	for i in hpn sctp X509; do
-		if has_version "net-misc/openssh[${i}]"; then
-			enabled_eol_flags+="${i},"
-			disabled_eol_flags+="-${i},"
-		fi
-	done
-
-	if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
-		# Skip for binary packages entirely because of environment saving, bug #907892
-		[[ ${MERGE_TYPE} == binary ]] && return
-
-		ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
-		ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
-		ewarn "since these USE flags required third-party patches that often trigger bugs"
-		ewarn "and are of questionable provenance."
-		ewarn
-		ewarn "If you must continue relying on this functionality, switch to"
-		ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
-		ewarn "world file first: 'emerge --deselect net-misc/openssh'"
-		ewarn
-		ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
-		ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
-		ewarn "variant, when re-emerging you will have to set"
-		ewarn
-		ewarn "  OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-
-		die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}/etc/hosts.{allow,deny} please."
-	fi
-}
-
-src_prepare() {
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	[[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
-
-	default
-
-	# These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
-	sed -e '/\t\tpercent \\/ d' \
-		-i regress/Makefile || die
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-	use xmss && append-cflags -DWITH_XMSS
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		# Solaris' glob.h doesn't have things like GLOB_TILDE, configure
-		# doesn't check for this, so force the replacement to be put in
-		# place
-		append-cppflags -DBROKEN_GLOB
-	fi
-
-	# use replacement, RPF_ECHO_ON doesn't exist here
-	[[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX}"/etc/ssh
-		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX}"/var/empty
-		--with-privsep-user=sshd
-		# optional at runtime; guarantee a known path
-		--with-xauth="${EPREFIX}"/usr/bin/xauth
-
-		# --with-hardening adds the following in addition to flags we
-		# already set in our toolchain:
-		# * -ftrapv (which is broken with GCC anyway),
-		# * -ftrivial-auto-var-init=zero (which is nice, but not the end of
-		#    the world to not have)
-		# * -fzero-call-used-regs=used (history of miscompilations with
-		#    Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
-		#    gcc PR104820, gcc PR104817, gcc PR110934)).
-		#
-		# Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
-		# so we cannot just disable -fzero-call-used-regs=used.
-		#
-		# Therefore, just pass --without-hardening, given it doesn't negate
-		# our already hardened toolchain defaults, and avoids adding flags
-		# which are known-broken in both Clang and GCC and haven't been
-		# proven reliable.
-		--without-hardening
-
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use_with selinux)
-		$(use_with security-key security-key-builtin)
-		$(use_with ssl openssl)
-		$(use_with ssl ssl-engine)
-	)
-
-	if use elibc_musl; then
-		# musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
-		myconf+=( --disable-utmp --disable-wtmp )
-	fi
-
-	# Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all
-	# bug #869839 (https://github.com/llvm/llvm-project/issues/57692)
-	tc-is-clang && myconf+=( --without-hardening )
-
-	econf "${myconf[@]}"
-}
-
-create_config_dropins() {
-	local locale_vars=(
-		# These are language variables that POSIX defines.
-		# http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
-		LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
-		# These are the GNU extensions.
-		# https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
-		LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
-	)
-
-	mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
-
-	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
-	# Send locale environment variables (bug #367017)
-	SendEnv ${locale_vars[*]}
-
-	# Send COLORTERM to match TERM (bug #658540)
-	SendEnv COLORTERM
-	EOF
-
-	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
-	RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
-	EOF
-
-	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
-	# https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
-	ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
-	EOF
-
-	cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
-	# Allow client to pass locale environment variables (bug #367017)
-	AcceptEnv ${locale_vars[*]}
-
-	# Allow client to pass COLORTERM to match TERM (bug #658540)
-	AcceptEnv COLORTERM
-	EOF
-
-	cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
-	# override default of no subsystems
-	Subsystem	sftp	${EPREFIX}/usr/$(get_libdir)/misc/sftp-server
-	EOF
-
-	if use pam ; then
-		cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
-		UsePAM yes
-		# This interferes with PAM.
-		PasswordAuthentication no
-		# PAM can do its own handling of MOTD.
-		PrintMotd no
-		PrintLastLog no
-		EOF
-	fi
-
-	if use livecd ; then
-		cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
-		# Allow root login with password on livecds.
-		PermitRootLogin Yes
-		EOF
-	fi
-}
-
-src_compile() {
-	default
-	create_config_dropins
-}
-
-src_test() {
-	local tests=( compat-tests )
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		ewarn "user, so we will run a subset only."
-		tests+=( interop-tests )
-	else
-		tests+=( tests )
-	fi
-
-	local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
-	mkdir -p "${HOME}"/.ssh || die
-	emake -j1 "${tests[@]}" </dev/null
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd-r1.initd sshd
-	newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
-	if use pam; then
-		newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
-
-	rmdir "${ED}"/var/empty || die
-
-	systemd_dounit "${FILESDIR}"/sshd.socket
-	systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service
-	systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
-
-	# Install dropins with explicit mode, bug 906638, 915840
-	diropts -m0755
-	insopts -m0644
-	insinto /etc/ssh
-	doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
-	doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
-	diropts -m0700
-	insopts -m0600
-	doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
-}
-
-pkg_preinst() {
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
-		show_ssl_warning=1
-	fi
-}
-
-pkg_postinst() {
-	# bug #139235
-	optfeature "x11 forwarding" x11-apps/xauth
-
-	local old_ver
-	for old_ver in ${REPLACING_VERSIONS}; do
-		if ver_test "${old_ver}" -lt "5.8_p1"; then
-			elog "Starting with openssh-5.8p1, the server will default to a newer key"
-			elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-			elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-		fi
-		if ver_test "${old_ver}" -lt "7.0_p1"; then
-			elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-			elog "Make sure to update any configs that you might have.  Note that xinetd might"
-			elog "be an alternative for you as it supports USE=tcpd."
-		fi
-		if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
-			elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-			elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-			elog "adding to your sshd_config or ~/.ssh/config files:"
-			elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-			elog "You should however generate new keys using rsa or ed25519."
-
-			elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-			elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-			elog "out of the box.  If you need this, please update your sshd_config explicitly."
-		fi
-		if ver_test "${old_ver}" -lt "7.6_p1"; then
-			elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-			elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-		fi
-		if ver_test "${old_ver}" -lt "7.7_p1"; then
-			elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
-			elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
-			elog "if you need to authenticate against LDAP."
-			elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
-		fi
-		if ver_test "${old_ver}" -lt "8.2_p1"; then
-			ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
-			ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
-			ewarn "connection is generally safe."
-		fi
-		if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
-			ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
-			ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
-			ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
-			ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
-			ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
-			ewarn "set 'Restart=no' in your sshd unit file."
-		fi
-	done
-
-	if [[ -n ${show_ssl_warning} ]]; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
similarity index 78%
rename from sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
index be1dd9e136..1b34d10467 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
@@ -1,10 +1,13 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
+# Remember to check the upstream release/stable branches for patches
+# to backport! See https://marc.info/?l=openssh-unix-dev&m=172723798122122&w=2.
+
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
-inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver
 
 # Make it more portable between straight releases
 # and _p? releases.
@@ -20,9 +23,9 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
 RESTRICT="!test? ( test )"
 
@@ -79,7 +82,10 @@ PATCHES=(
 	"${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
 	"${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
 	"${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
-	"${FILESDIR}/${PN}-9.8_p1-musl-connect.patch"
+	# Backports from upstream release branch
+	#"${FILESDIR}/${PV}"
+	# Our own backports
+	"${FILESDIR}/${PN}-9.9_p1-x-forwarding-slow.patch"
 )
 
 pkg_pretend() {
@@ -198,6 +204,7 @@ src_configure() {
 		$(use_with audit audit linux)
 		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
 		$(use_with ldns)
+		$(use_enable legacy-ciphers dsa-keys)
 		$(use_with libedit)
 		$(use_with pam)
 		$(use_with pie)
@@ -308,6 +315,8 @@ src_install() {
 	dobin contrib/ssh-copy-id
 	newinitd "${FILESDIR}"/sshd-r1.initd sshd
 	newconfd "${FILESDIR}"/sshd-r1.confd sshd
+	exeinto /etc/user/init.d
+	newexe "${FILESDIR}"/ssh-agent.initd ssh-agent
 
 	if use pam; then
 		newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
@@ -343,53 +352,50 @@ pkg_postinst() {
 	# bug #139235
 	optfeature "x11 forwarding" x11-apps/xauth
 
-	local old_ver
-	for old_ver in ${REPLACING_VERSIONS}; do
-		if ver_test "${old_ver}" -lt "5.8_p1"; then
-			elog "Starting with openssh-5.8p1, the server will default to a newer key"
-			elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-			elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-		fi
-		if ver_test "${old_ver}" -lt "7.0_p1"; then
-			elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-			elog "Make sure to update any configs that you might have.  Note that xinetd might"
-			elog "be an alternative for you as it supports USE=tcpd."
-		fi
-		if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518
-			elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-			elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-			elog "adding to your sshd_config or ~/.ssh/config files:"
-			elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-			elog "You should however generate new keys using rsa or ed25519."
+	if ver_replacing -lt "5.8_p1"; then
+		elog "Starting with openssh-5.8p1, the server will default to a newer key"
+		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
+		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
+	fi
+	if ver_replacing -lt "7.0_p1"; then
+		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+		elog "Make sure to update any configs that you might have.  Note that xinetd might"
+		elog "be an alternative for you as it supports USE=tcpd."
+	fi
+	if ver_replacing -lt "7.1_p1"; then #557388 #555518
+		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
+		elog "adding to your sshd_config or ~/.ssh/config files:"
+		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
+		elog "You should however generate new keys using rsa or ed25519."
 
-			elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-			elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-			elog "out of the box.  If you need this, please update your sshd_config explicitly."
-		fi
-		if ver_test "${old_ver}" -lt "7.6_p1"; then
-			elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-			elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-		fi
-		if ver_test "${old_ver}" -lt "7.7_p1"; then
-			elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
-			elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
-			elog "if you need to authenticate against LDAP."
-			elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
-		fi
-		if ver_test "${old_ver}" -lt "8.2_p1"; then
-			ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
-			ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
-			ewarn "connection is generally safe."
-		fi
-		if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then
-			ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
-			ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
-			ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
-			ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
-			ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
-			ewarn "set 'Restart=no' in your sshd unit file."
-		fi
-	done
+		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
+		elog "out of the box.  If you need this, please update your sshd_config explicitly."
+	fi
+	if ver_replacing -lt "7.6_p1"; then
+		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+	fi
+	if ver_replacing -lt "7.7_p1"; then
+		elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+		elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+		elog "if you need to authenticate against LDAP."
+		elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+	fi
+	if ver_replacing -lt "8.2_p1"; then
+		ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+		ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+		ewarn "connection is generally safe."
+	fi
+	if ver_replacing -lt "9.2_p1-r1" && systemd_is_booted; then
+		ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+		ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+		ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+		ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+		ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+		ewarn "set 'Restart=no' in your sshd unit file."
+	fi
 
 	if [[ -n ${show_ssl_warning} ]]; then
 		elog "Be aware that by disabling openssl support in openssh, the server and clients"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2.ebuild
index e53838b1ea..e4185459a1 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 79669263ee..c97ab027f2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Z. Liu <zhixu.liu@gmail.com> (2025-01-23)
+# Requires dev-qt/qtwebengine
+net-misc/seafile-client
+
 # John Helmert III <ajak@gentoo.org> (2024-12-14)
 # Requires libpcre2[jit] which is now masked on x32
 dev-util/cutter
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 85ccdbdac9..1b44176c41 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -32,6 +32,8 @@ dev-lang/rust:1.85.0 llvm_slot_19
 dev-lang/rust-bin:1.85.0 llvm_slot_19
 dev-lang/rust:1.84.1 llvm_slot_19
 dev-lang/rust-bin:1.84.1 llvm_slot_19
+dev-lang/rust:1.84.0 llvm_slot_19
+dev-lang/rust-bin:1.84.0 llvm_slot_19
 dev-lang/rust:1.83.0 llvm_slot_19
 dev-lang/rust-bin:1.83.0 llvm_slot_19
 dev-lang/rust:1.82.0 llvm_slot_19
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
index 1c52c8faa7..b5688c8783 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/video_cards.desc
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors.
+# Copyright 1999-2025 Gentoo Authors.
 # Distributed under the terms of the GNU General Public License v2
 
 # This file contains descriptions of VIDEO_CARDS USE_EXPAND flags.
@@ -25,6 +25,7 @@ nvk - VIDEO_CARDS setting to build nouveau vulkan driver for nvidia cards (Turin
 omap - VIDEO_CARDS setting to build DRM driver for TI OMAP video cards
 qxl - VIDEO_CARDS setting to build driver for qxl (QEMU virtual GPU)
 panfrost - VIDEO_CARDS setting to build driver for Mali 600/700/800 video cards
+panthor - VIDEO_CARDS setting to support for Mali 10th video cards
 r100 - VIDEO_CARDS setting to build only r100 based chips code for radeon
 r128 - VIDEO_CARDS setting to build driver for ATI r128 video cards
 r200 - VIDEO_CARDS setting to build only r200 based chips code for radeon
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 4b33cfbd0b..8c0ebeb5ea 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# idealseal <realidealseal@protonmail.com> (2025-03-02)
+# Fish was ported to Rust.
+>=app-shells/fish-4.0.0
+
 # James Le Cuirot <chewi@gentoo.org> (2024-12-17)
 # steam-overlay packages requiring Rust.
 x11-libs/extest
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index ecf671a4c0..e9a5ca50f0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,80 @@
 
 #--- END OF EXAMPLES ---
 
+# John Helmert III <ajak@gentoo.org> (2025-03-02)
+# Doesn't seem to cleanly load, see:
+# https://github.com/lkrg-org/lkrg/issues/364
+=app-antivirus/lkrg-0.9.9
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-03-01)
+# Last release 14 years ago, dead upstream, depends on Qt5 (and even that
+# only by means of downstream patching). Bug #947634.
+# Removal on 2025-03-31.
+sci-biology/clustalx
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-03-01)
+# Last release 12 years ago, dead upstream, depends on Qt5 (and even that
+# only by means of downstream patching), likely broken by now if going by
+# various upstream reports. Bug #947621. Removal on 2025-03-31.
+media-sound/qtscrobbler
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-03-01)
+# Currently packaged version released 12 years ago; dead upstream,
+# possibly GPL violating piece of very expensive software not available
+# to "new" customers in most countries even for a 5-figure USD sum.
+# Bug #947239. Removal on 2025-03-31.
+app-text/diffpdf
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-03-01)
+# Last release 10 years ago, dead upstream, does not build with Qt6,
+# no one else packages this. Removal on 2025-03-31.
+media-gfx/qvv
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-03-01)
+# Last release 8 years ago, dead upstream, depends on Qt5, no one
+# else packages this. Removal on 2025-03-31.
+x11-misc/flow-pomodoro
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-02-27)
+# We have collected a lot of barely used Perl virtuals over time
+# (they effectively only make sense with version dependencies).
+# Time to clean up. In ebuilds, just depend on dev-lang/perl.
+# The following are masked for removal on 2025-03-31:
+virtual/perl-Attribute-Handlers
+virtual/perl-AutoLoader
+virtual/perl-CPAN-Meta-YAML
+virtual/perl-Dumpvalue
+virtual/perl-ExtUtils-Constant
+virtual/perl-ExtUtils-Install
+virtual/perl-ExtUtils-Manifest
+virtual/perl-Filter-Simple
+virtual/perl-I18N-LangTags
+virtual/perl-IPC-Cmd
+virtual/perl-Locale-Maketext-Simple
+virtual/perl-Memoize
+virtual/perl-Module-Loaded
+virtual/perl-Net-Ping
+virtual/perl-Perl-OSType
+virtual/perl-Pod-Escapes
+virtual/perl-Safe
+virtual/perl-Thread-Queue
+virtual/perl-Thread-Semaphore
+virtual/perl-threads-shared
+virtual/perl-Tie-RefHash
+virtual/perl-Time-Piece
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-02-26)
+# Last release in 2005, last commit in 2013, dead as can be - does not
+# start, does not build, bugs #914927, #927337, #946657.
+# Removal on 2025-03-26.
+media-sound/jamin
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-02-26)
+# Last release 11 years ago, dead upstream, depends on Qt5 (and even that
+# only by means of downstream patching, no one else packages this.
+# Bug #947631. Removal on 2025-03-26.
+app-mobilephone/qtadb
+
 # Eray Aslan <eras@gentoo.org> (2025-02-24)
 # Mask experimental software
 =mail-mta/postfix-3.11*
@@ -75,11 +149,6 @@ kde-frameworks/kcalendarcore:5
 # Removal on 2025-03-16. Bug 948200.
 app-text/xournal
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-02-16)
-# Downstream-split fallback package for KF5-based revdeps without any
-# revdeps left. Removal on 2025-02-28.
-media-gfx/okularpart
-
 # Andrey Grozin <grozin@gentoo.org> (2025-02-15)
 # Last release 6 years ago, depends on Qt5,
 # no one else packages this.
@@ -192,47 +261,11 @@ games-fps/quakeforge
 # Removal on 2025-03-07. Bug: 949318
 net-misc/AQtion
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-30)
-# Last release 15 years ago, dead upstream (never imported from kdesvn),
-# no revdeps probably since amarok last-rites. Removal on 2025-02-27.
-media-libs/taglib-extras
-
-# Conrad Kostecki <conikost@gentoo.org> (2024-01-28)
-# A package, which depends on Qt5. Upstream dead for many years.
-# Removal on 2025-02-28. Bug #948048
-net-wireless/linssid
-
-# Conrad Kostecki <conikost@gentoo.org> (2024-01-28)
-# Binary package, which depends on Qt5. Bug #926665
-# Please update to v5 beta or v6 beta. Removal on 2025-02-28.
-media-sound/teamspeak-client:3
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-28)
-# Last release 8 years ago, dead upstream (repository gone as well),
-# depends on Qt5, no one else packages this. Removal on 2025-02-27.
-net-misc/qtm
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-28)
-# Last release+commit 7 years ago, dead upstream, unmaintained in Gentoo,
-# depends on Qt5, broken with >= ffmpeg-5, no one else packages this.
-# Removal on 2025-02-27. Bug #900947
-app-misc/qcma
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-28)
-# Last release+commit 8 years ago, dead upstream, unmaintained in Gentoo,
-# depends on Qt5, no one else packages this. Removal on 2025-02-27.
-x11-misc/urxvtconfig
-
 # Arthur Zamarin <arthurzam@gentoo.org> (2025-01-28)
 # Since we are done with EGO_SUM, this tool isn't needed any more.
 # Removal on 2025-02-27.  Bug #948966.
 dev-go/get-ego-vendor
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2025-01-28)
-# Last release from 14 years ago, dead upstream (repository gone as well).
-# Plenty of other options in ::gentoo. Bug #947724, removal on 2025-02-27.
-media-sound/bempc
-
 # Arthur Zamarin <arthurzam@gentoo.org> (2025-01-24)
 # EAPI=7, uses deprecated Go eclasses, fails to compile, installation
 # blocked by current versions of docker (which provides the features).
@@ -280,12 +313,6 @@ dev-qt/qtwebview:5
 >=dev-libs/intel-compute-runtime-24.52.32224.5
 >=dev-util/intel-graphics-compiler-2.5.7
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-01-06)
-# Masked for testing
-=dev-lang/perl-5.40.1*
-~virtual/perl-File-Spec-3.910.0
-~virtual/perl-Module-CoreList-5.202.501.184_rc
-
 # Nowa Ammerlaan <nowa@gentoo.org> (2025-01-03)
 # Contains a serious bug that can cause deletion of the users home dir.
 # See-also: https://github.com/keshavbhatt/whatsie/issues/230
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.6.0-musl-c99.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.6.0-musl-c99.patch
deleted file mode 100644
index c277bd6d11..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.6.0-musl-c99.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 12416003e4c691afc732d26f0a07c3890c24b396 Mon Sep 17 00:00:00 2001
-From: Gabi Falk <gabifalk@gmx.com>
-Date: Fri, 10 May 2024 14:36:12 +0000
-Subject: [PATCH] bridge/vlan.c: bridge/vlan.c: fix build with gcc 14 on musl
- systems
-
-On glibc based systems the definition of 'struct timeval' is pulled in
-with inclusion of <stdlib.h> header, but on musl based systems it
-doesn't work this way.  Missing definition triggers an
-incompatible-pointer-types error with gcc 14 (warning on previous
-versions of gcc):
-
-../include/json_print.h:80:30: warning: 'struct timeval' declared inside parameter list will not be visible outside of this definition or declaration
-   80 | _PRINT_FUNC(tv, const struct timeval *)
-      |                              ^~~~~~~
-../include/json_print.h:50:37: note: in definition of macro '_PRINT_FUNC'
-   50 |                                     type value);                        \
-      |                                     ^~~~
-../include/json_print.h:80:30: warning: 'struct timeval' declared inside parameter list will not be visible outside of this definition or declaration
-   80 | _PRINT_FUNC(tv, const struct timeval *)
-      |                              ^~~~~~~
-../include/json_print.h:55:45: note: in definition of macro '_PRINT_FUNC'
-   55 |                                             type value)                 \
-      |                                             ^~~~
-../include/json_print.h: In function 'print_tv':
-../include/json_print.h:58:48: error: passing argument 5 of 'print_color_tv' from incompatible pointer type [-Wincompatible-pointer-types]
-   58 |                                                value);                  \
-      |                                                ^~~~~
-      |                                                |
-      |                                                const struct timeval *
-
-Link: https://lore.kernel.org/netdev/20240510143613.1531283-1-gabifalk@gmx.com/T/#u
-Signed-off-by: Gabi Falk <gabifalk@gmx.com>
----
- bridge/vlan.c | 1 +
- bridge/vni.c  | 1 +
- vdpa/vdpa.c   | 1 +
- 3 files changed, 3 insertions(+)
-
-diff --git a/bridge/vlan.c b/bridge/vlan.c
-index 5352eb24..0a7e6c45 100644
---- a/bridge/vlan.c
-+++ b/bridge/vlan.c
-@@ -4,6 +4,7 @@
- #include <unistd.h>
- #include <fcntl.h>
- #include <sys/socket.h>
-+#include <sys/time.h>
- #include <net/if.h>
- #include <netinet/in.h>
- #include <linux/if_bridge.h>
-diff --git a/bridge/vni.c b/bridge/vni.c
-index a7abe6de..e1f981fc 100644
---- a/bridge/vni.c
-+++ b/bridge/vni.c
-@@ -10,6 +10,7 @@
- #include <string.h>
- #include <fcntl.h>
- #include <sys/socket.h>
-+#include <sys/time.h>
- #include <net/if.h>
- #include <netinet/in.h>
- #include <linux/if_link.h>
-diff --git a/vdpa/vdpa.c b/vdpa/vdpa.c
-index 6e4a9c11..43f87824 100644
---- a/vdpa/vdpa.c
-+++ b/vdpa/vdpa.c
-@@ -3,6 +3,7 @@
- #include <stdio.h>
- #include <getopt.h>
- #include <errno.h>
-+#include <sys/time.h>
- #include <linux/genetlink.h>
- #include <linux/if_ether.h>
- #include <linux/vdpa.h>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/Manifest
index eb76ee1fc0..124de22ab7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/Manifest
@@ -1,2 +1,3 @@
 DIST pcsc-lite-2.0.1.tar.bz2 815103 BLAKE2B a9eea4a4da1a78fc22797b17c128889b2f7caf8c4aa02dd77f4ac79e4ec458fb0162578b5422552545cd39303750d5396f3687f8cfee7603fad8d60cb54ee1e8 SHA512 af007f00f43e8d897710580f6f27814c9e7d3ca489ff01edf2e3b979e46267915aa04d9c15f225a420fa681de936e42a1d4779d962717cf9a9f4a3d1ca31502b
 DIST pcsc-lite-2.3.0.tar.xz 209064 BLAKE2B 48fc1a513a217ff499e8da63e026ce6adcd37987c878a0dda50756cfac5cc64245c95715df40df14e29883410c3d55670432ba0c658eff84add25b76c1828b11 SHA512 194c175ba7cf4610f09c08d463edf12f63e8e6a694938049988efb10c91e15b05d91747d58013f2f35452427996e8fe2ffb3706806d17ee278dc4896eab901c0
+DIST pcsc-lite-2.3.1.tar.xz 209724 BLAKE2B aafcecf34a284145eecd5e3e1c9cb6bf1d4a3f9e7dad82983cee72ecbb8682480c06bb1fe025e176ca8d34f8a50ed325d41f14217ee7cd8a96b5848398c89624 SHA512 ec70ab3cf338299b3a493344c176b73450631da208714f3ac0fb4d6aa942fdc7487467b971246407fc4f1815fe5e48a0f29dcc109fb5fef838fbce7a2207d87b
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.1.ebuild
new file mode 100644
index 0000000000..8385c17fe4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pcsc-lite/pcsc-lite-2.3.1.ebuild
@@ -0,0 +1,110 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit meson-multilib python-single-r1 tmpfiles udev
+
+DESCRIPTION="PC/SC Architecture smartcard middleware library"
+HOMEPAGE="https://pcsclite.apdu.fr https://github.com/LudovicRousseau/PCSC"
+SRC_URI="https://pcsclite.apdu.fr/files/${P}.tar.xz"
+
+# GPL-2 is there for the init script; everything else comes from
+# upstream.
+LICENSE="BSD GPL-3+ BSD-2 ISC GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+# This is called libusb so that it doesn't fool people in thinking that
+# it is _required_ for USB support. Otherwise they'll disable udev and
+# that's going to be worse.
+IUSE="embedded libusb policykit selinux systemd +udev"
+REQUIRED_USE="^^ ( udev libusb ) ${PYTHON_REQUIRED_USE}"
+
+# No dependencies need the MULTILIB_DEPS because the libraries are actually
+# standalone, the deps are only needed for the daemon itself.
+DEPEND="
+	libusb? ( virtual/libusb:1 )
+	udev? ( virtual/libudev:= )
+	policykit? ( >=sys-auth/polkit-0.111 )
+	acct-group/openct
+	acct-group/pcscd
+	acct-user/pcscd
+	${PYTHON_DEPS}"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-pcscd )"
+BDEPEND="
+	app-alternatives/lex
+	virtual/pkgconfig"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.8.11-polkit-pcscd.patch
+	"${FILESDIR}"/${PN}-1.9.8-systemd-user.patch
+	"${FILESDIR}"/${PN}-2.2.3-change-setup-spy-script-location.patch
+)
+
+multilib_src_configure() {
+	local emesonargs=(
+		-Dusbdropdir="${EPREFIX}"/usr/$(get_libdir)/readers/usb
+		-Dipcdir=/run/pcscd
+		-Dsystemdunit=system
+		$(meson_native_use_bool embedded)
+		$(meson_native_use_bool systemd libsystemd)
+		$(meson_native_use_bool udev libudev)
+		$(meson_native_use_bool libusb)
+		$(meson_native_use_bool policykit polkit)
+	)
+
+	meson_src_configure
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	dodoc HELP SECURITY
+
+	newinitd "${FILESDIR}"/pcscd-init.7 pcscd
+	dotmpfiles "${FILESDIR}"/pcscd.conf
+
+	if use udev; then
+		exeinto "$(get_udevdir)"
+		newexe "${FILESDIR}"/pcscd-udev pcscd.sh
+
+		insinto "$(get_udevdir)"/rules.d
+		newins "${FILESDIR}"/99-pcscd-hotplug-r2.rules 99-pcscd-hotplug.rules
+	fi
+
+	python_fix_shebang "${ED}"/usr/bin/pcsc-spy
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	elog "Starting from version 1.6.5, pcsc-lite will start as user nobody in"
+	elog "the pcscd group, to avoid running as root."
+	elog
+	elog "This also means you need the newest drivers available so that the"
+	elog "devices get the proper owner."
+	elog
+	elog "Furthermore, a conf.d file is no longer installed by default, as"
+	elog "the default configuration does not require one. If you need to"
+	elog "pass further options to pcscd, create a file and set the"
+	elog "EXTRA_OPTS variable."
+	elog
+
+	if use udev; then
+		elog "Hotplug support is provided by udev rules."
+		elog "When using OpenRC you additionally need to tell it to hotplug"
+		elog "pcscd by setting this variable in /etc/rc.conf:"
+		elog
+		elog "    rc_hotplug=\"pcscd\""
+	fi
+
+	tmpfiles_process pcscd.conf
+
+	use udev && udev_reload
+}
+
+pkg_postrm() {
+	use udev && udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
index de81a72599..b6004084a5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest
@@ -1,3 +1,3 @@
-DIST sssd-2.10.1.tar.gz 9196848 BLAKE2B 9e0677972ee37c4156dcfa86459af97e25d14651ccded87866fd7f18a23d318b578cd98d072afaafa50ae9c68eaf361955aefba1f31de8cf8dac1ca404321146 SHA512 001ff9cd60aa510ead11e418a1b96714136cc270b29551027cb12c340744890b358da5900a10863d4df649ad073f14f6f26c28e3f973b1cd5c2ab61f2a2a045b
+DIST sssd-2.10.2.tar.gz 9200497 BLAKE2B 76b6e4ab26c326d1075ae2811445e7c4196450af4b9791e3854c087bb82f229cc48a39027248d694943ec6fb9270d915a00d55eec7cd76c38700d4d1f3775360 SHA512 14ad222802e5426b0959ee32602e04ce24b3eb8d3bdd5e188cf29e3c7d32e0631b41c386fdbd129acf281317538460015d35410a688ea48dd546f9ae28522eac
 DIST sssd-2.9.5.tar.gz 8001964 BLAKE2B e9c839e58fbeac9e8cba83b726f075c5db6ce85059546d745672c222b594f4aa26ad103f0eb3a8ff9e2b364c3502fb93c639fe9e621fefd6fecd2319f5cb499a SHA512 d219f12ffc75af233f0e4ffc62c0442acc6da3cd94ed4eab7102a78821af5257c8e4ba0d06b2c99c08e06502f8d0d0bcc80540d63823dbe0f52eb0432ae7e14d
 DIST sssd-2.9.6.tar.gz 9136447 BLAKE2B 9ba4faa66d56150de58e86588bd0dedb02ff2f155fa118a35cd981885fed6cab5fdf13373f575a41691c87b4d18c586cba717b399e3826675eee1b0f8da967b7 SHA512 d9a35fc12022f0a2aa73be373b396411fc69b2fe5489ab93d17813a4c75b3ec30e598d5748ab202f7588039b465e11d616ce546cd5fe5439fa8edd9ac8cda69a
diff --git a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.2.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.2.ebuild
index 3f04d44251..2b9bd2e9a4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.10.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 PLOCALES="ca de es fr ja ko pt_BR ru sv tr uk"
 PLOCALES_BIN="${PLOCALES} bg cs eu fi hu id it ka nb nl pl pt tg zh_TW zh_CN"
 PLOCALE_BACKUP="sv"
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit autotools linux-info multilib-minimal optfeature plocale \
 	python-single-r1 pam systemd tmpfiles udev toolchain-funcs
@@ -192,7 +192,8 @@ src_prepare() {
 		Makefile.am \
 		|| die
 
-	# requires valgrind headers installed
+	# requires valgrind headers installed, see
+	# https://github.com/SSSD/sssd/pull/7845
 	sed -i \
 		-e '/^\s*test_iobuf[ \\]*$/d' \
 		Makefile.am \
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.1.ebuild
index 7cb77dcf68..1c7027b1f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/bc/bc-1.08.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://gnu/bc/${P}.tar.gz"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="libedit readline static"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 86369106b0..29a725d2ed 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -6,23 +6,27 @@ DIST gcc-11.5.0-patches-1.tar.xz 13664 BLAKE2B 64fd9c2d074aca58ecd8c0035ccf2d2b8
 DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e2cac92a13cc7e285d08191dd4a117f41a8faac2359c0e2a16f954c7fef354dda9df8c63bff1c5cefda82602c SHA512 88f17d5a5e69eeb53aaf0a9bc9daab1c4e501d145b388c5485ebeb2cc36178fbb2d3e49ebef4a8c007a05e88471a06b97cf9b08870478249f77fbfa3d4abd9a8
 DIST gcc-12-20241219.tar.xz 79920016 BLAKE2B 71044352515f33eaf0bcc64cc6eacdecb8b7b1dbca6d8836b629f76e60320f5090178ff37b6804fbda0913c0f55afca37588647974fd72e9961edd338ccf6ffb SHA512 e0c08366f392083feb1ae242242e9bd335681234808ed44d4e75afe157be2814bef321d2327186d217f38bbb6176706e1258228904d31fdb3bb37c8e245dacb0
 DIST gcc-12-20250220.tar.xz 79919964 BLAKE2B 01ac8e2865b46d8dde41b73b5b5dd8c6bd533dc1ecff9a05455ad10fc125ad1ba4bb15de637ca639a82057fbd354a6225c0dcd0144c313b91833aa712f2e133a SHA512 0ba3b3b1eca1a62da5f0f0238c5980bcb6f2efbc1e0dffefd04b107bc48d4dfaf72cc9037689d7725a4aa9e4478d0b43339eccfea718bb45a113aef14604d215
+DIST gcc-12-20250227.tar.xz 79915940 BLAKE2B 0adb19847cb3f317316549f657434654b9923806366a4b95e496effea9c07995b7d3de65c40cc2f62ba1e87cfb0f8cd8a1a833284042fdc5e6fce2bd7e7e9543 SHA512 d01cad1771762f5b56c783d6a3b39415be1c7619229b5ff056fe40ef0bf821c67a2d1a2272c2227a44f92825582579625352d19e2342d11f76a079556dae0ae8
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0-patches-2.tar.xz 14876 BLAKE2B 6bf5abbb2abba4b9fe9fa153ac4112fe5f563e97cd4e1b885ccd0d88abf1124fa91f20d6be972e2242410447be73bca60014785f8551b8087ed0d4cc3e868225 SHA512 dfd5f02d4c1076fad4ee998b2f620171dd3eb65a1160312def9dae89b18327a06db853f569e0e3c049e5ab06c61488bb6faecec52bafe737fddeb43628c54a1f
 DIST gcc-12.4.0.tar.xz 83377372 BLAKE2B 0d5aa9995bf53fa2dc976a846240cfb8fafd125ad6c54f45dc9d770215eae3e9ea0db82a9a4f79c51b4d5f8461a1d730c17db6841bc31bd96dba11d9ed7544ae SHA512 5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853
 DIST gcc-13-20241220.tar.xz 84504500 BLAKE2B 60d6dcdcafa36399a0c0de7fef3a4eb4ca8e0b6780cd31c9eace2965c53115205bf64e8247b833a4375c1e3ad2d94820b5bdc97a4689be95d8ab55a676afa689 SHA512 10fe009dc3b8872b24350e4fb999f71b848bd5a03e48e8292f76e6eca3dbdef8383a3b13b813aada983ebdbe3ecab1642961b3210cd1e0063a86655a44493017
 DIST gcc-13-20250221.tar.xz 84535136 BLAKE2B 8f56681b291231c7922680e77fa29f84510c37911713635cd3806a366fcc74f708c3c3dd6020cfcaf6a6adb84099a83e8de455ba201281264e9eff916c4b0c36 SHA512 4527db4becbe2a49c42e82fd817089cc4b861693560829350d0787685ccad0cd6c6ced2ec9a7ce538589f7b431c0e118dd2bc157435328065941e98e3facce96
+DIST gcc-13-20250301.tar.xz 84525780 BLAKE2B c366f4de63b7956abb1bf2d1039acdf90c7a801adbb2793e4c199b0f743d143327aac9c2b078991f802da758ed4326dd913d9f60aec4fc471eff9af72f781a8e SHA512 075bfb3c5aeaf1c9bf7ab69ef117fcc1fd3ce1042edc9442d95df717e622c2ea9cfabbabf8be5eda32b3cf115d7d3e73907fd577a69f0beb6895f7ec2c5fc813
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
 DIST gcc-13.3.0-patches-2.tar.xz 44440 BLAKE2B ebde73f6c3cd1a5fdc5bbce36414a59dda0925cba9d422d3689fc9c14fece44ee2391982a674411aa99bf47ffd49200f3ce51cc908beb8298adfff78e709a84c SHA512 eb56e0d7e69b5c3cca21f4cbff21c1204cf64ede7e66d689f45cf5ff37de8a59f24eb1f4b30d9c4222fd4126654fe4ffc146851f504761014995553c1202e8fd
 DIST gcc-14-20241221.tar.xz 88198252 BLAKE2B 7491c2e1c8885e201859143bdf5cae95af4c0db77709ec7d761ad535df30042f5deb8488ba7c508de3673e4b0f2af1de8d17476f39cd47b745ddccec6a9e4470 SHA512 91fe1e1d1f8e8fad64930a2eadf942a542bd42f841fceb49f475bccac00f04692b8cd38821ea9ee05f78b5c51001d8bd39df5f71f3a3d89aab8980019cea9be8
 DIST gcc-14-20250222.tar.xz 88217556 BLAKE2B 38023332b91bf6ff50d06b0967f7c4ed2f511ffd6cf29cc09a429572a2a69db39f3e6e0e0067752012d105abbbd64c17d21f1c6086e7754c9e90fa94343384f9 SHA512 517abef61c8a45a19fc3bc5aec276a82bed3e4d3e1cd2f468c9a5e92b8b727bf90c5914507b1c5b58721ee29dc6e4756184bc6a1ebef7b4800ff2e08762e5fe4
+DIST gcc-14-20250301.tar.xz 88230928 BLAKE2B 2b65e7cccbf431a74df73adac53995873e78240d7abd97e9c9c576806c389b3c1abb6d47710a25a26f2ee399de750a07c3fb7916a580875d08a3a83354d89c1c SHA512 6b2afe19ce95a595307ae10b89054927116d33b499f1ef8233936d719271c04cb8f66890068ef2252c59ab0276dd0e6210990cb88abdfb4965818c25949f431e
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-7.tar.xz 14244 BLAKE2B 11236e91e1fe83fec8ffaa40ec0cdd4b52a00a951e9aa9a7a0a932b234b8f1a9603333a7ccf55859f4ef53dd4d8ad1fd5c1d2514b6e45fce5b86bb58622a0ecc SHA512 5a4d86d943e31fa068b5a784c0132bd83c23243dcb3cf972557a42e004469a415e1b3185f31b1bb36f916594d475f266a2fda031a414e4a15e0bbfe471269eee
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
 DIST gcc-15-20250216.tar.xz 91404792 BLAKE2B 1a007a432c7f7ac6ba0169caf2561e26267ae5c75403ecd52227dbee255eff4c1bca5db9d6ce2e772ee357dc06e648d7ebfb3629117b13d48343a474a17901c6 SHA512 8dcb3968e157a2cb6a06e4ba76a0fd95936025d99f48333aacc554f347d19df8e6b9a0c9c454acd730a5608122ff4c12a712ccdf09919f8e310cf6688c00df84
 DIST gcc-15-20250223.tar.xz 91424896 BLAKE2B 0527c35ef3e24a9defe99bdccc39ba4c839cd867428f5424e3f8089381b3c3f68407bc2e8ddb9db72ea4860deed558b1ae584a41fa0623d127a055e9227d2216 SHA512 7e3296bcf7ed7868a5d4540525143995d6fd7d7144e223ae3666e3e4e716eef6ef1ea0389527df6d410442fc998ad5db6e07f52582819dfeadb0cba2d87d3208
+DIST gcc-15-20250302.tar.xz 91196748 BLAKE2B d6eef1753179f813ef1908c4ddc56144161abde36e602930bf4e53cccc7c352ee882bfa376528f20c34aa3544b1cb703c0fa062bb67245b0a3499125d4dd2bfc SHA512 407857cfe454cfa690eab0b01183811c7ef618921b64152f322e67bd27b708e57ee3de57274827340e387c5f906643bf2dc362b541d4d08f6a7283bc3da8bcb3
 DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
 DIST gcc-15.0.0-patches-46.tar.xz 22212 BLAKE2B 159b2693ded0b1dbddd271ca56d7f6db3569a8f79155521737b968ad131eee2730d3441dacef821b9dcd31b17ca0bf16a7b24001e7cb4ae1b36c55750184a3f6 SHA512 26d293ee368c75570e606949480feed18a69baad4687beaf2f50629bfc72d542bbce4b1cb6580fe7e578409a108891dc9762bb15c53b611434c83db5dd83d695
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250223-c-Fix-range-for-with-PMFs-PR118923.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250223-c-Fix-range-for-with-PMFs-PR118923.patch
new file mode 100644
index 0000000000..04cf198fb6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250223-c-Fix-range-for-with-PMFs-PR118923.patch
@@ -0,0 +1,231 @@
+From a41b3f54c13890b1327bb3d4fbae8f7feb37d00b Mon Sep 17 00:00:00 2001
+Message-ID: <a41b3f54c13890b1327bb3d4fbae8f7feb37d00b.1740542521.git.sam@gentoo.org>
+From: Jakub Jelinek <jakub@redhat.com>
+Date: Tue, 25 Feb 2025 09:26:46 +0100
+Subject: [PATCH] c++: Fix range for with PMFs [PR118923]
+
+The following testcases segfault because the new range for -frange-for-ext-temps
+temporary extension extends even the internal TARGET_EXPRs created by
+get_member_function_from_ptrfunc.
+
+The following patch fixes that by using get_internal_target_expr for those
+instead of force_target_expr (similarly in cp_finish_decl and
+build_comparison_op) and using force_target_expr inside of
+get_internal_target_expr.
+
+2025-02-25  Jakub Jelinek  <jakub@redhat.com>
+
+	PR c++/118923
+	* tree.cc (get_internal_target_expr): Use force_target_expr
+	instead of build_target_expr_with_type.
+	* typeck.cc (get_member_function_from_ptrfunc): Use
+	get_internal_target_expr instead of force_target_expr.
+	* decl.cc (cp_finish_decl): Likewise.
+	* method.cc (build_comparison_op): Likewise.
+
+	* g++.dg/cpp0x/pr118923.C: New test.
+	* g++.dg/cpp1y/pr118923.C: New test.
+---
+ gcc/cp/decl.cc                        |  6 +--
+ gcc/cp/method.cc                      |  2 +-
+ gcc/cp/tree.cc                        |  3 +-
+ gcc/cp/typeck.cc                      |  6 +--
+ gcc/testsuite/g++.dg/cpp0x/pr118923.C | 66 +++++++++++++++++++++++++++
+ gcc/testsuite/g++.dg/cpp1y/pr118923.C | 38 +++++++++++++++
+ 6 files changed, 110 insertions(+), 11 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp0x/pr118923.C
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/pr118923.C
+
+diff --git a/gcc/cp/decl.cc b/gcc/cp/decl.cc
+index 05ad9bb24d59..936e48e907e2 100644
+--- a/gcc/cp/decl.cc
++++ b/gcc/cp/decl.cc
+@@ -9377,8 +9377,7 @@ cp_finish_decl (tree decl, tree init, bool init_const_expr_p,
+ 	      tree guard = NULL_TREE;
+ 	      if (cleanups || cleanup)
+ 		{
+-		  guard = force_target_expr (boolean_type_node,
+-					     boolean_false_node, tf_none);
++		  guard = get_internal_target_expr (boolean_false_node);
+ 		  add_stmt (guard);
+ 		  guard = TARGET_EXPR_SLOT (guard);
+ 		}
+@@ -9407,8 +9406,7 @@ cp_finish_decl (tree decl, tree init, bool init_const_expr_p,
+ 		     popped that all, so push those extra cleanups around
+ 		     the whole sequence with a guard variable.  */
+ 		  gcc_assert (TREE_CODE (sl) == STATEMENT_LIST);
+-		  guard = force_target_expr (integer_type_node,
+-					     integer_zero_node, tf_none);
++		  guard = get_internal_target_expr (integer_zero_node);
+ 		  add_stmt (guard);
+ 		  guard = TARGET_EXPR_SLOT (guard);
+ 		  for (unsigned i = 0; i < n_extra_cleanups; ++i)
+diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
+index 3914bbb1ef23..05c19cf0661e 100644
+--- a/gcc/cp/method.cc
++++ b/gcc/cp/method.cc
+@@ -1597,7 +1597,7 @@ build_comparison_op (tree fndecl, bool defining, tsubst_flags_t complain)
+ 	      /* Some other array, will need runtime loop.  */
+ 	      else
+ 		{
+-		  idx = force_target_expr (sizetype, maxval, complain);
++		  idx = get_internal_target_expr (maxval);
+ 		  loop_indexes = tree_cons (idx, NULL_TREE, loop_indexes);
+ 		}
+ 	      expr_type = TREE_TYPE (expr_type);
+diff --git a/gcc/cp/tree.cc b/gcc/cp/tree.cc
+index 5628a576f01b..5863b6878f02 100644
+--- a/gcc/cp/tree.cc
++++ b/gcc/cp/tree.cc
+@@ -982,8 +982,7 @@ tree
+ get_internal_target_expr (tree init)
+ {
+   init = convert_bitfield_to_declared_type (init);
+-  tree t = build_target_expr_with_type (init, TREE_TYPE (init),
+-					tf_warning_or_error);
++  tree t = force_target_expr (TREE_TYPE (init), init, tf_warning_or_error);
+   TARGET_EXPR_INTERNAL_P (t) = true;
+   return t;
+ }
+diff --git a/gcc/cp/typeck.cc b/gcc/cp/typeck.cc
+index a9c32ff930d5..bbaca960bd7c 100644
+--- a/gcc/cp/typeck.cc
++++ b/gcc/cp/typeck.cc
+@@ -4219,16 +4219,14 @@ get_member_function_from_ptrfunc (tree *instance_ptrptr, tree function,
+ 	      && !DECL_P (instance_ptr)
+ 	      && !TREE_CONSTANT (instance_ptr)))
+ 	instance_ptr = instance_save_expr
+-	  = force_target_expr (TREE_TYPE (instance_ptr), instance_ptr,
+-			       complain);
++	  = get_internal_target_expr (instance_ptr);
+ 
+       /* See above comment.  */
+       if (TREE_SIDE_EFFECTS (function)
+ 	  || (!nonvirtual
+ 	      && !DECL_P (function)
+ 	      && !TREE_CONSTANT (function)))
+-	function
+-	  = force_target_expr (TREE_TYPE (function), function, complain);
++	function = get_internal_target_expr (function);
+ 
+       /* Start by extracting all the information from the PMF itself.  */
+       e3 = pfn_from_ptrmemfunc (function);
+diff --git a/gcc/testsuite/g++.dg/cpp0x/pr118923.C b/gcc/testsuite/g++.dg/cpp0x/pr118923.C
+new file mode 100644
+index 000000000000..55d3052b61f3
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp0x/pr118923.C
+@@ -0,0 +1,66 @@
++// PR c++/118923
++// { dg-do run { target c++11 } }
++// { dg-additional-options "-frange-for-ext-temps" { target c++23 } }
++// { dg-additional-options "-fno-range-for-ext-temps" { target c++20_down } }
++
++int g;
++
++struct A {
++  int a[3];
++  A (int x, int y, int z) : a{x, y, z} { if ((g++ & 7) != 4) __builtin_abort (); }
++  A (const A &x) = delete;
++  ~A () { if ((g++ & 7) != 7 - 2 * (__cpp_range_based_for >= 202211)) __builtin_abort (); }
++  int *begin () { return a; }
++  int *end () { return a + 3; }
++};
++
++struct B {
++  B () { if ((g++ & 7) != 3) __builtin_abort (); }
++  B (const B &) = delete;
++  ~B () { if ((g++ & 7) != 5 + (__cpp_range_based_for >= 202211)) __builtin_abort (); }
++};
++
++struct C {
++  A foo (const B &) { return { 1, 2, 3 }; }
++  A bar (const B &) { return { 4, 5, 6 }; }
++  bool baz () { return b; }
++  bool b = false;
++  static C c;
++};
++
++C C::c;
++
++struct D {
++  D () { if ((g++ & 5) != 0) __builtin_abort (); }
++  D (const D &) = delete;
++  ~D () { if ((g & 7) != 1 && (g & 7) != 6 + (__cpp_range_based_for >= 202211)) __builtin_abort (); g++; }
++};
++
++inline C *
++qux (const D &)
++{
++  return &C::c;
++}
++
++void 
++foo ()
++{
++  int z = 1;
++  auto d = qux (D {})->baz () ? &C::bar : &C::foo;
++  for (const int &r : (qux (D {})->*d) (B {}))
++    if (z++ != r)
++      __builtin_abort ();
++  C::c.b = true;
++  d = qux (D {})->baz () ? &C::bar : &C::foo;
++  for (const int &r : (qux (D {})->*d) (B {}))
++    if (z++ != r)
++      __builtin_abort ();
++}
++
++int
++main ()
++{
++  foo ();
++  if (g != 16)
++    __builtin_abort ();
++}
+diff --git a/gcc/testsuite/g++.dg/cpp1y/pr118923.C b/gcc/testsuite/g++.dg/cpp1y/pr118923.C
+new file mode 100644
+index 000000000000..b375f47a7d0f
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp1y/pr118923.C
+@@ -0,0 +1,38 @@
++// PR c++/118923
++// { dg-do run { target c++14 } }
++
++struct A {
++  int a[3] = { 0, 0, 0 };
++  int *begin () { return a; }
++  int *end () { return a + 3; }
++};
++
++struct B {
++  A foo () { return { 1, 2, 3 }; }
++  A bar () { return { 1, 2, 3 }; }
++  bool baz () { return b; }
++  bool b = false;
++  static B c;
++};
++
++B B::c;
++
++inline B *
++qux ()
++{
++  return &B::c;
++}
++
++void 
++foo ()
++{
++  auto d = qux ()->baz () ? &B::foo : &B::bar;
++  for (const int &r : (qux ()->*d) ())
++    ;
++}
++
++int
++main ()
++{
++  foo ();
++}
+-- 
+2.48.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
new file mode 100644
index 0000000000..2ea8273862
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="2"
+MUSL_VER="1"
+MUSL_GCC_VER="12.4.0"
+PYTHON_COMPAT=( python3_{10..12} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
new file mode 100644
index 0000000000..4ffc7cf0e2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
+MUSL_GCC_VER="13.2.0"
+PATCH_VER="2"
+MUSL_VER="2"
+PYTHON_COMPAT=( python3_{10..12} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
new file mode 100644
index 0000000000..ec135f5bd0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="8"
+MUSL_VER="1"
+MUSL_GCC_VER="14.1.0"
+PYTHON_COMPAT=( python3_{10..12} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# m68k doesnt build (ICE, bug 932733)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250223-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250223-r1.ebuild
new file mode 100644
index 0000000000..a4f89c7910
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250223-r1.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.0.0"
+PATCH_VER="46"
+MUSL_VER="2"
+MUSL_GCC_VER="15.0.0"
+PYTHON_COMPAT=( python3_{10..12} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${P}-c-Fix-range-for-with-PMFs-PR118923.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250302.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250302.ebuild
new file mode 100644
index 0000000000..729c8b2482
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250302.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.0.0"
+PATCH_VER="46"
+MUSL_VER="2"
+MUSL_GCC_VER="15.0.0"
+PYTHON_COMPAT=( python3_{10..12} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/files/gettext-0.23-libxml2-2.12.0.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/files/gettext-0.23-libxml2-2.12.0.patch
deleted file mode 100644
index 7a22f6e7ea..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/files/gettext-0.23-libxml2-2.12.0.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-https://git.savannah.gnu.org/cgit/gettext.git/commit/?id=adfbe2ee7cd9b47a0465aa9a07d773fa290f46c1
-
-From adfbe2ee7cd9b47a0465aa9a07d773fa290f46c1 Mon Sep 17 00:00:00 2001
-From: Bruno Haible <bruno@clisp.org>
-Date: Sun, 1 Dec 2024 19:35:51 +0100
-Subject: Fix compilation error with libxml2 >= 2.12.0 and gcc >= 14.
-
-Reported by Sam James <sam@gentoo.org>
-at <https://savannah.gnu.org/bugs/?66506>.
-
-* gettext-tools/src/its.c: Include <libxml/xmlversion.h>.
-(structured_error): Adapt to API change.
----
- gettext-tools/src/its.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/gettext-tools/src/its.c b/gettext-tools/src/its.c
-index 8ee7ab40f..3f28f8851 100644
---- a/gettext-tools/src/its.c
-+++ b/gettext-tools/src/its.c
-@@ -28,6 +28,7 @@
- #include <stdint.h>
- #include <stdlib.h>
- 
-+#include <libxml/xmlversion.h>
- #include <libxml/xmlerror.h>
- #include <libxml/tree.h>
- #include <libxml/parser.h>
-@@ -82,7 +83,13 @@
- /* ----------------------------- Error handling ----------------------------- */
- 
- static void
-+/* Adapt to API change in libxml 2.12.0.
-+   See <https://gitlab.gnome.org/GNOME/libxml2/-/issues/622>.  */
-+#if LIBXML_VERSION >= 21200
-+structured_error (void *data, const xmlError *err)
-+#else
- structured_error (void *data, xmlError *err)
-+#endif
- {
-   error (0, err->level == XML_ERR_FATAL ? EXIT_FAILURE : 0,
-          _("%s error: %s"), "libxml2", err->message);
--- 
-cgit v1.2.3-70-g09d2
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.4-r1.ebuild
index ccf20a7219..47456395d9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.4-r1.ebuild
@@ -22,7 +22,7 @@ else
 		mirror://gnu/${PN}/${P}.tar.xz
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 # Only libasprintf is under the LGPL (and libintl is in a sep package),
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-no-backup-if-mismatch-regression.patch b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-no-backup-if-mismatch-regression.patch
new file mode 100644
index 0000000000..f4d162694a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-no-backup-if-mismatch-regression.patch
@@ -0,0 +1,131 @@
+From b5d2124e2e6019ee5d329b49ef6904a0daec74a1 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 24 Feb 2025 22:59:51 -0800
+Subject: [PATCH] patch: fix --no-backup-if-mismatch regression
+
+Problem reported by Sam James in:
+https://lists.gnu.org/archive/html/bug-patch/2025-02/msg00014.html
+https://bugs.gentoo.org/show_bug.cgi?id=949834
+* src/patch.c (backup_if_mismatch_specified): New static var.
+(get_some_switches): Set it.
+(main): Default backup_if_mismatch only if not set on command line.
+* tests/no-backup: New file.
+* tests/Makefile.am (TESTS): Add it.
+---
+ src/patch.c       |  6 ++++-
+ tests/Makefile.am |  1 +
+ tests/no-backup   | 56 +++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 62 insertions(+), 1 deletion(-)
+ create mode 100644 tests/no-backup
+
+diff --git a/src/patch.c b/src/patch.c
+index 6c460f7..e4d0524 100644
+--- a/src/patch.c
++++ b/src/patch.c
+@@ -118,6 +118,7 @@ static bool merge;
+ static enum diff reject_format = NO_DIFF;  /* automatic */
+ static bool make_backups;
+ static bool backup_if_mismatch;
++static bool backup_if_mismatch_specified;
+ static char const *version_control;
+ static char const *version_control_context;
+ static bool remove_empty_files;
+@@ -196,7 +197,8 @@ main (int argc, char **argv)
+     if (set_utc && setenv ("TZ", "UTC0", 1) < 0)
+       pfatal ("setenv");
+ 
+-    backup_if_mismatch = ! posixly_correct;
++    if (!backup_if_mismatch_specified)
++      backup_if_mismatch = !posixly_correct;
+     if (make_backups | backup_if_mismatch)
+       backup_type = get_version (version_control_context, version_control);
+ 
+@@ -1050,9 +1052,11 @@ get_some_switches (int argc, char **argv)
+ 		usage (stdout, EXIT_SUCCESS);
+ 	    case CHAR_MAX + 5:
+ 		backup_if_mismatch = true;
++		backup_if_mismatch_specified = true;
+ 		break;
+ 	    case CHAR_MAX + 6:
+ 		backup_if_mismatch = false;
++		backup_if_mismatch_specified = true;
+ 		break;
+ 	    case CHAR_MAX + 7:
+ 		posixly_correct = true;
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 43ddf66..acb449a 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -50,6 +50,7 @@ TESTS = \
+ 	mixed-patch-types \
+ 	munged-context-format \
+ 	need-filename \
++	no-backup \
+ 	no-mode-change-git-diff \
+ 	no-newline-triggers-assert \
+ 	preserve-c-function-names \
+diff --git a/tests/no-backup b/tests/no-backup
+new file mode 100644
+index 0000000..57b73fa
+--- /dev/null
++++ b/tests/no-backup
+@@ -0,0 +1,56 @@
++# Copyright 2025 Free Software Foundation, Inc.
++#
++# Copying and distribution of this file, with or without modification,
++# in any medium, are permitted without royalty provided the copyright
++# notice and this notice are preserved.
++
++# Test the --no-backup-if-mismatch option
++
++. $srcdir/test-lib.sh
++
++require cat
++use_local_patch
++use_tmpdir
++
++# ==============================================================
++
++cat >my_file <<'EOF'
++/* ... */
++void baz();
++
++
++void baz() {
++	/* ... */
++}
++
++int main() {
++	int foo;
++	int bar;
++
++	/* ... */
++	baz();
++}
++EOF
++
++cat >my_file.patch <<'EOF'
++--- my_file	2025-02-16 11:22:12.881765792 +0000
+++++ my_file_new	2025-02-16 11:22:12.881796732 +0000
++@@ -2,7 +2,7 @@
++ void baz();
++
++ void baz() {
++-	/* ... */
+++	// ...
++ }
++
++ int main() {
++EOF
++
++unset POSIXLY_CORRECT
++
++check 'patch -N --no-backup-if-mismatch <my_file.patch || echo "Status: $?"' <<'EOF'
++patching file my_file
++Hunk #1 succeeded at 3 with fuzz 1 (offset 1 line).
++EOF
++
++ncheck 'test ! -f my_file.orig'
+-- 
+2.45.3
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-traditional-diff-lines.patch b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-traditional-diff-lines.patch
new file mode 100644
index 0000000000..3d9d3109e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6_p20250206-traditional-diff-lines.patch
@@ -0,0 +1,114 @@
+From 29fced6251928e6334fa15fd28bf2c198acd4cd4 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Wed, 26 Feb 2025 16:44:48 -0800
+Subject: [PATCH 1/2] Count traditional diff pattern lines correctly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes a bug I introduced on Thu Sep 5 16:37:50 2024 -0700.
+Problem reported by Petr Vaněk in:
+https://lists.gnu.org/archive/html/bug-patch/2025-02/msg00017.html
+* src/pch.c (another_hunk): Fix method for counting number
+of lines in a traditional diff hunk.
+---
+ src/pch.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/pch.c b/src/pch.c
+index 63c9a0c..d9f5c61 100644
+--- a/src/pch.c
++++ b/src/pch.c
+@@ -1765,9 +1765,10 @@ another_hunk (enum diff difftype, bool rev)
+ 	if (*s == ',') {
+ 	    idx_t last;
+ 	    s = scan_linenum (s + 1, &last);
+-	    if (p_first >= IDX_MAX - p_ptrn_lines)
++	    ptrdiff_t diff = last - p_first;
++	    if (! (-1 <= diff && diff < IDX_MAX))
+ 	      malformed ();
+-	    p_ptrn_lines += 1 - p_first;
++	    p_ptrn_lines = diff + 1;
+ 	}
+ 	else
+ 	    p_ptrn_lines = (*s != 'a');
+-- 
+2.45.3
+
+
+From b3d0c933389208ccac795a1b517c5a8b11cc012e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Van=C4=9Bk?= <arkamar@gentoo.org>
+Date: Wed, 26 Feb 2025 16:44:48 -0800
+Subject: [PATCH 2/2] Regression in commit abe92e8010ab affecting MariaDB tests
+
+I have disovered a regression in commit abe92e8010ab ("Prefer idx_t,
+ptrdiff_t to lin") while I was running MariaDB tests. The regression is
+related to a diff file [1], where the patch fails to apply it with
+following error:
+
+  patch: **** '---' expected at line 2 of patch
+
+To illustrate the issue, I have attached a git patch containing a
+testcase with simplified reproducer.
+
+[1] https://github.com/MariaDB/server/blob/mariadb-10.6.21/mysql-test/suite/innodb/r/innodb-wl5522%2Cstrict_crc32.rdiff file
+---
+ tests/Makefile.am             |  1 +
+ tests/regression-abe92e8010ab | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 34 insertions(+)
+ create mode 100644 tests/regression-abe92e8010ab
+
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index acb449a..8f1a248 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -57,6 +57,7 @@ TESTS = \
+ 	preserve-mode-and-timestamp \
+ 	quoted-filenames \
+ 	read-only-files \
++	regression-abe92e8010ab \
+ 	reject-format \
+ 	remember-backup-files \
+ 	remember-reject-files \
+diff --git a/tests/regression-abe92e8010ab b/tests/regression-abe92e8010ab
+new file mode 100644
+index 0000000..0e11e34
+--- /dev/null
++++ b/tests/regression-abe92e8010ab
+@@ -0,0 +1,33 @@
++. $srcdir/test-lib.sh
++
++require cat
++use_local_patch
++use_tmpdir
++
++cat > f <<EOF
++1
++2
++test:
++a
++4
++EOF
++
++cat > f.diff <<EOF
++2,3c2
++< test:
++< a
++---
++> 3
++EOF
++
++check 'patch f < f.diff' <<EOF
++patching file f
++Hunk #1 succeeded at 3 (offset 1 line).
++EOF
++
++check 'cat f' <<EOF
++1
++2
++3
++4
++EOF
+-- 
+2.45.3
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206-r1.ebuild
similarity index 84%
rename from sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206-r1.ebuild
index 5e593eb27c..0c0ae58d62 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206-r1.ebuild
@@ -3,6 +3,11 @@
 
 EAPI=8
 
+WANT_AUTOCONF=none
+WANT_LIBTOOL=none
+WANT_AUTOMAKE=1.16
+inherit autotools
+
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/patch.asc
 inherit flag-o-matic verify-sig
 
@@ -36,6 +41,13 @@ BDEPEND="
 	verify-sig? ( >=sec-keys/openpgp-keys-patch-20250206 )
 "
 
+PATCHES=(
+	# backport fix for https://bugs.gentoo.org/949834
+	"${FILESDIR}"/${P}-no-backup-if-mismatch-regression.patch
+	# backport https://lists.gnu.org/archive/html/bug-patch/2025-02/msg00017.html
+	"${FILESDIR}"/${P}-traditional-diff-lines.patch
+)
+
 src_unpack() {
 	if [[ ${PV} == 9999 ]] ; then
 		git-r3_src_unpack
@@ -49,6 +61,11 @@ src_unpack() {
 	default
 }
 
+src_prepare() {
+	default
+	eautomake
+}
+
 src_configure() {
 	use static && append-ldflags -static
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
index efd512c2f0..33b2c9078e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
@@ -1,3 +1,4 @@
 DIST ldb-2.8.1.tar.gz 1745790 BLAKE2B 7b0fb70b510da85e9b1e67e9485ed9caf7635d4709e855f46243746f3a65cb9ccc1958f151868261b4aeb4efc6e6aa0054e19cf8f43b8bbebd7d41630af29cc7 SHA512 37e53cee1361303398cb0366760f08f2f306ed08c98354f5eb9ab2330d67b866ed0af07b252c204f77bbb260fe911337f3585015305b9d5e0ab2fcea6761b164
 DIST ldb-2.8.2.tar.gz 1746336 BLAKE2B f3eeb9d103718c2dac9b81b85f4f5d8d214209ae4c8fe1267a40e1c5dae792f9ea991c4301fe7ff7e63ff0cd8eab51fd8212b0cf555a4c9ba90b8d761ca71b39 SHA512 df1c228307ede75920a927ae3124cd0d507dfcf00f93b6f5c14b79f4e1a23dbe00249bc92b3ee3ed1e5ce06fe363f0be1eb3dab491fbe79e83b1a1b35a6e50e1
 DIST ldb-2.9.1.tar.gz 1752372 BLAKE2B dcff2bf54a31c787504eb206453f46f3ab5b7e106a9b0978ee3f2f3d5ef267d60cb0c21864bb78c31f71b815051757bd4becf6379ea26d32e151489e09835569 SHA512 a7384d5b88b1b2edc1ac40f38f74b8b2eb403610d158c579a862007801586a4ad1ba11019737ecad8a83e8f2d1ae7ae16ec7e92c58f60feb2d6fed84c4212265
+DIST ldb-2.9.2.tar.gz 1752608 BLAKE2B c5a1e2f8ade531986ff9405dbaaa12d564f48b1839fc288b531cbfc0c832cee0d4e7c1018512cc64404d979e0c8a79d31ecde0007966f965cc17e6e2086111e6 SHA512 05f66fc32b1d7a310d7cd5f4ea9aa45902411d8f0b7cd80b00fe27d8b942fd5f60fa97b86001fc2b45937a317a95d6a7279385557b87f70fdc28d6eb010be6a4
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
new file mode 100644
index 0000000000..999046da9a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.2.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="threads(+)"
+inherit python-single-r1 waf-utils multilib-minimal
+
+DESCRIPTION="LDAP-like embedded database"
+HOMEPAGE="https://ldb.samba.org"
+SRC_URI="https://download.samba.org/pub/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0/${PV}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc ldap +lmdb python test"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}
+	test? ( lmdb )"
+
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.2"
+TDB_VERSION="1.4.10"
+TEVENT_VERSION="0.16.1"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	dev-libs/popt[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tdb-${TDB_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tevent-${TEVENT_VERSION}[${MULTILIB_USEDEP}]
+	ldap? ( net-nds/openldap:= )
+	lmdb? ( >=dev-db/lmdb-0.9.16:=[${MULTILIB_USEDEP}] )
+	python? (
+		${PYTHON_DEPS}
+		sys-libs/talloc[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tdb[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tevent[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	virtual/libcrypt
+	test? ( >=dev-util/cmocka-1.1.3[${MULTILIB_USEDEP}] )
+"
+BDEPEND="${PYTHON_DEPS}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+MULTILIB_WRAPPED_HEADERS=( /usr/include/pyldb.h )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.9.0-optional_packages.patch
+	"${FILESDIR}"/${PN}-1.1.31-fix_PKGCONFIGDIR-when-python-disabled.patch
+	"${FILESDIR}"/${PN}-2.4.2-skip-32bit-time_t-tests.patch
+	"${FILESDIR}"/${PN}-2.5.2-skip-waf-tevent-check.patch
+)
+
+pkg_setup() {
+	# Package fails to build with distcc
+	export DISTCC_DISABLE=1
+	export PYTHONHASHSEED=1
+
+	# waf requires a python interpreter
+	python-single-r1_pkg_setup
+}
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+
+	actual_tdb_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tdb/wscript || die)
+	if [[ ${actual_tdb_version} != ${TDB_VERSION} ]] ; then
+		eerror "Source tdb version: ${TDB_VERSION}"
+		eerror "Ebuild tdb version: ${actual_tdb_version}"
+		die "Ebuild needs to fix TDB_VERSION!"
+	fi
+
+	actual_tevent_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tevent/wscript || die)
+	if [[ ${actual_tevent_version} != ${TEVENT_VERSION} ]] ; then
+		eerror "Source tevent version: ${TEVENT_VERSION}"
+		eerror "Ebuild tevent version: ${actual_tevent_version}"
+		die "Ebuild needs to fix TEVENT_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	local myconf=(
+		$(usex ldap '' --disable-ldap)
+		$(usex lmdb '' --without-ldb-lmdb)
+		--disable-rpath
+		--disable-rpath-install
+		--with-modulesdir="${EPREFIX}"/usr/$(get_libdir)/samba
+		--bundled-libraries="${bundled_libs}"
+		--builtin-libraries=NONE
+	)
+
+	if ! use python || ! multilib_is_native_abi; then
+		myconf+=( --disable-python )
+	fi
+
+	waf-utils_src_configure "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+	multilib_is_native_abi && use doc && doxygen Doxyfile
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		WAF_MAKE=1 \
+		PATH=buildtools/bin:../../../buildtools/bin:${PATH}:"${BUILD_DIR}"/bin/shared/private/ \
+		LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:"${BUILD_DIR}"/bin/shared/private/:"${BUILD_DIR}"/bin/shared \
+		waf test || die
+	fi
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	if multilib_is_native_abi && use doc; then
+		doman  apidocs/man/man3/*.3
+		docinto html
+		dodoc -r apidocs/html/.
+	fi
+
+	# bug #726454
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	if has_version sys-auth/sssd; then
+		ewarn "You have sssd installed. It is known to break after ldb upgrades,"
+		ewarn "so please try to rebuild it before reporting bugs."
+		ewarn "See https://bugs.gentoo.org/404281"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
index 31934e95cd..ee2c2f74d1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.36-r3.ebuild
@@ -138,9 +138,11 @@ src_configure() {
 	fi
 
 	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
+		# Nothing is compiled which would affect the headers, so we set
+		# CC and PKG_CONFIG to ensure configure passes without defaulting
+		# to the unprefixed host variants e.g. "pkg-config"
 		local -x CC="$(tc-getBUILD_CC)"
+		local -x PKG_CONFIG="false"
 	fi
 
 	# Avoid possible "illegal instruction" errors with gold
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
index 566750ba0d..42cb9b1e24 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/libxcrypt-4.4.38.ebuild
@@ -138,9 +138,11 @@ src_configure() {
 	fi
 
 	if use headers-only; then
-		# Nothing is compiled here which would affect the headers for the target.
-		# So forcing CC is sane.
+		# Nothing is compiled which would affect the headers, so we set
+		# CC and PKG_CONFIG to ensure configure passes without defaulting
+		# to the unprefixed host variants e.g. "pkg-config"
 		local -x CC="$(tc-getBUILD_CC)"
+		local -x PKG_CONFIG="false"
 	fi
 
 	# Doesn't work with LTO: bug #852917.
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
index cef5e501f6..ff23f0d0be 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libxcrypt/metadata.xml
@@ -13,7 +13,7 @@
 	<use>
 		<flag name="compat">Build with compatibility interfaces for other crypt implementations</flag>
 		<flag name="system">Install as system libcrypt.so rather than to an alternate directory (will collide with <pkg>sys-libs/glibc</pkg>'s version)</flag>
-		<flag name="headers-only">Build and install only the headers.</flag>
+		<flag name="headers-only">Build and install only the headers. This is mostly useful for toolchain bootstrapping, to avoid circular deps.</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">besser82/libxcrypt</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
index 18bc0c38ed..f073526aac 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
@@ -1,2 +1 @@
-DIST pixman-0.43.4.tar.xz 636900 BLAKE2B c31e5700bfadcd72f522af50509a4a6cd7bbf90c918c75b108e50246f1c76e858125138902a222040ada192710ec788deb43eb65085416f3eff88e3ed970933e SHA512 b40fb05bd58dc78f4e4e9b19c86991ab0611b708657c9a7fb42bfe82d57820a0fde01a34b00a0848a41da6c3fb90c2213942a70f435a0e9467631695d3bc7e36
 DIST pixman-0.44.2.tar.xz 650012 BLAKE2B 856aa35ae705de522d70250beee8acc872b54d2b5caa9cee6bc12ffde7c293b3db76f56c75858cc5ab1bc592fb1d4078485c2def2ae4bcd5a50b6dfc2eb477eb SHA512 b24907f9a0bf6a9aa3278d31986c562c5f2d68f8c178021497c8648aca9f91e4c6f1ecfacf93eb01ba4f03ce4cfc5970fc40bb0fe6724bac9210fc57da09cba4
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/files/0.43.4-pixman-Adjust-arm-assembly-for-binutils-change.patch b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/files/0.43.4-pixman-Adjust-arm-assembly-for-binutils-change.patch
deleted file mode 100644
index c59ed7b3e8..0000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/files/0.43.4-pixman-Adjust-arm-assembly-for-binutils-change.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-https://bugs.gentoo.org/942441
-
-From 865e6ce00bb79a6b925ed4c2c436e1533e4472aa Mon Sep 17 00:00:00 2001
-From: Mike Hommey <mh@glandium.org>
-Date: Fri, 12 Jul 2024 11:11:17 -0400
-Subject: [PATCH] pixman: Adjust arm assembly for binutils change
-
-A change in the latest version of binutils broke building pixman for arm.
-
-The binutils change:
-https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=226749d5a6ff0d5c607d6428d6c81e1e7e7a994b
-
-Closes: https://gitlab.freedesktop.org/pixman/pixman/-/issues/96
----
- pixman/pixman-arm-simd-asm.S | 44 ++++++++++++++++++------------------
- 1 file changed, 22 insertions(+), 22 deletions(-)
-
-diff --git a/pixman/pixman-arm-simd-asm.S b/pixman/pixman-arm-simd-asm.S
-index 34d38f1..3dfe723 100644
---- a/pixman/pixman-arm-simd-asm.S
-+++ b/pixman/pixman-arm-simd-asm.S
-@@ -820,13 +820,13 @@ generate_composite_function \
- .macro over_white_8888_8888_ca_1pixel_tail
-         mvn     TMP0, WK1
-         teq     WK1, WK1, asr #32
--        bne     01f
--        bcc     03f
-+        bne     1f
-+        bcc     3f
-         mov     WK3, WK1
--        b       02f
--01:     over_white_8888_8888_ca_combine WK1, WK3
--02:     pixst   , 4, 3, DST
--03:
-+        b       2f
-+1:      over_white_8888_8888_ca_combine WK1, WK3
-+2:      pixst   , 4, 3, DST
-+3:
- .endm
- 
- .macro over_white_8888_8888_ca_2pixels_head
-@@ -837,21 +837,21 @@ generate_composite_function \
-         pixld   , 8, 3, DST
-         mvn     TMP0, WK1
-         teq     WK1, WK1, asr #32
--        bne     01f
-+        bne     1f
-         movcs   WK3, WK1
--        bcs     02f
-+        bcs     2f
-         teq     WK2, #0
--        beq     05f
--        b       02f
--01:     over_white_8888_8888_ca_combine WK1, WK3
--02:     mvn     TMP0, WK2
-+        beq     5f
-+        b       2f
-+1:      over_white_8888_8888_ca_combine WK1, WK3
-+2:      mvn     TMP0, WK2
-         teq     WK2, WK2, asr #32
--        bne     03f
-+        bne     3f
-         movcs   WK4, WK2
--        b       04f
--03:     over_white_8888_8888_ca_combine WK2, WK4
--04:     pixst   , 8, 3, DST
--05:
-+        b       4f
-+3:      over_white_8888_8888_ca_combine WK2, WK4
-+4:      pixst   , 8, 3, DST
-+5:
- .endm
- 
- .macro over_white_8888_8888_ca_process_head  cond, numbytes, firstreg, unaligned_src, unaligned_mask, preload
-@@ -1067,9 +1067,9 @@ generate_composite_function \
-   .if \offset != 0
-         ldrb    ORIG_W, [SRC, #\offset]
-   .endif
--        beq     01f
-+        beq     1f
-         teq     STRIDE_M, #0xFF
--        beq     02f
-+        beq     2f
-  .endif
-         uxtb16  SCRATCH, \d                 /* rb_dest */
-         uxtb16  \d, \d, ror #8               /* ag_dest */
-@@ -1079,13 +1079,13 @@ generate_composite_function \
-         uxtab16 \d, \d, \d, ror #8
-         mov     SCRATCH, SCRATCH, ror #8
-         sel     \d, SCRATCH, \d
--        b       02f
-+        b       2f
-  .if \offset == 0
- 48:     /* Last mov d,#0 of the set - used as part of shortcut for
-          * source values all 0 */
-  .endif
--01:     mov     \d, #0
--02:
-+1:      mov     \d, #0
-+2:
- .endm
- 
- .macro in_reverse_8888_8888_tail  numbytes, reg1, reg2, reg3, reg4
--- 
-2.45.2
-
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild
deleted file mode 100644
index f81d1c4ed4..0000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit ${GIT_ECLASS} flag-o-matic meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_iwmmxt cpu_flags_arm_iwmmxt2 cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	"${FILESDIR}"/${PV}-pixman-Adjust-arm-assembly-for-binutils-change.patch
-)
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	if ( use arm || use arm64 ) && tc-is-clang ; then
-		# See bug #768138 and https://gitlab.freedesktop.org/pixman/pixman/-/issues/46
-		append-cflags $(test-flags-CC -fno-integrated-as)
-	fi
-
-	local emesonargs=(
-		$(meson_feature cpu_flags_arm_iwmmxt iwmmxt)
-		$(meson_use     cpu_flags_arm_iwmmxt2 iwmmxt2)
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}