diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index 517688c657..707b7038ca 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -122,6 +122,8 @@ app-text/docbook-xsl-stylesheets
 app-text/manpager
 app-text/sgml-common
 
+sec-keys/openpgp-keys-gentoo-release
+
 dev-cpp/gtest
 
 dev-db/sqlite
@@ -197,7 +199,6 @@ dev-python/nspektr
 dev-python/ordered-set
 dev-python/packaging
 dev-python/platformdirs
-dev-python/pydantic
 dev-python/pydecomp
 dev-python/pygments
 dev-python/pyparsing
diff --git a/changelog/security/2023-08-09-weekly-updates.md b/changelog/security/2023-08-09-weekly-updates.md
new file mode 100644
index 0000000000..8ceb3251c1
--- /dev/null
+++ b/changelog/security/2023-08-09-weekly-updates.md
@@ -0,0 +1,4 @@
+- libarchive ([libarchive-20230729](https://github.com/libarchive/libarchive/releases/tag/v3.7.1))
+- vim ([CVE-2023-2609](https://nvd.nist.gov/vuln/detail/CVE-2023-2609), [CVE-2023-2610](https://nvd.nist.gov/vuln/detail/CVE-2023-2610))
+- qemu ([CVE-2023-0330](https://nvd.nist.gov/vuln/detail/CVE-2023-0330), [CVE-2023-2861](https://nvd.nist.gov/vuln/detail/CVE-2023-2861))
+- curl ([CVE-2023-32001](https://nvd.nist.gov/vuln/detail/CVE-2023-32001))
diff --git a/changelog/updates/2023-08-09-weekly-updates.md b/changelog/updates/2023-08-09-weekly-updates.md
new file mode 100644
index 0000000000..a0678932fb
--- /dev/null
+++ b/changelog/updates/2023-08-09-weekly-updates.md
@@ -0,0 +1,10 @@
+- libarchive ([3.7.1](https://github.com/libarchive/libarchive/releases/tag/v3.7.1) (includes [3.7.0](https://github.com/libarchive/libarchive/releases/tag/v3.7.0)))
+- libmd ([1.1.0](https://git.hadrons.org/cgit/libmd.git/log/?h=1.1.0))
+- vim ([9.0.1677](https://github.com/vim/vim/commits/v9.0.1677))
+- SDK: qemu ([8.0.3](https://wiki.qemu.org/ChangeLog/8.0))
+- libassuan ([2.5.6](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libassuan.git;a=blob;f=NEWS;h=e52bb5dd36ac93ea227e53e89f82af9ccf38f339;hb=6b50ee6bcdd6aa81bd7cc3fb2379864c3ed479b8))
+- libksba ([1.6.4](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=blob;f=NEWS;h=f640523209c1c9ce9855040e53914a79d24d6a67;hb=557999424ebd13e70d6fc17e648a5dd2a06f440b))
+- libuv ([1.46.0](https://github.com/libuv/libuv/releases/tag/v1.46.0) (includes [1.45.0](https://github.com/libuv/libuv/releases/tag/v1.45.0)))
+- curl ([8.2.1](https://curl.se/changes.html#8_2_1) (includes [8.2.0](https://curl.se/changes.html#8_2_0)))
+- portage ([3.0.49](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.49))
+- intel microcode ([20230613](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20230613))
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 39b3313825..62a5eebb6d 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -9,10 +9,15 @@
 
 # Needed by arm64-native SDK.
 =app-crypt/efitools-1.9.2 ~arm64
+
+# Needed to address CVE-2023-2609 and CVE-2023-2610.
+=app-editors/vim-9.0.1677 ~amd64 ~arm64
+=app-editors/vim-core-9.0.1677 ~amd64 ~arm64
+
+# Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
-=app-emulation/qemu-7.2.3 ~arm64
 =app-misc/pax-utils-1.3.7 ~amd64
 
 # Required for addressing CVE-2022-3715.
@@ -37,19 +42,18 @@
 =dev-libs/libgcrypt-1.10.1-r3 ~arm64
 =dev-python/lxml-4.9.2-r1 ~arm64
 =dev-util/bpftool-6.3 ~arm64
-
-# Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.6-r1 ~arm64
+=net-firewall/ipset-7.17-r1 ~arm64
 
 # Required for addressing CVE-2023-0361.
-=net-libs/gnutls-3.8.0 ~amd64 ~arm64
+=net-libs/gnutls-3.8.0 ~arm64
 
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.0-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.0-r1 ~arm64
 
-# Required for addressing CVE-2023-28319, CVE-2023-28320, CVE-2023-28321 and CVE-2023-28322.
-=net-misc/curl-8.1.2 ~amd64 ~arm64
+# Required for addressing CVE-2023-32001.
+=net-misc/curl-8.2.1 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =sec-policy/selinux-base-2.20200818-r3 ~arm64
@@ -57,7 +61,6 @@
 =sec-policy/selinux-unconfined-2.20200818-r2 ~arm64
 =sec-policy/selinux-virt-2.20200818-r2 ~arm64
 =sys-apps/checkpolicy-3.1 ~arm64
-=sys-apps/coreutils-9.3-r2 ~arm64
 =sys-apps/kexec-tools-2.0.24 ~arm64
 =sys-apps/policycoreutils-3.1-r4 ~arm64
 =sys-apps/semodule-utils-3.1 ~arm64
@@ -66,13 +69,13 @@
 =sys-cluster/ipvsadm-1.27-r1 **
 
 # Keep versions on both arches in sync.
+=sys-devel/automake-1.16.5-r1 ~arm64
 =sys-firmware/edk2-aarch64-18.02 **
 
 # FIPS support is still being tested.
 =sys-fs/cryptsetup-2.4.3-r1 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
-=sys-fs/multipath-tools-0.9.5 ~amd64
 =sys-libs/libselinux-3.1-r3 ~arm64
 =sys-libs/libsemanage-3.1-r2 ~arm64
 =sys-libs/libsepol-3.1 ~arm64
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 89f3befbbb..7d9d6e8e1b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -73,10 +73,6 @@ sys-apps/portage -xattr -rsync-verify
 # Enable -M and -Z flags; -M is used by mayday
 sys-process/lsof rpc selinux
 
-# can be removed with socat-2.0.0; this is the openssl/readline license
-# incompatibility 
-net-misc/socat -ssl
-
 # Prevent pulling in a ton of perl dependencies
 sys-apps/man-db -nls
 
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r2.ebuild
index 922096ca2c..e0799cc036 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-auth/google-oslogin/google-oslogin-20200910.00-r2.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=8
 
 DESCRIPTION="Components to support Google Cloud OS Login. This contains bits that belong in USR"
 HOMEPAGE="https://github.com/GoogleCloudPlatform/guest-oslogin"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index 4b98fc7499..d2ed4d61ba 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,6 @@
 DIST libarchive-3.6.2.tar.xz 5213196 BLAKE2B 355b5d402e352dee802513485ce7e047af58d6de5b9bf6a49f3fd8d7b94117007598820ac979585c0da79747e8b63b70ab151131182368a11f97a047cf9029d4 SHA512 a12bb6839e13a0be1099f42c650fc90fbfe62d32ce38bcbb4794206d29b2c782ae1115124d0e5f6b9716514213af32b05e4a42eb196447674a5f9a2a32bee043
 DIST libarchive-3.6.2.tar.xz.asc 659 BLAKE2B a4b0035ab2bda4129cdf0c99266cd1e5f4772d90de6e348c75958bc803f369d6abea85d9730c6c9a216466b35697faad8d265fb2c285545887eafde27d828887 SHA512 403e5f7dec14d8b1cc01fad5a249e7b7618a7b45bcb3361ea80d67d76b591b12ce97f2c88b23d5486505dd3b34c1f1643e02235a3e5fc5150ee5735946092efe
+DIST libarchive-3.7.0.tar.xz 5243356 BLAKE2B 8fb72a0504038c71584c0416c1d747b7f5c82266518704353e7fdf794bd9f9e2dc22b8fa2538fa8d12a3b9776581077040371d25647fe72c02a4ec5f3bb8d950 SHA512 f69ff7fbec7e909b6a03dd5b01c47316f95a277907409c8fba3930bb90d02cd9a329921eada59ca1afc9a19e34de7eb34e9d535bbc8cd98fb586f723bd0fdba8
+DIST libarchive-3.7.0.tar.xz.asc 659 BLAKE2B 5bbd535ce100fbfb7ed46f8d7a6957ebb590c07124de4192ae0b777ad3b3950e6406f1ccda97dde5b6e792be00a039621de21665df9989073ebd0a905299eda1 SHA512 eda3a4347fb8d7f78c8e0a73f621a4a731d46cafc2f46ac59cebe39f3ebd29b1c3db21772c2027b30c5c507f5f732c3876e94f319e62156d2a3146e412cad84d
+DIST libarchive-3.7.1.tar.xz 5254260 BLAKE2B 1a6fa4f5027effea3df1cfcd2d99b8b126fe03d727412b0a4529d6b2157c2c29490bcce206d0f771256c5ed6dec9612608c2c54c4861647f4e2892e0f5548adb SHA512 24380b9aa24434dfe39929ec85ede33580291023b20b7cdf03990ce62578eaeb389f5ca5680245a84c7aad51574c85a1fa3fad5254ec5395eadac1cb2130a936
+DIST libarchive-3.7.1.tar.xz.asc 659 BLAKE2B 5e72732d2e5a4f5f04f3510b3d81a148f23dffa10a3ebe709e816388c5a6e68c08ee2bbe36d81141d5ffa94ed64df3e4ca05994cda651c09589fda69a6a95e90 SHA512 6f6f6e5780c609bd9c6c359c210656f26afb585bda46988687e19d1e55f4f3260ea80bf11bfba1213fb3a3e1514c5c096692b4b9e96ffbadf06f85eb1227250a
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.0-f_namemax-fix.patch b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.0-f_namemax-fix.patch
new file mode 100644
index 0000000000..36ed70fca4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.0-f_namemax-fix.patch
@@ -0,0 +1,19 @@
+From: https://github.com/libarchive/libarchive/commit/bd074c2531e867078788fe8539376c31119e4e55.patch
+From: Wong Hoi Sing Edison <hswong3i@gmail.com>
+Date: Wed, 19 Jul 2023 16:59:32 +0800
+Subject: [PATCH] Replace `svfs.f_namelen` with `svfs.f_namemax` (#1924)
+
+The equivalent for `f_namelen` in struct statvfs is `f_namemax`.
+
+Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
+--- a/libarchive/archive_read_disk_posix.c
++++ b/libarchive/archive_read_disk_posix.c
+@@ -1866,7 +1866,7 @@ setup_current_filesystem(struct archive_read_disk *a)
+ #if defined(USE_READDIR_R)
+ 	/* Set maximum filename length. */
+ #if defined(HAVE_STATVFS)
+-	t->current_filesystem->name_max = svfs.f_namelen;
++	t->current_filesystem->name_max = svfs.f_namemax;
+ #else
+ 	t->current_filesystem->name_max = sfs.f_namelen;
+ #endif
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.0.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.0.ebuild
new file mode 100644
index 0000000000..0346154a71
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.0.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
+	kernel_linux? (
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+# Bug #910552 Only required for version 3.7.0
+PATCHES=(
+	"${FILESDIR}/${P}-f_namemax-fix.patch"
+)
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+	# TODO: figure out why we don't get one
+	mkdir -p unzip/test || die
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.1.ebuild
new file mode 100644
index 0000000000..673093b84d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.1.ebuild
@@ -0,0 +1,142 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
+	kernel_linux? (
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/pigz/pigz-2.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/pigz/pigz-2.7-r1.ebuild
index ae31607898..6918d7ad4f 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/pigz/pigz-2.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/pigz/pigz-2.7-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.zlib.net/pigz/${P}.tar.gz"
 
 LICENSE="ZLIB"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~ppc-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~ppc-macos"
 IUSE="static test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/tar/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/tar/Manifest
index 1a295ed77e..52fa6aa731 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/tar/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/tar/Manifest
@@ -1,2 +1,4 @@
 DIST tar-1.34.tar.xz 2226068 BLAKE2B 741a662457509a6775338ffe5d2d84872fcf38b93ace70c8b748a81055b9b62f65a48c4e541955d08ae99e6f528509e89eacd7c799a65bcc3d017a259110c115 SHA512 5e77c4a7b49983ad7d15238c2bce28be7a8aa437b4b1815fc00abd13096da308b6bba196cc6e3ed79d85e62823d520ae0d8fcda2d93873842cf84dc3369fc902
 DIST tar-1.34.tar.xz.sig 181 BLAKE2B 2fae91293a9dacda0374706e1f83498042a9d5224f80f6f0e14abdb914cb5a8e980f720eb4a453485844c7fe26e0525f230c0eab11c7fa89159a1a929370795c SHA512 55297f41549deee511f5b14c6b5dc7bb3d9282dad52bcc85f9dddfad24b677f989ba86387ad9b133c3698feedbd6b6cd7e9f005e8e4c89f72c80543eeceb78f7
+DIST tar-1.35.tar.xz 2317208 BLAKE2B e1a200d21f433cd7d917dd979db16919a9167056ae62cf7d038a6118e56b2fe419cd4a396eee66f1f4dc13a8dc380e23f6ffd7ee0ca84e5dd9ad9411f60e002c SHA512 8b84ed661e6c878fa33eb5c1808d20351e6f40551ac63f96014fb0d0b9c72d5d94d8865d39e36bcb184fd250f84778a3b271bbd8bd2ceb69eece0c3568577510
+DIST tar-1.35.tar.xz.sig 95 BLAKE2B 8501b55b700bc99b81f04519db1cd8f7bc3d87dd5bfefa25a3d979b23359f02dfb770f3dd66dca275baa70a99612cb85c1019faaf3a1f0bcf50c9815b8e32eca SHA512 00e5c95bf8015f75f59556a82ed7f50bddefe89754c7ff3c19411aee2f37626a5d65c33e18b87f7f8f96388d3f175fd095917419a3ad1c0fc9d6188088bac944
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild
new file mode 100644
index 0000000000..085101fd20
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild
@@ -0,0 +1,113 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/tar.asc
+inherit verify-sig
+
+DESCRIPTION="Use this to make tarballs :)"
+HOMEPAGE="https://www.gnu.org/software/tar/"
+SRC_URI="
+	mirror://gnu/tar/${P}.tar.xz
+	https://alpha.gnu.org/gnu/tar/${P}.tar.xz
+	verify-sig? (
+		mirror://gnu/tar/${P}.tar.xz.sig
+		https://alpha.gnu.org/gnu/tar/${P}.tar.xz.sig
+	)
+"
+
+LICENSE="GPL-3+"
+SLOT="0"
+if [[ -z "$(ver_cut 3)" || "$(ver_cut 3)" -lt 90 ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="acl minimal nls selinux xattr"
+
+RDEPEND="
+	acl? ( virtual/acl )
+	selinux? ( sys-libs/libselinux )
+"
+DEPEND="
+	${RDEPEND}
+	xattr? ( elibc_glibc? ( sys-apps/attr ) )
+"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-tar )
+"
+PDEPEND="
+	app-alternatives/tar
+"
+
+src_configure() {
+	# -fanalyzer doesn't make sense for us in ebuilds, as it's for static analysis
+	export gl_cv_warn_c__fanalyzer=no
+
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/bin
+		# Avoid -Werror
+		--disable-gcc-warnings
+		--enable-backup-scripts
+		--libexecdir="${EPREFIX}"/usr/sbin
+		$(use_with acl posix-acls)
+		$(use_enable nls)
+		$(use_with selinux)
+		$(use_with xattr xattrs)
+
+		# autoconf looks for gtar before tar (in configure scripts), hence
+		# in Prefix it is important that it is there, otherwise, a gtar from
+		# the host system (FreeBSD, Solaris, Darwin) will be found instead
+		# of the Prefix provided (GNU) tar
+		--program-prefix=g
+	)
+
+	# Drop CONFIG_SHELL hack after 1.35: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=7687bf4acc4dc4554538389383d7fb4c3e6521cd
+	CONFIG_SHELL="${BROOT}"/bin/bash FORCE_UNSAFE_CONFIGURE=1 econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# Drop after 1.35: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=18f90676e4695ffcf13413e9fbb24cc0ae2ae9d5
+	local -x XZ_OPT= XZ_DEFAULTS=
+
+	default
+}
+
+src_install() {
+	default
+
+	# A nasty yet required piece of baggage
+	exeinto /etc
+	doexe "${FILESDIR}"/rmt
+
+	mv "${ED}"/usr/sbin/{gbackup,backup-tar} || die
+	mv "${ED}"/usr/sbin/{grestore,restore-tar} || die
+	mv "${ED}"/usr/sbin/{g,}backup.sh || die
+	mv "${ED}"/usr/sbin/{g,}dump-remind || die
+
+	if use minimal ; then
+		find "${ED}"/etc "${ED}"/*bin/ "${ED}"/usr/*bin/ \
+			-type f -a '!' -name gtar \
+			-delete || die
+	fi
+
+	if ! use minimal; then
+		dosym grmt /usr/sbin/rmt
+	fi
+	dosym grmt.8 /usr/share/man/man8/rmt.8
+}
+
+pkg_postinst() {
+	# Ensure to preserve the symlink before app-alternatives/tar
+	# is installed
+	if [[ ! -h ${EROOT}/bin/tar ]]; then
+		if [[ -e ${EROOT}/usr/bin/tar ]] ; then
+			# bug #904887
+			ewarn "${EROOT}/usr/bin/tar exists but is not a symlink."
+			ewarn "This is expected during Prefix bootstrap and unusual otherwise."
+			ewarn "Moving away unexpected ${EROOT}/usr/bin/tar to .bak."
+			mv "${EROOT}/usr/bin/tar" "${EROOT}/usr/bin/tar.bak" || die
+		fi
+		ln -s gtar "${EROOT}/bin/tar" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
index 1bef075437..2b78989a37 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
@@ -6,3 +6,5 @@ DIST xz-5.4.2.tar.gz 2799022 BLAKE2B 3c622b0823f0cbb5fbc5eaa0372fc2f0fefe0950d13
 DIST xz-5.4.2.tar.gz.sig 566 BLAKE2B 95c9c70fdd25b92095dd9691e4d9d4306a3f982becfe7bd42ca6132a76f29be2c2bc66f4fc2bda547058c18e227292f4185799eb905084fc3ab415ae867b4b1b SHA512 30e965c228ed3a8ecb804db8eb11703a765b7ee934030ea69bb3940b630811eb71bf74fd20371ef7759761904ece4f0144a0b00be4d843cf98299fd016f161aa
 DIST xz-5.4.3.tar.gz 2869347 BLAKE2B c4192a59ca751567ebab17e08e72aa1bf0f5ca14af0b59fded1c4dff02c1b76ab30119a4138932f78f69bd4b7827071c81d6ca1c56be65491466ea061786ed78 SHA512 aff0fe166af6df4491a6f5df2372cab100b081452461a0e8c6fd65b72af3f250f16c64d9fb8fd309141e9b9ae4e41649f48687cc29e63dd82f27f2eab19b4023
 DIST xz-5.4.3.tar.gz.sig 566 BLAKE2B 1e3f86a2de532e77cae4c31928d57edeac81ca207e03c71523210605dc6bab76a50793697a242b232f74911c6e1872a0339ed977e2dd0d201504bd859fd3b4f4 SHA512 b7c7eedf4d9604ee50ec97275e5ab57e22a567402815281440ca765210c75707bd2de20e7ebfb0842725690ae19557916fc41a9fbdace5fec8190632b038292e
+DIST xz-5.4.4.tar.gz 2874706 BLAKE2B 0ade3767651a07a6bb4d53b510d7e97239e182788c42bc3388b97c54463ccaa968e27bcb88d34697df70381eea91279615f2622b5493ae2da22632e9576d8989 SHA512 2e27d864c9f346e53afc549d7046385b5d35a749af15d84f69de14612657df2f0e2ce71d3be03d57adadf8fd28549ecf4ef1c214bdcd1f061b5a47239e0104e8
+DIST xz-5.4.4.tar.gz.sig 566 BLAKE2B 9d695293fe479e07b4051f9b22af19191ec7cb5063da519769a24a08cff46819a4f29db002cea92e4af982410dd660d9b3185c8ef0908abbf13b86f89c0baa0f SHA512 6f12f0b30e4e5c78238f5d758443621d4126edf5ec8d02c51f06cc27e40822f0429c2018ec567eae20d118a81295f9d31e2f9101720d289bebab15f72590e9f2
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
index e795a918c7..90bd35bd9f 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.4.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.4.ebuild
new file mode 100644
index 0000000000..11ddc15f91
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.4.ebuild
@@ -0,0 +1,126 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Remember: we cannot leverage autotools in this ebuild in order
+#           to avoid circular deps with autotools
+
+EAPI=8
+
+inherit libtool multilib multilib-minimal preserve-libs usr-ldscript
+
+if [[ ${PV} == 9999 ]] ; then
+	# Per tukaani.org, git.tukaani.org is a mirror of github and
+	# may be behind.
+	EGIT_REPO_URI="
+		https://github.com/tukaani-project/xz
+		https://git.tukaani.org/xz.git
+	"
+	inherit git-r3 autotools
+
+	# bug #272880 and bug #286068
+	BDEPEND="sys-devel/gettext >=sys-devel/libtool-2"
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/jiatan.asc
+	inherit verify-sig
+
+	MY_P="${PN/-utils}-${PV/_}"
+	SRC_URI="
+		https://github.com/tukaani-project/xz/releases/download/v${PV}/${MY_P}.tar.gz
+		mirror://sourceforge/lzmautils/${MY_P}.tar.gz
+		https://tukaani.org/xz/${MY_P}.tar.gz
+		verify-sig? (
+			https://github.com/tukaani-project/xz/releases/download/v${PV}/${MY_P}.tar.gz.sig
+			https://tukaani.org/xz/${MY_P}.tar.gz.sig
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+fi
+
+DESCRIPTION="Utils for managing LZMA compressed files"
+HOMEPAGE="https://tukaani.org/xz/"
+
+# See top-level COPYING file as it outlines the various pieces and their licenses.
+LICENSE="public-domain LGPL-2.1+ GPL-2+"
+SLOT="0"
+IUSE="doc +extra-filters nls static-libs"
+
+if [[ ${PV} != 9999 ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-jiatan )"
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautopoint
+		eautoreconf
+	else
+		# Allow building shared libs on Solaris/x64
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-threads
+		$(multilib_native_use_enable doc)
+		$(use_enable nls)
+		$(use_enable static-libs static)
+	)
+
+	if ! multilib_is_native_abi ; then
+		myconf+=(
+			--disable-{xz,xzdec,lzmadec,lzmainfo,lzma-links,scripts}
+		)
+	fi
+
+	if ! use extra-filters ; then
+		myconf+=(
+			# LZMA1 + LZMA2 for standard .lzma & .xz files
+			--enable-encoders=lzma1,lzma2
+			--enable-decoders=lzma1,lzma2
+
+			# those are used by default, depending on preset
+			--enable-match-finders=hc3,hc4,bt4
+
+			# CRC64 is used by default, though some (old?) files use CRC32
+			--enable-checks=crc32,crc64
+		)
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
+
+		# Undo Solaris-based defaults pointing to /usr/xpg5/bin
+		myconf+=( --disable-path-for-script )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	default
+
+	gen_usr_ldscript -a lzma
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use doc ; then
+		rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
+	fi
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/liblzma$(get_libname 0)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/liblzma$(get_libname 0)
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index f2b9287eae..11ddc15f91 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -4,7 +4,7 @@
 # Remember: we cannot leverage autotools in this ebuild in order
 #           to avoid circular deps with autotools
 
-EAPI=7
+EAPI=8
 
 inherit libtool multilib multilib-minimal preserve-libs usr-ldscript
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/libmd/libmd-1.1.0.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/libmd/libmd-1.1.0.ebuild
index 826b791d45..7d310cd493 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/libmd/libmd-1.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/libmd/libmd-1.1.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://archive.hadrons.org/software/libmd/${P}.tar.xz"
 
 LICENSE="|| ( BSD BSD-2 ISC BEER-WARE public-domain )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 
 multilib_src_configure() {
 	ECONF_SOURCE="${S}" econf
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
index 7379f861a9..3e53b9057a 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest
@@ -1,2 +1,3 @@
 DIST krb5-1.20.1.tar.gz 8661660 BLAKE2B ead16f8b1aec8bba3776628b74257c9aec891770c1fa6d5c5e66275db5f078ca59c9944cd2b017453b777ce080f8e5a322f735fab77691479cfad7b881b92830 SHA512 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2
-DIST krb5-1.21.tar.gz 8622539 BLAKE2B 0f3a899dc1758ea013ebad3aae80605c14f0f6713919d005e799162a0c50a162f33d924c74a6f87ce225e1ab3847df2c0effb25b772fe259e7401531964b696f SHA512 8ee2366888f6d553a44fc642a89c69a57dbc1ec4c89a36b9ba8b00584a9a32c73a2b0566ba5f21852ad9617046666c276dac402393bf8eb19fbe0c07a838071a
+DIST krb5-1.20.2.tar.gz 8662259 BLAKE2B 35f9e82390b5ba7227d0b5c40ab08f128ff27e7264d48585e2bfd08a443cb4b06415216190a3c35c6bc505f33483bcbe11430d9e40c3907f838798b2dc492416 SHA512 69e263ef74116a3332c632a2a243499bcc47b01b1e57d02fe35aa6c2ff655674b6cf2b815457145f788bceac4d466d3f55f8c20ec9ee4a6051128417e1e7e99e
+DIST krb5-1.21.1.tar.gz 8623049 BLAKE2B d90a994b5d39dc88573e5cfca280565b0909b2e9aa8710a6d695e2c1faec37ea0c008d05894e8952dcf72348403f76fd8a124de8d8f34c70fad6de8866a92f0e SHA512 6f04216b0a151d6a9886bf009777bc95a7d3f9bcab30427cc8bbef3357e0130748c1d42b477be0eb2d469d9e0fb65bf5ac5ff05c22d6e1046795e161fe6afbcc
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.2.ebuild
new file mode 100644
index 0000000000..cefab2c0be
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.2.ebuild
@@ -0,0 +1,148 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit autotools python-any-r1 systemd toolchain-funcs multilib-minimal
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb:= )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-alternatives/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? ( dev-util/cmocka )
+	"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+	"${FILESDIR}/${PN}-1.20-missing-time-include.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_enable threads thread-support) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--disable-rpath
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.21.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.21.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.21.ebuild
rename to sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.21.1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
index e243bbfc4b..15fbc4e5e1 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest
@@ -1 +1,2 @@
 DIST rhash-1.4.3-src.tar.gz 429290 BLAKE2B d225aeae0b3a8fb2e093a9aef50cd07a790c7e9734e91114deef2ca8492c85261b8ed5dea45958e35e049ea888885175608962ea72297bdef48b00c52f51eaca SHA512 d87ffcde28d8f25cf775c279fed457e52d24523ed9b695629dae694b3c22372247d18f6032f8ce13a0b70fa2953be408982e46659daaa7c4ab227ae89eaed9c7
+DIST rhash-1.4.4-src.tar.gz 435691 BLAKE2B f3d42f333ad9a82fe4a8ef5af5d8008abf526c05c06a00c7033881d5a27ba663c3cc5cefb73ea8157ac24cb10a50a4e500706d489e61a03dbaee74a4735d1722 SHA512 00a7e5e058b53ce20ae79509815452ed9cb699d1322b678220b72c61dea3ea2f8fa131acfade8bb6d9f6af913f0c3c472330841181b22314b8755166310c946f
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.3.ebuild
index b7b11fc50f..a4f72204ed 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.3.ebuild
@@ -9,7 +9,7 @@ DESCRIPTION="Console utility and library for computing and verifying file hash s
 HOMEPAGE="http://rhash.sourceforge.net/"
 SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.gz"
 
-LICENSE="MIT"
+LICENSE="0BSD"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug nls ssl static-libs"
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4.ebuild
new file mode 100644
index 0000000000..b56bd78dac
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.4.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs multilib-minimal
+
+DESCRIPTION="Console utility and library for computing and verifying file hash sums"
+HOMEPAGE="http://rhash.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.gz"
+
+LICENSE="0BSD"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="debug nls ssl static-libs"
+
+RDEPEND="
+	ssl? (
+		dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+)"
+
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+"
+
+S="${WORKDIR}/RHash-${PV}"
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
+		# we lack posix_memalign
+		sed -i -e '/if _POSIX_VERSION/s/if .*$/if 0/' \
+			librhash/util.h || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	set -- \
+		./configure \
+		--target="${CHOST}" \
+		--cc="$(tc-getCC)" \
+		--ar="$(tc-getAR)" \
+		--extra-cflags="${CFLAGS}" \
+		--extra-ldflags="${LDFLAGS}" \
+		--prefix="${EPREFIX}"/usr \
+		--libdir="${EPREFIX}"/usr/$(get_libdir) \
+		--sysconfdir="${EPREFIX}"/etc \
+		--disable-openssl-runtime \
+		--disable-static \
+		--enable-lib-shared \
+		$(use_enable debug) \
+		$(use_enable nls gettext) \
+		$(use_enable ssl openssl) \
+		$(use_enable static-libs lib-static)
+
+	echo "${@}"
+	"${@}" || die "configure failed"
+}
+
+multilib_src_compile() {
+	emake all \
+		$(multilib_is_native_abi && use nls && echo compile-gmo)
+}
+
+multilib_src_install() {
+	# -j1 needed due to race condition.
+	emake DESTDIR="${D}" -j1 \
+		install{,-lib-headers,-pkg-config} \
+		$(multilib_is_native_abi && use nls && echo install-gmo) \
+		install-lib-so-link
+}
+
+multilib_src_test() {
+	emake test
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
index 8f828a8a87..d3f05280fb 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
@@ -1,4 +1,5 @@
 DIST vim-9.0.1403.tar.gz 16976705 BLAKE2B 9664d52de488086308fcbcda0b0a1167161afbf0efbb40dd9ce9e2393f0ada35e0a44d7f0c3f789d26ae1427604a281f689e87885fbb1557dce12a69898ec46d SHA512 bd83feba38a4aa9b3cf910a0b5a2c153abc4c6eaf9abf0ebee389879ff9ddee51c6f9dba5151aab5df3f73594cf8921d0a0e34121c50e65366cdcdd6482fd00f
 DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e4b82bee371148b19042478d3f974793477c3fc2d9ddff9233fa1ec3c864962880840867544e92464f1a0876f51 SHA512 2f3242ec0f79cf6affc2f7fdaf689c35d8597706ac1689dbbdc01352676199605bb37f22bd901f1e8d59f312237d3fce4bee8b979b28a744ea9e40558621980e
 DIST vim-9.0.1627.tar.gz 17048824 BLAKE2B 3fa583cf676c2388641b1240ed4b90c2e42cd9f50ea44a943cce86bba4bf278adf54837bb5c4530471fd57cfcd08cd39be78b17a5e907435a02dc5874ff7f571 SHA512 d2fb863e03d4ad773fcba8917f3cd1e373f661aa8b8a20bd3e416a73788997d31c6dd106a1bf59d72475bb577bbe6d52eb079fff9c7152d96bb6e5c9aa6e2f3b
+DIST vim-9.0.1677.tar.gz 17069398 BLAKE2B c4eb4e6f8bc7367c24191a8b2a6ea992d11a9bcef27659b60e2844bfa06490fe770937d2548187a45d0fbc8d1f0be2374457a0cdba9792137e02bdd1b9cd5dfb SHA512 8c50d8a6f081673023aa0dd607810fb652d25a46c955d0fa744faf557517a465160cf01b39d5ee6d2c93dd172635500ff7315e54565f7f628ee8f0f8dab8c291
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1677.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1677.ebuild
new file mode 100644
index 0000000000..5fb29ea38f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1677.ebuild
@@ -0,0 +1,231 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim and app-editors/gvim
+
+VIM_VERSION="9.0"
+VIM_PATCHES_VERSION="9.0.1000"
+inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+S="${WORKDIR}/vim-${PV}"
+
+DESCRIPTION="vim and gvim shared files"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="nls acl minimal"
+
+# ncurses is only needed by ./configure, so no subslot operator required
+DEPEND=">=sys-libs/ncurses-5.2-r2:0"
+BDEPEND="sys-devel/autoconf"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898406):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i \
+		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "sed failed"
+
+	# See bug #77841. We remove this file after the tarball extraction.
+	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
+	# everyone since previous flag filtering bugs have turned out to affect
+	# multiple archs...
+	replace-flags -O3 -O2
+
+	# Fix bug #18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+
+	# Remove src/auto/configure file.
+	rm -v src/auto/configure || die "rm configure failed"
+}
+
+src_configure() {
+	# Fix bug #37354: Disallow -funroll-all-loops on amd64
+	# Bug 57859 suggests that we want to do this for all archs
+	filter-flags -funroll-all-loops
+
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug 24447). The hvc
+	# things are for ppc64, see bug 86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	# Let Portage do the stripping. Some people like that.
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	local myconf=(
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
+		--enable-gui=no
+		--without-x
+		--disable-darwin
+		--disable-perlinterp
+		--disable-pythoninterp
+		--disable-rubyinterp
+		--disable-gpm
+		--disable-selinux
+		$(use_enable nls)
+		$(use_enable acl)
+	)
+
+	# Keep Gentoo Prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake -j1 -C src auto/osdef.h objects
+	emake tools
+}
+
+src_test() { :; }
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	dodir /usr/{bin,share/{man/man1,vim}}
+	emake -C src \
+		installruntime \
+		installmanlinks \
+		installmacros \
+		installtutor \
+		installtutorbin \
+		installtools \
+		install-languages \
+		DESTDIR="${D}" \
+		BINDIR="${EPREFIX}"/usr/bin \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		DATADIR="${EPREFIX}"/usr/share
+
+	keepdir ${vimfiles}/keymap
+
+	# default vimrc is installed by vim-core since it applies to
+	# both vim and gvim
+	insinto /etc/vim/
+	newins "${FILESDIR}"/vimrc-r6 vimrc
+	eprefixify "${ED}"/etc/vim/vimrc
+
+	if use minimal; then
+		# To save space, install only a subset of the files.
+		# Helps minimalize the livecd, bug 65144.
+		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
+		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
+		rm -v "${ED}"/usr/bin/vimtutor || die
+
+		for f in "${ED}${vimfiles}"/colors/*.vim; do
+			if [[ ${f} != */@(default).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+
+		for f in "${ED}${vimfiles}"/syntax/*.vim; do
+			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+	fi
+
+	newbashcomp "${FILESDIR}"/xxd-completion xxd
+
+	# install gvim icon since both vim/gvim desktop files reference it
+	doicon -s scalable "${FILESDIR}"/gvim.svg
+}
+
+pkg_postinst() {
+	# update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
index 8f828a8a87..d3f05280fb 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
@@ -1,4 +1,5 @@
 DIST vim-9.0.1403.tar.gz 16976705 BLAKE2B 9664d52de488086308fcbcda0b0a1167161afbf0efbb40dd9ce9e2393f0ada35e0a44d7f0c3f789d26ae1427604a281f689e87885fbb1557dce12a69898ec46d SHA512 bd83feba38a4aa9b3cf910a0b5a2c153abc4c6eaf9abf0ebee389879ff9ddee51c6f9dba5151aab5df3f73594cf8921d0a0e34121c50e65366cdcdd6482fd00f
 DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e4b82bee371148b19042478d3f974793477c3fc2d9ddff9233fa1ec3c864962880840867544e92464f1a0876f51 SHA512 2f3242ec0f79cf6affc2f7fdaf689c35d8597706ac1689dbbdc01352676199605bb37f22bd901f1e8d59f312237d3fce4bee8b979b28a744ea9e40558621980e
 DIST vim-9.0.1627.tar.gz 17048824 BLAKE2B 3fa583cf676c2388641b1240ed4b90c2e42cd9f50ea44a943cce86bba4bf278adf54837bb5c4530471fd57cfcd08cd39be78b17a5e907435a02dc5874ff7f571 SHA512 d2fb863e03d4ad773fcba8917f3cd1e373f661aa8b8a20bd3e416a73788997d31c6dd106a1bf59d72475bb577bbe6d52eb079fff9c7152d96bb6e5c9aa6e2f3b
+DIST vim-9.0.1677.tar.gz 17069398 BLAKE2B c4eb4e6f8bc7367c24191a8b2a6ea992d11a9bcef27659b60e2844bfa06490fe770937d2548187a45d0fbc8d1f0be2374457a0cdba9792137e02bdd1b9cd5dfb SHA512 8c50d8a6f081673023aa0dd607810fb652d25a46c955d0fa744faf557517a465160cf01b39d5ee6d2c93dd172635500ff7315e54565f7f628ee8f0f8dab8c291
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1677.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1677.ebuild
new file mode 100644
index 0000000000..fb932d372b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1677.ebuild
@@ -0,0 +1,370 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim-core and app-editors/gvim
+
+VIM_VERSION="9.0"
+VIM_PATCHES_VERSION="9.0.1000"
+
+LUA_COMPAT=( lua5-{1..4} luajit )
+PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_REQ_USE="threads(+)"
+USE_RUBY="ruby27 ruby30 ruby31"
+
+inherit vim-doc flag-o-matic bash-completion-r1 lua-single python-single-r1 ruby-single toolchain-funcs desktop xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="Vim, an improved vi-style text editor"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="X acl crypt cscope debug gpm lua minimal nls perl python racket ruby selinux sound tcl terminal vim-pager"
+REQUIRED_USE="
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	vim-pager? ( !minimal )
+"
+
+RDEPEND="
+	>=app-eselect/eselect-vi-1.1
+	>=sys-libs/ncurses-5.2-r2:0=
+	nls? ( virtual/libintl )
+	acl? ( kernel_linux? ( sys-apps/acl ) )
+	crypt? ( dev-libs/libsodium:= )
+	cscope? ( dev-util/cscope )
+	gpm? ( >=sys-libs/gpm-1.19.3 )
+	lua? ( ${LUA_DEPS}
+		$(lua_gen_impl_dep 'deprecated' lua5-1)
+	)
+	~app-editors/vim-core-${PV}
+	vim-pager? ( app-editors/vim-core[-minimal] )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	racket? ( dev-scheme/racket )
+	ruby? ( ${RUBY_DEPS} )
+	selinux? ( sys-libs/libselinux )
+	sound? ( media-libs/libcanberra )
+	tcl? ( dev-lang/tcl:0= )
+	X? ( x11-libs/libXt )
+"
+DEPEND="${RDEPEND}"
+# configure runs the Lua interpreter
+BDEPEND="
+	sys-devel/autoconf
+	lua? ( ${LUA_DEPS} )
+	nls? ( sys-devel/gettext )
+"
+PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898452):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+
+	use lua && lua-single_pkg_setup
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i -e \
+		'1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "mve.awk sed failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i -e \
+		's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# conditionally make the manpager.sh script
+	if use vim-pager; then
+		cat > "${S}"/runtime/macros/manpager.sh <<-_EOF_ || die "cat EOF failed"
+			#!/bin/sh
+			sed -e 's/\x1B\[[[:digit:]]\+m//g' | col -b | \\
+					vim \\
+						-c 'let no_plugin_maps = 1' \\
+						-c 'set nolist nomod ft=man ts=8' \\
+						-c 'let g:showmarks_enable=0' \\
+						-c 'runtime! macros/less.vim' -
+			_EOF_
+	fi
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug 18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+	rm src/auto/configure || die "rm failed"
+}
+
+src_configure() {
+
+	# Fix bug #37354: Disallow -funroll-all-loops on amd64
+	# Bug #57859 suggests that we want to do this for all archs
+	filter-flags -funroll-all-loops
+
+	# Fix bug 76331: -O3 causes problems, use -O2 instead. We'll do this for
+	# everyone since previous flag filtering bugs have turned out to affect
+	# multiple archs...
+	replace-flags -O3 -O2
+
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug #24447). The hvc
+	# things are for ppc64, see bug #86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	local myconf=()
+	if use minimal; then
+		myconf=(
+			--with-features=tiny
+			--disable-nls
+			--disable-canberra
+			--disable-acl
+			--enable-gui=no
+			--without-x
+			--disable-darwin
+			--disable-luainterp
+			--disable-perlinterp
+			--disable-pythoninterp
+			--disable-mzschemeinterp
+			--disable-rubyinterp
+			--disable-selinux
+			--disable-tclinterp
+			--disable-gpm
+		)
+	else
+		use debug && append-flags "-DDEBUG"
+
+		myconf=(
+			--with-features=huge
+			$(use_enable sound canberra)
+			$(use_enable acl)
+			$(use_enable crypt libsodium)
+			$(use_enable cscope)
+			$(use_enable gpm)
+			$(use_enable nls)
+			$(use_enable perl perlinterp)
+			$(use_enable python python3interp)
+			$(use_with python python3-command "${PYTHON}")
+			$(use_enable racket mzschemeinterp)
+			$(use_enable ruby rubyinterp)
+			$(use_enable selinux)
+			$(use_enable tcl tclinterp)
+			$(use_enable terminal)
+		)
+
+		# --with-features=huge forces on cscope even if we --disable it. We need
+		# to sed this out to avoid screwiness. (1 Sep 2004 ciaranm)
+		if ! use cscope; then
+			sed -i -e \
+				'/# define FEAT_CSCOPE/d' src/feature.h || die "sed failed"
+		fi
+
+		if use lua; then
+			# -DLUA_COMPAT_OPENLIB=1 is required to enable the
+			# deprecated (in 5.1) luaL_openlib API (#874690)
+			use lua_single_target_lua5-1 && append-cppflags -DLUA_COMPAT_OPENLIB=1
+
+			myconf+=(
+				--enable-luainterp
+				$(use_with lua_single_target_luajit luajit)
+				--with-lua-prefix="${EPREFIX}/usr"
+			)
+		fi
+
+		# don't test USE=X here ... see bug #19115
+		# but need to provide a way to link against X ... see bug #20093
+		myconf+=(
+			--enable-gui=no
+			--disable-darwin
+			$(use_with X x)
+		)
+	fi
+
+	# let package manager strip binaries
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	# keep prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf \
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)" \
+		"${myconf[@]}"
+}
+
+src_compile() {
+	# The following allows emake to be used
+	emake -j1 -C src auto/osdef.h objects
+
+	emake
+}
+
+src_test() {
+	einfo
+	einfo "Starting vim tests. Several error messages will be shown"
+	einfo "while the tests run. This is normal behaviour and does not"
+	einfo "indicate a fault."
+	einfo
+	ewarn "If the tests fail, your terminal may be left in a strange"
+	ewarn "state. Usually, running 'reset' will fix this."
+	einfo
+
+	# Don't let vim talk to X
+	unset DISPLAY
+
+	# Arch and opensuse seem to do this and at this point, I'm willing
+	# to try anything to avoid random test hangs!
+	export TERM=xterm
+
+	# See https://github.com/vim/vim/blob/f08b0eb8691ff09f98bc4beef986ece1c521655f/src/testdir/runtest.vim#L5
+	# for more information on test variables we can use.
+	# Note that certain variables need vim-compatible regex (not PCRE), see e.g.
+	# http://www.softpanorama.org/Editors/Vimorama/vim_regular_expressions.shtml.
+	#
+	# Skipped tests:
+	# - Test_expand_star_star
+	# Hangs because of a recursive symlink in /usr/include/nodejs (bug #616680)
+	# - Test_exrc
+	# Looks in wrong location? (bug #742710)
+	# - Test_job_tty_in_out
+	# Fragile and depends on TERM(?)
+	# - Test_spelldump_bang
+	# Hangs.
+	# - Test_fuzzy_completion_env
+	# Too sensitive to leaked environment variables.
+	# - Test_term_mouse_multiple_clicks_to_select_mode
+	# Hangs.
+	# - Test_spelldump
+	# Hangs.
+	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
+
+	emake -j1 -C src/testdir nongui
+}
+
+# Call eselect vi update with --if-unset
+# to respect user's choice (bug #187449)
+eselect_vi_update() {
+	ebegin "Calling eselect vi update"
+	eselect vi update --if-unset
+	eend $?
+}
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	# Note: Do not install symlinks for 'vi', 'ex', or 'view', as these are
+	#       managed by eselect-vi
+	dobin src/vim
+	if ! use minimal ; then
+		dosym vim /usr/bin/vimdiff
+	fi
+	dosym vim /usr/bin/rvim
+	dosym vim /usr/bin/rview
+	if use vim-pager ; then
+		dosym ${vimfiles}/macros/less.sh /usr/bin/vimpager
+		dosym ${vimfiles}/macros/manpager.sh /usr/bin/vimmanpager
+		insinto ${vimfiles}/macros
+		doins runtime/macros/manpager.sh
+		fperms a+x ${vimfiles}/macros/manpager.sh
+	fi
+
+	domenu runtime/vim.desktop
+
+	newbashcomp "${FILESDIR}"/${PN}-completion ${PN}
+
+	# keep in sync with 'complete ... -F' list
+	bashcomp_alias vim ex vi view rvim rview vimdiff
+}
+
+pkg_postinst() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
index b4bf0c1f18..9dd0cb50cd 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
@@ -2,3 +2,4 @@ DIST qemu-6.0.0.tar.xz 107333232 BLAKE2B 7746329d3e13782b7c346ce4052cc517cfc65cd
 DIST qemu-7.1.0.tar.xz 121833004 BLAKE2B e05f91ce4993c7591a2df08b5fb017f8b8ec2141ab7bfd55d14730ea6b793ac1091de539992058392a5522d4e58beee92a87752707be58e3619b8213ef9f35bf SHA512 c60c5ff8ec99b7552e485768908920658fdd8035ff7a6fa370fb6881957dc8b7e5f18ff1a8f49bd6aa22909ede2a7c084986d8244f12074ccd33ebe40a0c411f
 DIST qemu-8.0.0.tar.xz 127835148 BLAKE2B 9b54aae10fe09691a26e68374723ded5fdda6409673b4de9461a25ee060cfd03968a16ddeadc21d48b9262e53aa6d4e5eb645376969f97c65807fad19607b04f SHA512 1f31d1e653dec2d35f1b7a5468ee3f471553b48eca8c8afafffcf9243c6b2260e78a5b73da3fe567f9b85d4133573eebd397747b3aec501fb24076263eb07b27
 DIST qemu-8.0.2.tar.xz 126707132 BLAKE2B f2b1a63e10c42aabfe39722c7732d0f04818ad367b769b3deb29c5bf9adcabc3aca1706f3c40fafeeb57ac1f7a61ded5066de32134c483e2fd27bc65b4b7d30a SHA512 4e915d33a662bf55b09247fb85150be376c92270d3764e3d6470c452cb70cc558f54e84de5610dd60a9eb3ea02d5d4277b1ec75c9804967d278fa8361c7f9b9a
+DIST qemu-8.0.3.tar.xz 126710536 BLAKE2B 071cc1a35209a02e8c5dd4f43cb112f110b4655adb0f870a04fdf9a6e2c761699574e8c9426f70f60787a99acf252d7a64d94a8e837cdfeda93d89428d7866f3 SHA512 18b2ccb65f7ec2ae92f0e04406539620c881e2b75f63816588c86043a07464bb99d16a83e792ed9508de393f4b694c46d52f4d07edf52741e85224c8b8d5d5c3
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.3.ebuild
new file mode 100644
index 0000000000..c0c5794a73
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.3.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{9..11} )
+
+inherit edo systemd toolchain-funcs python-any-r1 udev
+
+MY_PN="qemu"
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="QEMU Guest Agent (qemu-ga) for use when running inside a VM"
+HOMEPAGE="https://wiki.qemu.org/Features/GuestAgent"
+SRC_URI="http://wiki.qemu.org/download/${MY_P}.tar.xz"
+
+LICENSE="GPL-2 BSD-2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~ppc64 ~x86"
+
+RDEPEND="dev-libs/glib"
+DEPEND="${RDEPEND}"
+BDEPEND="${PYTHON_DEPS}
+	dev-lang/perl
+	dev-util/ninja"
+
+S="${WORKDIR}/${MY_P}"
+
+PATCHES=(
+)
+
+src_configure() {
+	tc-export AR LD OBJCOPY RANLIB
+
+	local myconf=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--libdir="/usr/$(get_libdir)"
+		--localstatedir=/
+		--disable-bsd-user
+		--disable-linux-user
+		--disable-system
+		--disable-strip
+		--enable-tools
+		--disable-werror
+		--without-default-features
+		--enable-guest-agent
+		--python="${PYTHON}"
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+	)
+
+	edo ./configure "${myconf[@]}"
+}
+
+src_install() {
+	dobin build/qga/qemu-ga
+
+	# Normal init stuff
+	newinitd "${FILESDIR}/qemu-ga.init-r1" qemu-guest-agent
+	newconfd "${FILESDIR}/qemu-ga.conf-r1" qemu-guest-agent
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/qemu-ga.logrotate" qemu-guest-agent
+
+	# systemd stuff
+	udev_newrules "${FILESDIR}/qemu-ga-systemd.udev" 99-qemu-guest-agent.rules
+
+	systemd_newunit "${FILESDIR}/qemu-ga-systemd.service" \
+		qemu-guest-agent.service
+}
+
+pkg_postinst() {
+	elog "You should add 'qemu-guest-agent' to the default runlevel."
+	elog "e.g. rc-update add qemu-guest-agent default"
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.3.ebuild
index 438e63f95e..96f174d6b4 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.3.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
index 4ec99a05b3..8fe52687a1 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
@@ -1,2 +1,3 @@
 DIST portage-utils-0.95.tar.xz 1806140 BLAKE2B 5a468a7b4006073203ba634a5d70398e254ef5db7e9b71fbcf20bce68942f74acce1d42b5d315931f93e8698c8dd2f38f328fcc6fdaa86addba7dbcc21fce5fa SHA512 2d1f4b986a377249043259d8ada1a35a7dd55179f0ef5c2c18a4180c8f1f7064133ab2677426098e61b1355fa26cb0f8aa3c6ea06d46af4c4ba2df4eb53489a4
+DIST portage-utils-0.96.1.tar.xz 1807156 BLAKE2B 6bf334c0083e5e8b0d6206ff43d4df0e32a9576ddedbe055cb6ef903b5f11d0878512ace7f93ea37207181321ca160a8f721b3095b2bcbfcdbb353ba3f5d4873 SHA512 769e734e0738aa52408fd6c151706085148818a19b2ad1051684e2d54fe9f486f2e3a25e8fb408c83325cfb428644c6c0aa3b6d1bac0d2189680c70d9657bcbf
 DIST portage-utils-0.96.tar.xz 1806032 BLAKE2B 93ef9658a4b0bae7fb0527462bd9d0d19f396262818380d8ec2022c9fda596265c50adc262bdf296a4dd8c6b891b064316281d21444c8b903db20ca2463879e3 SHA512 cc32f53532c082544cabe505d8b90b947b6ab48742678aa98cbe9ba291625e8449ed0ecd90e01dc00b06c209b34001ad57a060918658e53d3babdc5c76ea7b02
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.95.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.1.ebuild
similarity index 79%
rename from sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.95.ebuild
rename to sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.1.ebuild
index b70c8d6732..31ad40ade1 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.95.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.1.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/portage-utils.git"
 else
 	SRC_URI="https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
@@ -21,6 +21,10 @@ SLOT="0"
 IUSE="openmp +qmanifest +qtegrity static"
 
 RDEPEND="
+	openmp? ( || (
+		sys-devel/gcc:*[openmp]
+		sys-libs/libomp
+	) )
 	qmanifest? (
 		!static? (
 			app-crypt/gpgme:=
@@ -50,9 +54,8 @@ DEPEND="${RDEPEND}
 	)"
 BDEPEND="virtual/pkgconfig"
 
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
-}
+# bug #898362, gnulib check explicitly looks for MIN in some headers
+QA_CONFIG_IMPL_DECL_SKIP="MIN"
 
 pkg_setup() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.ebuild
deleted file mode 100644
index b70c8d6732..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.96.ebuild
+++ /dev/null
@@ -1,75 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic toolchain-funcs
-
-DESCRIPTION="Small and fast Portage helper tools written in C"
-HOMEPAGE="https://wiki.gentoo.org/wiki/Portage-utils"
-
-if [[ ${PV} == *9999 ]]; then
-	inherit git-r3 autotools
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/portage-utils.git"
-else
-	SRC_URI="https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="openmp +qmanifest +qtegrity static"
-
-RDEPEND="
-	qmanifest? (
-		!static? (
-			app-crypt/gpgme:=
-			app-crypt/libb2:=
-			dev-libs/openssl:=
-			sys-libs/zlib:=
-		)
-	)
-	qtegrity? (
-		!static? (
-			dev-libs/openssl:=
-		)
-	)"
-DEPEND="${RDEPEND}
-	qmanifest? (
-		static? (
-			app-crypt/gpgme[static-libs]
-			app-crypt/libb2[static-libs]
-			dev-libs/openssl[static-libs]
-			sys-libs/zlib[static-libs]
-		)
-	)
-	qtegrity? (
-		static? (
-			dev-libs/openssl[static-libs]
-		)
-	)"
-BDEPEND="virtual/pkgconfig"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
-}
-
-src_prepare() {
-	default
-	[[ ${PV} == *9999 ]] && eautoreconf
-}
-
-src_configure() {
-	use static && append-ldflags -static
-
-	econf \
-		--disable-maintainer-mode \
-		--with-eprefix="${EPREFIX}" \
-		$(use_enable qmanifest) \
-		$(use_enable qtegrity) \
-		$(use_enable openmp)
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
index a40fd823f8..31ad40ade1 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
@@ -54,6 +54,9 @@ DEPEND="${RDEPEND}
 	)"
 BDEPEND="virtual/pkgconfig"
 
+# bug #898362, gnulib check explicitly looks for MIN in some headers
+QA_CONFIG_IMPL_DECL_SKIP="MIN"
+
 pkg_setup() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
index fd4e525fef..f07698d3eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
@@ -10,3 +10,4 @@ DIST perl-5.38.0.tar.xz 13565448 BLAKE2B 22fd334d911e8ebe16ad2a96522110ad2c14d09
 DIST perl-cross-1.3.7.tar.gz 118291 BLAKE2B dc9c060857d6905c817e91c3f5b1f546b76e02c6de02dc260185e0de8628a5ead3a557501da75549e2585cd30879190558740e697b1c78a69fa08ccb5649efcd SHA512 1111274f34f8b46e9f418883e9b1652ba4a5a9b4a5880a9a5b38bc8aeb5d75a9f4943233870f5ebf5fbcdc0c30b2983ace11ad051b55d3283327d8f2c15e172c
 DIST perl-cross-1.4.1.tar.gz 117688 BLAKE2B e01103fb92764213dafb1ab92954fdc4bdcf1bd71a0064279ee75fed55a1c71850eaabdf667d6ab1c15eadccf7497668e5bb5ab13de33fef707fba14bfd52912 SHA512 5f403d3a52f724383d25c23b08e8001954300fa8f07a5b49df440ef4d06ef756404a6e448093c4f4d4f9a470b1c3f2b1b8b27d3d227ac1823552f6a377edd06a
 DIST perl-cross-1.4.tar.gz 113861 BLAKE2B 7c7783afccc6a04ab122a7c60b1cff7f0a2725655b2b63325ca25d7b8acb0cf993b496e2a590db943054336337ad215550b6b2a565f1d91a5aa9cfe3a4c36db4 SHA512 bde73cac13c0b42c4c6783d7e30dea491d70b65131e1c8434ef75db1f39a8e15ef5857568b706e8456faa3822402676dd247a1f20f4bed983597fdd5a6b4faad
+DIST perl-cross-1.5.tar.gz 115073 BLAKE2B ecc2764beef5dd188e56c2e499297e09e03a48fe4cb3b1582005e5899d7a3e9f28b9e600a18e16560a9a1955fef6d0a543a601574991a3853c8c9cdee7acc5df SHA512 b358d79e10777118b97568329e11b6b72cfe4960f2f3c0e857de31b515bd588448ad224d182b083f4075b47fd3877decbb037e7d26d4ba090011e6e41946370f
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r3.ebuild
index 1f35736fe6..f63397626b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r3.ebuild
@@ -53,7 +53,7 @@ LICENSE="|| ( Artistic GPL-1+ )"
 SLOT="0/${SUBSLOT}"
 
 if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 IUSE="berkdb debug doc gdbm ithreads minimal quadmath"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.38.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.38.0-r1.ebuild
index bcfda06282..21774a38d7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.38.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.38.0-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=7
 inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
 
 PATCH_VER=1
-CROSS_VER=1.4.1
+CROSS_VER=1.5
 PATCH_BASE="perl-5.38.0-patches-${PATCH_VER}"
 PATCH_DEV=dilfridge
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 015d56dd2d..a966f0bfdf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -8,6 +8,8 @@ DIST Python-3.12.0b3.tar.xz 20220780 BLAKE2B 78deb1efe3642bd11265fdb810d8e40d6d8
 DIST Python-3.12.0b3.tar.xz.asc 963 BLAKE2B fad39386d4f8a6a1103e0cef431ba171fd5e6af75b097684717f68046683bf967981d1aee0e17f7dc7f97578e686565f817e39de11b309c4e8d64949fff396aa SHA512 ab0d91f3c2fc001fe924f71182526d543a3c9e65238954bb954c58d03171a6cb3640a15570d2d7b889c6251fd876790121cd36bcc29a901f53d17f5f4f8f6f4e
 DIST Python-3.12.0b4.tar.xz 20244176 BLAKE2B 6f1d199fcce07b5ca4fbf5a24b382aac2af793c6f43346708d984b20422a2f9ac4e6bc352e3c008e7815083e06c4b69e36c1a3ea94a8e3c398a1d2188595a0f5 SHA512 942a47d12c51e13939c815de908e766b818e4862c536153ae94b8032b5263b0cc23bda9a75fe60f48ee400a4ce405e2583da684847623cf552c20efcbc663469
 DIST Python-3.12.0b4.tar.xz.asc 963 BLAKE2B 3ed0c47bd892791325598f20578bca72d8ffce9421c80d35c12b2a0d23611dfc329a2016f332950910990fcd9bd55e90753f547ca8a54dde039618b43c71a6b4 SHA512 ab2684cc4044bf39c8064ec7d41dc2d04f01c9bccf5404ec1fffbce89a3a831b4d7dac3613ef892988a16839aeb13cbc03a085fae5c086ee19d3bfb925dff6c0
+DIST Python-3.12.0rc1.tar.xz 20285264 BLAKE2B 2cbf77e9405426c58714506c14281a941b4006219215d990f79672719eaa4f26c7b6356a1096400aae84d682c5a9622dfd8ea90dc635312efba6cd8c730d3f37 SHA512 67c38317e34aa1c4ced831cf50f74de21f9e40ce708397be3682d0c1012c3e0b2617d77525dc6c3246725dfc11b5448792adc0ef2e3741e818776bc5fba0c50d
+DIST Python-3.12.0rc1.tar.xz.asc 963 BLAKE2B 852298edf878c891e53e317d21a31a5fbd6876aa958aae715a77c0bd27a508844964ad69280d15d59428375a14a8f97c24ce9ef64ab101020bd541d5125e8676 SHA512 319ce9c5d935dcbb5ea12468c5127b4541c1b8af443aef210bdd26030fc3eee062639601fd72e70428cc18179fafb33ad2527a0c262650c4da678544fd06d0b9
 DIST Python-3.8.17.tar.xz 20696584 BLAKE2B 07be197f7d753775b039ca200864e6d40cbb0115538604d0b214a5404beecd38e3ef416c1941f7871e2e92913d09faba48745bb9df141cf8e5ca77c7de6f0a24 SHA512 bc7e02acfebba86e4394f02195993500fac9347a52c7b49727eb0cdda38786ae917234272872d75effaddb042810d9682ef5627b0cc199f8aa0d5d3e315ddc0e
 DIST Python-3.8.17.tar.xz.asc 833 BLAKE2B c1eb893e8005c59c918528d676f06679182cf45ae256f9929d2daf56577dd2dcb3aff264e9ca47b605ecba2a1c00fabf282c59a231e67cec2324c33c6b3ca7f6 SHA512 bb017e2b17a3ca8ed568d2589285a87365bcca6a677e06fab5184d03e251ace6276117a160f59201e6a1c597e32d79ee109ffc7083266e6e2105b7afaaac3876
 DIST Python-3.9.17.tar.xz 19647312 BLAKE2B eae9d1c0b9a6cd9ce84af75e58899bcd127163c90434d2bc879047706adb087721aa5ac9425e6906e6238296b2695ea0304a2b93288627cee3560ee85f450062 SHA512 994d92346e563a4635411808744eac8207c68e6fc9c1db1c2eb4103dad8553aaad4a8116e38c61f28cb17905a12cc46dccdde985e1c45882bf1815081b88b6be
@@ -17,5 +19,8 @@ DIST python-gentoo-patches-3.10.12.tar.xz 13980 BLAKE2B 8ca0e652b73634d9fa52fbdd
 DIST python-gentoo-patches-3.11.4.tar.xz 7108 BLAKE2B 185bc558a24bead21719d543319a47b36fcd6bdd22a5dcb11ad794a381b2bc51c28f5ea03ca1ad3359e3f96c081c10b08285e4354daf85a0535bfd2123d40d16 SHA512 19ca9fa9071cab3938008af515a65def75ed5cff7152dcab5895b29fc1ba87044a1027540a1cc63231c4e77a8b67fe931bf39adf3d642a648e7da970a0cecd3c
 DIST python-gentoo-patches-3.12.0b3.tar.xz 4656 BLAKE2B b7ae4023c1aea6f3fe9f98bc1a974cfd79769dae104fb1dd88cf778f89b6a7d30f68093abc5211e746548e46ed06044beb7458b2ed3b0d67b5a48f00bc960683 SHA512 8d7fbb6ecf65770c6900dccff34c668a79efa3a86d55be50edaa3f583b50be9b4a7e628a41fa9efc92ad61ed9be8e04f1b324e68240fcfdaaad67b7a077ef928
 DIST python-gentoo-patches-3.12.0b4.tar.xz 4660 BLAKE2B 50c8b2d80b33f26a274a80884a071568ec0c79fa9312da544d5a748a5bd38d245de4f6919d8fc482e9f81c0c6686ef7d02f0b311e861d20be32846ccc875be72 SHA512 7cddf24248ee24c06b9bd765b2445b8bcf08e2f244cd9a9e1515d7207059e27efe818e0da088dc6f3b7fa882858836443484e13cdaabbbe0afe7a7db8c2dffce
+DIST python-gentoo-patches-3.12.0b4_p1.tar.xz 7772 BLAKE2B 54bc9fa2a39d36e83b4fca11c5f1b19df96777a1abc18a1dbd894d83e1504971e52e861225af44201d0d2c1740559c6fde0a52fe4d97111a5c1acf61efc4b47d SHA512 8bc7d81255f6b8f6b7d6be84af0a778bbb51126154c0ff2f0f5bb1a5ebdaf1055a4e012bbf239a1bbd0c5ca7d98fe8257731d1cf916ba55c10fddd5e75f6f33b
+DIST python-gentoo-patches-3.12.0b4_p2.tar.xz 8132 BLAKE2B 4c1df7c8e1dda483724d8c3bb8ab7a7739fcdee16eaf1a2a5aeedb6011c13769ee9f2d0b1cf849df12aaf3230c0771b16533496539e1a0fab633e38699c8a75f SHA512 9051311d1e31163d13b8d2b1981d700ad2cf297b30f8d2867df8fe535fdb7da11efcb6fef8a201a76ff05aa8ae91c3679eeee72a729dc7249714796f6af2be9f
+DIST python-gentoo-patches-3.12.0rc1.tar.xz 5040 BLAKE2B c03e9cc0f5ef0a68ab5d74764a30b8ab336b2b0feb105124fcb6f1ba660db7c27deab412f91b0980b072dcbe6bca06b8f2f9fd11aa11e95196d936fc8ba75bbc SHA512 bc8d67ccff73e3841c9fb591f5b1b4db7156cea0bde4edc2de605d6e921b5998c6f67bf7f1be505bcd50bc55b8f844be2b011720b5a93b04e7bf60df38bd5373
 DIST python-gentoo-patches-3.8.17.tar.xz 32424 BLAKE2B d992f6b1c971583000086175d07198d367e4504dea8829b35742a3daf2279ba1fbade8c37f00018bda97fa9080d1d40087c236486bbcd369c2d1c850de47a976 SHA512 d309da6805a72742cf8d1bb170a777edd7b7aa936d6e9967e96bed4427285180cd9935f202f899f3aa54632a31a5a94c5b7c20a343b1a714d8aa5fc6f8e9f371
 DIST python-gentoo-patches-3.9.17.tar.xz 25048 BLAKE2B da19105dfa2fda7b422ac368f85c97d7541be74a6f9b9170a19ceac901e026ab39baef83c610172ecba1f70cce6e2832e956c2e4c87387b0e21c79c2c633b116 SHA512 ce9d3c62c675bceccaac21fd467c54322a55a1c8af9be3a6dcfd7a892c03b39b38dc35ba570e3dd9fc984a5f3eeabb3cc564ba2d7f935dbf6df829264cb32b2f
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p1.ebuild
new file mode 100644
index 0000000000..8c769c87e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p1.ebuild
@@ -0,0 +1,526 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_beta/b}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils[extra-filters(+)]
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-util/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
+		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
+		local -x CFLAGS= LDFLAGS=
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross to satisfy --with-build-python.
+			--without-lto
+			--without-readline
+			--disable-optimizations
+		)
+
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__GDBM_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__SQLITE3_STATE=disabled
+			MODULE__HASHLIB_STATE=disabled
+			MODULE__SSL_STATE=disabled
+			MODULE__CURSES_STATE=disabled
+			MODULE__CURSES_PANEL_STATE=disabled
+			MODULE_READLINE_STATE=disabled
+			MODULE__TKINTER_STATE=disabled
+			MODULE_PYEXPAT_STATE=disabled
+			MODULE_ZLIB_STATE=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the --with-build-python value
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p2.ebuild
new file mode 100644
index 0000000000..8c769c87e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_beta4_p2.ebuild
@@ -0,0 +1,526 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_beta/b}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils[extra-filters(+)]
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-util/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
+		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
+		local -x CFLAGS= LDFLAGS=
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross to satisfy --with-build-python.
+			--without-lto
+			--without-readline
+			--disable-optimizations
+		)
+
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__GDBM_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__SQLITE3_STATE=disabled
+			MODULE__HASHLIB_STATE=disabled
+			MODULE__SSL_STATE=disabled
+			MODULE__CURSES_STATE=disabled
+			MODULE__CURSES_PANEL_STATE=disabled
+			MODULE_READLINE_STATE=disabled
+			MODULE__TKINTER_STATE=disabled
+			MODULE_PYEXPAT_STATE=disabled
+			MODULE_ZLIB_STATE=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the --with-build-python value
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc1.ebuild
new file mode 100644
index 0000000000..d3a1935055
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc1.ebuild
@@ -0,0 +1,526 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils[extra-filters(+)]
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-util/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
+		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
+		local -x CFLAGS= LDFLAGS=
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross to satisfy --with-build-python.
+			--without-lto
+			--without-readline
+			--disable-optimizations
+		)
+
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__GDBM_STATE=disabled
+			MODULE__DBM_STATE=disabled
+			MODULE__SQLITE3_STATE=disabled
+			MODULE__HASHLIB_STATE=disabled
+			MODULE__SSL_STATE=disabled
+			MODULE__CURSES_STATE=disabled
+			MODULE__CURSES_PANEL_STATE=disabled
+			MODULE_READLINE_STATE=disabled
+			MODULE__TKINTER_STATE=disabled
+			MODULE_PYEXPAT_STATE=disabled
+			MODULE_ZLIB_STATE=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the --with-build-python value
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
index 8f9a919b86..0618c072e8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
@@ -73,10 +73,6 @@ src_configure() {
 	# bug #407135
 	use test && append-flags -g
 
-	# Symbol aliases are implemented as asm statements.
-	# Will require porting: https://gcc.gnu.org/PR48200
-	filter-lto
-
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
index a415899f69..0ab6d10eae 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.
 
 LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="bzip2 lzma nls static-libs test +utils zstd"
 RESTRICT="!test? ( test )"
 
@@ -78,10 +78,6 @@ src_configure() {
 	# bug #407135
 	use test && append-flags -g
 
-	# Symbol aliases are implemented as asm statements.
-	# Will require porting: https://gcc.gnu.org/PR48200
-	filter-lto
-
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild
new file mode 100644
index 0000000000..51765e3789
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild
@@ -0,0 +1,124 @@
+# Copyright 2003-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/elfutils.gpg
+inherit autotools flag-o-matic multilib-minimal verify-sig
+
+DESCRIPTION="Libraries/utilities to handle ELF objects (drop in replacement for libelf)"
+HOMEPAGE="https://sourceware.org/elfutils/"
+SRC_URI="https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.sig )"
+
+LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="bzip2 debuginfod lzma nls static-libs test +utils zstd"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!dev-libs/libelf
+	>=sys-libs/zlib-1.2.8-r1[static-libs?,${MULTILIB_USEDEP}]
+	bzip2? ( >=app-arch/bzip2-1.0.6-r4[static-libs?,${MULTILIB_USEDEP}] )
+	debuginfod? (
+		app-arch/libarchive:=
+		dev-db/sqlite:3=
+		net-libs/libmicrohttpd:=
+
+		net-misc/curl[static-libs?,${MULTILIB_USEDEP}]
+	)
+	lzma? ( >=app-arch/xz-utils-5.0.5-r1[static-libs?,${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[static-libs?,${MULTILIB_USEDEP}] )
+	elibc_musl? (
+		dev-libs/libbsd
+		sys-libs/argp-standalone
+		sys-libs/fts-standalone
+		sys-libs/obstack-standalone
+	)
+"
+DEPEND="
+	${RDEPEND}
+"
+BDEPEND="
+	>=sys-devel/flex-2.5.4a
+	sys-devel/m4
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-elfutils )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.189-PaX-support.patch
+	"${FILESDIR}"/${PN}-0.189-skip-DT_RELR-failing-tests.patch
+	"${FILESDIR}"/${PN}-0.189-tests-run-lfs-symbols.sh-needs-gawk.patch
+	"${FILESDIR}"/${PN}-0.189-musl-aarch64-regs.patch
+	"${FILESDIR}"/${PN}-0.189-musl-macros.patch
+	"${FILESDIR}"/${P}-configure-bashisms.patch
+	"${FILESDIR}"/${P}-clang16-tests.patch
+)
+
+src_prepare() {
+	default
+
+	# Only here for ${P}-configure-bashisms.patch, delete on next bump!
+	eautoreconf
+
+	if ! use static-libs; then
+		sed -i -e '/^lib_LIBRARIES/s:=.*:=:' -e '/^%.os/s:%.o$::' lib{asm,dw,elf}/Makefile.in || die
+	fi
+
+	# https://sourceware.org/PR23914
+	sed -i 's:-Werror::' */Makefile.in || die
+}
+
+src_configure() {
+	# bug #407135
+	use test && append-flags -g
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(use_enable nls)
+		$(multilib_native_use_enable debuginfod)
+		$(use_enable debuginfod libdebuginfod)
+
+		# explicitly disable thread safety, it's not recommended by upstream
+		# doesn't build either on musl.
+		--disable-thread-safety
+
+		# Valgrind option is just for running tests under it; dodgy under sandbox
+		# and indeed even w/ glibc with newer instructions.
+		--disable-valgrind
+		--program-prefix="eu-"
+		--with-zlib
+		$(use_with bzip2 bzlib)
+		$(use_with lzma)
+		$(use_with zstd)
+	)
+
+	# Needed because sets alignment macro
+	is-flagq -fsanitize=address && myeconfargs+=( --enable-sanitize-address )
+	is-flagq -fsanitize=undefined && myeconfargs+=( --enable-sanitize-undefined )
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	env LD_LIBRARY_PATH="${BUILD_DIR}/libelf:${BUILD_DIR}/libebl:${BUILD_DIR}/libdw:${BUILD_DIR}/libasm" \
+		LC_ALL="C" \
+		emake check VERBOSE=1
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	dodoc NOTES
+
+	# These build quick, and are needed for most tests, so don't
+	# disable their building when the USE flag is disabled.
+	if ! use utils; then
+		rm -rf "${ED}"/usr/bin || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-PaX-support.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-PaX-support.patch
new file mode 100644
index 0000000000..2d44c75771
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-PaX-support.patch
@@ -0,0 +1,26 @@
+Add support for PaX ELF markings
+
+Patch by Kevin F. Quinn <kevquinn@gentoo.org>
+
+http://bugs.gentoo.org/115100
+
+--- a/libelf/elf.h
++++ b/libelf/elf.h
+@@ -722,6 +722,7 @@ typedef struct
+ #define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
+ #define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
+ #define PT_GNU_PROPERTY	0x6474e553	/* GNU property */
++#define PT_PAX_FLAGS	0x65041580	/* Indicates PaX flag markings */
+ #define PT_LOSUNW	0x6ffffffa
+ #define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
+ #define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
+--- a/src/elflint.c
++++ b/src/elflint.c
+@@ -4493,6 +4493,7 @@ only executables, shared objects, and core files can have program headers\n"));
+ 
+       if (phdr->p_type >= PT_NUM && phdr->p_type != PT_GNU_EH_FRAME
+ 	  && phdr->p_type != PT_GNU_STACK && phdr->p_type != PT_GNU_RELRO
++	  && phdr->p_type != PT_PAX_FLAGS
+ 	  && phdr->p_type != PT_GNU_PROPERTY
+ 	  /* Check for a known machine-specific type.  */
+ 	  && ebl_segment_type_name (ebl, phdr->p_type, NULL, 0) == NULL)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-aarch64-regs.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-aarch64-regs.patch
new file mode 100644
index 0000000000..222c0527b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-aarch64-regs.patch
@@ -0,0 +1,57 @@
+https://www.sourceware.org/bugzilla/show_bug.cgi?id=25832
+https://cgit.openembedded.org/openembedded-core/plain/meta/recipes-devtools/elfutils/files/0006-Fix-build-on-aarch64-musl.patch
+https://bugs.gentoo.org/693772
+
+Other variants/links:
+https://git.alpinelinux.org/aports/tree/main/elfutils/fix-aarch64_fregs.patch
+https://github.com/gentoo/musl/blob/6450482b9b4463b57ac249c63b7ed796e9874c40/dev-libs/elfutils/files/0.178/fix-aarch64_fregs.patch
+
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Tue, 15 Aug 2017 17:27:30 +0800
+Subject: [PATCH] Fix build on aarch64/musl
+
+Errors
+
+invalid operands to binary & (have 'long double' and 'unsigned int')
+
+error: redefinition
+ of 'struct iovec'
+ struct iovec { void *iov_base; size_t iov_len; };
+        ^
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+Rebase to 0.170
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+
+--- a/backends/aarch64_initreg.c
++++ b/backends/aarch64_initreg.c
+@@ -33,7 +33,7 @@
+ #include "system.h"
+ #include <assert.h>
+ #if defined(__aarch64__) && defined(__linux__)
+-# include <linux/uio.h>
++# include <sys/uio.h>
+ # include <sys/user.h>
+ # include <sys/ptrace.h>
+ /* Deal with old glibc defining user_pt_regs instead of user_regs_struct.  */
+@@ -82,7 +82,7 @@ aarch64_set_initial_registers_tid (pid_t tid __attribute__ ((unused)),
+ 
+   Dwarf_Word dwarf_fregs[32];
+   for (int r = 0; r < 32; r++)
+-    dwarf_fregs[r] = fregs.vregs[r] & 0xFFFFFFFF;
++    dwarf_fregs[r] = (unsigned int)fregs.vregs[r] & 0xFFFFFFFF;
+ 
+   if (! setfunc (64, 32, dwarf_fregs, arg))
+     return false;
+--- a/backends/arm_initreg.c
++++ b/backends/arm_initreg.c
+@@ -38,7 +38,7 @@
+ #endif
+ 
+ #ifdef __aarch64__
+-# include <linux/uio.h>
++# include <sys/uio.h>
+ # include <sys/user.h>
+ # include <sys/ptrace.h>
+ /* Deal with old glibc defining user_pt_regs instead of user_regs_struct.  */
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-macros.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-macros.patch
new file mode 100644
index 0000000000..97c6c1dcd6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-musl-macros.patch
@@ -0,0 +1,86 @@
+May not be required (or at least some hunks) with next release (0.186?)
+
+https://git.alpinelinux.org/aports/plain/main/elfutils/musl-macros.patch
+--- a/lib/libeu.h
++++ b/lib/libeu.h
+@@ -31,6 +31,27 @@
+ 
+ #include <stddef.h>
+ #include <stdint.h>
++#include <unistd.h>
++#include <alloca.h>
++#include <string.h>
++
++#ifndef TEMP_FAILURE_RETRY
++#define TEMP_FAILURE_RETRY(expression) \
++  (__extension__                                                              \
++   ({ long int __result;                                                     \
++       do __result = (long int) (expression);                                 \
++       while (__result == -1L && errno == EINTR);                             \
++       __result; }))
++#endif
++
++#ifndef strndupa
++#define strndupa(s, n) \
++       (__extension__ ({const char *__in = (s); \
++                        size_t __len = strnlen (__in, (n)) + 1; \
++                        char *__out = (char *) alloca (__len); \
++                        __out[__len-1] = '\0'; \
++                        (char *) memcpy (__out, __in, __len-1);}))
++#endif
+ 
+ extern void *xmalloc (size_t) __attribute__ ((__malloc__));
+ extern void *xcalloc (size_t, size_t) __attribute__ ((__malloc__));
+--- a/src/arlib.h
++++ b/src/arlib.h
+@@ -29,6 +29,16 @@
+ #include <stdint.h>
+ #include <sys/types.h>
+ 
++#if !defined(ACCESSPERMS)
++# define ACCESSPERMS (S_IRWXU|S_IRWXG|S_IRWXO) /* 0777 */
++#endif
++#if !defined(ALLPERMS)
++# define ALLPERMS (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO) /* 07777 */
++#endif
++#if !defined(DEFFILEMODE)
++# define DEFFILEMODE (S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH)/* 0666*/
++#endif
++
+ 
+ /* State of -D/-U flags.  */
+ extern bool arlib_deterministic_output;
+--- a/src/elfcompress.c
++++ b/src/elfcompress.c
+@@ -37,6 +37,14 @@
+ #include "libeu.h"
+ #include "printversion.h"
+ 
++#if !defined(FNM_EXTMATCH)
++# define FNM_EXTMATCH 0
++#endif
++
++#if !defined(ALLPERMS)
++# define ALLPERMS (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO) /* 07777 */
++#endif
++
+ /* Name and version of program.  */
+ ARGP_PROGRAM_VERSION_HOOK_DEF = print_version;
+ 
+--- a/src/strip.c
++++ b/src/strip.c
+@@ -45,6 +45,14 @@
+ #include <system.h>
+ #include <printversion.h>
+ 
++#if !defined(FNM_EXTMATCH)
++# define FNM_EXTMATCH 0
++#endif
++
++#if !defined(ACCESSPERMS)
++#define ACCESSPERMS (S_IRWXU|S_IRWXG|S_IRWXO)
++#endif
++
+ typedef uint8_t GElf_Byte;
+ 
+ /* Name and version of program.  */
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-skip-DT_RELR-failing-tests.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-skip-DT_RELR-failing-tests.patch
new file mode 100644
index 0000000000..0ffe75d93d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-skip-DT_RELR-failing-tests.patch
@@ -0,0 +1,39 @@
+We know these tests fail with DT_RELR (https://sourceware.org/bugzilla/show_bug.cgi?id=28495)
+so skip for now.
+--- a/tests/run-elflint-self.sh
++++ b/tests/run-elflint-self.sh
+@@ -18,5 +18,8 @@
+ 
+ . $srcdir/test-subr.sh
+ 
++# XFAIL b/c no DT_RELR support yet (https://sourceware.org/bugzilla/show_bug.cgi?id=28495)
++exit 77
++
+ testrun_on_self ${abs_top_builddir}/src/elflint --quiet --gnu-ld
+ testrun_on_self_compressed ${abs_top_builddir}/src/elflint --quiet --gnu-ld
+--- a/tests/run-strip-strmerge.sh
++++ b/tests/run-strip-strmerge.sh
+@@ -17,6 +17,9 @@
+ 
+ . $srcdir/test-subr.sh
+ 
++# XFAIL b/c no DT_RELR support yet (https://sourceware.org/bugzilla/show_bug.cgi?id=28495)
++exit 77
++
+ # Generate a file with merged .shstrtab/.strtab table.
+ # strip and unstrip it. Check all files with elflint.
+ 
+diff --git a/tests/run-reverse-sections-self.sh b/tests/run-reverse-sections-self.sh
+index 71afd6a..87de933 100755
+--- a/tests/run-reverse-sections-self.sh
++++ b/tests/run-reverse-sections-self.sh
+@@ -17,6 +17,9 @@
+ 
+ . $srcdir/test-subr.sh
+ 
++# XFAIL b/c no DT_RELR support yet (https://sourceware.org/bugzilla/show_bug.cgi?id=28495)
++exit 77
++
+ test_reverse_self ()
+ {
+   in_file="$1"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-tests-run-lfs-symbols.sh-needs-gawk.patch b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-tests-run-lfs-symbols.sh-needs-gawk.patch
new file mode 100644
index 0000000000..c64a30ec03
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/files/elfutils-0.189-tests-run-lfs-symbols.sh-needs-gawk.patch
@@ -0,0 +1,41 @@
+https://inbox.sourceware.org/elfutils-devel/20230719231639.1786109-1-sam@gentoo.org/T/#u
+
+From 7f607f9aba5c6fccb3d94776452b1cfa421df1f7 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Thu, 20 Jul 2023 00:15:10 +0100
+Subject: [PATCH] tests: run-lfs-symbols.sh needs gawk
+
+With awk=mawk, I get:
+```
+FAIL: run-lfs-symbols.sh
+
+First sanity-check that LFS detection works.
+checking ./testfile-nolfs
+awk: line 3: syntax error at or near /
+FAIL run-lfs-symbols.sh (exit status: 2)
+```
+
+	* tests/run-lfs-symbols.sh: Call 'gawk' instead of 'awk'.
+
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/tests/run-lfs-symbols.sh
++++ b/tests/run-lfs-symbols.sh
+@@ -42,13 +42,13 @@ LFS_FORMAT='BEGIN {
+ LFS=$(printf "$LFS_FORMAT" "${abs_srcdir}/lfs-symbols")
+ 
+ makeprint() {
+-  make print-$1 -C $2 |& awk -F= "/^$1=/{ print \$2 }"
++  make print-$1 -C $2 |& gawk -F= "/^$1=/{ print \$2 }"
+ }
+ 
+ testrun_lfs() {
+   echo "checking $1"
+   if [ -e "$1" ]; then
+-    bad=$(testrun ${abs_top_builddir}/src/nm -u "$1" | awk "$LFS")
++    bad=$(testrun ${abs_top_builddir}/src/nm -u "$1" | gawk "$LFS")
+     if [ -n "$bad" ]; then
+       echo "$1 contains non-lfs symbols:" $bad
+       exit_status=1
+-- 
+2.41.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
index 1b2b95f274..05def2bfd0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
@@ -8,6 +8,7 @@
 	<use>
 		<flag name="lzma">Support automatic decompression of LZMA-compressed files and kernel images</flag>
 		<flag name="utils">Install command-line utilities (all the eu-* programs)</flag>
+		<flag name="debuginfod">Enable debuginfod support, both the debuginfod server and the libdebuginfod client library</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:elfutils_project:elfutils</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/Manifest
index 846b78dc76..bb161b9f1d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/Manifest
@@ -1,3 +1,4 @@
 DIST gmp-6.2.1-arm64-darwin.patch.bz2 2520 BLAKE2B 3d4e9dbd29dc9aa81f0c9e0de4a5904c989d54148c9e3dcc5097a43b3fb1ecd17802dacfc71ee131c0805a345f5dce9009e88439758d3a0ed8b3a88526353b4a SHA512 72d49f09c3facd75036c945e076207e72e5673ba9605999c32a122e43e8b970ed646c8ca8f07acbb62bff5e7c387d4c8e1f73ca73e50ac3f574b5f6471d66d56
 DIST gmp-6.2.1.tar.xz 2027316 BLAKE2B c0d85f175392a50cfa01bc6b0a312b235946ad8b4f6f84f6dabd33d7a6f2cc75c9b0e1e33057be07750bfa0145b7c4cf3b6188a5be6ca9d7271ec2276c84ebcb SHA512 c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
+DIST gmp-6.3.0.tar.xz 2094196 BLAKE2B a865129e2b3f634ec5bad7f97ed89532e43f5662ac47a7d8ab7f0df8c9f8d0886bd984651422e2573c2163bca69c0547c248147ec90880accbd53db97dc0ddee SHA512 e85a0dab5195889948a3462189f0e0598d331d3457612e2d3350799dba2e244316d256f8161df5219538eb003e4b5343f989aaa00f96321559063ed8c8f29fd2
 DIST gmp-man-6.2.1.pdf 827583 BLAKE2B 9aa25457a3c488e37cc7d54d825253ab749a3780919570579b319cf607001de50b212ca387b70213abcc5ab428b4525bdb9cd8ae932798a2d7928da98ce3f353 SHA512 f2d9d02e97975355ef490e921fedc94fb7687c3661eec8fa2e94a1622b6e59b17b3879eb3ec1f2df8edac100f727175144d107f4c49c602b773c43bc9e91dbcb
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild
new file mode 100644
index 0000000000..f96c0cf02b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild
@@ -0,0 +1,186 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit gnuconfig libtool flag-o-matic multilib-minimal toolchain-funcs
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+
+MANUAL_PV=${MY_PV}
+MANUAL_PV=6.2.1
+
+MY_P=${PN}-${MY_PV}
+PLEVEL=${PV/*p}
+
+DESCRIPTION="Library for arbitrary-precision arithmetic on different type of numbers"
+HOMEPAGE="https://gmplib.org/"
+SRC_URI="
+	https://gmplib.org/download/gmp/${MY_P}.tar.xz
+	mirror://gnu/${PN}/${MY_P}.tar.xz
+	doc? ( https://gmplib.org/${PN}-man-${MANUAL_PV}.pdf )
+"
+S="${WORKDIR}"/${MY_P%a}
+
+LICENSE="|| ( LGPL-3+ GPL-2+ )"
+# The subslot reflects the C & C++ SONAMEs.
+SLOT="0/10.4"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +cpudetection +cxx pic static-libs"
+REQUIRED_USE="cpudetection? ( asm )"
+RESTRICT="!cpudetection? ( bindist )"
+
+BDEPEND="
+	app-arch/xz-utils
+	sys-devel/m4
+"
+
+DOCS=( AUTHORS ChangeLog NEWS README doc/configuration doc/isa_abi_headache )
+HTML_DOCS=( doc )
+
+MULTILIB_WRAPPED_HEADERS=( /usr/include/gmp.h )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.1.0-noexecstack-detect.patch
+	"${FILESDIR}"/${PN}-6.2.1-no-zarch.patch
+)
+
+pkg_pretend() {
+	if use cpudetection && ! use amd64 && ! use x86 ; then
+		elog "Using generic C implementation on non-amd64/x86 with USE=cpudetection"
+		elog "--enable-fat is a no-op on alternative arches."
+		elog "To obtain an optimized build, set USE=-cpudetection, but binpkgs should not then be made."
+	fi
+}
+
+src_prepare() {
+	default
+
+	# We cannot run autotools here as gcc depends on this package
+	elibtoolize
+
+	# bug #536894
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		eapply "${FILESDIR}"/${PN}-6.1.2-gcc-apple-4.0.1.patch
+	fi
+
+	# GMP uses the "ABI" env var during configure as does Gentoo (econf).
+	# So, to avoid patching the source constantly, wrap things up.
+	mv configure configure.wrapped || die
+	cat <<-\EOF > configure
+	#!/usr/bin/env sh
+	exec env ABI="${GMPABI}" "$0.wrapped" "$@"
+	EOF
+
+	# Patches to original configure might have lost the +x bit.
+	chmod a+rx configure{,.wrapped} || die
+
+	# Save the upstream files named config.{guess,sub} which are
+	# wrappers around the gnuconfig versions.
+	mkdir "${T}"/gmp-gnuconfig || die
+	mv config.guess "${T}"/gmp-gnuconfig/config.guess || die
+	mv config.sub "${T}"/gmp-gnuconfig/config.sub || die
+	# Grab fresh copies from gnuconfig.
+	touch config.guess config.sub || die
+	gnuconfig_update
+	# Rename the fresh copies to the filenames the wrappers from GMP
+	# expect.
+	mv config.guess configfsf.guess || die
+	mv config.sub configfsf.sub || die
+}
+
+multilib_src_configure() {
+	# Generally a very fragile package
+	strip-flags
+	# Miscompiled with LTO at least on arm64, bug #889948
+	# 6.3.0 says it now supports LTO, but needs retesting on a variety
+	# of platforms. Fix was maybe https://gmplib.org/repo/gmp-6.3/rev/9c324044f4b5.
+	filter-lto
+
+	# Because of our 32-bit userland, 1.0 is the only HPPA ABI that works
+	# https://gmplib.org/manual/ABI-and-ISA.html#ABI-and-ISA (bug #344613)
+	if [[ ${CHOST} == hppa2.0-* ]] ; then
+		GMPABI="1.0"
+	fi
+
+	# ABI mappings (needs all architectures supported)
+	case ${ABI} in
+		32|x86)       GMPABI=32;;
+		64|amd64|n64) GMPABI=64;;
+		[onx]32)      GMPABI=${ABI};;
+	esac
+	export GMPABI
+
+	tc-export CC
+
+	# https://gmplib.org/manual/Notes-for-Package-Builds
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--localstatedir="${EPREFIX}"/var/state/gmp
+		--enable-shared
+
+		$(use_enable asm assembly)
+		# fat is needed to avoid gmp installing either purely generic
+		# or specific-to-used-CPU (which our config.guess refresh prevents at the moment).
+		# Both Fedora and opensuse use this option to tackle the issue, bug #883201.
+		#
+		# This only works for amd64/x86, so to get accelerated performance
+		# (i.e. not using the generic C), one needs USE=-cpudetection if
+		# on non-amd64/x86.
+		#
+		# (We do not mask USE=cpudetection on !amd64/x86 because we want
+		# the flag to be useful on other arches to allow opting out of the
+		# config.guess logic below.)
+		$(use_enable cpudetection fat)
+		$(use_enable cxx)
+		$(use_enable static-libs static)
+
+		# --with-pic forces static libraries to be built as PIC
+		# and without TEXTRELs. musl does not support TEXTRELs: bug #707332
+		$(use pic && echo --with-pic)
+
+		# XXX: In the past, we had PGO support with upstream's 'tuneup' script
+		# per https://gmplib.org/manual/Performance-optimization, but we had
+		# a variety of issues with it: bug #454912, bug #650558, and bug #658688.
+	)
+
+	# Move the wrappers from GMP back into place (may have been destroyed by previous econf run)
+	cp "${T}"/gmp-gnuconfig/config.guess "${S}"/config.guess || die
+	cp "${T}"/gmp-gnuconfig/config.sub "${S}"/config.sub || die
+
+	# See bug #883201 again.
+	if ! use cpudetection && ! tc-is-cross-compiler ; then
+		local gmp_host=$("${S}"/config.guess || die "failed to run config.guess")
+
+		if [[ -z ${gmp_host} ]] ; then
+			die "Empty result from GMP's custom config.guess!"
+		fi
+
+		einfo "GMP guessed processor type: ${gmp_host}"
+		ewarn "This build will only work on this machine. Enable USE=cpudetection for binary packages!"
+		export ac_cv_build="${gmp_host}"
+		export ac_cv_host="${gmp_host}"
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Should be a standalone lib
+	rm -f "${ED}"/usr/$(get_libdir)/libgmp.la
+
+	# This requires libgmp
+	local la="${ED}/usr/$(get_libdir)/libgmpxx.la"
+	if ! use static-libs ; then
+		rm -f "${la}" || die
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	use doc && cp "${DISTDIR}"/gmp-man-${MANUAL_PV}.pdf "${ED}"/usr/share/doc/${PF}/
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-2.5.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-2.5.6.ebuild
index 256c740dea..62347c4294 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-2.5.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-2.5.6.ebuild
@@ -19,7 +19,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-3 LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # Note: On each bump, update dep bounds on each version from configure.ac!
 RDEPEND=">=dev-libs/libgpg-error-1.33"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4.ebuild
index 3edea2dadd..ebb33d4508 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4.ebuild
@@ -19,7 +19,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="LGPL-3+ GPL-2+ GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs"
 
 RDEPEND=">=dev-libs/libgpg-error-1.33"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/files/libpcre-8.45-fix-stack-size-detection.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/files/libpcre-8.45-fix-stack-size-detection.patch
new file mode 100644
index 0000000000..2b5af062d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/files/libpcre-8.45-fix-stack-size-detection.patch
@@ -0,0 +1,18 @@
+https://bugs.exim.org/show_bug.cgi?id=2173#c4
+https://bugs.gentoo.org/910188
+https://github.com/MariaDB/server/pull/2700
+--- a/pcre_exec.c
++++ b/pcre_exec.c
+@@ -509,6 +509,12 @@
+                  (e.g. stopped by repeated call or recursion limit)
+ */
+ 
++#ifdef __GNUC__
++static int
++match(REGISTER PCRE_PUCHAR eptr, REGISTER const pcre_uchar *ecode,
++  PCRE_PUCHAR mstart, int offset_top, match_data *md, eptrblock *eptrb,
++  unsigned int rdepth) __attribute__((optnone,noinline,noclone));
++#endif
+ static int
+ match(REGISTER PCRE_PUCHAR eptr, REGISTER const pcre_uchar *ecode,
+   PCRE_PUCHAR mstart, int offset_top, match_data *md, eptrblock *eptrb,
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild
new file mode 100644
index 0000000000..0f71104bd9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit libtool multilib-minimal preserve-libs usr-ldscript
+
+DESCRIPTION="Perl-compatible regular expression library"
+HOMEPAGE="http://www.pcre.org/"
+MY_P="pcre-${PV/_rc/-RC}"
+if [[ ${PV} != *_rc* ]] ; then
+	# Only the final releases are available here.
+	SRC_URI="
+		mirror://sourceforge/pcre/${MY_P}.tar.bz2
+		https://ftp.pcre.org/pub/pcre/${MY_P}.tar.bz2
+		ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/${MY_P}.tar.bz2
+	"
+else
+	SRC_URI="ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/Testing/${MY_P}.tar.bz2"
+fi
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="bzip2 +cxx +jit libedit pcre16 pcre32 +readline static-libs unicode valgrind zlib"
+REQUIRED_USE="
+	readline? ( !libedit )
+	libedit? ( !readline )
+"
+
+RDEPEND="
+	bzip2? ( app-arch/bzip2 )
+	zlib? ( sys-libs/zlib )
+	libedit? ( dev-libs/libedit )
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-util/valgrind )
+"
+BDEPEND="virtual/pkgconfig"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/pcre-config
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.45-fix-stack-size-detection.patch
+)
+
+src_prepare() {
+	default
+
+	sed -i -e "s:-lpcre ::" libpcrecpp.pc.in || die
+	elibtoolize
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(multilib_native_use_enable bzip2 pcregrep-libbz2)
+		$(use_enable cxx cpp)
+		$(use_enable jit)
+		$(use_enable jit pcregrep-jit)
+		$(use_enable pcre16)
+		$(use_enable pcre32)
+		$(multilib_native_use_enable libedit pcretest-libedit)
+		$(multilib_native_use_enable readline pcretest-libreadline)
+		$(use_enable static-libs static)
+		$(use_enable unicode utf)
+		$(use_enable unicode unicode-properties)
+		$(multilib_native_use_enable valgrind)
+		$(multilib_native_use_enable zlib pcregrep-libz)
+
+		--enable-pcre8
+		--enable-shared
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake V=1 $(multilib_is_native_abi || echo "bin_PROGRAMS=")
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		$(multilib_is_native_abi || echo "bin_PROGRAMS= dist_html_DATA=") \
+		install
+
+	gen_usr_ldscript -a pcre
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_preinst() {
+	preserve_old_lib /$(get_libdir)/libpcre.so.0
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /$(get_libdir)/libpcre.so.0
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.46.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.46.0.ebuild
index 0028ef084a..83eda75426 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.46.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.46.0.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} = 9999* ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD BSD-2 ISC MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
index 42495d934e..7826c2f32a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit autotools git-r3
 else
 	inherit gnome.org libtool
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.1.ebuild
index 5ba1613413..54282f07d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.1.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="|| ( LGPL-3 LGPL-2.1 )"
 # Subslot = libnettle - libhogweed soname version
 SLOT="0/8-6"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
 # The arm64 crypto option controls AES, SHA1, and SHA2 usage.
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index 2678fda9c1..17c5782636 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1,5 +1,4 @@
 DIST cython-0.29.34.gh.tar.gz 2114639 BLAKE2B c5f70fd3e6074d9030a1035bc98d71b703e0f391b61bd91f3ffba2c35a29a98b9ff8ef2047e7c75743ead280f0f06a924abe84ae8bf7696b65da662a3c58ee0c SHA512 51679d1304d0f87dfb51e60c753f1ce60027f855a91cf130a5dcf84353884a7dcf09c01701945ae2f9173f8f095890c377d5faac28c2f01d7f764609c0130411
 DIST cython-0.29.35.gh.tar.gz 2115190 BLAKE2B ac23abbd2b560ee52a79840d995a4cf36ddb3a8705b9327010f1ad6add8028185c15703efcc1d59b581d65b5de38e123c0f07c36fe6ffe54a6efee7512161344 SHA512 35d679d94e1f731e004b83fb4ae0d569703b0800c913012308146b1c54463ce12cb1cf3733e24162fb357f179444c5ca31108a37850e6c749ddebac5175119f5
 DIST cython-0.29.36.gh.tar.gz 2115333 BLAKE2B 6d43779c7222ff65d7de3a35ec18ef636480807d53480a8f94cc8c92d462fcc2f4d201a3bbf6e840a11fd33025e32c53f85626b05c131d10eed2859cdca7eb2d SHA512 a086fe1a11290cd3c870b891e61a0a0e2595bab9c26888024a758b6950c07059346d682fa9349e46c0af89805abbdd750059b3189960b8ce18007dfb5eb4391a
-DIST cython-3.0.0b3.gh.tar.gz 2688784 BLAKE2B 933bb48b2bf5169c973a36c877a36eae28b80409a7ff395b82a14ac0740247496df3c9f2d69884c823b7475069f0c75d6cbbb964b88de60b38082e6e36659bff SHA512 f1d0fdcec4bc6b0f6cb66078592424fdcb7a028b79c5b9d41280ae112235736d11c9f4f793e810007e880ae0def195ac25999db59065c7f7bdcfab84b06bf7d3
-DIST cython-3.0.0rc2.gh.tar.gz 2713358 BLAKE2B 5d1e1043e0785c4e79441e47ab6d03b7dbdff8728946707acd39452c1a20e3527e3142bbf09d140d28e233ef0ae0e870650f5f77a8d2a1d084199b5b39937463 SHA512 42ff1b3f2509c90be6007b9156454ae89c1be26a9dde6ca9c109b0cfa3de30797eeeffef38ea1bfe37a9c8e062c776c8cb755826f8c25aa7c9703fbb031bf643
+DIST cython-3.0.0.gh.tar.gz 2713478 BLAKE2B 16be50b463cf155417fee02b4529bbde8c4402bac0098ddf2cb05e33ac4c5b455bf7595b046b2bc6edcc8121f2c6be3b7af60c3c721a37bebcf4c654cd41a43f SHA512 a9bf6f0a78accd0624bc2a61329541d97d60257ae3a6b6601f73bd9122427a3d460129b317f000d3061a4dfe3e6a6de59342354862ded13e85c7eb622ee39f9a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta3-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
similarity index 80%
rename from sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta3-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
index bbe34ee3f7..5455a20d02 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
@@ -11,7 +11,7 @@ PYTHON_REQ_USE="threads(+)"
 
 inherit distutils-r1 multiprocessing toolchain-funcs
 
-MY_P=${P/_beta/b}
+MY_P=${P/_rc/rc}
 DESCRIPTION="A Python to C compiler"
 HOMEPAGE="
 	https://cython.org/
@@ -19,7 +19,7 @@ HOMEPAGE="
 	https://pypi.org/project/Cython/
 "
 SRC_URI="
-	https://github.com/cython/cython/archive/${PV/_beta/b}.tar.gz
+	https://github.com/cython/cython/archive/${PV/_rc/rc}.tar.gz
 		-> ${MY_P}.gh.tar.gz
 "
 S=${WORKDIR}/${MY_P}
@@ -43,11 +43,7 @@ PATCHES=(
 	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
 	"${FILESDIR}/${PN}-0.29.23-test_exceptions-py310.patch"
 	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
-	# backport upstream fix e.g. for dev-python/pysimdjson on py3.12
-	"${FILESDIR}/${P}-py312-long.patch"
-	# should fix dev-python/symengine
-	# https://github.com/cython/cython/pull/5483
-	"${FILESDIR}/${P}-const-iter.patch"
+	"${FILESDIR}/${P}-version-stderr-stdout.patch"
 )
 
 distutils_enable_sphinx docs \
@@ -68,11 +64,19 @@ python_test() {
 		return
 	fi
 
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
 	tc-export CC
 	# https://github.com/cython/cython/issues/1911
 	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
-	"${PYTHON}" runtests.py -vv -j "$(makeopts_jobs)" --work-dir "${BUILD_DIR}"/tests ||
-		die "Tests fail with ${EPYTHON}"
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
 }
 
 python_install_all() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_rc2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_rc2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0-version-stderr-stdout.patch b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0-version-stderr-stdout.patch
new file mode 100644
index 0000000000..7a12c6eead
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0-version-stderr-stdout.patch
@@ -0,0 +1,35 @@
+https://bugs.gentoo.org/911333
+https://github.com/cython/cython/pull/5572
+https://github.com/cython/cython/commit/ca69b359b040bf6c0fc90692bbea3bdd9d7877e6
+
+From ca69b359b040bf6c0fc90692bbea3bdd9d7877e6 Mon Sep 17 00:00:00 2001
+From: Eli Schwartz <eschwartz@archlinux.org>
+Date: Fri, 28 Jul 2023 06:52:03 -0400
+Subject: [PATCH] Only write the version to stderr, if it's a separate file
+ descriptor from stdout (GH-5572)
+
+At least one project tries to detect the Cython version by redirecting stderr to
+stdout and capturing it. This is done in pure POSIX shell, so it probably seemed
+like the simple and obvious solution for a less capable programming language
+given that no output at all was expected on stdout.
+
+But the result is that the version number appears twice, and then gets misparsed
+and ends up triggering bad assumptions in the code running cython.
+
+It turns out that it's pretty easy to just print once, though. Detect when
+stdout and stderr are redirected to the same location, and only print once.
+
+See https://github.com/cython/cython/issues/5504
+Fixes https://bugs.gentoo.org/911333
+--- a/Cython/Compiler/Main.py
++++ b/Cython/Compiler/Main.py
+@@ -776,7 +776,7 @@ def main(command_line = 0):
+         print("Cython version %s" % __version__)
+         # For legacy reasons, we also write the version to stderr.
+         # New tools should expect it in stdout, but existing ones still pipe from stderr.
+-        if not sys.stderr.isatty():
++        if not sys.stderr.isatty() and os.fstat(1) != os.fstat(2):
+             sys.stderr.write("Cython version %s\n" % __version__)
+     if options.working_path!="":
+         os.chdir(options.working_path)
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-const-iter.patch b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-const-iter.patch
deleted file mode 100644
index 18822f1290..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-const-iter.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-From 913b8fadc5fc45306764c0ede472e1bc3b606d10 Mon Sep 17 00:00:00 2001
-From: Isuru Fernando <isuruf@gmail.com>
-Date: Mon, 12 Jun 2023 13:42:09 -0500
-Subject: [PATCH 1/4] Don't remove const for reverse iteration
-
----
- Cython/Compiler/ExprNodes.py   | 27 ---------------------------
- Cython/Includes/libcpp/map.pxd |  8 ++++++--
- 2 files changed, 6 insertions(+), 29 deletions(-)
-
-diff --git a/Cython/Compiler/ExprNodes.py b/Cython/Compiler/ExprNodes.py
-index ad4701b7bb6..275a6233da5 100644
---- a/Cython/Compiler/ExprNodes.py
-+++ b/Cython/Compiler/ExprNodes.py
-@@ -3268,32 +3268,6 @@ def free_temps(self, code):
-         ExprNode.free_temps(self, code)
- 
- 
--def remove_const(item_type):
--    """
--    Removes the constness of a given type and its underlying templates
--    if any.
--
--    This is to solve the compilation error when the temporary variable used to
--    store the result of an iterator cannot be changed due to its constness.
--    For example, the value_type of std::map, which will also be the type of
--    the temporarry variable, is std::pair<const Key, T>. This means the first
--    component of the variable cannot be reused to store the result of each
--    iteration, which leads to a compilation error.
--    """
--    if item_type.is_const:
--        item_type = item_type.cv_base_type
--    if item_type.is_typedef:
--        item_type = remove_const(item_type.typedef_base_type)
--    if item_type.is_cpp_class and item_type.templates:
--        templates = [remove_const(t) if t.is_const else t for t in item_type.templates]
--        template_type = item_type.template_type
--        item_type = PyrexTypes.CppClassType(
--            template_type.name, template_type.scope,
--            template_type.cname, template_type.base_classes,
--            templates, template_type)
--    return item_type
--
--
- class NextNode(AtomicExprNode):
-     #  Used as part of for statement implementation.
-     #  Implements result = next(iterator)
-@@ -3336,7 +3310,6 @@ def infer_type(self, env, iterator_type=None):
- 
-     def analyse_types(self, env):
-         self.type = self.infer_type(env, self.iterator.type)
--        self.type = remove_const(self.type)
-         self.is_temp = 1
-         return self
- 
-diff --git a/Cython/Includes/libcpp/map.pxd b/Cython/Includes/libcpp/map.pxd
-index d81af66e09a..2c2c5c82adf 100644
---- a/Cython/Includes/libcpp/map.pxd
-+++ b/Cython/Includes/libcpp/map.pxd
-@@ -50,7 +50,9 @@ cdef extern from "<map>" namespace "std" nogil:
-         cppclass reverse_iterator:
-             reverse_iterator() except +
-             reverse_iterator(reverse_iterator&) except +
--            value_type& operator*()
-+            # correct would be value_type& but this does not work
-+            # well with cython's code gen
-+            pair[T, U]& operator*()
-             reverse_iterator operator++()
-             reverse_iterator operator--()
-             reverse_iterator operator++(int)
-@@ -63,7 +65,9 @@ cdef extern from "<map>" namespace "std" nogil:
-             const_reverse_iterator() except +
-             const_reverse_iterator(reverse_iterator&) except +
-             operator=(reverse_iterator&) except +
--            const value_type& operator*()
-+            # correct would be const value_type& but this does not work
-+            # well with cython's code gen
-+            const pair[T, U]& operator*()
-             const_reverse_iterator operator++()
-             const_reverse_iterator operator--()
-             const_reverse_iterator operator++(int)
-
-From cb804f989eaa9938e72d0336d82bb7aa0003455f Mon Sep 17 00:00:00 2001
-From: Isuru Fernando <isuruf@gmail.com>
-Date: Mon, 12 Jun 2023 13:57:58 -0500
-Subject: [PATCH 2/4] Add test from gh5478
-
----
- tests/run/cpp_iterators.pyx | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/tests/run/cpp_iterators.pyx b/tests/run/cpp_iterators.pyx
-index 81048d0b36b..424168fa825 100644
---- a/tests/run/cpp_iterators.pyx
-+++ b/tests/run/cpp_iterators.pyx
-@@ -7,6 +7,7 @@ from libcpp.map cimport map as stdmap
- from libcpp.set cimport set as stdset
- from libcpp.string cimport string
- from libcpp.vector cimport vector
-+from libcpp.memory cimport shared_ptr, make_shared
- from cython.operator cimport dereference as deref
- 
- cdef extern from "cpp_iterators_simple.h":
-@@ -272,6 +273,27 @@ def test_iteration_over_attribute_of_call():
-     for i in get_object_with_iterable_attribute().vec:
-         print(i)
- 
-+cdef extern from *:
-+    # TODO: support make_shared[const int]
-+    shared_ptr[const int] make_shared_const_int "std::make_shared<const int>"(int)
-+
-+def test_iteration_over_shared_const_ptr_set(py_v):
-+    """
-+    >>> test_iteration_over_shared_const_ptr_set[2, 4, 6])
-+    6
-+    4
-+    2
-+    """
-+    cdef stdset[shared_ptr[const int]] s
-+    cdef int i
-+    for e in py_v:
-+        i = e
-+        s.insert(make_shared_const_int(i))
-+
-+    cdef shared_ptr[const int] a
-+    for a in s:
-+        print(deref(a))
-+
- def test_iteration_over_reversed_list(py_v):
-     """
-     >>> test_iteration_over_reversed_list([2, 4, 6])
-
-From a9bfacdcf5358e9d5a1d3c8ab0dd2eff6f18018a Mon Sep 17 00:00:00 2001
-From: Isuru Fernando <isuruf@gmail.com>
-Date: Mon, 12 Jun 2023 14:07:37 -0500
-Subject: [PATCH 3/4] Fix multimap too
-
----
- Cython/Includes/libcpp/map.pxd | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/Cython/Includes/libcpp/map.pxd b/Cython/Includes/libcpp/map.pxd
-index 2c2c5c82adf..eb739509ac1 100644
---- a/Cython/Includes/libcpp/map.pxd
-+++ b/Cython/Includes/libcpp/map.pxd
-@@ -177,7 +177,9 @@ cdef extern from "<map>" namespace "std" nogil:
-         cppclass reverse_iterator:
-             reverse_iterator() except +
-             reverse_iterator(reverse_iterator&) except +
--            value_type& operator*()
-+            # correct would be value_type& but this does not work
-+            # well with cython's code gen
-+            pair[T, U]& operator*()
-             reverse_iterator operator++()
-             reverse_iterator operator--()
-             reverse_iterator operator++(int)
-@@ -190,7 +192,9 @@ cdef extern from "<map>" namespace "std" nogil:
-             const_reverse_iterator() except +
-             const_reverse_iterator(reverse_iterator&) except +
-             operator=(reverse_iterator&) except +
--            const value_type& operator*()
-+            # correct would be const value_type& but this does not work
-+            # well with cython's code gen
-+            const pair[T, U]& operator*()
-             const_reverse_iterator operator++()
-             const_reverse_iterator operator--()
-             const_reverse_iterator operator++(int)
-
-From 0528cd937e6d4606eb0902ee8d8db672ee7f88fe Mon Sep 17 00:00:00 2001
-From: Isuru Fernando <isuruf@gmail.com>
-Date: Mon, 12 Jun 2023 17:50:41 -0500
-Subject: [PATCH 4/4] Fix test
-
----
- tests/run/cpp_iterators.pyx | 15 +++++++--------
- 1 file changed, 7 insertions(+), 8 deletions(-)
-
-diff --git a/tests/run/cpp_iterators.pyx b/tests/run/cpp_iterators.pyx
-index 424168fa825..57d2716bea5 100644
---- a/tests/run/cpp_iterators.pyx
-+++ b/tests/run/cpp_iterators.pyx
-@@ -277,18 +277,17 @@ cdef extern from *:
-     # TODO: support make_shared[const int]
-     shared_ptr[const int] make_shared_const_int "std::make_shared<const int>"(int)
- 
--def test_iteration_over_shared_const_ptr_set(py_v):
-+def test_iteration_over_shared_const_ptr_vector(py_v):
-     """
--    >>> test_iteration_over_shared_const_ptr_set[2, 4, 6])
--    6
--    4
-+    >>> test_iteration_over_shared_const_ptr_vector([2, 4, 6])
-     2
-+    4
-+    6
-     """
--    cdef stdset[shared_ptr[const int]] s
-+    cdef vector[shared_ptr[const int]] s
-     cdef int i
--    for e in py_v:
--        i = e
--        s.insert(make_shared_const_int(i))
-+    for i in py_v:
-+        s.push_back(make_shared_const_int(i))
- 
-     cdef shared_ptr[const int] a
-     for a in s:
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-py312-long.patch b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-py312-long.patch
deleted file mode 100644
index fb849eca86..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.0_beta3-py312-long.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From d82e4e34582e908d315b912a60d81d5759850df5 Mon Sep 17 00:00:00 2001
-From: Stefan Behnel <stefan_ml@behnel.de>
-Date: Mon, 29 May 2023 21:58:15 +0200
-Subject: [PATCH] Fix the argument type passed into the new
- "PyUnstable_Long_Compact*()" C-API functions in CPython 3.12.
-
----
- Cython/Utility/TypeConversion.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Cython/Utility/TypeConversion.c b/Cython/Utility/TypeConversion.c
-index efc5c1373..09e87d81c 100644
---- a/Cython/Utility/TypeConversion.c
-+++ b/Cython/Utility/TypeConversion.c
-@@ -149,8 +149,8 @@ static CYTHON_INLINE Py_hash_t __Pyx_PyIndex_AsHash_t(PyObject*);
-         ((1 - (Py_ssize_t) __Pyx_PyLong_Sign(x)) * __Pyx_PyLong_DigitCount(x))
- 
-   #if defined(PyUnstable_Long_IsCompact) && defined(PyUnstable_Long_CompactValue)
--    #define __Pyx_PyLong_IsCompact(x)     PyUnstable_Long_IsCompact(x)
--    #define __Pyx_PyLong_CompactValue(x)  PyUnstable_Long_CompactValue(x)
-+    #define __Pyx_PyLong_IsCompact(x)     PyUnstable_Long_IsCompact((PyLongObject*) x)
-+    #define __Pyx_PyLong_CompactValue(x)  PyUnstable_Long_CompactValue((PyLongObject*) x)
-   #else
-     #define __Pyx_PyLong_IsCompact(x)     (((PyLongObject*)x)->long_value.lv_tag < (2 << _PyLong_NON_SIZE_BITS))
-     #define __Pyx_PyLong_CompactValue(x)  ((1 - (Py_ssize_t) __Pyx_PyLong_Sign(x)) * (Py_ssize_t) __Pyx_PyLong_Digits(x)[0])
--- 
-2.41.0
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index fc6c809c69..1b240bf273 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,3 +1,2 @@
-DIST docutils-0.17.1.tar.gz 2016138 BLAKE2B aa0b6525ba2e3eaebc17010806952ed5f40919876fcb813f50cc05b628dfd22e6073a9a4b2bfe989089ae68d9b7111ae3a97dda2bde5c0536f8fb76c0942fe29 SHA512 5ec2087116bd5356fdffc54f07f6b0355aac5fa9d6caeefa77e8d201fd4706c0d419193c4d9a3964ae493da3091fe2c7dc36b74f81a1e1b9282173658b06e71b
 DIST docutils-0.19.tar.gz 2056383 BLAKE2B 9983a905642de4e81ca118578671b503ddfda4bef1afcc0524de40543e1f9617fd8d768ef467da49d2f01076683400bad6a0fe15f6b5a3a1e202c42b2e34ab1b SHA512 fb904a899f2b6f3c07c5079577bd7c52a3182cb85f6a4149391e523498df15bfa317f0c04095b890beeb3f89c2b444875a2a609d880ac4d7fbc3125e46b37ea5
 DIST docutils-0.20.1.tar.gz 2058365 BLAKE2B 73fb8302599ffe57b0840c898b0b2e3ccd39ff9ea6eec2b5d345d02c950e1a8357bd821e62733b0484e82bc30e71d30fab381390b0edaef4375b02bcd9eeeb40 SHA512 a0ddca315d03677003036d6a8052ac96fbd3fcc4508564938ea684d79bedb4d322d83449c7b26e55b19b0aadd6e46ca9ac409bb16279a20f06c70e9c15ef5eb0
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild
deleted file mode 100644
index 4764ca403b..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild
+++ /dev/null
@@ -1,76 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-LICENSE="BSD-2 GPL-3 public-domain"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-PATCHES=(
-	"${FILESDIR}/docutils-0.18.1-py311.patch"
-)
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/{buildhtml,quicktest}.py
-}
-
-install_txt_doc() {
-	local doc="${1}"
-	local dir="txt/$(dirname ${doc})"
-	docinto "${dir}"
-	dodoc "${doc}"
-}
-
-python_install_all() {
-	local DOCS=( *.txt )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-
-	local doc
-	while IFS= read -r -d '' doc; do
-		install_txt_doc "${doc}"
-	done < <(find docs tools -name '*.txt' -print0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.18.1-py311.patch b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.18.1-py311.patch
deleted file mode 100644
index 878c6f1961..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.18.1-py311.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-Combination of:
-http://svn.code.sf.net/p/docutils/code/trunk@8910
-http://svn.code.sf.net/p/docutils/code/trunk@8909
-
-diff --git a/test/DocutilsTestSupport.py b/test/DocutilsTestSupport.py
-index 592d3f9df..e1f33aa7a 100644
---- a/test/DocutilsTestSupport.py
-+++ b/test/DocutilsTestSupport.py
-@@ -819,6 +819,7 @@ def exception_data(func, *args, **kwds):
-     except Exception as detail:
-         return (detail, detail.args,
-                 '%s: %s' % (detail.__class__.__name__, detail))
-+    return None, [], "No exception"
- 
- 
- def _format_str(*args):
-diff --git a/test/test_parsers/test_rst/test_directives/test_tables.py b/test/test_parsers/test_rst/test_directives/test_tables.py
-index 07be0122f..73724ed7e 100755
---- a/test/test_parsers/test_rst/test_directives/test_tables.py
-+++ b/test/test_parsers/test_rst/test_directives/test_tables.py
-@@ -65,6 +65,92 @@ def null_bytes():
-     next(reader)
- 
- null_bytes_exception = DocutilsTestSupport.exception_data(null_bytes)[0]
-+# Null bytes are valid in Python 3.11+:
-+if null_bytes_exception is None:
-+    bad_encoding_result = """\
-+<document source="test data">
-+    <table>
-+        <title>
-+            bad encoding
-+        <tgroup cols="4">
-+            <colspec colwidth="25">
-+            <colspec colwidth="25">
-+            <colspec colwidth="25">
-+            <colspec colwidth="25">
-+            <tbody>
-+                <row>
-+                    <entry>
-+                        <paragraph>
-+                            \xfe\xff"Treat"
-+                    <entry>
-+                        <paragraph>
-+                            "Quantity"
-+                    <entry>
-+                        <paragraph>
-+                            "Description"
-+                    <entry>
-+                <row>
-+                    <entry>
-+                        <paragraph>
-+                            "Albatr\u00b0\u00df"
-+                    <entry>
-+                        <paragraph>
-+                            2.99
-+                    <entry>
-+                        <paragraph>
-+                            "\u00a1Ona\x03\xc3\x03\xc4\x03\xb9\x03\xba!"
-+                    <entry>
-+                <row>
-+                    <entry>
-+                        <paragraph>
-+                            "CrunchyFrog"
-+                    <entry>
-+                        <paragraph>
-+                            1.49
-+                    <entry>
-+                        <paragraph>
-+                            "Ifwetooktheb\u00f6nesout
-+                    <entry>
-+                        <paragraph>
-+                            itwouldn\x20\x19tbe
-+                <row>
-+                    <entry>
-+                        <paragraph>
-+                            crunchy
-+                    <entry>
-+                        <paragraph>
-+                            nowwouldit?"
-+                    <entry>
-+                    <entry>
-+                <row>
-+                    <entry>
-+                        <paragraph>
-+                            "GannetRipple"
-+                    <entry>
-+                        <paragraph>
-+                            1.99
-+                    <entry>
-+                        <paragraph>
-+                            "\xbfOna\x03\xc3\x03\xc4\x03\xb9\x03\xba?"
-+                    <entry>
-+    <paragraph>
-+        (7- and 8-bit text encoded as UTF-16 has lots of null/zero bytes.)
-+"""
-+else:
-+    bad_encoding_result = """\
-+<document source="test data">
-+    <system_message level="3" line="1" source="test data" type="ERROR">
-+        <paragraph>
-+            Error with CSV data in "csv-table" directive:
-+            %s
-+        <literal_block xml:space="preserve">
-+            .. csv-table:: bad encoding
-+               :file: %s
-+               :encoding: latin-1
-+    <paragraph>
-+        (7- and 8-bit text encoded as UTF-16 has lots of null/zero bytes.)
-+""" % (null_bytes_exception, utf_16_csv)
-+
- 
- totest = {}
- 
-@@ -1031,19 +1117,8 @@ u"""\
- 
- (7- and 8-bit text encoded as UTF-16 has lots of null/zero bytes.)
- """ % utf_16_csv,
--"""\
--<document source="test data">
--    <system_message level="3" line="1" source="test data" type="ERROR">
--        <paragraph>
--            Error with CSV data in "csv-table" directive:
--            %s
--        <literal_block xml:space="preserve">
--            .. csv-table:: bad encoding
--               :file: %s
--               :encoding: latin-1
--    <paragraph>
--        (7- and 8-bit text encoded as UTF-16 has lots of null/zero bytes.)
--""" % (null_bytes_exception, utf_16_csv)],
-+bad_encoding_result
-+],
- ["""\
- .. csv-table:: good encoding
-    :file: %s
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
index 8bcef4e1bf..54226557c0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
@@ -1 +1,2 @@
 DIST jaraco.functools-3.8.0.tar.gz 16251 BLAKE2B 15735a053b395173de2568d13d54d0a770477f72e138998abb67f24314d13ae1a008a2b373979dfb8b3b8955754758e07eb5981459b793ba4b6839e6aefbdda8 SHA512 923e94f54c46896d89db6b4a0c5d803996dc5caddd6a3ada66f943b58afd1750f5403d10de5ab87f93e57c3eab43806401f7c6b5a8265938793d45cba93df688
+DIST jaraco.functools-3.8.1.tar.gz 16210 BLAKE2B 2e49829c4eda4ba9228c8972b1971c1a42bb972e5a7f0ef9994313b4b07cb8395c0b0ccc15c5f285a6a224ad60dec65901742c5f162156c4be96257a9ef9f67c SHA512 0ffd8fc0e973b0ee957cbc074dcae790530c6a944a54ae36e3feee954a59765663b8a734e5c1d1e56975c958b47560eb1f23b510028fee6cf682aeaf175c9460
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-3.8.1.ebuild
new file mode 100644
index 0000000000..0607441caa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-3.8.1.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 7 -- sys-apps/portage dep
+EAPI=7
+
+DISTUTILS_USE_PEP517=flit
+PYPI_NO_NORMALIZE=1
+PYPI_PN=${PN/-/.}
+PYTHON_COMPAT=( pypy3 python3_{10..12} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Additional functions used by other projects by developer jaraco"
+HOMEPAGE="
+	https://github.com/jaraco/jaraco.functools/
+	https://pypi.org/project/jaraco.functools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/more-itertools-0.12.0-r1[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/jaraco-classes[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "jaraco.functools"
+		version = "${PV}"
+		description = "Functools like those found in stdlib"
+	EOF
+}
+
+python_install() {
+	distutils-r1_python_install
+	# rename to workaround a bug in pkg_resources
+	# https://bugs.gentoo.org/834522
+	mv "${D}$(python_get_sitedir)"/jaraco{_,.}functools-${PV}.dist-info || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1-r1.ebuild
index 3114013733..c1747da85d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1-r1.ebuild
@@ -25,13 +25,6 @@ RDEPEND="
 	>=dev-python/jaraco-context-4.1.1-r1[${PYTHON_USEDEP}]
 	>=dev-python/jaraco-functools-3.5.0-r1[${PYTHON_USEDEP}]
 "
-BDEPEND="
-	test? (
-		$(python_gen_cond_dep '
-			dev-python/pathlib2[${PYTHON_USEDEP}]
-		' 3.9)
-	)
-"
 
 distutils_enable_tests pytest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
index 4a3217e4b9..369fdc1db2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
@@ -44,9 +44,6 @@ PDEPEND="
 BDEPEND="
 	test? (
 		${PDEPEND}
-		$(python_gen_cond_dep '
-			dev-python/pathlib2[${PYTHON_USEDEP}]
-		' 3.9)
 	)
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
index 5b7a6edd4e..3a2715be6f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
@@ -1,2 +1,3 @@
 DIST lxml-4.9.2.gh.tar.gz 957365 BLAKE2B 201b3977da90386e413f1b89a4b7ee1e44d6bbea05e622e92feb1d67c637ce46ebf746f0648f034ed3bccd609233ccf7d8a7ee456f13b8d9ca8587ddf1ebd32a SHA512 816b2fe2eef2a97a0df66cbc39850c6dc3d6470e4033cc73edb40c80c0afbbe6c084d042d7c98b29497926e76f648caa42e1ebe5d83060af08af6972316077b0
+DIST lxml-4.9.3-patches.tar.xz 10544 BLAKE2B 407938d2f701400e919110c3bfe84e94621f39f8178850c466d41549ee0eff4f23e93cdd8ea684713e8276acfaa05d6f7b7af4d375c859b9fc5b2981d60983a3 SHA512 c2d5d2ffb035aed6d846de84885b87142b2be7a09ffe6927e7c032acab343730acfcbefd75e8141cf3b41b308c532869a7878b515f3d4eeefa7526a3d2599398
 DIST lxml-4.9.3.gh.tar.gz 958628 BLAKE2B ffdf3fe781a03815f7c026229d313721c93375ebafad9b4a20c5d8a380a631401e546d8701a94d8c49615fb6a71e84940d8ca0299b47a37c1c9596db36659113 SHA512 903bd4935c7708b459aee9befcf3f6e3e3aaa9adc122591ea923b6e3d8fd288f07cab3f5f0edb08e3bf9db80414324f0a1a8e5a5089f9cda82f6c50f5df59423
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-4.9.3-tests-py3.11-cython3.patch b/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-4.9.3-tests-py3.11-cython3.patch
new file mode 100644
index 0000000000..1fb466ab81
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-4.9.3-tests-py3.11-cython3.patch
@@ -0,0 +1,10 @@
+--- a/src/lxml/tests/test_errors.py
++++ b/src/lxml/tests/test_errors.py
+@@ -25,6 +25,7 @@ class ErrorTestCase(HelperTestCase):
+     def test_empty_parse(self):
+         self.assertRaises(etree.XMLSyntaxError, etree.fromstring, '')
+ 
++    @unittest.skipIf(sys.version_info >= (3, 11), "Known GC failure (https://bugzilla.redhat.com/show_bug.cgi?id=2051510)")
+     @unittest.skipIf(IS_PYPY, "broken on pypy")
+     def test_element_cyclic_gc_none(self):
+         # test if cyclic reference can crash etree
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild
new file mode 100644
index 0000000000..0ec56e19ad
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild
@@ -0,0 +1,116 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 optfeature toolchain-funcs
+
+DESCRIPTION="A Pythonic binding for the libxml2 and libxslt libraries"
+HOMEPAGE="
+	https://lxml.de/
+	https://pypi.org/project/lxml/
+	https://github.com/lxml/lxml/
+"
+SRC_URI="
+	https://github.com/lxml/lxml/archive/${P}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-4.9.3-patches.tar.xz
+"
+S=${WORKDIR}/lxml-${P}
+
+LICENSE="BSD ElementTree GPL-2 PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="doc examples +threads test"
+RESTRICT="!test? ( test )"
+
+# Note: lib{xml2,xslt} are used as C libraries, not Python modules.
+DEPEND="
+	>=dev-libs/libxml2-2.10.3
+	>=dev-libs/libxslt-1.1.38
+"
+RDEPEND="
+	${DEPEND}
+"
+BDEPEND="
+	virtual/pkgconfig
+	>=dev-python/cython-0.29.35[${PYTHON_USEDEP}]
+	doc? (
+		$(python_gen_any_dep '
+			dev-python/docutils[${PYTHON_USEDEP}]
+			dev-python/pygments[${PYTHON_USEDEP}]
+			dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+		')
+	)
+	test? (
+		dev-python/cssselect[${PYTHON_USEDEP}]
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.9.3-tests-pypy.patch
+	"${FILESDIR}"/${PN}-4.9.3-tests-py3.11-cython3.patch
+	"${WORKDIR}"/${PN}-4.9.3-patches
+)
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version -b "dev-python/docutils[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/pygments[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+python_prepare_all() {
+	# avoid replacing PYTHONPATH in tests.
+	sed -i -e '/sys\.path/d' test.py || die
+
+	# don't use some random SDK on Darwin
+	sed -i -e '/_ldflags =/s/=.*isysroot.*darwin.*None/= None/' \
+		setupinfo.py || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_compile() {
+	tc-export PKG_CONFIG
+	distutils-r1_python_compile
+}
+
+python_compile_all() {
+	use doc && emake html
+}
+
+python_test() {
+	local dir=${BUILD_DIR}/test$(python_get_sitedir)/lxml
+	local -x PATH=${BUILD_DIR}/test/usr/bin:${PATH}
+
+	cp -al "${BUILD_DIR}"/{install,test} || die
+	cp -al src/lxml/tests "${dir}/" || die
+	cp -al src/lxml/html/tests "${dir}/html/" || die
+	ln -rs "${S}"/doc "${dir}"/../../ || die
+
+	"${EPYTHON}" test.py -vv --all-levels -p || die "Test ${test} fails with ${EPYTHON}"
+}
+
+python_install_all() {
+	if use doc; then
+		local DOCS=( README.rst *.txt doc/*.txt )
+		local HTML_DOCS=( doc/html/. )
+	fi
+	if use examples; then
+		dodoc -r samples
+	fi
+
+	distutils-r1_python_install_all
+}
+
+pkg_postinst() {
+	optfeature "Support for BeautifulSoup as a parser backend" dev-python/beautifulsoup4
+	optfeature "Translates CSS selectors to XPath 1.0 expressions" dev-python/cssselect
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3.ebuild
index 207b59bada..0d937323af 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3.ebuild
@@ -23,7 +23,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
index 0efcd3527e..9656cef990 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/Manifest
@@ -1 +1,3 @@
+DIST more-itertools-10.0.0.tar.gz 109938 BLAKE2B c602bd837a89010cc2d4818751e41a81379a6376efa82b7bc399f954d0fe02cd91d2eec85d5aa2621cf7c84a1b7421ff0b2794b5a80e184dcb5d220d201b5f25 SHA512 50815ebf96e416d349774dfc4b370f731f893b1e54970ae80f1f0f08b0cd1e6a94925194051561f6ab7d216916c239ac510269b93f9316bc819bf665d9da12b2
+DIST more-itertools-10.1.0.tar.gz 111235 BLAKE2B 457eb62d735ac0d0f4a93a6a79c747ac965c1af394a1d894c4f80abfa0a94de76d804c7e68d4122fabf09b7c8e2f1d59bb1c43ff54c7cd5c2d52b5a1280b0290 SHA512 520cf4a5cfce314bb43a052962b478be27f0459735902c45384ad785cd678b493bab87f5736aa6be8d742911c4e8b02c597859428b1f459550b27f7751a53494
 DIST more-itertools-9.1.0.tar.gz 107389 BLAKE2B e2f5ba6daf5ee2dbb01a9f2c07f8595418285e8472960054681a551a42e39200e40a2799c644d37a0d8654307c9119b05364e47d590c933e6082fa5be390579c SHA512 635a97caa457ede1b7ea12fd1ee75bd8722e97a089a2d35f143dc77bcbaa2e3793338513af87408476a8a1443367b270ec0d239d652fc8f96f102308e1f3e937
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.0.0.ebuild
similarity index 52%
rename from sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.0.0.ebuild
index df5b00b2ff..12fa532efc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.0.0.ebuild
@@ -4,29 +4,21 @@
 EAPI=8
 
 DISTUTILS_USE_PEP517=flit
+PYPI_NO_NORMALIZE=1
 PYTHON_COMPAT=( python3_{10..12} pypy3 )
 
-inherit distutils-r1
+inherit distutils-r1 pypi
 
-MY_P=${P/-/_}
-DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
+DESCRIPTION="More routines for operating on iterables, beyond itertools"
 HOMEPAGE="
-	https://pypi.org/project/typing-extensions/
-	https://github.com/python/typing_extensions/
+	https://github.com/more-itertools/more-itertools/
+	https://pypi.org/project/more-itertools/
 "
-SRC_URI="
-	https://github.com/python/typing_extensions/archive/${PV}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
 
-LICENSE="PSF-2"
+LICENSE="MIT"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
+distutils_enable_sphinx docs \
+	dev-python/sphinx-rtd-theme
 distutils_enable_tests unittest
-
-python_test() {
-	cd src || die
-	eunittest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.1.0.ebuild
new file mode 100644
index 0000000000..12fa532efc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/more-itertools/more-itertools-10.1.0.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYPI_NO_NORMALIZE=1
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="More routines for operating on iterables, beyond itertools"
+HOMEPAGE="
+	https://github.com/more-itertools/more-itertools/
+	https://pypi.org/project/more-itertools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+distutils_enable_sphinx docs \
+	dev-python/sphinx-rtd-theme
+distutils_enable_tests unittest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/nspektr/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/Manifest
index c369f932ba..39e612642f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/nspektr/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/Manifest
@@ -1 +1,2 @@
 DIST nspektr-0.4.0.tar.gz 7734 BLAKE2B 66a52f5080c78accc75e2193dab6d07a6257330f9938ac463c160d7e1f9740294416657193e5831f564354eb0dc3112a9ab41676e1c928ac40769d2a4d218089 SHA512 c8e8dcadd3ccd49bc9b1a38d2ff9f1d8d6f85665d3830cc9d7975ec1c63b1e2f1a7a64e12457701ca658e2e0e30cac7652be6d706a4e47ba6a61ae76d9be8875
+DIST nspektr-0.5.0.tar.gz 8573 BLAKE2B a96aaaee5cd309272d5b0c78eaf9793baf1406e427a142595b67693d513d5badac064149587c02cdf02cdd7720fafeb2787fc98a9db79cc573e77d6158afd4d4 SHA512 b7293a6ccb34a5c4b87a9b28de170322296adf2d883e7671df05ac06453023190ed588eb8e1677b7c5383b6fc5962c079d363ebb214ebb9f8516cfd2039e6167
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.4.0.ebuild
index 71d24a45e5..c48603b459 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.4.0.ebuild
@@ -24,9 +24,6 @@ RDEPEND="
 	>=dev-python/jaraco-functools-3.5.0-r2[${PYTHON_USEDEP}]
 	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
 	>=dev-python/packaging-21.3-r2[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/importlib-metadata-4.11.2[${PYTHON_USEDEP}]
-	' 3.8 3.9)
 "
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.5.0.ebuild
new file mode 100644
index 0000000000..a5cbcdf981
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/nspektr/nspektr-0.5.0.ebuild
@@ -0,0 +1,54 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 7 -- sys-apps/portage dep
+EAPI=7
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3 python3_{10..12} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Distribution package dependency inspector"
+HOMEPAGE="
+	https://github.com/jaraco/nspektr/
+	https://pypi.org/project/nspektr/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/jaraco-context-4.1.1-r2[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-functools-3.5.0-r2[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-21.3-r2[${PYTHON_USEDEP}]
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "nspektr"
+		version = "${PV}"
+		description = "package inspector"
+
+		# tests inspect itself
+		[project.optional-dependencies]
+		docs = [
+			"fake-nonexisting",
+		]
+		testing = [
+			"pytest",
+		]
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/packaging/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/packaging/Manifest
index ffd93c1622..048a982b9e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/packaging/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/packaging/Manifest
@@ -1,2 +1 @@
-DIST packaging-21.3.gh.tar.gz 80471 BLAKE2B a16ba1e74f0c868816131a7cb07b7aa0c14760cf3ad4c3d6737ac30ef99276c33b1f018d29e710f28e8d0cfb0e3e6b91e375d1d17e2b7ec6302164377cd503d0 SHA512 8960deacda26877b73d98a3b632e760e902a16ec7a04707f84044980e4d4fb33e4f584db115c9008066aa876079f28633bafe37fbd5ce9a23830b6b89eb4ae7a
 DIST packaging-23.1.tar.gz 134240 BLAKE2B ef7ef320a98592769078581e32fcc355d05f6fbb7611e7bd83fd2ed64d5f5f5d9c1f89c2a4a91ace1221214a9047e233d8d6a339fd29066b3695137ec5a870bd SHA512 0f2246b8bfeb467623ee72e6fdb7c0416e3b4ba0e00102c1528581e0835cc8e731a812b15e2e429d3ebb0001713d95cc2675f443f4597b092e305a3ef2e9137a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-21.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-21.3-r2.ebuild
deleted file mode 100644
index 45aaeb4424..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-21.3-r2.ebuild
+++ /dev/null
@@ -1,50 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 7 -- sys-apps/portage dep
-EAPI=7
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
-
-inherit distutils-r1
-
-DESCRIPTION="Core utilities for Python packages"
-HOMEPAGE="
-	https://github.com/pypa/packaging/
-	https://pypi.org/project/packaging/"
-SRC_URI="
-	https://github.com/pypa/packaging/archive/${PV}.tar.gz -> ${P}.gh.tar.gz"
-
-SLOT="0"
-LICENSE="|| ( Apache-2.0 BSD-2 )"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/pyparsing-3.0.7-r1[${PYTHON_USEDEP}]
-"
-DEPEND="
-	test? (
-		dev-python/pretend[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "packaging"
-		dynamic = ["version"]
-		description = "More routines for operating on iterables, beyond itertools"
-	EOF
-}
-
-python_test() {
-	epytest --capture=no
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index c938047ff3..6755c176f0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1,3 +1,4 @@
+DIST platformdirs-3.10.0.tar.gz 19203 BLAKE2B 951568733e4c3324d5817b3d9451aa5cc1d08afcce690a574357551f4452192cc98d406c6fc5c7d65d0a1f1d6111cb39a0877994e52021652c8c054add54f258 SHA512 39c068dad3fe6ec85247a8957c0fcfb27207e78041686a0231d836eeb431bba82583e2fcb609903bb0f479cd04e4c7866b6126e52a708e7e71eed7631bd121b0
 DIST platformdirs-3.8.0.tar.gz 18451 BLAKE2B cac717c3968fd20b7bdac464443cedcdc50b04b732ae8a212fcb946170ad1553ffae82cbdca05c2cf01ebbc4383216cd0f0afe84cddc2ce6107f10fd40213542 SHA512 64937f3e9e03a9ec8dc2068777dfe553ec09cef62ce53a753608bd9a73e0afaa4489c98046e7b4b3fdbded237cf2813bfd306a6d5ad5788031b6857d8d4fa430
 DIST platformdirs-3.8.1.tar.gz 18533 BLAKE2B d1d669fe76e52637f59c32ddb93920988821a1f1720d6b91042f80abedafc1d6dbcd5f744f22f5502121dc0b12285001cbde63e923e8159f139342a9497459e2 SHA512 85d7781e4ef0755bf9a7a4d90b92ea06f497081ec4c5438780f12876a1006b2e591c1b182f6648cad19039d1bd7611cf0c2215015653bafbad2cc529f27d94e7
 DIST platformdirs-3.9.1.tar.gz 18836 BLAKE2B d673573005e97895e4d665e1539805be7c4355d8de166481625f76fab250779e8efa81d86374fc388b24d8cc8d892f61b6dda113cdbb9419fff3357006c9b7e6 SHA512 c41d8be17c9336b5eba9dc15beb2d6db4b53d2ac06c51439542490019e25c091351c266f11fc4998b8eef00eb91399c464ac59b318bcd1ef14ebbd8350ae2c50
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.10.0.ebuild
new file mode 100644
index 0000000000..70e821d796
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.10.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest
deleted file mode 100644
index 4a9b032989..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest
+++ /dev/null
@@ -1,6 +0,0 @@
-DIST pydantic-1.10.11.gh.tar.gz 766203 BLAKE2B 5ab426a805a471baac409c82d5a0cdaa9eae0bc46c0c0643ab653db68ccd5bd6db2c2e6aa12113f513e35d590b291986d463e776515f495991e9818541ab2553 SHA512 494e692781dd8fe3980e06ba975fa0c86ad32e36bffead8c836e1680ff3c43de458ef5a344182950060fc3616208d82ad77fd9098811384208f25a9b72c0fe42
-DIST pydantic-1.10.9.gh.tar.gz 765868 BLAKE2B 802c542d75b41ff2926215bf4f6bd68a906d581db7b08ed85577f9021d259717f3ef8dbacfe381723aa042aab8720ad182c57fee188f2436b33d21164e24ba23 SHA512 d376a302eac3427cdc8da0ed2fab01c0b5e7a059447777a53c394a60dac5fa0066488be8553022bb5aa89367d5a2e80e5d6e3cb39d9272843718dd07f6acd11e
-DIST pydantic-2.0.1.tar.gz 578758 BLAKE2B 1f330806462cfbb60d4c7dac0a682e191fcdb8e4c75b36603ec7acd8115b625123cf2806248b41e1b9ac5395ca412801180db3cea7a64239ea91c59db19c71dd SHA512 cec0ab3fbe1120806e8821296b65e35c3b8711b4bb2b1d45bcf506964678b6087c5f463ad2332b19ab554f0b04ee7b4fc11f9caa6d292442fe40cdc19dfb4053
-DIST pydantic-2.0.2.tar.gz 580114 BLAKE2B 2e2f29c104889f1e38d229077b4d51d1c2498d61e92591a2ccec58b04a64464cfd7c018e9514117a820fe4b7403d599127a6ef1c1fbda6a5326af3773abd6ad7 SHA512 af06ecc5cc2fc26e6b251cdeb18ad90e15ed9ec11ce83f4d39b8f7f18adc29e3cec83f25227caa24920a9c54d0e5c4b744087dc5a8359540bba1bef7a95c67d5
-DIST pydantic-2.0.3.tar.gz 593215 BLAKE2B eff4de5d45e623e91df43eb89c3d350fdbb22adc1e05417cbb65c0dc3d58475d5e77bad046498d403a1663f7327ca6e5db517fd00f59d554532a53f4f1bbbbb6 SHA512 081f47e8948178a9cc5cf4aa17f0fb1f45d4fab28f5b89e2a56f5812c38a87ab97fb6758236fb64fc44553230807d51a9c7451c2bdbb8b77a9b0fc9083385391
-DIST pydantic-2.0.tar.gz 572748 BLAKE2B 611bb31065c1016d18137c0b5bfb0c7730243f727c1ffa3e3264f78fe750f31832d7388c177f59e0a676fa1eca7fc102e425fef59f97dc852c17b400723efc63 SHA512 830f5379f623e128f23f6d0672f0005a8b184b646e162be67fc08008f75dff53012c1576f0530ef9f6723ac664cfd662432de8f35cbcf98963ed8a680d697ce9
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/metadata.xml
deleted file mode 100644
index 52ee265cfe..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/metadata.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-	<maintainer type="project">
-		<email>python@gentoo.org</email>
-		<name>Python</name>
-	</maintainer>
-	<upstream>
-		<remote-id type="cpe">cpe:/a:pydantic_project:pydantic</remote-id>
-		<remote-id type="pypi">pydantic</remote-id>
-		<remote-id type="github">pydantic/pydantic</remote-id>
-		<bugs-to>https://github.com/pydantic/pydantic/issues</bugs-to>
-		<doc>https://docs.pydantic.dev/</doc>
-	</upstream>
-	<use>
-		<flag name="native-extensions">Compiles native "C" extensions.</flag>
-	</use>
-</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.11.ebuild
deleted file mode 100644
index 742af7f9f9..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.11.ebuild
+++ /dev/null
@@ -1,91 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 python3_{10..12} )
-
-inherit distutils-r1
-
-MY_P=${P/_beta/b}
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-SRC_URI="
-	https://github.com/pydantic/pydantic/archive/v${PV/_beta/b}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="native-extensions"
-
-RDEPEND="
-	>=dev-python/typing-extensions-4.1.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	native-extensions? (
-		<dev-python/cython-3[${PYTHON_USEDEP}]
-	)
-	test? (
-		>=dev-python/email-validator-1.2.1[${PYTHON_USEDEP}]
-		dev-python/hypothesis[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-		dev-python/python-dotenv[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	sed -i -e '/CFLAGS/d' setup.py || die
-	distutils-r1_src_prepare
-}
-
-python_compile() {
-	if [[ ${EPYTHON} == pypy3 ]] || ! use native-extensions; then
-		# do not build extensions on PyPy to workaround
-		# https://github.com/cython/cython/issues/4763
-		local -x SKIP_CYTHON=1
-	fi
-	distutils-r1_python_compile
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local -x PYTEST_PLUGINS=pytest_mock
-
-	local EPYTEST_DESELECT=(
-		# flaky test, known upstream
-		tests/test_hypothesis_plugin.py::test_can_construct_models_with_all_fields
-		# mypy linting causes regressions with new mypy versions
-		tests/mypy
-	)
-	case ${EPYTHON} in
-		pypy3)
-			EPYTEST_DESELECT+=(
-				tests/test_private_attributes.py::test_private_attribute
-				tests/test_private_attributes.py::test_private_attribute_annotation
-				tests/test_private_attributes.py::test_private_attribute_factory
-				tests/test_private_attributes.py::test_private_attribute_multiple_inheritance
-				tests/test_private_attributes.py::test_underscore_attrs_are_private
-			)
-			;;
-		python3.12)
-			EPYTEST_DESELECT+=(
-				tests/test_abc.py::test_model_subclassing_abstract_base_classes_without_implementation_raises_exception
-				tests/test_generics.py::test_partial_specification_name
-				tests/test_generics.py::test_parse_generic_json
-				tests/test_types.py::test_secretfield
-			)
-			;;
-	esac
-	rm -rf pydantic || die
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.9.ebuild
deleted file mode 100644
index 66c8c5dca6..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.9.ebuild
+++ /dev/null
@@ -1,91 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 python3_{10..12} )
-
-inherit distutils-r1
-
-MY_P=${P/_beta/b}
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-SRC_URI="
-	https://github.com/pydantic/pydantic/archive/v${PV/_beta/b}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="native-extensions"
-
-RDEPEND="
-	>=dev-python/typing-extensions-4.1.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	native-extensions? (
-		<dev-python/cython-3[${PYTHON_USEDEP}]
-	)
-	test? (
-		>=dev-python/email-validator-1.2.1[${PYTHON_USEDEP}]
-		dev-python/hypothesis[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-		dev-python/python-dotenv[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	sed -i -e '/CFLAGS/d' setup.py || die
-	distutils-r1_src_prepare
-}
-
-python_compile() {
-	if [[ ${EPYTHON} == pypy3 ]] || ! use native-extensions; then
-		# do not build extensions on PyPy to workaround
-		# https://github.com/cython/cython/issues/4763
-		local -x SKIP_CYTHON=1
-	fi
-	distutils-r1_python_compile
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local -x PYTEST_PLUGINS=pytest_mock
-
-	local EPYTEST_DESELECT=(
-		# flaky test, known upstream
-		tests/test_hypothesis_plugin.py::test_can_construct_models_with_all_fields
-		# mypy linting causes regressions with new mypy versions
-		tests/mypy
-	)
-	case ${EPYTHON} in
-		pypy3)
-			EPYTEST_DESELECT+=(
-				tests/test_private_attributes.py::test_private_attribute
-				tests/test_private_attributes.py::test_private_attribute_annotation
-				tests/test_private_attributes.py::test_private_attribute_factory
-				tests/test_private_attributes.py::test_private_attribute_multiple_inheritance
-				tests/test_private_attributes.py::test_underscore_attrs_are_private
-			)
-			;;
-		python3.12)
-			EPYTEST_DESELECT+=(
-				tests/test_abc.py::test_model_subclassing_abstract_base_classes_without_implementation_raises_exception
-				tests/test_generics.py::test_partial_specification_name
-				tests/test_generics.py::test_parse_generic_json
-				tests/test_types.py::test_secretfield
-			)
-			;;
-	esac
-	rm -rf pydantic || die
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.1.ebuild
deleted file mode 100644
index 89ea9f054c..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.1.ebuild
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS=""
-
-RDEPEND="
-	>=dev-python/annotated-types-0.4.0[${PYTHON_USEDEP}]
-	~dev-python/pydantic-core-2.0.2[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.6.1[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/hatch-fancy-pypi-readme-22.5.0[${PYTHON_USEDEP}]
-	test? (
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		>=dev-python/email-validator-2.0.0[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=()
-	local EPYTEST_IGNORE=(
-		# require pytest-examples
-		tests/test_docs.py
-	)
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.2.ebuild
deleted file mode 100644
index ad8c181a72..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.2.ebuild
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( python3_{10..12} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~riscv ~x86"
-
-RDEPEND="
-	>=dev-python/annotated-types-0.4.0[${PYTHON_USEDEP}]
-	~dev-python/pydantic-core-2.1.2[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.6.1[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/hatch-fancy-pypi-readme-22.5.0[${PYTHON_USEDEP}]
-	test? (
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		>=dev-python/email-validator-2.0.0[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=()
-	local EPYTEST_IGNORE=(
-		# require pytest-examples
-		tests/test_docs.py
-	)
-	case ${EPYTHON} in
-		python3.12)
-			EPYTEST_DESELECT+=(
-				tests/test_abc.py::test_model_subclassing_abstract_base_classes_without_implementation_raises_exception
-				tests/test_computed_fields.py::test_abstractmethod_missing
-				tests/test_edge_cases.py::test_abstractmethod_missing_for_all_decorators
-				tests/test_generics.py::test_partial_specification_name
-				tests/test_model_signature.py::test_annotated_field
-			)
-			;;
-	esac
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.3.ebuild
deleted file mode 100644
index 38f6d29f7c..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.3.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( python3_{10..12} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-
-RDEPEND="
-	>=dev-python/annotated-types-0.4.0[${PYTHON_USEDEP}]
-	~dev-python/pydantic-core-2.3.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.6.1[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/hatch-fancy-pypi-readme-22.5.0[${PYTHON_USEDEP}]
-	test? (
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		>=dev-python/email-validator-2.0.0[${PYTHON_USEDEP}]
-		>=dev-python/Faker-18.13.0[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	sed -i -e '/benchmark/d' pyproject.toml || die
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	local EPYTEST_DESELECT=()
-	local EPYTEST_IGNORE=(
-		# require pytest-examples
-		tests/test_docs.py
-		# benchmarks
-		tests/benchmarks
-	)
-	case ${EPYTHON} in
-		python3.12)
-			EPYTEST_DESELECT+=(
-				tests/test_abc.py::test_model_subclassing_abstract_base_classes_without_implementation_raises_exception
-				tests/test_computed_fields.py::test_abstractmethod_missing
-				tests/test_edge_cases.py::test_abstractmethod_missing_for_all_decorators
-				tests/test_generics.py::test_partial_specification_name
-				tests/test_model_signature.py::test_annotated_field
-			)
-			;;
-	esac
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.ebuild
deleted file mode 100644
index b4f8b35805..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-2.0.ebuild
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=hatchling
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS=""
-
-RDEPEND="
-	>=dev-python/annotated-types-0.4.0[${PYTHON_USEDEP}]
-	~dev-python/pydantic-core-2.0.1[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.6.1[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/hatch-fancy-pypi-readme-22.5.0[${PYTHON_USEDEP}]
-	test? (
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		>=dev-python/email-validator-2.0.0[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=()
-	local EPYTEST_IGNORE=(
-		# require pytest-examples
-		tests/test_docs.py
-	)
-
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
index 9d82f24750..00ec05f171 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
@@ -1 +1,2 @@
 DIST Pygments-2.15.1.tar.gz 4819591 BLAKE2B f42d3342b88c5b5745fbfbd1f76913f7d17745d396311a39627aca8e968445b19983e7c633583097c495ce6f43a6a7224262a7c35645751803b6c1172062d8c0 SHA512 408f0bbbc8226ee91b82ed084d178f114657150bcf9381dd34debb704399ccdb2e78cb5578ff297797771660d7263c51c305d03b2a27ae29269110be0bca50a9
+DIST Pygments-2.16.1.tar.gz 4872980 BLAKE2B 57ec4f52f2bca3d9df993f583434d61ad0adbc2719f2d0b4ac84160672a3a57ec144509c520f2724a15f0222548abfbe0e743fa31a8dac64d54111b2d7393ae4 SHA512 9b66c79c03e7ecd36cc00efd428a0a6b372e70dbccdcaae26eff4d56c07a17e2e00d2cf0291eb6624ffd1c896b797789b973e80ccbca4240d56daad95eacfd80
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.16.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.16.1.ebuild
new file mode 100644
index 0000000000..781fe60b07
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.16.1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYPI_NO_NORMALIZE=1
+PYPI_PN=${PN^}
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 bash-completion-r1 pypi
+
+DESCRIPTION="Pygments is a syntax highlighting package written in Python"
+HOMEPAGE="
+	https://pygments.org/
+	https://github.com/pygments/pygments/
+	https://pypi.org/project/Pygments/
+"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/lxml[${PYTHON_USEDEP}]
+		dev-python/pillow[${PYTHON_USEDEP}]
+		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
+		virtual/ttf-fonts
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fuzzing tests, very slow
+	tests/test_basic_api.py::test_random_input
+	# incompatibility with python-ctags3, apparently
+	# https://github.com/pygments/pygments/issues/2486
+	tests/test_html_formatter.py::test_ctags
+)
+
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	newbashcomp external/pygments.bashcomp pygmentize
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/Manifest
index 7a0a48dafd..133b4bd7f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/Manifest
@@ -1,2 +1,3 @@
 DIST pyparsing-3.1.0.tar.gz 882565 BLAKE2B 8ed2e15e2422ded9a558b866a5cbbdc0fb6c7ce42962710e42cfd751aae7b48bacd3d6201084189a940d262fb7b142ea37b897bae23f97a175f6152c19adb5c9 SHA512 0ad2e8fff93708426b3675e2d41da12b3f09531bf272799db4095ee618bbaa0f4b90e527ff09dda2acbdb923d59117678fbb28b82a7cfd2b395d686f47b61850
+DIST pyparsing-3.1.1.tar.gz 884814 BLAKE2B d5a2b74181d2d93575e9be43285a7156c3b796d58993397c2ed8df10467d54ef193d1f82bbdac0cecd97fb20d1cb64d79f8502b02d8886511ca90c02ac3739bb SHA512 59ae01e13277e25cabd1a1ea41a27aac9235c09746f54c0eaac53d0aae488309fe2044b3b31e1105cb8207ad3326828ec32bdd5e904cceee8b0d032740679628
 DIST pyparsing_3.0.9.gh.tar.gz 967771 BLAKE2B c13c74661b9e0d53b4886c9949b01951d220991f916362a13ce0c32c0ab05a6b1cab4d5e5a626acb7563c0ec1716348ede205cb67bf22c0710904f07404ad82a SHA512 1158f27e31f8eced540217b7234b09005eac416fad74faf59678fdae93fe2f76e0e3b5f4adfd3ceb42c8aef19150950293e989c9a5189741175073eb7a03cd6d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.0.ebuild
index 5a9966efcc..eed60b612a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.0.ebuild
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples"
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.1.ebuild
new file mode 100644
index 0000000000..5a9966efcc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pyparsing/pyparsing-3.1.1.ebuild
@@ -0,0 +1,47 @@
+# Copyright 2004-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Easy-to-use Python module for text parsing"
+HOMEPAGE="
+	https://github.com/pyparsing/pyparsing/
+	https://pypi.org/project/pyparsing/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="examples"
+
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	# railroad-diagrams not packaged (and not suitable for packaging yet)
+	tests/test_diagram.py
+)
+
+EPYTEST_DESELECT=(
+	# also railroad-diagrams
+	tests/test_examples.py::TestExamples::test_range_check
+	tests/test_unit.py::Test02_WithoutPackrat::testEmptyExpressionsAreHandledProperly
+	tests/test_unit.py::Test04_WithPackrat::testEmptyExpressionsAreHandledProperly
+	tests/test_unit.py::Test06_WithBoundedPackrat::testEmptyExpressionsAreHandledProperly
+	tests/test_unit.py::Test08_WithUnboundedPackrat::testEmptyExpressionsAreHandledProperly
+	tests/test_unit.py::Test09_WithLeftRecursionParsing::testEmptyExpressionsAreHandledProperly
+	tests/test_unit.py::Test10_WithLeftRecursionParsingBoundedMemo::testEmptyExpressionsAreHandledProperly
+)
+
+python_install_all() {
+	if use examples; then
+		docompress -x /usr/share/doc/${PF}/examples
+		dodoc -r examples
+	fi
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0-r1.ebuild
index ab9edfcc5a..6241349f1e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0-r1.ebuild
@@ -34,9 +34,6 @@ RDEPEND="
 	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
 	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
 	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/importlib-metadata-4.11.1[${PYTHON_USEDEP}]
-	' 3.9)
 "
 BDEPEND="
 	${RDEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild
index 9a271b1098..2f07f855a1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild
@@ -34,9 +34,6 @@ RDEPEND="
 	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
 	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
 	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/importlib-metadata-4.11.1[${PYTHON_USEDEP}]
-	' 3.9)
 "
 BDEPEND="
 	${RDEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index cee96b74d8..f3af271c07 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1,3 +1 @@
-DIST typing_extensions-4.6.3.gh.tar.gz 75114 BLAKE2B 2c6761d26de5ce4a09c2957e93225798d282dcbc5689921f72acd2ccc338e458e21b2b73884af4a329c65f1a7eed7898e13e87fdab7fce757b4927adcdb09770 SHA512 4c8dd4e1494ed504466f3188146059203f9ce37b8f2d9f70929c1bffa7e58bee87c3ef01162cedb55ba3fd048cec0da96cc4141b25ba76dc32c7d493a69efeab
-DIST typing_extensions-4.7.0.gh.tar.gz 84473 BLAKE2B 786a305e31a93ca70e964a42209f3e8f5574950054305b4bea077b0ba5452a478c10f2c8e6b2fbe13460d1f5e8fa12d1b6df18b2260ba62eeca7b3b7d7948715 SHA512 02c72581a197af989996f7d887919a6c91966d3c1d15a39dee9670a37b61e796c3aff7e544b01d9d2bd3932024a27054f03ccbe1a4b0370a310454bcebf904f3
 DIST typing_extensions-4.7.1.gh.tar.gz 84841 BLAKE2B 9b49b37c90b90775995d9d77b6b480eeab51b71a9af9474c0f43db021106ff02d0e4e882be04c114477ff2b386037c286e9de2d9cd2394bd4e1459ce7c6e1951 SHA512 948f6c5c9597f6cf7d77987d1a5dad9f15b4303f9d156de3d97abda0c55567b2649eb6df7ac36a07f9d6306103d81fd00a38b04b3b5c521ff2f8f153f9219fb1
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.6.3.ebuild
deleted file mode 100644
index 7cbafe6461..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.6.3.ebuild
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1
-
-MY_P=${P/-/_}
-DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
-HOMEPAGE="
-	https://pypi.org/project/typing-extensions/
-	https://github.com/python/typing_extensions/
-"
-SRC_URI="
-	https://github.com/python/typing_extensions/archive/${PV}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests unittest
-
-python_test() {
-	cd src || die
-	eunittest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.1.ebuild
index df5b00b2ff..7cbafe6461 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.7.1.ebuild
@@ -22,7 +22,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_tests unittest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
index e8a990def9..260d9a5ce6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
@@ -1 +1,3 @@
 DIST wheel-0.40.0.tar.gz 96226 BLAKE2B f4207ab822f037a3d8decc50643ad7e49a632028c712bc33c680d178f10117ff0aa4f2a971bf739a77a76dbf818360d0f628ce997b942ee9d85ec7fac28badc8 SHA512 211e68d927c93b9b2748bf081097d1172cf8d4863d540be72f1d6023b64042410805d4208a2c94de89a1eeb0fb32044e78f41ab58ac94498ac0c489a1eea0d23
+DIST wheel-0.41.0.tar.gz 96943 BLAKE2B 8c0c4509640023c6fea2f680b24707b5ba75da50f54ffc4efe06355dfb6cd06c83fc15763666dc31c6ed83deebe552189bbaeda6fd3cba356a79f71f0992d1f9 SHA512 2e5099f5d512dd8e2205cfefa68e9229a7713367ec367f580021eeb68fb5bc0382bd89a524aa8f0d7617eb26f5d57eaa5e0976d94d042a6ffa20738624d3bae7
+DIST wheel-0.41.1.tar.gz 97605 BLAKE2B 499474c0f8e6cedf68566981b45f47e3460920c4ef0f64780c8b585360633197befe1dca453df68318b152c3912b0f94ce7c830ca08f98740ce63f1be297b2e9 SHA512 706db476563f35d16b6657b81c81290fb684ee0cf4ba54d11faafe00ccbc626b43736dfc59d1f75469f82b4f6006db35dba5d4c9bc2a1a436aeafcbe94386714
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.0.ebuild
new file mode 100644
index 0000000000..63a78566d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.0.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A built-package format for Python"
+HOMEPAGE="
+	https://github.com/pypa/wheel/
+	https://pypi.org/project/wheel/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_prepare() {
+	# unbundle packaging
+	rm -r src/wheel/vendored || die
+	sed -i -e 's:\.vendored\.::' src/wheel/*.py || die
+	sed -i -e 's:wheel\.vendored\.::' tests/*.py || die
+
+	distutils-r1_src_prepare
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.1.ebuild
new file mode 100644
index 0000000000..63a78566d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.41.1.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A built-package format for Python"
+HOMEPAGE="
+	https://github.com/pypa/wheel/
+	https://pypi.org/project/wheel/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_prepare() {
+	# unbundle packaging
+	rm -r src/wheel/vendored || die
+	sed -i -e 's:\.vendored\.::' src/wheel/*.py || die
+	sed -i -e 's:wheel\.vendored\.::' tests/*.py || die
+
+	distutils-r1_src_prepare
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/b2/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/b2/Manifest
index 1bc47347ca..4282ea521e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/b2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/b2/Manifest
@@ -1,3 +1,2 @@
-DIST b2-4.10.0.tar.gz 982436 BLAKE2B 7e408e4ae67cf483c972fd7cefda39938c7819aa28e3ef358f44efe19ef43014d52fe32be40e27f33c27db760833948bbeb54e4ee99fd7ebb4e73e8ea3618c6b SHA512 251a3e07b18cbc768e7423d6259eec7466dfb33d2bab1e2f88bc0896574c854338429b591e6961c0d81c17b9ec6eb4cda06f46a8952f5ca4e4fa8bffb69a50d7
 DIST b2-4.10.1.tar.gz 982429 BLAKE2B bb1e6ef741ca10d3b0029e64d69a7ee7eb0d40d26c68d2a3932d4210e8e2a83131c9bac2d54f2885373725d58fe73dd7fa7aebfc5781059f01c3462c738d426c SHA512 0bc4897a342685190626a6593926c4b200c5ca9b498ba77287a7c49467a8e3f65cb850b9616fd05d4aea9ebfab32ec46792d7d8226bed89911a711ce14ecce30
 DIST b2-4.9.6.tar.gz 977724 BLAKE2B 15ce459d7051be037bdb477432591baccb4e5339a16385a63205c19815766406f631879f0e1f986e184640466f5b6af5ade72d248975731528032a8e735e483e SHA512 a3dc9dccbf1221971607a15df642d4ad9029c1acaf329e419f363a6e6ddb6062a8ef595aa49810dc2ff3a3f333bfbaed7384819a143cc5847a95daf6fd48ccb1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/b2/b2-4.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/b2/b2-4.10.0.ebuild
deleted file mode 100644
index 84055fa002..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/b2/b2-4.10.0.ebuild
+++ /dev/null
@@ -1,70 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo flag-o-matic toolchain-funcs
-
-MY_PV="$(ver_rs 1- _)"
-
-DESCRIPTION="A system for large project software construction, simple to use and powerful"
-HOMEPAGE="https://www.bfgroup.xyz/b2/"
-SRC_URI="https://github.com/bfgroup/b2/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
-S="${WORKDIR}/${P}/src"
-
-LICENSE="Boost-1.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="examples"
-RESTRICT="test"
-
-RDEPEND="!dev-util/boost-build"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-4.9.2-disable_python_rpath.patch
-	"${FILESDIR}"/${PN}-4.9.2-darwin-gentoo-toolchain.patch
-	"${FILESDIR}"/${PN}-4.9.2-add-none-feature-options.patch
-	"${FILESDIR}"/${PN}-4.9.2-no-implicit-march-flags.patch
-	"${FILESDIR}"/${PN}-4.9.2-odr.patch
-)
-
-src_configure() {
-	# need to enable LFS explicitly for 64-bit offsets on 32-bit hosts (#761100)
-	append-lfs-flags
-}
-
-src_compile() {
-	cd engine || die
-
-	# upstream doesn't want separate flags for CPPFLAGS/LDFLAGS
-	# https://github.com/bfgroup/b2/pull/187#issuecomment-1335688424
-	edo ${CONFIG_SHELL:-${BASH}} ./build.sh cxx \
-		--cxx="$(tc-getCXX)" \
-		--cxxflags="${CXXFLAGS} ${CPPFLAGS} ${LDFLAGS}" \
-		-d+2 \
-		--without-python
-}
-
-src_test() {
-	# Forget tests, b2 is a lost cause
-	:
-}
-
-src_install() {
-	dobin engine/b2
-
-	insinto /usr/share/b2/src
-	doins -r "${FILESDIR}/site-config.jam" \
-		bootstrap.jam build-system.jam ../example/user-config.jam \
-		build kernel options tools util
-
-	find "${ED}"/usr/share/b2/src -iname '*.py' -delete || die
-
-	dodoc ../notes/{changes,release_procedure,build_dir_option,relative_source_paths}.txt
-
-	if use examples; then
-		docinto examples
-		dodoc -r ../example/.
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/Manifest
index 5ed5323362..ad44f7911b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/Manifest
@@ -1 +1,2 @@
 DIST devscripts_2.22.2.tar.xz 995524 BLAKE2B a7649ea5b790a64b5470a66425e487959b058e9af34be173210277765c8610f7d6da1b9105f97e1da2f84a578ca7514b1dabaa7c38a88c9b1eef29c2f34f97a1 SHA512 d6c47f604a252f58e1cf8ea9fe7387a390683757144bb76cce6915fca1ff7ccb71ce6c87d829f874097d869172774a806b506dc7fb4187876d14e50eaaf92593
+DIST devscripts_2.23.5.tar.xz 991592 BLAKE2B e5932d3d98f555b9585c4b9b3e0932c8ea56a572c474db1c27caa175de2af1c2d5ed9f1cd37bdc6eb4e886000c31d7389b2c1943a53091d2dcc75081959a277f SHA512 c1ca4d664ff03d4952f89612dfad9aa6ffd2a51ea90945d28a3b85ba8bc6d2be3e35d84339369e1fd4eb25e99a1d6773051e34cc93df83e3927ab6d53d61d393
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/checkbashisms-2.23.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/checkbashisms-2.23.5.ebuild
new file mode 100644
index 0000000000..c8583d535c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/checkbashisms/checkbashisms-2.23.5.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MY_PN="devscripts"
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="Perl script to check for commonly used bash features not defined by POSIX"
+HOMEPAGE="https://packages.debian.org/devscripts https://salsa.debian.org/debian/devscripts"
+SRC_URI="mirror://debian/pool/main/d/${MY_PN}/${MY_P/-/_}.tar.xz"
+S="${WORKDIR}/${MY_PN}/scripts"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+
+# Requires python packages to check tools we don't need anyway
+RESTRICT="test"
+
+RDEPEND="dev-lang/perl
+	virtual/perl-Getopt-Long"
+
+src_prepare() {
+	default
+
+	sed "s@###VERSION###@${PV}@" -i checkbashisms.pl || die
+}
+
+src_compile() { :; }
+
+src_install() {
+	newbin ${PN}.pl ${PN}
+	doman ${PN}.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
index 348c2db250..a75779752d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
@@ -2,7 +2,13 @@ DIST cmake-3.26.4-SHA-256.txt 1646 BLAKE2B a92cecbe635cb7a01be338ca9554de5603124
 DIST cmake-3.26.4-SHA-256.txt.asc 833 BLAKE2B c33f4d8cc1ba271a06b427e4bb5cb39e38f768c497aec6df07ffe9f7be997c5df88024e0de09902e6169cbad9020b20f024ef277cefc45b5cd172ed7a819e1bb SHA512 d3ddbe0c31a1093dfd4bed26dae7959e5682d367695fd4f6f021e327b8335d33fcf7b0259149f449be82da224ee74c276b135ac2860917535fb5a19b4f0f6334
 DIST cmake-3.26.4-docs.tar.xz 507352 BLAKE2B 9d7e4bb2292d22f93c5435e30317cb0701dc9c6ad6b397fc9108050217917f48ded84b2d6094782e2e8a502e693a8e45c5c659e65db3857dbcac261910890861 SHA512 95ef908381501bd8189113a7a520e70d81dbb4e1f416cfe38cbf7005e76f3571b964496d33980975835ff02634f85e1eb170a575e0ea30bfa749043cad84c605
 DIST cmake-3.26.4.tar.gz 10669686 BLAKE2B 34508c724e0d4967e010917f6fac6f426b0d835c38cd197b64e70a18febee1c3efff5f5edc5cd7c5080881bd5c1d77d03243b5dcf8b47f238fa4ac4e5996072f SHA512 fe817c8d5e247db3f0a9a58ee37c466a47220100d9e90711cd5d06c223cef87e41d1a756e75d1537e5f8cd010dcb8971cbeab4684b1ac12bcecf84bf7b720167
-DIST cmake-3.27.0-rc4.tar.gz 10976281 BLAKE2B 423e5b83799b2b427d91fb1ca9f49de59f197738117375938a47c3d496d3be0db6fc6fa77720b88e8378a40baeede1892746ad49a95dec0af233d68d7746a3ee SHA512 acc5d83605a227005ac8f193dac1a3f4d3c1f2356c259672db1b705e59e5850cf261bdb7fa8a03147af7ec0547e8be4fd6ed3afb539154f95f068eeaab7f00e4
-DIST cmake-3.27.0-rc5.tar.gz 10978359 BLAKE2B 554847389a81ccce9aafc8b678a9d521c4f68f558451282f85212afc40e3508f6d0fd2ebd09c7a21a31728588968ac85ed426d9e0aab653494d55f666c2e9cff SHA512 b6be7a3b2aba827843e3f5cb2ac9ad21d7c9f8cd4913c0c1d64c7ccbc48654889b5d7e854613a87ebc780dc8381b48e8ae74d5b10209aaf82728d538bd600717
-DIST cmake-3.27.0_rc4-docs.tar.xz 520640 BLAKE2B 8ea770a2fd4a53e1246406cf6990978bda11cfe93b1be0908a130b827d91621685b5d232d039cc88530a6331454d2741adcef75c0c9372d0f9a6f0d0626756a6 SHA512 e145e23036d2ebf24d8a89ac3497d1cfa33a95cabbbd6c7ade6d6199db25062fe288551a05549a0c8c40507adce0c87ea6c316a62c3f809df6aec822e34cfa66
-DIST cmake-3.27.0_rc5-docs.tar.xz 521192 BLAKE2B 275f7cf69b16f935b6b82b485c18ce6b8f33737119386116643e115a1bd1a675d5bb02a1467ba22ddc17d377c044bab3563d1e34e68a215ce1a3b974ada09b69 SHA512 918b01cef0791bf58fccad9cc3365f050c87077d43a968ceb84255fcd9bff6ed9a070c3afc8a14914488a06bbd978fd69940cc64ff2affeb7f832da47a552670
+DIST cmake-3.26.5-SHA-256.txt 1646 BLAKE2B 242688153008e99bab046fc6e32d20990cd5f654bed67a6d5de0c41b140a6b53adaa797de71ce4dce2cfb120e3472726ab79b871e7926600689e0ae11016ba2d SHA512 f333cdbb2a77ba4c697df3dc270c73e5847b1361d70f5900602226997362a22563b6e1c2eecce35a5cb4ee04a157795c78e4ed426d407aa63b5e04b2be7d1ece
+DIST cmake-3.26.5-SHA-256.txt.asc 833 BLAKE2B 4014785626e30f4ee2bb9bfeb1bb5398040c96b2303e657ee938fcfc6302f54515b4b2a4c2bcb1cb212a1c849b128e0f18e4f34c0ba7b99a5d25c606a631819a SHA512 fef08f30627641ac4ea0aabaec099ad0cae0c0b957419328f37b1ba88f9103069213d2bcf6f733941a254fd4913981e3c5367bf422b9873e59001644b4e760a5
+DIST cmake-3.26.5.tar.gz 10669227 BLAKE2B 23d9df4becaf26da6698f1601ed080a63124c1ab4df7b087423feeab4fd0e7596803eb807b52eb87bd50c894ec3ecef9c046349c1d2d14f7384a38fe9f61830d SHA512 43c17e00d6f326b96ea47c62bbffd19409281641b297b2362e4ed6a696e7e618d2ff265a213634bfa4c1200c3f581531fde6507f282a9460ab65af6c7bab61de
+DIST cmake-3.27.0-SHA-256.txt 1646 BLAKE2B 262ec1c374029603877015351bd3b25f60a9b311f98b4f9a85df573bfd468a06dce2161354c07affe17221633efcc2677d1c93f303c05b93a6e8548bdd8b9f72 SHA512 d91813fe3df1a5a3d06991c6abe3afa8dc5a9236b93e427b05c077a138e53a42e367cfacb76da562e6c6db01411bfea4ecb416363a3f724c10616cbcfb0a2ad4
+DIST cmake-3.27.0-SHA-256.txt.asc 833 BLAKE2B a86db55c45440770ae200e7e9e0b01329df8758588de15a8c3ed96f82f6493e3e3a059b81fe42e7fcae36ae52da7b4c8ee3b90359b6e35103596bfbe098b6af6 SHA512 441aa1a17973913005992079b3de54dea42239830ec52741de089ef978e084d1e233c375fccab1cee08d4d18bbd6197417771de6aec8335752a2ca5efebbf181
+DIST cmake-3.27.0-docs.tar.xz 521348 BLAKE2B 319c84195c37b1944bb5d3fde1aeae75623fc90a734c1ba74d730cd5678bff75806f7aa8aa8171fd7878a09b3316c9c0ee23c0c055e869a4385f54987f86d801 SHA512 e9c300526f9fe4e450e921308b7af42f4b8972f2f546f7bbf2dffb4ca696793fe09f1610636b05c82b1cf74ed8ef95377bec69e15f8c9197d6960e674e0d5400
+DIST cmake-3.27.0.tar.gz 10977223 BLAKE2B a031002dc662552c7af2da35494b536c359011c035216286d22dd78d3b6f607d1a552b5296f14117956f20dd61b94036004912f2e834957e0aacb8bb5037ed75 SHA512 8b5836ac1c1f1e741ebbf6c9a1c9dca322dfd963598838a8789cd926fc071bde2fc53e42b6a2d5d8697f12d96dbf2cebdf03817d7d84b68256ef80b779a27fed
+DIST cmake-3.27.1-SHA-256.txt 1646 BLAKE2B 3437dc50b66a014569e9194c609cdcb6022175f6220685d24f5276af4348ffd93db8a18108e54d00d62e54889181cccc09e722fccdd10475515f91b55859d12d SHA512 b0a48431e333dd0cc2670b630340e39015617f9d49a3c43c6181d8e669f33abc00d4c08fab8d59aecadbbbba031136136897a1f1a4cf5dec849ca868592c7e9f
+DIST cmake-3.27.1-SHA-256.txt.asc 833 BLAKE2B 17dbb29edcf09501455dffe090f3973083e38134559131572a55b065eae5494541b56589f78d55467cfa1ef1d3e8cba180a7dc3c949531193fc9ef3102feaad5 SHA512 bbe31efe4ffbae5d82483a677dab86586477b0af0e79dd6bfe85ae266b09a1881bf31249d91023f41fdcab066e558e52a1e7eb12dfbbea44f297d3d8eeaaea48
+DIST cmake-3.27.1.tar.gz 10977868 BLAKE2B dcb998e45d238ba94ff9422a30014b274d1db48f094c7e027717b7b271bb0c63e4f11cae29552683e747f9872ccddbaaefa4d90a0113dc409d556ad0743835f6 SHA512 d8831105fed3772bcb821a2b184fe0ffbff15795a5b0a89f2ad1cb0372a40c8f22f2bab72c671a6d17464521b7337067df929a5c3ece99f84848cc3a2fe6716f
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r2.ebuild
index 9671aad54a..db31f9608f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r2.ebuild
@@ -65,7 +65,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash
+	app-crypt/rhash:0=
 	>=dev-libs/expat-2.0.1
 	>=dev-libs/jsoncpp-1.9.2-r2:0=
 	>=dev-libs/libuv-1.10.0:=
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.5-r1.ebuild
new file mode 100644
index 0000000000..1a57865860
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.5-r1.ebuild
@@ -0,0 +1,294 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
+CMAKE_DOCS_VERSION=3.26.4
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake elisp-common flag-o-matic multiprocessing \
+	toolchain-funcs virtualx xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="CMake"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} emacs ncurses qt5 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	emacs? ( >=app-editors/emacs-23.1:* )
+	ncurses? ( sys-libs/ncurses:0= )
+	qt5? (
+		dev-qt/qtcore:5
+		dev-qt/qtgui:5
+		dev-qt/qtwidgets:5
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.16.0_rc4-darwin-bundle.patch
+	"${FILESDIR}"/${PN}-3.14.0_rc3-prefix-dirs.patch
+	"${FILESDIR}"/${PN}-3.19.1-darwin-gcc.patch
+
+	# Handle gentoo packaging in find modules
+	"${FILESDIR}"/${PN}-3.17.0_rc1-FindBLAS.patch
+	# Next patch needs to be reworked
+	#"${FILESDIR}"/${PN}-3.17.0_rc1-FindLAPACK.patch
+	"${FILESDIR}"/${PN}-3.5.2-FindQt4.patch
+
+	# Respect python eclasses
+	"${FILESDIR}"/${PN}-2.8.10.2-FindPythonLibs.patch
+	"${FILESDIR}"/${PN}-3.9.0_rc2-FindPythonInterp.patch
+
+	"${FILESDIR}"/${PN}-3.18.0-filter_distcc_warning.patch # bug 691544
+
+	# upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+	)
+	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
+
+	cmake_src_configure
+}
+
+src_compile() {
+	cmake_src_compile
+	use emacs && elisp-compile Auxiliary/cmake-mode.el
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	virtx cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	if use emacs; then
+		elisp-install ${PN} Auxiliary/cmake-mode.el Auxiliary/cmake-mode.elc
+		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	use emacs && elisp-site-regen
+
+	if use qt5; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	use emacs && elisp-site-regen
+
+	if use qt5; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc5.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild
index a80e655595..4afe435263 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild
@@ -65,7 +65,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash
+	app-crypt/rhash:0=
 	>=dev-libs/expat-2.0.1
 	>=dev-libs/jsoncpp-1.9.2-r2:0=
 	>=dev-libs/libuv-1.10.0:=
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc4.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc4.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild
index a80e655595..9d987065b9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0_rc4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild
@@ -10,7 +10,7 @@ EAPI=8
 
 CMAKE_DOCS_PREBUILT_DEV=sam
 #CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-CMAKE_DOCS_VERSION=${PV}
+CMAKE_DOCS_VERSION=3.27.0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # See bug #784815
 CMAKE_DOCS_USEFLAG="+doc"
@@ -65,7 +65,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash
+	app-crypt/rhash:0=
 	>=dev-libs/expat-2.0.1
 	>=dev-libs/jsoncpp-1.9.2-r2:0=
 	>=dev-libs/libuv-1.10.0:=
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
index a80e655595..4afe435263 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
@@ -65,7 +65,7 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash
+	app-crypt/rhash:0=
 	>=dev-libs/expat-2.0.1
 	>=dev-libs/jsoncpp-1.9.2-r2:0=
 	>=dev-libs/libuv-1.10.0:=
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-9999.ebuild
index 86cedf266f..fefd68d177 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-9999.ebuild
@@ -44,10 +44,6 @@ RDEPEND="
 	virtual/pkgconfig
 "
 
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.63-xtools-support.patch
-)
-
 python_prepare_all() {
 	local disable_unittests=(
 		# ASAN and sandbox both want control over LD_PRELOAD
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
index b4fbaa1c84..e00b1f7629 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
@@ -9,7 +9,7 @@ DESCRIPTION="Small utility to modify the dynamic linker and RPATH of ELF executa
 HOMEPAGE="https://github.com/NixOS/patchelf"
 SRC_URI="https://github.com/NixOS/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ~hppa ~ia64 ~loong ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~riscv-linux ~x86-linux"
+KEYWORDS="amd64 arm arm64 hppa ~ia64 ~loong ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~riscv-linux ~x86-linux"
 LICENSE="GPL-3"
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
index e0985acad3..73821e1bd0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
@@ -1,3 +1,2 @@
 DIST pkgconf-1.8.1.tar.xz 302372 BLAKE2B 591961f0b1fd185834fd8e2a672199cffc035139599817b1d56d571300d2aa800a719c9477aac4023dfade597ad3cc3b45360babe57498977568ee57077c7bbe SHA512 7a7d5204c1c9bfb6578bda56f299d1fa0300e69a133a65730b10ad77aefbf26fceb74ae77cecda326b3ed5db5736f27fcce94764b3a56d40f4bb99fecdc80bba
-DIST pkgconf-1.9.4.tar.xz 309164 BLAKE2B f0a99f9c7aaf571b14aa24b6dae441fb041d794294e560601232c03254e521a49a5724e41c5ada537f7933bb4831b63482896c8569a9502c8c5d841190e1d091 SHA512 079436244f3942161f91c961c96d382a85082079c9843fec5ddd7fb245ba7500a9f7a201b5ef2c70a7a079fe1aacf3a52b73de5402a6f061df87bcdcf0a90755
-DIST pkgconf-1.9.5.tar.xz 310068 BLAKE2B 196babfccbf34c10bf08eb52fe1a4366273e07fcc97fb42d117295bb1cb141811e6a0453597b4aab31dc2bfc06baf9b2507484c68cd6c7474c94e5676a743d0e SHA512 604853d8bb1c3ca14e696f83ac5b161e2592defb921d53e1c16cc949d4b9ecac2b12983c1fbbb3c89898323bda18c8749bff3946e049c8305a1a39a773265f09
+DIST pkgconf-2.0.0.tar.xz 310204 BLAKE2B c3c35724fddce349702e86046be5ddf359d8e1278e175ffbe46d6f202ef9cd14d41c76f3eb09de18ec2c67a45d7c45f0ba6e600d5873535aa63eb8361dd5df7e SHA512 6f40201a1e5d400358bb5218647d3160d42881c4a7d1bc3c8a75b306e47dc2ed1204268b2bdac0c14068e66cd3defe211570263274de7fedd0206b7dd343613d
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/metadata.xml
index 53180d5fbb..f29f620472 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/metadata.xml
@@ -1,10 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>floppym@gentoo.org</email>
-		<name>Mike Gilbert</name>
-	</maintainer>
 	<maintainer type="project">
 		<email>base-system@gentoo.org</email>
 	</maintainer>
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild
deleted file mode 100644
index 903ca97e29..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild
+++ /dev/null
@@ -1,70 +0,0 @@
-# Copyright 2012-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib multilib-minimal
-
-if [[ ${PV} == 9999 ]] ; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
-else
-	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	# Per release notes, 1.9.x is a testing/development release.
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
-HOMEPAGE="https://gitea.treehouse.systems/ariadne/pkgconf"
-
-LICENSE="ISC"
-SLOT="0/4"
-IUSE="test"
-
-RESTRICT="!test? ( test )"
-
-BDEPEND="
-	test? (
-		dev-libs/atf
-		dev-util/kyua
-	)
-"
-RDEPEND="!dev-util/pkgconfig"
-
-src_prepare() {
-	default
-
-	[[ ${PV} == 9999 ]] && eautoreconf
-
-	MULTILIB_CHOST_TOOLS=(
-		/usr/bin/pkgconf
-		/usr/bin/pkg-config$(get_exeext)
-	)
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		--with-system-includedir="${EPREFIX}/usr/include"
-		--with-system-libdir="${EPREFIX}/$(get_libdir):${EPREFIX}/usr/$(get_libdir)"
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_test() {
-	unset PKG_CONFIG_LIBDIR PKG_CONFIG_PATH
-	default
-}
-
-multilib_src_install() {
-	default
-
-	dosym pkgconf$(get_exeext) /usr/bin/pkg-config$(get_exeext)
-	dosym pkgconf.1 /usr/share/man/man1/pkg-config.1
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	find "${ED}" -type f -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.0.0.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.4.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.0.0.ebuild
index 903ca97e29..742423bfd5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-2.0.0.ebuild
@@ -10,8 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	# Per release notes, 1.9.x is a testing/development release.
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-9999.ebuild
index 903ca97e29..742423bfd5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-9999.ebuild
@@ -10,8 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.ariadne.space/${PN}/${P}.tar.xz"
-	# Per release notes, 1.9.x is a testing/development release.
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild
index 80824ce5ae..d495c2cd60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.41.0.ebuild
@@ -50,7 +50,7 @@ if [[ ${PV} != *9999 ]]; then
 	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
index d70f2cbf1f..16b3e300cc 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
@@ -651,6 +651,10 @@ cmake_build() {
 			;;
 		ninja)
 			[[ -e build.ninja ]] || die "build.ninja not found. Error during configure stage."
+			case ${CMAKE_VERBOSE} in
+				OFF) NINJA_VERBOSE=OFF eninja "$@" ;;
+				*) eninja "$@" ;;
+			esac
 			eninja "$@"
 			;;
 	esac
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index fd9bf47aa9..658d26f2a4 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -191,6 +191,7 @@ esac
 if [[ -z ${_DISTUTILS_R1_ECLASS} ]]; then
 _DISTUTILS_R1_ECLASS=1
 
+inherit flag-o-matic
 inherit multibuild multilib multiprocessing ninja-utils toolchain-funcs
 
 if [[ ! ${DISTUTILS_SINGLE_IMPL} ]]; then
@@ -271,8 +272,7 @@ _distutils_set_globals() {
 				;;
 			setuptools)
 				bdep+='
-					>=dev-python/setuptools-67.7.2[${PYTHON_USEDEP}]
-					>=dev-python/wheel-0.40.0[${PYTHON_USEDEP}]
+					>=dev-python/setuptools-67.8.0-r1[${PYTHON_USEDEP}]
 				'
 				;;
 			sip)
@@ -292,7 +292,7 @@ _distutils_set_globals() {
 			eqawarn "is enabled."
 		fi
 	else
-		local setuptools_dep='>=dev-python/setuptools-67.7.2[${PYTHON_USEDEP}]'
+		local setuptools_dep='>=dev-python/setuptools-67.8.0-r1[${PYTHON_USEDEP}]'
 
 		case ${DISTUTILS_USE_SETUPTOOLS:-bdepend} in
 			no|manual)
@@ -1718,7 +1718,7 @@ distutils-r1_python_install() {
 		# python likes to compile any module it sees, which triggers sandbox
 		# failures if some packages haven't compiled their modules yet.
 		addpredict "${EPREFIX}/usr/lib/${EPYTHON}"
-		addpredict "${EPREFIX}/usr/lib/pypy3.9"
+		addpredict "${EPREFIX}/usr/lib/pypy3.10"
 		addpredict "${EPREFIX}/usr/local" # bug 498232
 
 		if [[ ! ${DISTUTILS_SINGLE_IMPL} ]]; then
@@ -1836,6 +1836,12 @@ distutils-r1_run_phase() {
 		local -x CYTHON_FORCE_REGEN=1
 	fi
 
+	# Rust extensions are incompatible with C/C++ LTO compiler
+	# see e.g. https://bugs.gentoo.org/910220
+	if has cargo ${INHERITED}; then
+		filter-lto
+	fi
+
 	# How to build Python modules in different worlds...
 	local ldopts
 	case "${CHOST}" in
@@ -1974,7 +1980,7 @@ _distutils-r1_post_python_compile() {
 			die "${rscriptdir} should not exist!"
 		if [[ -d ${bindir} ]]; then
 			mkdir -p "${rscriptdir}" || die
-			cp -a --reflink=auto "${bindir}"/. "${rscriptdir}"/ || die
+			cp -a "${bindir}"/. "${rscriptdir}"/ || die
 		fi
 
 		# enable venv magic inside the install tree
diff --git a/sdk_container/src/third_party/portage-stable/eclass/git-r3.eclass b/sdk_container/src/third_party/portage-stable/eclass/git-r3.eclass
index e9fdf2ac3a..83c5ab590c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/git-r3.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/git-r3.eclass
@@ -10,6 +10,21 @@
 # Third generation eclass for easing maintenance of live ebuilds using
 # git as remote repository.
 
+# @ECLASS_VARIABLE: EGIT_LFS
+# @PRE_INHERIT
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# If set, git lfs support will be enabled.
+# Set before inheriting this eclass.
+
+# @ECLASS_VARIABLE: _NUM_LFS_FILTERS_FOUND
+# @INTERNAL
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# This is used to provide QA warnings if a repo has git lfs filters
+# defined but EGIT_LFS is not turned on and vice versa.
+# If non-empty, then the repo likely needs EGIT_LFS to clone properly.
+
 case ${EAPI} in
 	6|7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
@@ -22,8 +37,10 @@ PROPERTIES+=" live"
 
 if [[ ${EAPI} != 6 ]]; then
 	BDEPEND=">=dev-vcs/git-1.8.2.1[curl]"
+	[[ ${EGIT_LFS} ]] && BDEPEND+=" dev-vcs/git-lfs"
 else
 	DEPEND=">=dev-vcs/git-1.8.2.1[curl]"
+	[[ ${EGIT_LFS} ]] && DEPEND+=" dev-vcs/git-lfs"
 fi
 
 # @ECLASS_VARIABLE: EGIT_CLONE_TYPE
@@ -81,6 +98,28 @@ fi
 # fatal errors rather than 'non-pretty versions'.
 : "${EGIT_MIN_CLONE_TYPE:=shallow}"
 
+# @ECLASS_VARIABLE: EGIT_LFS_CLONE_TYPE
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Type of lfs clone that should be used against the remote repository.
+# This can be either of: 'mirror', 'single', 'shallow'.
+#
+# This works a bit differently than EGIT_CLONE_TYPE.
+#
+# The 'mirror' type clones all LFS files that is available from the
+# cloned repo. Is is mostly useful for backup or rehosting purposes as
+# the disk usage will be excessive.
+#
+# The 'single' type clones only the LFS files from the current commit.
+# However unlike 'shallow', it will not cleanup stale LFS files.
+#
+# The 'shallow' type clones only the LFS files from the current commit.
+# LFS files that are not referenced by the current commit and more than
+# a few days old will be automatically removed to save disk space.
+# This is the recommended mode for LFS repos to prevent excessive disk
+# usage.
+: "${EGIT_LFS_CLONE_TYPE:=shallow}"
+
 # @ECLASS_VARIABLE: EGIT3_STORE_DIR
 # @USER_VARIABLE
 # @DEFAULT_UNSET
@@ -344,7 +383,7 @@ _git-r3_set_gitdir() {
 			umask "${EVCS_UMASK}" || die "Bad options to umask: ${EVCS_UMASK}"
 		fi
 		mkdir "${GIT_DIR}" || die
-		git init --bare || die
+		git init --bare -b __init__ || die
 		if [[ ${saved_umask} ]]; then
 			umask "${saved_umask}" || die
 		fi
@@ -760,6 +799,35 @@ git-r3_fetch() {
 			fi
 		fi
 
+		if [[ ${EGIT_LFS} ]]; then
+			# Fetch the LFS files from the current ref (if any)
+			local lfs_fetch_command=( git lfs fetch "${r}" )
+
+			case "${EGIT_LFS_CLONE_TYPE}" in
+				shallow)
+					lfs_fetch_command+=(
+						--prune
+					)
+					;;
+				single)
+					;;
+				mirror)
+					lfs_fetch_command+=(
+						--all
+					)
+					;;
+				*)
+					die "Invalid EGIT_LFS_CLONE_TYPE=${EGIT_LFS_CLONE_TYPE}"
+			esac
+
+			set -- "${lfs_fetch_command[@]}"
+			echo "${@}" >&2
+			"${@}" || die
+		elif [[ -d ${GIT_DIR}/lfs && ${EGIT_LFS_CLONE_TYPE} == shallow ]]; then
+			# Cleanup the LFS files from old checkouts if LFS support has been turned off.
+			rm -fr ${GIT_DIR}/lfs || die
+		fi
+
 		success=1
 		break
 	done
@@ -874,7 +942,12 @@ git-r3_checkout() {
 		# use git init+fetch instead of clone since the latter doesn't like
 		# non-empty directories.
 
-		git init --quiet || die
+		git init --quiet -b __init__ || die
+		if [[ ${EGIT_LFS} ]]; then
+			# The "skip-repo" flag will just skip the installation of the pre-push hooks.
+			# We don't use these hook as we don't do any pushes
+			git lfs install --local --skip-repo || die
+		fi
 		# setup 'alternates' to avoid copying objects
 		echo "${orig_repo}/objects" > "${GIT_DIR}"/objects/info/alternates || die
 		# now copy the refs
@@ -905,6 +978,16 @@ git-r3_checkout() {
 		fi
 		echo "${@}" >&2
 		"${@}" || die "git checkout ${remote_ref:-${new_commit_id}} failed"
+
+		# If any filters in any of the ".gitattributes" files specifies lfs,
+		# then this repo is most likely storing files with git lfs.
+		local has_git_lfs_filters=$(
+			git grep "filter=lfs" -- ".gitattributes" "**/.gitattributes"
+		)
+		if [[ $has_git_lfs_filters ]]; then
+			# This is used for issuing QA warnings regarding LFS files in the repo (or lack thereof)
+			_EGIT_LFS_FILTERS_FOUND="yes"
+		fi
 	}
 	git-r3_sub_checkout
 	unset -f git-r3_sub_checkout
@@ -1054,6 +1137,13 @@ git-r3_src_unpack() {
 	_git-r3_env_setup
 	git-r3_src_fetch
 	git-r3_checkout
+
+	if [[ ! ${EGIT_LFS} && ${_EGIT_LFS_FILTERS_FOUND} ]]; then
+		eqawarn "QA Notice: There are Git LFS filters setup in the cloned repo, consider using EGIT_LFS!"
+	fi
+	if [[ ${EGIT_LFS} && ! ${_EGIT_LFS_FILTERS_FOUND} ]]; then
+		eqawarn "QA Notice: There are no Git LFS filters setup in the cloned repo. EGIT_LFS will do nothing!"
+	fi
 }
 
 # https://bugs.gentoo.org/show_bug.cgi?id=482666
diff --git a/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
index 2ce1a87c06..bdeabb9fc2 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
@@ -680,7 +680,8 @@ if [[ ${ETYPE} == sources ]]; then
 			# Reflect that kernels contain firmware blobs unless otherwise
 			# stripped. Starting with version 4.14, the whole firmware
 			# tree has been dropped from the kernel.
-			kernel_is lt 4 14 && LICENSE+=" !deblob? ( linux-firmware )"
+			kernel_is lt 4 14 &&
+				LICENSE+=" !deblob? ( linux-fw-redistributable all-rights-reserved )"
 
 			if [[ -n KV_MINOR ]]; then
 				DEBLOB_PV="${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}"
@@ -710,7 +711,7 @@ if [[ ${ETYPE} == sources ]]; then
 		elif kernel_is lt 4 14; then
 			# Deblobbing is not available, so just mark kernels older
 			# than 4.14 as tainted with non-libre materials.
-			LICENSE+=" linux-firmware"
+			LICENSE+=" linux-fw-redistributable all-rights-reserved"
 		fi
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass b/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
index 223e2a15ba..8198650aad 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
@@ -78,7 +78,7 @@ DEPEND="!!sys-devel/llvm:0"
 # @INTERNAL
 # @DESCRIPTION:
 # Correct values of LLVM slots, newest first.
-declare -g -r _LLVM_KNOWN_SLOTS=( {17..8} )
+declare -g -r _LLVM_KNOWN_SLOTS=( {18..8} )
 
 # @FUNCTION: get_llvm_slot
 # @USAGE: [-b|-d] [<max_slot>]
diff --git a/sdk_container/src/third_party/portage-stable/eclass/meson.eclass b/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
index 2c274b2131..5aff3eb589 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
@@ -3,8 +3,7 @@
 
 # @ECLASS: meson.eclass
 # @MAINTAINER:
-# William Hubbs <williamh@gentoo.org>
-# Mike Gilbert <floppym@gentoo.org>
+# base-system@gentoo.org
 # @SUPPORTED_EAPIS: 7 8
 # @BLURB: common ebuild functions for meson-based packages
 # @DESCRIPTION:
@@ -55,6 +54,12 @@ BDEPEND=">=dev-util/meson-0.62.2
 # Build directory, location where all generated files should be placed.
 # If this isn't set, it defaults to ${WORKDIR}/${P}-build.
 
+# @ECLASS_VARIABLE: MESON_VERBOSE
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Set to OFF to disable verbose messages during compilation
+: "${MESON_VERBOSE:=ON}"
+
 # @ECLASS_VARIABLE: EMESON_BUILDTYPE
 # @DESCRIPTION:
 # The buildtype value to pass to meson setup.
@@ -385,10 +390,15 @@ meson_src_compile() {
 		-C "${BUILD_DIR}"
 		--jobs "$(makeopts_jobs "${MAKEOPTS}" 0)"
 		--load-average "$(makeopts_loadavg "${MAKEOPTS}" 0)"
-		--verbose
-		"$@"
 	)
 
+	case ${MESON_VERBOSE} in
+		OFF) ;;
+		*) mesoncompileargs+=( --verbose ) ;;
+	esac
+
+	mesoncompileargs+=( "$@" )
+
 	set -- meson compile "${mesoncompileargs[@]}"
 	echo "$@" >&2
 	"$@" || die "compile failed"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/multibuild.eclass b/sdk_container/src/third_party/portage-stable/eclass/multibuild.eclass
index 33edb9312a..d8a5862731 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/multibuild.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/multibuild.eclass
@@ -170,8 +170,7 @@ multibuild_copy_sources() {
 
 	_multibuild_create_source_copy() {
 		einfo "${MULTIBUILD_VARIANT}: copying to ${BUILD_DIR}"
-		# enable reflinking if possible to make this faster
-		cp -p -R --reflink=auto \
+		cp -p -R \
 			"${_MULTIBUILD_INITIAL_BUILD_DIR}" "${BUILD_DIR}" || die
 	}
 
@@ -190,8 +189,7 @@ multibuild_merge_root() {
 	local src=${1}
 	local dest=${2}
 
-	# enable reflinking if possible to make this faster
-	cp -a --reflink=auto "${src}"/. "${dest}"/ || die "${MULTIBUILD_VARIANT:-(unknown)}: merging image failed"
+	cp -a "${src}"/. "${dest}"/ || die "${MULTIBUILD_VARIANT:-(unknown)}: merging image failed"
 	rm -rf "${src}" || die
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/ninja-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/ninja-utils.eclass
index e6d8c9e6c0..5a211e8113 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/ninja-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/ninja-utils.eclass
@@ -3,8 +3,7 @@
 
 # @ECLASS: ninja-utils.eclass
 # @MAINTAINER:
-# Michał Górny <mgorny@gentoo.org>
-# Mike Gilbert <floppym@gentoo.org>
+# base-system@gentoo.org
 # @AUTHOR:
 # Michał Górny <mgorny@gentoo.org>
 # Mike Gilbert <floppym@gentoo.org>
@@ -48,6 +47,12 @@ _NINJA_UTILS_ECLASS=1
 # supposed to be set in make.conf. If unset, eninja() will convert
 # MAKEOPTS instead.
 
+# @ECLASS_VARIABLE: NINJA_VERBOSE
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Set to OFF to disable verbose messages during compilation
+: "${NINJA_VERBOSE:=ON}"
+
 inherit multiprocessing
 
 case "${NINJA}" in
@@ -80,7 +85,12 @@ get_NINJAOPTS() {
 # also supports being called via 'nonfatal'.
 eninja() {
 	[[ -n "${NINJA_DEPEND}" ]] || ewarn "Unknown value '${NINJA}' for \${NINJA}"
-	set -- "${NINJA}" -v $(get_NINJAOPTS) "$@"
+	local v
+	case "${NINJA_VERBOSE}" in
+		OFF) ;;
+		*) v="-v"
+	esac
+	set -- "${NINJA}" ${v} $(get_NINJAOPTS) "$@"
 	echo "$@" >&2
 	"$@" || die -n "${*} failed"
 }
diff --git a/sdk_container/src/third_party/portage-stable/eclass/pam.eclass b/sdk_container/src/third_party/portage-stable/eclass/pam.eclass
index 22b59ad65e..2516fa8965 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/pam.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/pam.eclass
@@ -6,14 +6,14 @@
 # base-system@gentoo.org
 # @AUTHOR:
 # Diego Pettenò <flameeyes@gentoo.org>
-# @SUPPORTED_EAPIS: 6 7 8
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: Handles pam related tasks
 # @DESCRIPTION:
 # This eclass contains functions to install pamd configuration files and
 # pam modules.
 
-case ${EAPI:-0} in
-	[678]) ;;
+case ${EAPI} in
+	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
@@ -22,6 +22,14 @@ _PAM_ECLASS=1
 
 inherit flag-o-matic
 
+# @FUNCTION: _pam_flag_disabled
+# @INTERNAL
+# @DESCRIPTION:
+# Check whether pam support is disabled.
+_pam_flag_disabled() {
+	in_iuse pam && ! use pam
+}
+
 # @FUNCTION: dopamd
 # @USAGE: <file> [more files]
 # @DESCRIPTION:
@@ -29,15 +37,13 @@ inherit flag-o-matic
 dopamd() {
 	[[ -z $1 ]] && die "dopamd requires at least one argument"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	( # dont want to pollute calling env
 		insinto /etc/pam.d
 		insopts -m 0644
 		doins "$@"
-	) || die "failed to install $@"
+	)
 	cleanpamd "$@"
 }
 
@@ -48,15 +54,13 @@ dopamd() {
 newpamd() {
 	[[ $# -ne 2 ]] && die "newpamd requires two arguments"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	( # dont want to pollute calling env
 		insinto /etc/pam.d
 		insopts -m 0644
 		newins "$1" "$2"
-	) || die "failed to install $1 as $2"
+	)
 	cleanpamd $2
 }
 
@@ -67,15 +71,13 @@ newpamd() {
 dopamsecurity() {
 	[[ $# -lt 2 ]] && die "dopamsecurity requires at least two arguments"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0
-	fi
+	_pam_flag_disabled && return 0
 
 	( # dont want to pollute calling env
 		insinto /etc/security/$1
 		insopts -m 0644
 		doins "${@:2}"
-	) || die "failed to install ${@:2}"
+	)
 }
 
 # @FUNCTION: newpamsecurity
@@ -85,15 +87,13 @@ dopamsecurity() {
 newpamsecurity() {
 	[[ $# -ne 3 ]] && die "newpamsecurity requires three arguments"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	( # dont want to pollute calling env
 		insinto /etc/security/$1
 		insopts -m 0644
 		newins "$2" "$3"
-	) || die "failed to install $2 as $3"
+	)
 }
 
 # @FUNCTION: getpam_mod_dir
@@ -129,12 +129,10 @@ EOF
 dopammod() {
 	[[ -z $1 ]] && die "dopammod requires at least one argument"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	exeinto $(getpam_mod_dir)
-	doexe "$@" || die "failed to install $@"
+	doexe "$@"
 }
 
 # @FUNCTION: newpammod
@@ -145,12 +143,10 @@ dopammod() {
 newpammod() {
 	[[ $# -ne 2 ]] && die "newpammod requires two arguments"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	exeinto $(getpam_mod_dir)
-	newexe "$1" "$2" || die "failed to install $1 as $2"
+	newexe "$1" "$2"
 }
 
 # @FUNCTION: pamd_mimic_system
@@ -171,26 +167,23 @@ pamd_mimic_system() {
 pamd_mimic() {
 	[[ $# -lt 3 ]] && die "pamd_mimic requires at least three arguments"
 
-	if has pam ${IUSE} && ! use pam; then
-		return 0;
-	fi
+	_pam_flag_disabled && return 0
 
 	dodir /etc/pam.d
-	pamdfile=${D}/etc/pam.d/$2
-	echo -e "# File autogenerated by pamd_mimic in pam eclass\n\n" >> \
-		$pamdfile
+	local pamdfile="${ED}/etc/pam.d/$2"
+	echo -e "# File autogenerated by pamd_mimic in pam eclass\n\n" \
+		>> "${pamdfile}" || die
 
-	originalstack=$1
-	authlevels="auth account password session"
+	local authlevels="auth account password session"
 
-	mimic="\tsubstack\t\t${originalstack}"
+	local mimic="\tsubstack\t\t$1"
 
 	shift; shift
 
 	while [[ -n $1 ]]; do
 		has $1 ${authlevels} || die "unknown level type"
 
-		echo -e "$1${mimic}" >> ${pamdfile}
+		echo -e "$1${mimic}" >> "${pamdfile}" || die
 
 		shift
 	done
@@ -204,7 +197,7 @@ pamd_mimic() {
 cleanpamd() {
 	while [[ -n $1 ]]; do
 		if ! has_version sys-libs/pam; then
-			sed -i -e '/pam_shells\|pam_console/s:^:#:' "${D}/etc/pam.d/$1" || die
+			sed -i -e '/pam_shells\|pam_console/s:^:#:' "${ED}/etc/pam.d/$1" || die
 		fi
 
 		shift
diff --git a/sdk_container/src/third_party/portage-stable/eclass/pypi.eclass b/sdk_container/src/third_party/portage-stable/eclass/pypi.eclass
index 594216a7fd..b80ff9c95d 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/pypi.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/pypi.eclass
@@ -105,6 +105,7 @@ _pypi_translate_version() {
 	local version=${1}
 	version=${version/_alpha/a}
 	version=${version/_beta/b}
+	version=${version/_pre/.dev}
 	version=${version/_rc/rc}
 	_PYPI_TRANSLATED_VERSION=${version/_p/.post}
 }
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-any-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-any-r1.eclass
index d7d44a87f5..4e2e12e228 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-any-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-any-r1.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: python-any-r1.eclass
@@ -176,7 +176,7 @@ _python_any_set_globals() {
 		_python_export "${i}" PYTHON_PKG_DEP
 
 		# note: need to strip '=' slot operator for || deps
-		deps="${PYTHON_PKG_DEP/:0=/:0} ${deps}"
+		deps="${PYTHON_PKG_DEP/:=} ${deps}"
 	done
 	deps="|| ( ${deps})"
 
@@ -259,7 +259,7 @@ python_gen_any_dep() {
 		local i_depstr=${depstr//\$\{PYTHON_USEDEP\}/${PYTHON_USEDEP}}
 		i_depstr=${i_depstr//\$\{PYTHON_SINGLE_USEDEP\}/${PYTHON_SINGLE_USEDEP}}
 		# note: need to strip '=' slot operator for || deps
-		out="( ${PYTHON_PKG_DEP%=} ${i_depstr} ) ${out}"
+		out="( ${PYTHON_PKG_DEP%:=} ${i_depstr} ) ${out}"
 	done
 	echo "|| ( ${out})"
 }
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-r1.eclass
index 4758defe64..b816e3b6f8 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-r1.eclass
@@ -522,7 +522,7 @@ python_gen_any_dep() {
 			local i_depstr=${depstr//\$\{PYTHON_USEDEP\}/${PYTHON_USEDEP}}
 			i_depstr=${i_depstr//\$\{PYTHON_SINGLE_USEDEP\}/${PYTHON_SINGLE_USEDEP}}
 			# note: need to strip '=' slot operator for || deps
-			out="( ${PYTHON_PKG_DEP/:0=/:0} ${i_depstr} ) ${out}"
+			out="( ${PYTHON_PKG_DEP/:=} ${i_depstr} ) ${out}"
 		fi
 	done
 	echo "|| ( ${out})"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index 40c15b65d7..27157a003a 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -238,12 +238,11 @@ _python_impl_matches() {
 				fi
 				return 0
 				;;
-			3.9|3.10)
-				# <pypy3-7.3.12 is 3.9, >=7.3.12 is 3.10
+			3.10)
 				[[ ${impl} == python${pattern/./_} || ${impl} == pypy3 ]] &&
 					return 0
 				;;
-			3.8|3.1[1-2])
+			3.8|3.9|3.1[1-2])
 				[[ ${impl} == python${pattern/./_} ]] && return 0
 				;;
 			*)
@@ -339,7 +338,7 @@ _python_export() {
 				debug-print "${FUNCNAME}: EPYTHON = ${EPYTHON}"
 				;;
 			PYTHON)
-				export PYTHON=${BROOT-${EPREFIX}}/usr/bin/${impl}
+				export PYTHON=${BROOT}/usr/bin/${impl}
 				debug-print "${FUNCNAME}: PYTHON = ${PYTHON}"
 				;;
 			PYTHON_SITEDIR)
@@ -447,14 +446,12 @@ _python_export() {
 			PYTHON_PKG_DEP)
 				local d
 				case ${impl} in
-					python3.10)
-						PYTHON_PKG_DEP=">=dev-lang/python-3.10.12:3.10";;
-					python3.11)
-						PYTHON_PKG_DEP=">=dev-lang/python-3.11.4:3.11";;
-					python3.12)
-						PYTHON_PKG_DEP=">=dev-lang/python-3.12.0_beta3:3.12";;
+					python*)
+						PYTHON_PKG_DEP="dev-lang/python:${impl#python}"
+						;;
 					pypy3)
-						PYTHON_PKG_DEP='>=dev-python/pypy3-7.3.11_p1:0=';;
+						PYTHON_PKG_DEP="dev-python/${impl}:="
+						;;
 					*)
 						die "Invalid implementation: ${impl}"
 				esac
@@ -1026,8 +1023,6 @@ python_fix_shebang() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	[[ ${EPYTHON} ]] || die "${FUNCNAME}: EPYTHON unset (pkg_setup not called?)"
-	local PYTHON
-	_python_export "${EPYTHON}" PYTHON
 
 	local force quiet
 	while [[ ${@} ]]; do
@@ -1100,7 +1095,7 @@ python_fix_shebang() {
 			if [[ ! ${error} ]]; then
 				debug-print "${FUNCNAME}: in file ${f#${D%/}}"
 				debug-print "${FUNCNAME}: rewriting shebang: ${shebang}"
-				sed -i -e "1s@${from}@#!${PYTHON}@" "${f}" || die
+				sed -i -e "1s@${from}@#!${EPREFIX}/usr/bin/${EPYTHON}@" "${f}" || die
 				any_fixed=1
 			else
 				eerror "The file has incompatible shebang:"
@@ -1236,6 +1231,55 @@ _python_check_EPYTHON() {
 	fi
 }
 
+# @FUNCTION: _python_check_occluded_packages
+# @INTERNAL
+# @DESCRIPTION:
+# Check if the current directory does not contain any incomplete
+# package sources that would block installed packages from being used
+# (and effectively e.g. make it impossible to load compiled extensions).
+_python_check_occluded_packages() {
+	debug-print-function ${FUNCNAME} "${@}"
+
+	# DO NOT ENABLE THIS unless you're going to check for false
+	# positives before filing bugs.
+	[[ ! ${PYTHON_EXPERIMENTAL_QA} ]] && return
+
+	type -P diff &>/dev/null || return
+	[[ -z ${BUILD_DIR} || ! -d ${BUILD_DIR}/install ]] && return
+
+	local sitedir="${BUILD_DIR}/install$(python_get_sitedir)"
+	# avoid unnecessarily checking if we are inside install dir
+	[[ ${sitedir} -ef . ]] && return
+
+	local f fn diff
+	for f in "${sitedir}"/*/; do
+		f=${f%/}
+		fn=${f##*/}
+
+		# skip metadata directories
+		[[ ${fn} == *.dist-info || ${fn} == *.egg-info ]] && continue
+
+		if [[ -d ${fn} ]]; then
+			diff=$(diff -dupr -x "__pycache__" "${fn}" "${sitedir}/${fn}")
+			if [[ -n ${diff} ]]; then
+				eqawarn "The directory ${fn} occludes package installed for ${EPYTHON}."
+				echo
+				echo ">>> Diff:"
+				echo "${diff}"
+				echo "<<< End-of-diff"
+				echo
+
+				if [[ ! ${_PYTHON_WARNED_OCCLUDED_PACKAGES} ]]; then
+					eqawarn "The complete build log includes diffs."
+					eqawarn "For more information on occluded packages, please see:"
+					eqawarn "https://projects.gentoo.org/python/guide/test.html#importerrors-for-c-extensions"
+					_PYTHON_WARNED_OCCLUDED_PACKAGES=1
+				fi
+			fi
+		fi
+	done
+}
+
 # @VARIABLE: EPYTEST_DESELECT
 # @DEFAULT_UNSET
 # @DESCRIPTION:
@@ -1266,6 +1310,7 @@ epytest() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	_python_check_EPYTHON
+	_python_check_occluded_packages
 
 	local color
 	case ${NOCOLOR} in
@@ -1350,6 +1395,7 @@ eunittest() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	_python_check_EPYTHON
+	_python_check_occluded_packages
 
 	# unittest fails with "no tests" correctly since Python 3.12
 	local runner=unittest
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
index bffbf36f16..e28f6148dd 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
@@ -338,7 +338,7 @@ tc-is-static-only() {
 tc-stack-grows-down() {
 	# List the few that grow up.
 	case ${ARCH} in
-	hppa|metag) return 1 ;;
+		hppa|metag) return 1 ;;
 	esac
 
 	# Assume all others grow down.
@@ -534,43 +534,16 @@ tc-ld-force-bfd() {
 	ewarn "Forcing usage of the BFD linker"
 
 	# Set up LD to point directly to bfd if it's available.
-	# We need to extract the first word in case there are flags appended
-	# to its value (like multilib).  #545218
 	local ld=$(tc-getLD "$@")
+	# We need to extract the first word in case there are flags appended
+	# to its value (like multilib), bug #545218.
 	local bfd_ld="${ld%% *}.bfd"
 	local path_ld=$(type -P "${bfd_ld}" 2>/dev/null)
 	[[ -e ${path_ld} ]] && export LD=${bfd_ld}
 
 	# Set up LDFLAGS to select bfd based on the gcc / clang version.
-	local fallback="true"
-	if tc-is-gcc; then
-		local major=$(gcc-major-version "$@")
-		local minor=$(gcc-minor-version "$@")
-		if [[ ${major} -gt 4 ]] || [[ ${major} -eq 4 && ${minor} -ge 8 ]]; then
-			# gcc-4.8+ supports -fuse-ld directly.
-			export LDFLAGS="${LDFLAGS} -fuse-ld=bfd"
-			fallback="false"
-		fi
-	elif tc-is-clang; then
-		local major=$(clang-major-version "$@")
-		local minor=$(clang-minor-version "$@")
-		if [[ ${major} -gt 3 ]] || [[ ${major} -eq 3 && ${minor} -ge 5 ]]; then
-			# clang-3.5+ supports -fuse-ld directly.
-			export LDFLAGS="${LDFLAGS} -fuse-ld=bfd"
-			fallback="false"
-		fi
-	fi
-	if [[ ${fallback} == "true" ]] ; then
-		# <=gcc-4.7 and <=clang-3.4 require some coercion.
-		# Only works if bfd exists.
-		if [[ -e ${path_ld} ]] ; then
-			local d="${T}/bfd-linker"
-			mkdir -p "${d}"
-			ln -sf "${path_ld}" "${d}"/ld
-			export LDFLAGS="${LDFLAGS} -B${d}"
-		else
-			die "unable to locate a BFD linker"
-		fi
+	if tc-is-gcc || tc-is-clang ; then
+		export LDFLAGS="${LDFLAGS} -fuse-ld=bfd"
 	fi
 }
 
@@ -647,6 +620,7 @@ tc-has-tls() {
 		return *i ? j : *i;
 	}
 	EOF
+
 	local flags
 	case $1 in
 		-s) flags="-S";;
@@ -654,6 +628,7 @@ tc-has-tls() {
 		-l) ;;
 		-*) die "Usage: tc-has-tls [-c|-l] [toolchain prefix]";;
 	esac
+
 	: "${flags:=-fPIC -shared -Wl,-z,defs}"
 	[[ $1 == -* ]] && shift
 	$(tc-getCC "$@") ${flags} "${base}.c" -o "${base}" >&/dev/null
@@ -666,7 +641,7 @@ tc-has-tls() {
 # Parse information from CBUILD/CHOST/CTARGET rather than
 # use external variables from the profile.
 tc-ninja_magic_to_arch() {
-	ninj() { [[ ${type} == "kern" ]] && echo $1 || echo $2 ; }
+	_tc_echo_kernel_alias() { [[ ${type} == "kern" ]] && echo $1 || echo $2 ; }
 
 	local type=$1
 	local host=$2
@@ -676,16 +651,16 @@ tc-ninja_magic_to_arch() {
 		aarch64*)	echo arm64;;
 		alpha*)		echo alpha;;
 		arm*)		echo arm;;
-		avr*)		ninj avr32 avr;;
-		bfin*)		ninj blackfin bfin;;
+		avr*)		_tc_echo_kernel_alias avr32 avr;;
+		bfin*)		_tc_echo_kernel_alias blackfin bfin;;
 		c6x*)		echo c6x;;
 		cris*)		echo cris;;
 		frv*)		echo frv;;
 		hexagon*)	echo hexagon;;
-		hppa*)		ninj parisc hppa;;
+		hppa*)		_tc_echo_kernel_alias parisc hppa;;
 		i?86*)		echo x86;;
 		ia64*)		echo ia64;;
-		loongarch*)	ninj loongarch loong;;
+		loongarch*)	_tc_echo_kernel_alias loongarch loong;;
 		m68*)		echo m68k;;
 		metag*)		echo metag;;
 		microblaze*)	echo microblaze;;
@@ -708,11 +683,11 @@ tc-ninja_magic_to_arch() {
 		riscv*)		echo riscv;;
 		s390*)		echo s390;;
 		score*)		echo score;;
-		sh64*)		ninj sh64 sh;;
+		sh64*)		_tc_echo_kernel_alias sh64 sh;;
 		sh*)		echo sh;;
-		sparc64*)	ninj sparc64 sparc;;
+		sparc64*)	_tc_echo_kernel_alias sparc64 sparc;;
 		sparc*)		[[ ${PROFILE_ARCH} == "sparc64" ]] \
-						&& ninj sparc64 sparc \
+						&& _tc_echo_kernel_alias sparc64 sparc \
 						|| echo sparc
 					;;
 		tile*)		echo tile;;
@@ -731,7 +706,7 @@ tc-ninja_magic_to_arch() {
 		# since our usage of tc-arch is largely concerned with
 		# normalizing inputs for testing ${CTARGET}, let's filter
 		# other cross targets (mingw and such) into the unknown.
-		*)			echo unknown;;
+		*)		echo unknown;;
 	esac
 }
 # @FUNCTION: tc-arch-kernel
@@ -781,7 +756,7 @@ tc-endian() {
 		sh*)		echo little;;
 		sparc*)		echo big;;
 		x86_64*)	echo little;;
-		*)			echo wtf;;
+		*)		echo wtf;;
 	esac
 }
 
@@ -1058,18 +1033,17 @@ gen_usr_ldscript() {
 
 	tc-is-static-only && return
 
-	# We only care about stuffing / for the native ABI. #479448
+	# We only care about stuffing / for the native ABI, bug #479448
 	if [[ $(type -t multilib_is_native_abi) == "function" ]] ; then
 		multilib_is_native_abi || return 0
 	fi
 
-	# Eventually we'd like to get rid of this func completely #417451
+	# Eventually we'd like to get rid of this func completely, bug #417451
 	case ${CTARGET:-${CHOST}} in
-	*-darwin*) ;;
-	*-android*) return 0 ;;
-	*linux*)
-		use prefix && return 0 ;;
-	*) return 0 ;;
+		*-darwin*) ;;
+		*-android*) return 0 ;;
+		*linux*) use prefix && return 0 ;;
+		*) return 0 ;;
 	esac
 
 	# Just make sure it exists
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index dabdd3a8f4..9f626c5bfc 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -614,14 +614,11 @@ toolchain_src_prepare() {
 		done
 	fi
 
-	# >=gcc-4
-	if [[ -x contrib/gcc_update ]] ; then
-		einfo "Touching generated files"
-		./contrib/gcc_update --touch | \
-			while read f ; do
-				einfo "  ${f%%...}"
-			done
-	fi
+	einfo "Touching generated files"
+	./contrib/gcc_update --touch | \
+		while read f ; do
+			einfo "  ${f%%...}"
+		done
 }
 
 do_gcc_gentoo_patches() {
@@ -742,16 +739,10 @@ setup_multilib_osdirnames() {
 	config+="/t-linux64"
 
 	local sed_args=()
-	if tc_version_is_at_least 4.6 ; then
-		sed_args+=( -e 's:$[(]call if_multiarch[^)]*[)]::g' )
-	fi
+	sed_args+=( -e 's:$[(]call if_multiarch[^)]*[)]::g' )
 	if [[ ${SYMLINK_LIB} == "yes" ]] ; then
 		einfo "Updating multilib directories to be: ${libdirs}"
-		if tc_version_is_at_least 4.6.4 || tc_version_is_at_least 4.7 ; then
-			sed_args+=( -e '/^MULTILIB_OSDIRNAMES.*lib32/s:[$][(]if.*):../lib32:' )
-		else
-			sed_args+=( -e "/^MULTILIB_OSDIRNAMES/s:=.*:= ${libdirs}:" )
-		fi
+		sed_args+=( -e '/^MULTILIB_OSDIRNAMES.*lib32/s:[$][(]if.*):../lib32:' )
 	else
 		einfo "Using upstream multilib; disabling lib32 autodetection"
 		sed_args+=( -r -e 's:[$][(]if.*,(.*)[)]:\1:' )
@@ -800,8 +791,19 @@ toolchain_src_configure() {
 		--mandir="${DATAPATH}/man"
 		--infodir="${DATAPATH}/info"
 		--with-gxx-include-dir="${STDCXX_INCDIR}"
+
+		# portage's econf() does not detect presence of --d-s-r
+		# because it greps only top-level ./configure. But not
+		# libiberty's or gcc's configure.
+		--disable-silent-rules
 	)
 
+	if tc_version_is_at_least 10 ; then
+		confgcc+=(
+			--disable-dependency-tracking
+		)
+	fi
+
 	# Stick the python scripts in their own slotted directory (bug #279252)
 	#
 	#  --with-python-dir=DIR
@@ -869,8 +871,7 @@ toolchain_src_configure() {
 			# - After discussing in #gcc, we concluded that =yes,extra,rtl makes
 			#   more sense when a user explicitly requests USE=debug. If rtl is too slow,
 			#   we can change this to yes,extra.
-			local off=$(tc_version_is_at_least 4.0 && echo release || echo no)
-			confgcc+=( --enable-checking="${GCC_CHECKS_LIST:-$(usex debug yes,extra,rtl ${off})}" )
+			confgcc+=( --enable-checking="${GCC_CHECKS_LIST:-$(usex debug yes,extra,rtl release)}" )
 		fi
 	fi
 
@@ -998,7 +999,13 @@ toolchain_src_configure() {
 			fi
 		fi
 
-		confgcc+=( --disable-bootstrap )
+		confgcc+=(
+			# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100289
+			# TOOD: Find a way to disable this just for stage1 cross?
+			--disable-gcov
+
+			--disable-bootstrap
+		)
 	else
 		if tc-is-static-only ; then
 			confgcc+=( --disable-shared )
@@ -1298,6 +1305,7 @@ toolchain_src_configure() {
 		)
 	fi
 
+	# TODO: Ignore RCs here (but TOOLCHAIN_IS_RC isn't yet an eclass var)
 	if [[ ${PV} == *_p* && -f "${S}"/gcc/doc/gcc.info ]] ; then
 		# Safeguard against https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106899 being fixed
 		# without corresponding ebuild changes.
@@ -1313,8 +1321,8 @@ toolchain_src_configure() {
 
 	confgcc+=( "$@" ${EXTRA_ECONF} )
 
-	if [[ -n ${build_config_targets} ]] ; then
-		# ./configure --with-build-config='bootstrap-lto bootstrap-cet'
+	if ! is_crosscompile && ! tc-is-cross-compiler && [[ -n ${build_config_targets} ]] ; then
+		# e.g. ./configure --with-build-config='bootstrap-lto bootstrap-cet'
 		confgcc+=( --with-build-config="${build_config_targets[*]}" )
 	fi
 
@@ -1629,7 +1637,7 @@ gcc_do_make() {
 			GCC_MAKE_TARGET=${GCC_MAKE_TARGET-all}
 
 			ewarn "Disabling bootstrapping. ONLY recommended for development."
-			ewarn "This is NOT a safe configuration for endusers!"
+			ewarn "This is NOT a safe configuration for end users!"
 			ewarn "This compiler may not be safe or reliable for production use!"
 		elif _tc_use_if_iuse pgo; then
 			GCC_MAKE_TARGET=${GCC_MAKE_TARGET-profiledbootstrap}
@@ -1872,7 +1880,7 @@ toolchain_src_install() {
 	if ! is_crosscompile; then
 		# Rename the main go binaries as we don't want to clobber dev-lang/go
 		# when gcc-config runs. bug #567806
-		if tc_version_is_at_least 5 && is_go ; then
+		if is_go ; then
 			for x in go gofmt; do
 				mv ${x} ${x}-${GCCMAJOR} || die
 			done
diff --git a/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass b/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
index 6472e995e8..d99dc34618 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
@@ -16,7 +16,7 @@
 # the developer's work.
 #
 # To use the eclass, start by packaging the upstream's key
-# as app-crypt/openpgp-keys-*.  Then inherit the eclass, add detached
+# as sec-keys/openpgp-keys-*.  Then inherit the eclass, add detached
 # signatures to SRC_URI and set VERIFY_SIG_OPENPGP_KEY_PATH.  The eclass
 # provides verify-sig USE flag to toggle the verification.
 #
@@ -35,7 +35,7 @@
 # SRC_URI="https://example.org/${P}.tar.gz
 #   verify-sig? ( https://example.org/${P}.tar.gz.sig )"
 # BDEPEND="
-#   verify-sig? ( app-crypt/openpgp-keys-example )"
+#   verify-sig? ( sec-keys/openpgp-keys-example )"
 #
 # VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/example.asc
 # @CODE
diff --git a/sdk_container/src/third_party/portage-stable/licenses/linux-firmware b/sdk_container/src/third_party/portage-stable/licenses/linux-firmware
deleted file mode 100644
index 86d810891a..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/linux-firmware
+++ /dev/null
@@ -1,7 +0,0 @@
-Gentoo license note:
-
-Linux firmware images are distributed under a variety of licenses,
-many of them being non-free. Most likely, upstream redistribution of
-some firmware images may conflict with the licenses or lack thereof on
-the images. You will need to check the WHENCE and LICEN[CS]E.* files
-in the package for specific licensing terms.
diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.40.ebuild b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.40.ebuild
index 191746391c..e3c7f2fb40 100644
--- a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.40.ebuild
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.40.ebuild
@@ -17,7 +17,7 @@ SRC_URI="
 
 LICENSE="libpng2"
 SLOT="0/16"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="apng cpu_flags_arm_neon cpu_flags_x86_sse static-libs"
 
 RDEPEND=">=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]"
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.17-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.17-r1.ebuild
index e4e4505a85..4553504133 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.17-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.17-r1.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~loong ppc ~ppc64 ~riscv x86"
 
 RDEPEND="
 	>=net-firewall/iptables-1.4.7
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
index 666fab5a3c..c796172a61 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
@@ -8,3 +8,5 @@ DIST gnutls-3.7.9.tar.xz 6377212 BLAKE2B c8263381132b0c96f23a580823cfaf571120568
 DIST gnutls-3.7.9.tar.xz.sig 685 BLAKE2B 2e7ba793d026cf96c54c75a81160c58cf21d6d5f034a603ffe88d5fa4cbfa1d4fd590efbe81fbee7790cd4956776085b7827fead67c9b07f1d7eadd405815eb7 SHA512 906227a0d6f57878e85e9acdf754d20b7628a7a95b40aeffced398a0a0c6220f5e32191a9f988f55b8b903bf55212179dce2abcc08c2bb3397a2704dd2319438
 DIST gnutls-3.8.0.tar.xz 6378480 BLAKE2B 64784e9c0ac4dcab2c9e90d7d17d0bd8a0021224be285c12a53673f3a52aa3f189152b1b0b4aaae5a8fb41951361af1fd04a5b535774c4a26c26eb895519af40 SHA512 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629
 DIST gnutls-3.8.0.tar.xz.sig 684 BLAKE2B c5dbed12b8233ed8502dac16b77d6043591296f4b9ddb0445271e8fe875c2a05b9663ad6523cca6355faaa9d244cc6e6fb8ff0d65fee47b36ab6b57f57d89f64 SHA512 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654
+DIST gnutls-3.8.1.tar.xz 6447056 BLAKE2B 16cb6d2dc7d67724ff45765ae3f154c8d268d8c4547df591a95ff014fc18f16f572a76e3cd00b3e13615ba41e80141cef21aa9915b467a1c452edfe314e2e0c7 SHA512 22e78db86b835843df897d14ad633d8a553c0f9b1389daa0c2f864869c6b9ca889028d434f9552237dc4f1b37c978fbe0cce166e3768e5d4e8850ff69a6fc872
+DIST gnutls-3.8.1.tar.xz.sig 685 BLAKE2B bfafa80bef81c2a24556f010f00294643ba7901eff07f055a0ebd9ca532b47b7b3d3403e9d1a1389c14e6f37f474a37afa2844f326d5ab35fa35b195f2ff1ade SHA512 f03fde611927c83f6b57af695d5610ba3cefbb88a261cf5485c94b3fb32c7480a77c68a353a6a28185337195e30011d6b5578c53ea4180a656cf7b175156f7f1
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
index c0a448c452..af4fed8424 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
@@ -17,7 +17,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.1.ebuild
new file mode 100644
index 0000000000..19eb1aa7b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.1.ebuild
@@ -0,0 +1,142 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/gnutls.asc
+inherit libtool multilib-minimal verify-sig
+
+DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
+HOMEPAGE="https://www.gnutls.org/"
+SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3 LGPL-2.1+"
+# As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
+# component for it until libgnutls.so breaks ABI, to avoid pointless rebuilds.
+# Subslot format:
+# <libgnutls.so number>.<libgnutlsxx.so number>
+SLOT="0/30.30"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
+REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
+	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
+	>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
+	>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
+	brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
+	dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
+	nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
+	pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] )
+	idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] )
+	zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
+	zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		seccomp? ( sys-libs/libseccomp )
+	)
+"
+BDEPEND="
+	dev-util/gtk-doc-am
+	>=virtual/pkgconfig-0-r1
+	doc? ( dev-util/gtk-doc )
+	nls? ( sys-devel/gettext )
+	test-full? (
+		app-crypt/dieharder
+		|| ( sys-libs/libfaketime >=app-misc/datefudge-1.22 )
+		dev-libs/softhsm:2[-bindist(-)]
+		net-dialup/ppp
+		net-misc/socat
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20221017 )
+"
+
+DOCS=( README.md doc/certtool.cfg )
+
+HTML_DOCS=()
+
+src_prepare() {
+	default
+
+	# bug #520818
+	export TZ=UTC
+
+	use doc && HTML_DOCS+=( doc/gnutls.html )
+
+	# don't try to use system certificate store on macOS, it is
+	# confusingly ignoring our ca-certificates and more importantly
+	# fails to compile in certain configurations
+	sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die
+
+	# Use sane .so versioning on FreeBSD.
+	elibtoolize
+}
+
+multilib_src_configure() {
+	LINGUAS="${LINGUAS//en/en@boldquot en@quot}"
+
+	local libconf=()
+
+	# TPM needs to be tested before being enabled
+	# Note that this may add a libltdl dep when enabled. Check configure.ac.
+	libconf+=(
+		--without-tpm
+		--without-tpm2
+	)
+
+	# hardware-accel is disabled on OSX because the asm files force
+	#   GNU-stack (as doesn't support that) and when that's removed ld
+	#   complains about duplicate symbols
+	[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
+
+	# -fanalyzer substantially slows down the build and isn't useful for
+	# us. It's useful for upstream as it's static analysis, but it's not
+	# useful when just getting something built.
+	export gl_cv_warn_c__fanalyzer=no
+
+	local myeconfargs=(
+		--disable-valgrind-tests
+		$(multilib_native_enable manpages)
+		$(multilib_native_use_enable doc gtk-doc)
+		$(multilib_native_use_enable doc)
+		$(multilib_native_use_enable seccomp seccomp-tests)
+		$(multilib_native_use_enable test tests)
+		$(multilib_native_use_enable test-full full-test-suite)
+		$(multilib_native_use_enable tools)
+		$(use_enable cxx)
+		$(use_enable dane libdane)
+		$(use_enable nls)
+		$(use_enable openssl openssl-compatibility)
+		$(use_enable sslv2 ssl2-support)
+		$(use_enable sslv3 ssl3-support)
+		$(use_enable static-libs static)
+		$(use_enable tls-heartbeat heartbeat-support)
+		$(use_with brotli)
+		$(use_with idn)
+		$(use_with pkcs11 p11-kit)
+		$(use_with zlib)
+		$(use_with zstd)
+		--disable-rpath
+		--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
+		--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+		--without-included-libtasn1
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use examples; then
+		docinto examples
+		dodoc doc/examples/*.c
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.4.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.4.ebuild
index eeb1b0b076..d37ecea1fc 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libpcap/libpcap-1.10.4.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="https://www.tcpdump.org/release/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( https://www.tcpdump.org/release/${P}.tar.gz.sig )"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 fi
 
 LICENSE="BSD"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index bec0d37f1f..53f120dded 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -2,3 +2,5 @@ DIST curl-8.0.1.tar.xz 2575544 BLAKE2B 67d82e9d71f0a351b5c2ed3ad5eab02e367ded872
 DIST curl-8.0.1.tar.xz.asc 488 BLAKE2B 452e1bebe1028e7621bbf8829e50cf56e254cd63a8cf2a4c0332176b9f18fb2821304ae556a203996d273c986bddbd04db2218c18fd34dee66e9155861ba50ce SHA512 92c6a0570e9a8a708fe2f717b8b37a68dcb9cd4520ca50c9baafec5891bda103bce2d2dcb67f1387bf11bd7e51e0e64ccd52d196e61d58b598ad3aa1960386cf
 DIST curl-8.1.2.tar.xz 2612652 BLAKE2B 66d0828912bb9971dac99025aa8b5c1c2fac1f8b568f2a8a97bd9f66986bdb164b603b539ec3e123cd6a26ea65829e58c90fc9852be88b42074cf40c89c566d1 SHA512 532ab96eba6dea66d272f3be56f5af5c5da922480f9a10e203de98037c311f12f8145ba6bf813831e42815e068874ccfd108f84f7650743f5dbb3ebc3bc9c4f4
 DIST curl-8.1.2.tar.xz.asc 488 BLAKE2B 304dbdb51aa113c0b70b2662e29b1be3294b04f5f00264ce60703756363999cd567dcd0301e27b294d1d53f16ecc016ba429fcbea240949b372750f7e6e7375a SHA512 d120299a2d59259aeb19ae0fa3a3e181e25b6927677187037c61a0901879956177ce8dda10764073a47848f81dcbbcb94e0b6008742994042b6b8fd194e169c3
+DIST curl-8.2.1.tar.xz 2631932 BLAKE2B 77c0b067935397afb3961378f2fe349fa988c6379c1ab7437c5d5f967710b2e9ba7aec91df8fe58a8b26c00c0164d4db9bd095ca27d1bf52b768c8d83cc0ecaf SHA512 3f78c9330c52d32b166f17829fc2be13418ef925e88f75aacad7f369e7afe00dc4a56566418730dbb845b2b284d721b08f639df322e2e1ef2dfab165c4189094
+DIST curl-8.2.1.tar.xz.asc 488 BLAKE2B 569a7c8d338f7175b5035fa281861b57cce7f5327ec6437d79e215e5a806619c9432d7960687e5463787f681cc408371c1eb1f0db7fb8678b8ef34ec50ef69d0 SHA512 31ee66a09e7bd14de949ae991c23a0b905d38407b73ae39bae6d01854d8708355c14bc4d0eab3ff931b85986d0236dd34e934eef6061f4b70739137fd0525084
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
index 550db16e60..1357144db7 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
@@ -17,7 +17,7 @@ else
 		https://curl.se/download/${P}.tar.xz
 		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="curl"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild
new file mode 100644
index 0000000000..825ad81bdf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild
@@ -0,0 +1,351 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
+inherit autotools multilib-minimal multiprocessing prefix toolchain-funcs verify-sig
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.se/"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/curl/curl.git"
+else
+	SRC_URI="
+		https://curl.se/download/${P}.tar.xz
+		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="curl"
+SLOT="0"
+IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
+# These select the default SSL implementation
+IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
+IUSE+=" nghttp3"
+RESTRICT="!test? ( test )"
+
+# Only one default ssl provider can be enabled
+# The default ssl provider needs its USE satisfied
+REQUIRED_USE="
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_mbedtls
+			curl_ssl_nss
+			curl_ssl_openssl
+			curl_ssl_rustls
+		)
+	)
+	curl_ssl_gnutls? ( gnutls )
+	curl_ssl_mbedtls? ( mbedtls )
+	curl_ssl_nss? ( nss )
+	curl_ssl_openssl? ( openssl )
+	curl_ssl_rustls? ( rustls )
+"
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	http2? ( >=net-libs/nghttp2-1.15.0:=[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
+	nghttp3? (
+		net-libs/nghttp3[${MULTILIB_USEDEP}]
+		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
+	)
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			app-misc/ca-certificates
+			net-libs/gnutls:=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:=[${MULTILIB_USEDEP}]
+		)
+		mbedtls? (
+			app-misc/ca-certificates
+			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
+		)
+		nss? (
+			app-misc/ca-certificates
+			dev-libs/nss[${MULTILIB_USEDEP}]
+			dev-libs/nss-pem
+		)
+		openssl? (
+			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+		)
+		rustls? (
+			net-libs/rustls-ffi:=[${MULTILIB_USEDEP}]
+		)
+	)
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
+		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
+
+DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	__builtin_available
+	closesocket
+	CloseSocket
+	getpass_r
+	ioctlsocket
+	IoctlSocket
+	mach_absolute_time
+	setmode
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-prefix.patch
+	"${FILESDIR}"/${PN}-respect-cflags-3.patch
+)
+
+src_prepare() {
+	default
+
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	if use ssl; then
+		myconf+=( --without-gnutls --without-mbedtls --without-nss --without-rustls )
+
+		if use gnutls; then
+			multilib_is_native_abi && einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls )
+		fi
+		if use mbedtls; then
+			multilib_is_native_abi && einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use nss; then
+			multilib_is_native_abi && einfo "SSL provided by nss"
+			myconf+=( --with-nss --with-nss-deprecated )
+		fi
+		if use openssl; then
+			multilib_is_native_abi && einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use rustls; then
+			multilib_is_native_abi && einfo "SSL provided by rustls"
+			myconf+=( --with-rustls )
+		fi
+		if use curl_ssl_gnutls; then
+			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_mbedtls; then
+			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_nss; then
+			multilib_is_native_abi && einfo "Default SSL provided by nss"
+			myconf+=( --with-default-ssl-backend=nss )
+		elif use curl_ssl_openssl; then
+			multilib_is_native_abi && einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_rustls; then
+			multilib_is_native_abi && einfo "Default SSL provided by rustls"
+			myconf+=( --with-default-ssl-backend=rustls )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+		fi
+
+	else
+		myconf+=( --without-ssl )
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	myconf+=(
+		$(use_enable alt-svc)
+		--enable-crypto-auth
+		--enable-dict
+		--disable-ech
+		--enable-file
+		$(use_enable ftp)
+		$(use_enable gopher)
+		$(use_enable hsts)
+		--enable-http
+		$(use_enable imap)
+		$(use_enable ldap)
+		$(use_enable ldap ldaps)
+		--enable-ntlm
+		--disable-ntlm-wb
+		$(use_enable pop3)
+		--enable-rt
+		--enable-rtsp
+		$(use_enable samba smb)
+		$(use_with ssh libssh2)
+		$(use_enable smtp)
+		$(use_enable telnet)
+		$(use_enable tftp)
+		--enable-tls-srp
+		$(use_enable adns ares)
+		--enable-cookies
+		--enable-dateparse
+		--enable-dnsshuffle
+		--enable-doh
+		--enable-symbol-hiding
+		--enable-http-auth
+		--enable-ipv6
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-netrc
+		$(use_enable progress-meter)
+		--enable-proxy
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-pthreads
+		--enable-threaded-resolver
+		--disable-versioned-symbols
+		--without-amissl
+		--without-bearssl
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with http2 nghttp2)
+		--without-hyper
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		--without-libgsasl
+		--without-libpsl
+		--without-msh3
+		$(use_with nghttp3)
+		$(use_with nghttp3 ngtcp2)
+		--without-quiche
+		$(use_with rtmp librtmp)
+		--without-schannel
+		--without-secure-transport
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
+		$(use_enable websockets)
+		--without-winidn
+		--without-wolfssl
+		--with-zlib
+		$(use_with zstd)
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+	)
+
+	if use test && multilib_is_native_abi && ( use http2 || use nghttp3 ); then
+		myconf+=(
+			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# Avoid building the client (we just want libcurl for multilib)
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+	# Fix up the pkg-config file to be more robust.
+	# https://github.com/curl/curl/issues/864
+	local priv=() libs=()
+	# We always enable zlib.
+	libs+=( "-lz" )
+	priv+=( "zlib" )
+	if use http2; then
+		libs+=( "-lnghttp2" )
+		priv+=( "libnghttp2" )
+	fi
+	if use nghttp3; then
+		libs+=( "-lnghttp3" "-lngtcp2" )
+		priv+=( "libnghttp3" "libngtcp2" )
+	fi
+	if use ssl && use curl_ssl_openssl; then
+		libs+=( "-lssl" "-lcrypto" )
+		priv+=( "openssl" )
+	fi
+	grep -q Requires.private libcurl.pc && die "need to update ebuild"
+	libs=$(printf '|%s' "${libs[@]}")
+	sed -i -r \
+		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
+		libcurl.pc || die
+	echo "Requires.private: ${priv[*]}" >> libcurl.pc || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts
+	fi
+}
+
+# There is also a pytest harness that tests for bugs in some very specific
+# situations; we can rely on upstream for this rather than adding additional test deps.
+multilib_src_test() {
+	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
+	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
+	# -v: verbose
+	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
+	# -k: keep test files after completion
+	# -am: automake style TAP output
+	# -p: print logs if test fails
+	# Note: if needed, we can skip specific tests. See e.g. Fedora's packaging
+	# or just read https://github.com/curl/curl/tree/master/tests#run.
+	# Note: we don't run the testsuite for cross-compilation.
+	# Upstream recommend 7*nproc as a starting point for parallel tests.
+	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
+	# as most gentoo users don't have an 'ip6-localhost'
+	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p -j$((7*$(makeopts_jobs))) !241 !1083"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts DESTDIR="${D}" install
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+	rm -rf "${ED}"/etc/ || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
index 0414671d12..825ad81bdf 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
@@ -51,7 +51,7 @@ RDEPEND="
 	sys-libs/zlib[${MULTILIB_USEDEP}]
 	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
 	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
-	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
+	http2? ( >=net-libs/nghttp2-1.15.0:=[${MULTILIB_USEDEP}] )
 	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
 	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
 	ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
@@ -91,7 +91,7 @@ BDEPEND="
 	virtual/pkgconfig
 	test? (
 		sys-apps/diffutils
-		http2? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
+		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
 		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
 	)
 	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-basic-auth.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-basic-auth.patch
new file mode 100644
index 0000000000..899ffb75a8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-basic-auth.patch
@@ -0,0 +1,127 @@
+Patch-Source: https://github.com/curl/curl/pull/11492
+--
+From 0470577eb4524f09d245e9e6afd42ba8677a5a19 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 20 Jul 2023 23:20:50 +0200
+Subject: [PATCH 1/2] test979: test -u with redirect to (the same) absolute
+ host
+
+---
+ tests/data/Makefile.inc |  1 +
+ tests/data/test979      | 64 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 65 insertions(+)
+ create mode 100644 tests/data/test979
+
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 8ee1394d4e562..12aefb14c0d1b 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -122,6 +122,7 @@ test943 test944 test945 test946 test947 test948 test949 test950 test951 \
+ test952 test953 test954 test955 test956 test957 test958 test959 test960 \
+ test961 test962 test963 test964 test965 test966 test967 test968 test969 \
+ test970 test971 test972 test973 test974 test975 test976 test977 test978 \
++test979 \
+ \
+ test980 test981 test982 test983 test984 test985 test986 test987 test988 \
+ test989 \
+diff --git a/tests/data/test979 b/tests/data/test979
+new file mode 100644
+index 0000000000000..40cc35044d9f6
+--- /dev/null
++++ b/tests/data/test979
+@@ -0,0 +1,64 @@
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++Basic
++</keywords>
++</info>
++
++#
++# Server-side
++<reply>
++<data crlf="yes" nocheck="yes">
++HTTP/1.1 302 go go go
++Content-Length: 8
++Location: http://%HOSTIP:%HTTPPORT/user/%TESTNUMBER0002
++Content-Type: text/html
++Funny-head: yesyes
++
++notreal
++</data>
++<data2 crlf="yes">
++HTTP/1.1 200 OK
++Content-Length: 6
++Content-Type: text/html
++Funny-head: yesyes
++
++final
++</data2>
++</reply>
++
++#
++# Client-side
++<client>
++<server>
++http
++</server>
++<name>
++-u with redirect to absolute URL using same origin and auth
++</name>
++<command>
++http://first:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u smith:doggie
++</command>
++</client>
++
++#
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="yes">
++GET /%TESTNUMBER HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Authorization: Basic c21pdGg6ZG9nZ2ll
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET /user/%TESTNUMBER0002 HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Authorization: Basic c21pdGg6ZG9nZ2ll
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+
+From c1effdfe658ae505e8ea65e5f46d810c4b8d81cb Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 20 Jul 2023 23:28:19 +0200
+Subject: [PATCH 2/2] transfer: do not clear the credentials on redirect to
+ absolute URL
+
+Makes test 979 work. Regression shipped in 8.2.0 from commit
+dd4d1a26959f63a2c
+
+Fixes #11486
+Reported-by: Cloudogu Siebels
+---
+ lib/transfer.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/lib/transfer.c b/lib/transfer.c
+index 52cd6a0153673..b678004b95ad2 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -1558,10 +1558,6 @@ CURLcode Curl_follow(struct Curl_easy *data,
+     /* If this is not redirect due to a 401 or 407 response and an absolute
+        URL: don't allow a custom port number */
+     disallowport = TRUE;
+-    if(!data->set.allow_auth_to_other_hosts) {
+-      Curl_safefree(data->state.aptr.user);
+-      Curl_safefree(data->state.aptr.passwd);
+-    }
+   }
+ 
+   DEBUGASSERT(data->state.uh);
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-http2-eof.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-http2-eof.patch
new file mode 100644
index 0000000000..0040a3c656
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.2.0-http2-eof.patch
@@ -0,0 +1,32 @@
+Patch-Source: https://github.com/curl/curl/commit/f9314f317f017e19e1802ce04ceeae620ca2cd71
+--
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 20 Jul 2023 13:08:00 +0200
+Subject: [PATCH] http2: fix regression on upload EOF handling
+
+- a regression introduced by c9ec85121110d7cbbbed2990024222c8f5b8afe5
+  where optimization of small POST bodies leads to a new code path
+  for such uploads that did not trigger the "done sending" event
+- add triggering this event for early "upload_done" situations
+
+Fixes #11485
+Closes #11487
+Reported-by: Aleksander Mazur
+---
+ lib/http.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/http.c b/lib/http.c
+index f851bcd4a3443..e04028b3fec54 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -3380,6 +3380,9 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
+     }
+   }
+ 
++  if(data->req.upload_done)
++    Curl_conn_ev_data_done_send(data);
++
+   if((conn->httpversion >= 20) && data->req.upload_chunky)
+     /* upload_chunky was set above to set up the request in a chunky fashion,
+        but is disabled here again to avoid that the chunked encoded version is
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.7.4.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.7.4.4-r1.ebuild
new file mode 100644
index 0000000000..56c0a04850
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/socat/socat-1.7.4.4-r1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+MY_P=${P/_beta/-b}
+DESCRIPTION="Multipurpose relay (SOcket CAT)"
+HOMEPAGE="http://www.dest-unreach.org/socat/ https://repo.or.cz/socat.git"
+SRC_URI="http://www.dest-unreach.org/socat/download/${MY_P}.tar.bz2"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="ipv6 readline ssl tcpd"
+
+DEPEND="ssl? ( >=dev-libs/openssl-3:0= )
+	readline? ( sys-libs/readline:= )
+	tcpd? ( sys-apps/tcp-wrappers )"
+RDEPEND="${DEPEND}"
+
+# Tests are a large bash script
+# Hard to disable individual tests needing network or privileges
+# in 1.7.4.2: FAILED:  59 329
+RESTRICT="test"
+
+DOCS=( BUGREPORTS CHANGES DEVELOPMENT EXAMPLES FAQ FILES PORTING README SECURITY )
+
+src_configure() {
+	# bug #293324
+	filter-flags '-Wno-error*'
+
+	tc-export AR
+
+	econf \
+		$(use_enable ssl openssl) \
+		$(use_enable readline) \
+		$(use_enable ipv6 ip6) \
+		$(use_enable tcpd libwrap)
+}
+
+src_install() {
+	default
+
+	docinto html
+	dodoc doc/*.html doc/*.css
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
index d5bae25084..2a5ed76b70 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
@@ -1 +1,2 @@
 DIST whois_5.5.17.tar.xz 90608 BLAKE2B 82793097e421d88130d089fc64bb0bceac0c9170b39388262b45d2bf62fc2f8b7c4e393fc5351bba6be303ced00a00af1972bf73c1c8c7c86c812b19a0a6fb5a SHA512 0ed33edc2005eb51a88bda505cc3f6ebe3966095d6f12c03cfe62c12e7e575e1d008632d12de6f27b4c09b91ce5a45705d57acce88409e573bbd7b5132df7fc6
+DIST whois_5.5.18.tar.xz 90216 BLAKE2B 2098b15d36ee0f99e710fdeb10ce1650eba84da1ce770df46182439a6de07995b79746767968522200f5261490e5ffd262673705b12e1004e1ca0dd1af0b9e15 SHA512 28482a6b84d97e2ff69e7a2d01865d227d76aff41a42511a6ebd4ac636b9054643d1df800e6575fb846712e1473f7a31a211dbc08fbdfaaead443d22138266c7
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.18.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.18.ebuild
new file mode 100644
index 0000000000..7d0d51aff2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.18.ebuild
@@ -0,0 +1,81 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P=${P/-/_}
+DESCRIPTION="Improved Whois Client"
+HOMEPAGE="https://github.com/rfc1036/whois"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/rfc1036/whois.git"
+else
+	SRC_URI="mirror://debian/pool/main/w/whois/${MY_P}.tar.xz"
+	#SRC_URI="https://github.com/rfc1036/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	#S="${WORKDIR}"/${PN}
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="iconv idn nls xcrypt"
+
+RDEPEND="
+	iconv? ( virtual/libiconv )
+	idn? ( net-dns/libidn2:= )
+	nls? ( virtual/libintl )
+	xcrypt? ( >=sys-libs/libxcrypt-4.1:= )
+	!xcrypt? ( virtual/libcrypt:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/xz-utils
+	>=dev-lang/perl-5
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.7.2-config-file.patch
+	"${FILESDIR}"/${PN}-5.3.0-libidn_automagic.patch
+	"${FILESDIR}"/${PN}-5.5.6-libxcrypt_automagic.patch
+)
+
+src_prepare() {
+	default
+
+	if use nls ; then
+		sed -i -e 's:#\(.*pos\):\1:' Makefile || die
+	else
+		sed -i -e '/ENABLE_NLS/s:define:undef:' config.h || die
+
+		# don't generate po files when nls is disabled (bug #419889)
+		sed -i -e '/^all:/s/ pos//' \
+			-e '/^install:/s/ install-pos//' Makefile || die
+	fi
+}
+
+src_configure() { :; } # expected no-op
+
+src_compile() {
+	unset HAVE_ICONV HAVE_LIBIDN
+
+	use iconv && export HAVE_ICONV=1
+	use idn && export HAVE_LIBIDN=1
+	use xcrypt && export HAVE_XCRYPT=1
+
+	tc-export CC
+
+	emake CFLAGS="${CFLAGS} ${CPPFLAGS}"
+}
+
+src_install() {
+	emake BASEDIR="${ED}" prefix=/usr install
+
+	insinto /etc
+	doins whois.conf
+	dodoc README debian/changelog
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/Manifest b/sdk_container/src/third_party/portage-stable/net-nds/openldap/Manifest
index c197823a3d..987dc7f896 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/Manifest
@@ -1,6 +1,8 @@
 DIST openldap-2.4.59.tgz 5886272 BLAKE2B a2a8bed1d2af97fd41d651668152fd4740871bc5a8abf4b50390839228af82ac103346b3500ae0f8dd31b708acabb30435b90cd48dfafe510e648df5150d96b8 SHA512 233459ab446da6e107a7fc4ecd5668d6b08c11a11359ee76449550393e8f586a29b59d7ae09a050a1fca4fcf388ea61438ef60831b3ae802d92c048365ae3968
 DIST openldap-OPENLDAP_REL_ENG_2_5_14.tar.bz2 5024359 BLAKE2B ffdffbd47e76545c2dc2d433d290945ab6eebd910031a60249cd8f6eac24f67841098e61c7e57864428e20a183a46d36dac422bba8cf6f3596f97439875af96b SHA512 abd1e8bda0762500db028f283fe2da9480a419072927295d6f3e1448cae130592511f385a87585843cf88217417c90ef57174ca919cfcf163eb41642a72bb4e3
+DIST openldap-OPENLDAP_REL_ENG_2_5_16.tar.bz2 5022608 BLAKE2B 829e416e3cf92d36df0d6642e44083f9b288ef9c3743a84aef3f03cdf7b08b21ea45231653a2659fe0da285ca47a346d336d02c8e0dda21f039fb9e49630262b SHA512 629b92e275b69a540b200e61165492a4706afdf7b15d21bfe2f1fd4c338ecf397ad0c918e36dcef54d1f0cede2f039a8f73d4735f00e892d64ce9a177d490a07
 DIST openldap-OPENLDAP_REL_ENG_2_6_3.tar.gz 6244895 BLAKE2B 97792a1b368de44867b0ce9eef38601c3e64b7d40e4ca206295bee110097697c919040d2220eea6f0581812e09a2cc3e6afb4a243a5072a8a0a95f24f9fb354b SHA512 1c882a0cd0729b5d0f40b58588d0e36ae3b1cae6d569f0576e940c7c63d03c29ed2c9db87695a87594ba99a927ef4cba491bddba3ce049025fd5883463122ba7
 DIST openldap-OPENLDAP_REL_ENG_2_6_4.tar.bz2 5043227 BLAKE2B 9bec77dbace0e52d1607d9ac13a77349e7d0b8876aa81fa635893638d00db58ec6bf8412f11fd266bba0440887be1aa21eb4a876122152f7f6de9fd8f75b6b4c SHA512 bff11bf1ae125bcabbd307f6c4e1c102a8df6f1091f84f5e7053fdbaa89ccd6aa0c86cc8dcce4fb9b6ffd853b5f8d3c933733f5713aeb4d6a9d77ab145293b48
 DIST openldap-OPENLDAP_REL_ENG_2_6_5.tar.bz2 5040569 BLAKE2B d1835e560a81bc3df2eb44964162306057ad28869a1e41da7ab823460b4a33437cd385ec9448a6df9bc580afd04dff5c4680e0b91a2f16960ad2c5f3812410ba SHA512 d259ca5ac8fbdcf9bb477e24c0feaf05678ab660007164a54463a954f1b26c3f9740855d16155fa249adcb2652223fdcfc682bb4005b46a5f36e2d5cae37f158
+DIST openldap-OPENLDAP_REL_ENG_2_6_6.tar.bz2 5040213 BLAKE2B 2497b6698344674a9e8db5f2f2531541167065bb8ac9f512ecdb9349115140d5e83daef9b489e244eee08445de57599ddcfeeed71d4aab41edc58a3092910925 SHA512 3c235ff7b26f753afeb0176e95ecbf6a353bf76f00935c091323366bf97289f628d4d7b4ae3e2a31fe0797715d6c69e6704967dc79ccbae7add3023e226ad73b
 DIST rfc2307bis.schema-20140524 12262 BLAKE2B 98031f49e9bde1e4821e637af3382364d8344ed7017649686a088070d96a632dffa6c661552352656b1b159c0fd962965580069a64c7f3d5bb6a3ed75f60fd99 SHA512 83b89a1deeefc8566b97e7e865b9b6d04541099cbdf719e24538a7d27d61b6209e87ab9003a9f140bd9afd018ec569e71721e3a24090e1902c8b6659d2ba103e
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild
new file mode 100644
index 0000000000..b55c20f3ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild
@@ -0,0 +1,860 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+# Re cleanups:
+# 2.5.x is an LTS release so we want to keep it for a while.
+
+inherit autotools flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+
+MY_PV="$(ver_rs 1-2 _)"
+
+BIS_PN=rfc2307bis.schema
+BIS_PV=20140524
+BIS_P="${BIS_PN}-${BIS_PV}"
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="https://www.openldap.org/"
+SRC_URI="
+	https://gitlab.com/openldap/${PN}/-/archive/OPENLDAP_REL_ENG_${MY_PV}/${PN}-OPENLDAP_REL_ENG_${MY_PV}.tar.bz2
+	mirror://gentoo/${BIS_P}
+"
+S="${WORKDIR}"/${PN}-OPENLDAP_REL_ENG_${MY_PV}
+
+LICENSE="OPENLDAP GPL-2"
+# Subslot added for bug #835654
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+IUSE_DAEMON="argon2 +cleartext crypt experimental minimal samba tcpd"
+IUSE_OVERLAY="overlays perl autoca"
+IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog test"
+IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
+IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+RESTRICT="!test? ( test )"
+
+RESTRICT="!test? ( test )"
+REQUIRED_USE="cxx? ( sasl )
+	pbkdf2? ( ssl )
+	test? ( cleartext debug sasl )
+	autoca? ( !gnutls )
+	?? ( test minimal )
+	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+
+SYSTEM_LMDB_VER=0.9.31
+# openssl is needed to generate lanman-passwords required by samba
+COMMON_DEPEND="
+	kernel_linux? ( sys-apps/util-linux )
+	ssl? (
+		!gnutls? (
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+		)
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}]
+		)
+	)
+	sasl? ( dev-libs/cyrus-sasl:= )
+	!minimal? (
+		dev-libs/libltdl
+		sys-fs/e2fsprogs
+		>=dev-db/lmdb-${SYSTEM_LMDB_VER}:=
+		argon2? ( app-crypt/argon2:= )
+		crypt? ( virtual/libcrypt:= )
+		tcpd? ( sys-apps/tcp-wrappers )
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		perl? ( dev-lang/perl:=[-build(-)] )
+		samba? (
+			dev-libs/openssl:0=
+		)
+		smbkrb5passwd? (
+			dev-libs/openssl:0=
+			kerberos? ( app-crypt/heimdal )
+		)
+		kerberos? (
+			virtual/krb5
+			kinit? ( !app-crypt/heimdal )
+		)
+	)
+"
+DEPEND="${COMMON_DEPEND}
+	sys-apps/groff
+"
+RDEPEND="${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-ldap )
+"
+
+# The user/group are only used for running daemons which are
+# disabled in minimal builds, so elide the accounts too.
+BDEPEND="!minimal? (
+		acct-group/ldap
+		acct-user/ldap
+)
+"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# USE=cxx
+	/usr/include/LDAPAsynConnection.h
+	/usr/include/LDAPAttrType.h
+	/usr/include/LDAPAttribute.h
+	/usr/include/LDAPAttributeList.h
+	/usr/include/LDAPConnection.h
+	/usr/include/LDAPConstraints.h
+	/usr/include/LDAPControl.h
+	/usr/include/LDAPControlSet.h
+	/usr/include/LDAPEntry.h
+	/usr/include/LDAPEntryList.h
+	/usr/include/LDAPException.h
+	/usr/include/LDAPExtResult.h
+	/usr/include/LDAPMessage.h
+	/usr/include/LDAPMessageQueue.h
+	/usr/include/LDAPModList.h
+	/usr/include/LDAPModification.h
+	/usr/include/LDAPObjClass.h
+	/usr/include/LDAPRebind.h
+	/usr/include/LDAPRebindAuth.h
+	/usr/include/LDAPReferenceList.h
+	/usr/include/LDAPResult.h
+	/usr/include/LDAPSaslBindResult.h
+	/usr/include/LDAPSchema.h
+	/usr/include/LDAPSearchReference.h
+	/usr/include/LDAPSearchResult.h
+	/usr/include/LDAPSearchResults.h
+	/usr/include/LDAPUrl.h
+	/usr/include/LDAPUrlList.h
+	/usr/include/LdifReader.h
+	/usr/include/LdifWriter.h
+	/usr/include/SaslInteraction.h
+	/usr/include/SaslInteractionHandler.h
+	/usr/include/StringList.h
+	/usr/include/TlsOptions.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
+	"${FILESDIR}"/${PN}-2.6.1-system-mdb.patch
+	"${FILESDIR}"/${PN}-2.6.1-cloak.patch
+	"${FILESDIR}"/${PN}-2.6.1-flags.patch
+)
+
+openldap_filecount() {
+	local dir="$1"
+	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
+}
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
+	fi
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	have_files=0
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${EROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
+			einfo "- Checking ${each}..."
+			if [[ -r "${CURRENT_TAG}" ]] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
+
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
+
+				# are we on the same branch?
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ "${have_files}" == "1" ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
+				if [[ "${have_files}" == "1" ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					openldap_upgrade_howto
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
+
+	# Now we must check for the major version of sys-libs/db linked against.
+	# TODO: remove this as we dropped bdb support (gone upstream) in 2.6.1?
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
+		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
+			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
+		local fail=0
+
+		# This will not cover detection of cn=Config based configuration, but
+		# it's hopefully good enough.
+		if grep -sq '^backend.*shell' "${EROOT}"/etc/openldap/slapd.conf; then
+			eerror "    OpenLDAP >= 2.6.x has dropped support for Shell backend."
+			eerror "	You will need to migrate per upstream's migration notes"
+			eerror "	at https://www.openldap.org/doc/admin25/appendix-upgrading.html."
+			eerror "	Your existing database will not be accessible until it is"
+			eerror "	converted away from backend shell!"
+			echo
+			fail=1
+		fi
+		if has_version "${CATEGORY}/${PN}[berkdb]" || grep -sq '^backend.*(bdb|hdb)' /etc/openldap/slapd.conf; then
+			eerror "	OpenLDAP >= 2.5.x has dropped support for Berkeley DB."
+			eerror "	You will need to migrate per upstream's migration notes"
+			eerror "	at https://www.openldap.org/doc/admin25/appendix-upgrading.html."
+			eerror "	Your existing database will not be accessible until it is"
+			eerror "	converted to mdb!"
+			echo
+			fail=1
+		elif [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			:
+			# Nothing wrong here.
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was not built against"
+			eerror "	any version of sys-libs/db, but the new one will build"
+			eerror "	against	${NEWVER} and your database may be inaccessible."
+			echo
+			fail=1
+		elif [[ -n "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
+			eerror "	built against any version and your database may be"
+			eerror "	inaccessible."
+			echo
+			fail=1
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
+			eerror "	${NEWVER} and your database would be inaccessible."
+			echo
+			fail=1
+		fi
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
+	fi
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	local d l i
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror
+	eerror "Additionally, rebuilding against different major versions of the"
+	eerror "sys-libs/db libraries will cause your database to be inaccessible."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. grep -E -v '^(entry|context)CSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. Check that your data is intact."
+	eerror "11. Set up the new replication system."
+	eerror
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
+		die "You need to upgrade your database first"
+	else
+		eerror "You have the magical FORCE_UPGRADE=1 in place."
+		eerror "Don't say you weren't warned about data loss."
+	fi
+}
+
+pkg_setup() {
+	if ! use sasl && use cxx ; then
+		die "To build the ldapc++ library you must emerge openldap with sasl support"
+	fi
+	# Bug #322787
+	if use minimal && ! has_version "net-nds/openldap" ; then
+		einfo "No datadir scan needed, openldap not installed"
+	elif use minimal && has_version 'net-nds/openldap[minimal]' ; then
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+	else
+		openldap_find_versiontags
+	fi
+}
+
+src_prepare() {
+	# The system copy of dev-db/lmdb must match the version that this copy
+	# of OpenLDAP shipped with! See bug #588792.
+	#
+	# Fish out MDB_VERSION_MAJOR/MDB_VERSION_MINOR/MDB_VERSION_PATCH from
+	# the bundled lmdb's header to find out the version.
+	local bundled_lmdb_version=$(sed -En '/^#define MDB_VERSION_(MAJOR|MINOR|PATCH)(\s+)?/{s/[^0-9.]//gp}' libraries/liblmdb/lmdb.h || die)
+	printf -v bundled_lmdb_version "%s." ${bundled_lmdb_version}
+
+	if [[ ${SYSTEM_LMDB_VER}. != ${bundled_lmdb_version} ]] ; then
+		eerror "Source lmdb version: ${bundled_lmdb_version}"
+		eerror "Ebuild lmdb version: ${SYSTEM_LMDB_VER}"
+		die "Ebuild needs to update SYSTEM_LMDB_VER!"
+	fi
+
+	rm -r libraries/liblmdb || die 'could not removed bundled lmdb directory'
+
+	local filename
+	for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do
+		iconv -f iso-8859-1 -t utf-8 "${filename}" > "${filename}.utf8"
+		mv "${filename}.utf8" "${filename}"
+	done
+
+	default
+
+	sed -i \
+		-e "s:\$(localstatedir)/run:${EPREFIX}/run:" \
+		-e '/MKDIR.*.(DESTDIR)\/run/d' \
+		-e '/MKDIR.*.(DESTDIR).*.(runstatedir)/d' \
+		servers/slapd/Makefile.in || die 'adjusting slapd Makefile.in failed'
+
+	pushd build &>/dev/null || die "pushd build"
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to remove too early stripping"
+	popd &>/dev/null || die
+
+	# Fails with OpenSSL 3, bug #848894
+	# https://bugs.openldap.org/show_bug.cgi?id=10009
+	rm tests/scripts/test076-authid-rewrite || die
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+build_contrib_module() {
+	# <dir> [<target>]
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
+	einfo "Compiling contrib-module: $1"
+	local target="${2:-all}"
+	emake \
+		LDAP_BUILD="${BUILD_DIR}" prefix="${EPREFIX}/usr" \
+		CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" \
+		"${target}"
+	popd &>/dev/null || die
+}
+
+multilib_src_configure() {
+	# Optional Features
+	myconf+=(
+		--enable-option-checking
+		$(use_enable debug)
+		--enable-dynamic
+		$(use_enable syslog)
+		$(use_enable ipv6)
+		--enable-local
+	)
+
+	# Optional Packages
+	myconf+=(
+		--without-fetch
+	)
+
+	if use experimental ; then
+		# connectionless ldap per bug #342439
+		# connectionless is a unsupported feature according to Howard Chu
+		# see https://bugs.openldap.org/show_bug.cgi?id=9739
+		# (see also bug #892009)
+		append-flags -DLDAP_CONNECTIONLESS
+	fi
+
+	if ! use minimal && multilib_is_native_abi; then
+		# SLAPD (Standalone LDAP Daemon) Options
+		# overlay chaining requires '--enable-ldap' #296567
+		# see https://www.openldap.org/doc/admin26/overlays.html#Chaining
+		myconf+=(
+			--enable-ldap=yes
+			--enable-slapd
+			$(use_enable cleartext)
+			$(use_enable crypt)
+			$(multilib_native_use_enable sasl spasswd)
+			--disable-slp
+			$(use_enable tcpd wrappers)
+		)
+		if use experimental ; then
+			myconf+=(
+				--enable-dynacl
+				# ACI build as dynamic module not supported (yet)
+				--enable-aci=yes
+			)
+		fi
+
+		for option in modules rlookups slapi; do
+			myconf+=( --enable-${option} )
+		done
+
+		# static SLAPD backends
+		for backend in mdb; do
+			myconf+=( --enable-${backend}=yes )
+		done
+
+		# module SLAPD backends
+		for backend in asyncmeta dnssrv meta null passwd relay sock; do
+			# missing modules: wiredtiger (not available in portage)
+			myconf+=( --enable-${backend}=mod )
+		done
+
+		use perl && myconf+=( --enable-perl=mod )
+
+		if use odbc ; then
+			myconf+=( --enable-sql=mod )
+			if use iodbc ; then
+				myconf+=( --with-odbc="iodbc" )
+				append-cflags -I"${EPREFIX}"/usr/include/iodbc
+			else
+				myconf+=( --with-odbc="unixodbc" )
+			fi
+		fi
+
+		use overlays && myconf+=( --enable-overlays=mod )
+		use autoca && myconf+=( --enable-autoca=mod ) || myconf+=( --enable-autoca=no )
+		# compile-in the syncprov
+		myconf+=( --enable-syncprov=yes )
+
+		# SLAPD Password Module Options
+		myconf+=(
+			$(use_enable argon2)
+		)
+
+		# Optional Packages
+		myconf+=(
+			$(use_with systemd)
+			$(multilib_native_use_with sasl cyrus-sasl)
+		)
+	else
+		myconf+=(
+			--disable-backends
+			--disable-slapd
+			--disable-mdb
+			--disable-overlays
+			--disable-autoca
+			--disable-syslog
+			--without-systemd
+		)
+	fi
+
+	# Library Generation & Linking Options
+	myconf+=(
+		$(use_enable static-libs static)
+		--enable-shared
+		--enable-versioning
+		--with-pic
+	)
+
+	# some cross-compiling tests don't pan out well.
+	tc-is-cross-compiler && myconf+=(
+		--with-yielding-select=yes
+	)
+
+	local ssl_lib="no"
+	if use ssl || ( ! use minimal && use samba ) ; then
+		if use gnutls ; then
+			myconf+=( --with-tls="gnutls" )
+		else
+			# disable MD2 hash function
+			append-cflags -DOPENSSL_NO_MD2
+			myconf+=( --with-tls="openssl" )
+		fi
+	else
+		myconf+=( --with-tls="no" )
+	fi
+
+	tc-export AR CC CXX
+
+	ECONF_SOURCE="${S}" econf \
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
+		--localstatedir="${EPREFIX}"/var \
+		--runstatedir="${EPREFIX}"/run \
+		--sharedstatedir="${EPREFIX}"/var/lib \
+		"${myconf[@]}"
+
+	# argument '--runstatedir' seems to have no effect therefore this workaround
+	sed -i \
+		-e 's:^runstatedir=.*:runstatedir=${EPREFIX}/run:' \
+		configure contrib/ldapc++/configure contrib/ldaptcl/configure || die 'could not set runstatedir'
+
+	sed -i \
+		-e "s:/var/run/sasl2/mux:${EPREFIX}/run/sasl2/mux:" \
+		doc/guide/admin/security.sdf || die 'could not fix run path in doc'
+
+	emake depend
+}
+
+src_configure_cxx() {
+	# This needs the libraries built by the first build run.
+	# we have to run it AFTER the main build, not just after the main configure
+	local myconf_ldapcpp=(
+		--with-libldap="${E}/lib"
+		--with-ldap-includes="${S}/include"
+	)
+
+	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die "could not create ${BUILD_DIR}/contrib/ldapc++ directory"
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+
+	local LDFLAGS="${LDFLAGS}"
+	local CPPFLAGS="${CPPFLAGS}"
+
+	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs -L"${BUILD_DIR}"/libraries/libldap/.libs
+	append-cppflags -I"${BUILD_DIR}"/include
+
+	ECONF_SOURCE="${S}"/contrib/ldapc++ econf "${myconf_ldapcpp[@]}"
+	popd &>/dev/null || die "popd contrib/ldapc++"
+}
+
+multilib_src_compile() {
+	tc-export AR CC CXX
+	emake CC="$(tc-getCC)" SHELL="${EPREFIX}"/bin/sh
+
+	if ! use minimal && multilib_is_native_abi ; then
+		if use cxx ; then
+			einfo "Building contrib library: ldapc++"
+			src_configure_cxx
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake
+			popd &>/dev/null || die
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
+
+			MY_DEFS="-DDO_SHADOW"
+			if use samba ; then
+				MY_DEFS="${MY_DEFS} -DDO_SAMBA"
+				MY_KRB5_INC=""
+			fi
+			if use kerberos ; then
+				MY_DEFS="${MY_DEFS} -DDO_KRB5"
+				MY_KRB5_INC="$(krb5-config --cflags)"
+			fi
+
+			emake \
+				DEFS="${MY_DEFS}" \
+				KRB5_INC="${MY_KRB5_INC}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use overlays ; then
+			einfo "Building contrib-module: samba4"
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
+
+			emake \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="$(tc-getCC)" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use kerberos ; then
+			if use kinit ; then
+				build_contrib_module "kinit" "kinit.c" "kinit"
+			fi
+			build_contrib_module "passwd" "pw-kerberos.la"
+		fi
+
+		if use pbkdf2; then
+			build_contrib_module "passwd/pbkdf2"
+		fi
+
+		if use sha2 ; then
+			build_contrib_module "passwd/sha2"
+		fi
+
+		# We could build pw-radius if GNURadius would install radlib.h
+		build_contrib_module "passwd" "pw-netscape.la"
+
+		#build_contrib_module "acl" "posixgroup.la" # example code only
+		#build_contrib_module "acl" "gssacl.la" # example code only, also needs kerberos
+		build_contrib_module "addpartial"
+		build_contrib_module "allop"
+		build_contrib_module "allowed"
+		build_contrib_module "autogroup"
+		build_contrib_module "cloak"
+		# build_contrib_module "comp_match" # really complex, adds new external deps, questionable demand
+		build_contrib_module "denyop"
+		build_contrib_module "dsaschema"
+		build_contrib_module "dupent"
+		build_contrib_module "lastbind"
+		# lastmod may not play well with other overlays
+		build_contrib_module "lastmod"
+		build_contrib_module "noopsrch"
+		#build_contrib_module "nops" https://bugs.gentoo.org/641576
+		#build_contrib_module "nssov" RESO:LATER
+		build_contrib_module "trace"
+		# build slapi-plugins
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
+		einfo "Building contrib-module: addrdnvalues plugin"
+		$(tc-getCC) -shared \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CPPFLAGS} \
+			${CFLAGS} \
+			-fPIC \
+			${LDFLAGS} \
+			-o libaddrdnvalues-plugin.so \
+			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
+		popd &>/dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		cd tests || die
+		pwd
+
+		# Increase various test timeouts/delays, bug #894012
+		# We can't just double everything as there's a cumulative effect.
+		export SLEEP0=2 # originally 1
+		export SLEEP1=10 # originally 7
+		export SLEEP2=20 # originally 15
+		export TIMEOUT=16 # originally 8
+
+		# emake test => runs only lloadd & mdb, in serial; skips ldif,sql,wt,regression
+		# emake partests => runs ALL of the tests in parallel
+		# wt/WiredTiger is not supported in Gentoo
+		TESTS=( lloadd mdb )
+		#TESTS+=( pldif ) # not done by default, so also exclude here
+		#use odbc && TESTS+=( psql ) # not done by default, so also exclude here
+
+		emake -Onone "${TESTS[@]}"
+	fi
+}
+
+multilib_src_install() {
+	emake CC="$(tc-getCC)" \
+		DESTDIR="${D}" SHELL="${EPREFIX}"/bin/sh install
+
+	if ! use minimal && multilib_is_native_abi; then
+		# openldap modules go here
+		# TODO: write some code to populate slapd.conf with moduleload statements
+		keepdir /usr/$(get_libdir)/openldap/openldap/
+
+		# initial data storage dir
+		keepdir /var/lib/openldap-data
+		use prefix || fowners ldap:ldap /var/lib/openldap-data
+		fperms 0700 /var/lib/openldap-data
+
+		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+		# use our config
+		rm "${ED}"/etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.6.3-slapd-conf slapd.conf
+		configfile="${ED}"/etc/openldap/slapd.conf
+
+		# populate with built backends
+		einfo "populate config with built backends"
+		for x in "${ED}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			einfo "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
+		use prefix || fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default || die
+
+		# install our own init scripts and systemd unit files
+		einfo "Install init scripts"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-initd-2.4.40-r2 > "${T}"/slapd || die
+		doinitd "${T}"/slapd
+		newconfd "${FILESDIR}"/slapd-confd-2.6.1 slapd
+
+		if use systemd; then
+			# The systemd unit uses Type=notify, so it is useless without USE=systemd
+			einfo "Install systemd service"
+			rm -rf "${ED}"/{,usr/}lib/systemd
+			sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-2.6.1.service > "${T}"/slapd.service || die
+			systemd_dounit "${T}"/slapd.service
+			systemd_install_serviced "${FILESDIR}"/slapd.service.conf
+			newtmpfiles "${FILESDIR}"/slapd.tmpfilesd slapd.conf
+		fi
+
+		# if built without SLP, we don't need to be before avahi
+			sed -i \
+				-e '/before/{s/avahi-daemon//g}' \
+				"${ED}"/etc/init.d/slapd \
+				|| die
+
+		if use cxx ; then
+			einfo "Install the ldapc++ library"
+			cd "${BUILD_DIR}/contrib/ldapc++" || die
+			emake DESTDIR="${D}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			cd "${S}"/contrib/ldapc++ || die
+			newdoc README ldapc++-README
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README smbk5pwd-README
+		fi
+
+		if use overlays ; then
+			einfo "Install the samba4 module"
+			cd "${S}/contrib/slapd-modules/samba4" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README samba4-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules" || die
+		for l in */*.la */*/*.la; do
+			[[ -e ${l} ]] || continue
+			libtool --mode=install cp ${l} \
+				"${ED}"/usr/$(get_libdir)/openldap/openldap || \
+				die "installing ${l} failed"
+		done
+
+		dodoc "${FILESDIR}"/DB_CONFIG.fast.example
+		docinto contrib
+		doman */*.5
+		#newdoc acl/README*
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		newdoc allowed/README allowed-README
+		newdoc autogroup/README autogroup-README
+		newdoc dsaschema/README dsaschema-README
+		newdoc passwd/README passwd-README
+		cd "${S}/contrib/slapi-plugins" || die
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins */*.so
+		docinto contrib
+		newdoc addrdnvalues/README addrdnvalues-README
+
+		insinto /etc/openldap/schema
+		newins "${DISTDIR}"/${BIS_P} ${BIS_PN}
+
+		docinto back-sock ; dodoc "${S}"/servers/slapd/back-sock/searchexample*
+		docinto back-perl ; dodoc "${S}"/servers/slapd/back-perl/SampleLDAP.pm
+
+		dosbin "${S}"/contrib/slapd-tools/statslog
+		newdoc "${S}"/contrib/slapd-tools/README README.statslog
+	fi
+
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README
+	docinto rfc ; dodoc doc/rfc/*.txt
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+	# bug 440470, only display the getting started help there was no openldap before,
+	# or we are going to a non-minimal build
+	! has_version net-nds/openldap || has_version 'net-nds/openldap[minimal]'
+	OPENLDAP_PRINT_MESSAGES=$((! $?))
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		if use systemd; then
+			tmpfiles_process slapd.conf
+		fi
+
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			use prefix || chown ldap:ldap "${EROOT}"/etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT allow' if you want to use them."
+		fi
+
+		if use prefix; then
+			# Warn about prefix issues with slapd
+			eerror "slapd might NOT be usable on Prefix systems as it requires root privileges"
+			eerror "to start up, and requires that certain files directories be owned by"
+			eerror "ldap:ldap.  As Prefix does not support changing ownership of files and"
+			eerror "directories, you will have to manually fix this yourself."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		if [[ -d "${EROOT}"/var/run/openldap ]]; then
+			use prefix || { chown ldap:ldap "${EROOT}"/var/run/openldap || die; }
+			chmod 0755 "${EROOT}"/var/run/openldap || die
+		fi
+		use prefix || chown root:ldap "${EROOT}"/etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${EROOT}"/etc/openldap/slapd.conf{,.default} || die
+		use prefix || chown ldap:ldap "${EROOT}"/var/lib/openldap-data
+	fi
+
+	if has_version 'net-nds/openldap[-minimal]' && ((${OPENLDAP_PRINT_MESSAGES})); then
+		elog "Getting started using OpenLDAP? There is some documentation available:"
+		elog "Gentoo Guide to OpenLDAP Authentication"
+		elog "(https://wiki.gentoo.org/wiki/Centralized_authentication_using_OpenLDAP)"
+	fi
+
+	preserve_old_lib_notify /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild
new file mode 100644
index 0000000000..b8aa589bf0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild
@@ -0,0 +1,870 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Re cleanups:
+# 2.5.x is an LTS release so we want to keep it for a while.
+
+inherit autotools flag-o-matic multibuild multilib multilib-minimal preserve-libs
+inherit ssl-cert toolchain-funcs systemd tmpfiles
+
+MY_PV="$(ver_rs 1-2 _)"
+
+BIS_PN=rfc2307bis.schema
+BIS_PV=20140524
+BIS_P="${BIS_PN}-${BIS_PV}"
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="https://www.openldap.org/"
+SRC_URI="
+	https://gitlab.com/openldap/${PN}/-/archive/OPENLDAP_REL_ENG_${MY_PV}/${PN}-OPENLDAP_REL_ENG_${MY_PV}.tar.bz2
+	mirror://gentoo/${BIS_P}
+"
+S="${WORKDIR}"/${PN}-OPENLDAP_REL_ENG_${MY_PV}
+
+LICENSE="OPENLDAP GPL-2"
+# Subslot added for bug #835654
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+IUSE_DAEMON="argon2 +cleartext crypt experimental minimal samba tcpd"
+IUSE_OVERLAY="overlays perl autoca"
+IUSE_OPTIONAL="debug gnutls iodbc odbc sasl ssl selinux static-libs +syslog test"
+IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
+IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	cxx? ( sasl )
+	pbkdf2? ( ssl )
+	test? ( cleartext sasl )
+	autoca? ( !gnutls )
+	?? ( test minimal )
+	kerberos? ( ?? ( kinit smbkrb5passwd ) )
+"
+
+SYSTEM_LMDB_VER=0.9.31
+# openssl is needed to generate lanman-passwords required by samba
+COMMON_DEPEND="
+	kernel_linux? ( sys-apps/util-linux )
+	ssl? (
+		!gnutls? (
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+		)
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}]
+		)
+	)
+	sasl? ( dev-libs/cyrus-sasl:= )
+	!minimal? (
+		dev-libs/libevent:=
+		dev-libs/libltdl
+		sys-fs/e2fsprogs
+		>=dev-db/lmdb-${SYSTEM_LMDB_VER}:=
+		argon2? ( app-crypt/argon2:= )
+		crypt? ( virtual/libcrypt:= )
+		tcpd? ( sys-apps/tcp-wrappers )
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		perl? ( dev-lang/perl:=[-build(-)] )
+		samba? (
+			dev-libs/openssl:0=
+		)
+		smbkrb5passwd? (
+			dev-libs/openssl:0=
+			kerberos? ( app-crypt/heimdal )
+		)
+		kerberos? (
+			virtual/krb5
+			kinit? ( !app-crypt/heimdal )
+		)
+	)
+"
+DEPEND="
+	${COMMON_DEPEND}
+	sys-apps/groff
+"
+RDEPEND="
+	${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-ldap )
+"
+
+# The user/group are only used for running daemons which are
+# disabled in minimal builds, so elide the accounts too.
+BDEPEND="
+	!minimal? (
+		acct-group/ldap
+		acct-user/ldap
+	)
+"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# USE=cxx
+	/usr/include/LDAPAsynConnection.h
+	/usr/include/LDAPAttrType.h
+	/usr/include/LDAPAttribute.h
+	/usr/include/LDAPAttributeList.h
+	/usr/include/LDAPConnection.h
+	/usr/include/LDAPConstraints.h
+	/usr/include/LDAPControl.h
+	/usr/include/LDAPControlSet.h
+	/usr/include/LDAPEntry.h
+	/usr/include/LDAPEntryList.h
+	/usr/include/LDAPException.h
+	/usr/include/LDAPExtResult.h
+	/usr/include/LDAPMessage.h
+	/usr/include/LDAPMessageQueue.h
+	/usr/include/LDAPModList.h
+	/usr/include/LDAPModification.h
+	/usr/include/LDAPObjClass.h
+	/usr/include/LDAPRebind.h
+	/usr/include/LDAPRebindAuth.h
+	/usr/include/LDAPReferenceList.h
+	/usr/include/LDAPResult.h
+	/usr/include/LDAPSaslBindResult.h
+	/usr/include/LDAPSchema.h
+	/usr/include/LDAPSearchReference.h
+	/usr/include/LDAPSearchResult.h
+	/usr/include/LDAPSearchResults.h
+	/usr/include/LDAPUrl.h
+	/usr/include/LDAPUrlList.h
+	/usr/include/LdifReader.h
+	/usr/include/LdifWriter.h
+	/usr/include/SaslInteraction.h
+	/usr/include/SaslInteractionHandler.h
+	/usr/include/StringList.h
+	/usr/include/TlsOptions.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
+	"${FILESDIR}"/${PN}-2.6.1-system-mdb.patch
+	"${FILESDIR}"/${PN}-2.6.1-cloak.patch
+	"${FILESDIR}"/${PN}-2.6.1-flags.patch
+	"${FILESDIR}"/${PN}-2.6.1-fix-missing-mapping.patch
+)
+
+openldap_filecount() {
+	local dir="$1"
+	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
+}
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
+	fi
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	have_files=0
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${EROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
+			einfo "- Checking ${each}..."
+			if [[ -r "${CURRENT_TAG}" ]] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
+
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
+
+				# are we on the same branch?
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ "${have_files}" == "1" ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
+				if [[ "${have_files}" == "1" ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					openldap_upgrade_howto
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
+
+	# Now we must check for the major version of sys-libs/db linked against.
+	# TODO: remove this as we dropped bdb support (gone upstream) in 2.6.1?
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
+		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
+			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
+		local fail=0
+
+		# This will not cover detection of cn=Config based configuration, but
+		# it's hopefully good enough.
+		if grep -sq '^backend.*shell' "${EROOT}"/etc/openldap/slapd.conf; then
+			eerror "    OpenLDAP >= 2.5.x has dropped support for Shell backend."
+			eerror "	You will need to migrate per upstream's migration notes"
+			eerror "	at https://www.openldap.org/doc/admin25/appendix-upgrading.html."
+			eerror "	Your existing database will not be accessible until it is"
+			eerror "	converted away from backend shell!"
+			echo
+			fail=1
+		fi
+		if has_version "${CATEGORY}/${PN}[berkdb]" || grep -sq '^backend.*(bdb|hdb)' /etc/openldap/slapd.conf; then
+			eerror "	OpenLDAP >= 2.5.x has dropped support for Berkeley DB."
+			eerror "	You will need to migrate per upstream's migration notes"
+			eerror "	at https://www.openldap.org/doc/admin25/appendix-upgrading.html."
+			eerror "	Your existing database will not be accessible until it is"
+			eerror "	converted to mdb!"
+			echo
+			fail=1
+		elif [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			:
+			# Nothing wrong here.
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was not built against"
+			eerror "	any version of sys-libs/db, but the new one will build"
+			eerror "	against	${NEWVER} and your database may be inaccessible."
+			echo
+			fail=1
+		elif [[ -n "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
+			eerror "	built against any version and your database may be"
+			eerror "	inaccessible."
+			echo
+			fail=1
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
+			eerror "	${NEWVER} and your database would be inaccessible."
+			echo
+			fail=1
+		fi
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
+	fi
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	local d l i
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror
+	eerror "Additionally, rebuilding against different major versions of the"
+	eerror "sys-libs/db libraries will cause your database to be inaccessible."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. grep -E -v '^(entry|context)CSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. Check that your data is intact."
+	eerror "11. Set up the new replication system."
+	eerror
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
+		die "You need to upgrade your database first"
+	else
+		eerror "You have the magical FORCE_UPGRADE=1 in place."
+		eerror "Don't say you weren't warned about data loss."
+	fi
+}
+
+pkg_setup() {
+	if ! use sasl && use cxx ; then
+		die "To build the ldapc++ library you must emerge openldap with sasl support"
+	fi
+	# Bug #322787
+	if use minimal && ! has_version "net-nds/openldap" ; then
+		einfo "No datadir scan needed, openldap not installed"
+	elif use minimal && has_version 'net-nds/openldap[minimal]' ; then
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+	else
+		openldap_find_versiontags
+	fi
+}
+
+src_prepare() {
+	# The system copy of dev-db/lmdb must match the version that this copy
+	# of OpenLDAP shipped with! See bug #588792.
+	#
+	# Fish out MDB_VERSION_MAJOR/MDB_VERSION_MINOR/MDB_VERSION_PATCH from
+	# the bundled lmdb's header to find out the version.
+	local bundled_lmdb_version=$(sed -En '/^#define MDB_VERSION_(MAJOR|MINOR|PATCH)(\s+)?/{s/[^0-9.]//gp}' \
+		libraries/liblmdb/lmdb.h || die)
+	printf -v bundled_lmdb_version "%s." ${bundled_lmdb_version}
+
+	if [[ ${SYSTEM_LMDB_VER}. != ${bundled_lmdb_version} ]] ; then
+		eerror "Source lmdb version: ${bundled_lmdb_version}"
+		eerror "Ebuild lmdb version: ${SYSTEM_LMDB_VER}"
+		die "Ebuild needs to update SYSTEM_LMDB_VER!"
+	fi
+
+	rm -r libraries/liblmdb || die 'could not removed bundled lmdb directory'
+
+	local filename
+	for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do
+		iconv -f iso-8859-1 -t utf-8 "${filename}" > "${filename}.utf8"
+		mv "${filename}.utf8" "${filename}"
+	done
+
+	default
+
+	sed -i \
+		-e "s:\$(localstatedir)/run:${EPREFIX}/run:" \
+		-e '/MKDIR.*.(DESTDIR)\/run/d' \
+		servers/slapd/Makefile.in || die 'adjusting slapd Makefile.in failed'
+
+	pushd build &>/dev/null || die "pushd build"
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to remove too early stripping"
+	popd &>/dev/null || die
+
+	# Fails with OpenSSL 3, bug #848894
+	# https://bugs.openldap.org/show_bug.cgi?id=10009
+	rm tests/scripts/test076-authid-rewrite || die
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+build_contrib_module() {
+	# <dir> [<target>]
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
+	einfo "Compiling contrib-module: $1"
+	local target="${2:-all}"
+	emake \
+		LDAP_BUILD="${BUILD_DIR}" prefix="${EPREFIX}/usr" \
+		CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" \
+		"${target}"
+	popd &>/dev/null || die
+}
+
+multilib_src_configure() {
+	# Optional Features
+	myconf+=(
+		--enable-option-checking
+		$(use_enable debug)
+		--enable-dynamic
+		$(use_enable syslog)
+		--enable-ipv6
+		--enable-local
+	)
+
+	# Optional Packages
+	myconf+=(
+		--without-fetch
+	)
+
+	if use experimental ; then
+		# connectionless ldap per bug #342439
+		# connectionless is a unsupported feature according to Howard Chu
+		# see https://bugs.openldap.org/show_bug.cgi?id=9739
+		# (see also bug #892009)
+		append-flags -DLDAP_CONNECTIONLESS
+	fi
+
+	if ! use minimal && multilib_is_native_abi; then
+		# SLAPD (Standalone LDAP Daemon) Options
+		# overlay chaining requires '--enable-ldap' #296567
+		# see https://www.openldap.org/doc/admin26/overlays.html#Chaining
+		myconf+=(
+			--enable-ldap=yes
+			--enable-slapd
+			$(use_enable cleartext)
+			$(use_enable crypt)
+			$(multilib_native_use_enable sasl spasswd)
+			--disable-slp
+			$(use_enable tcpd wrappers)
+		)
+		if use experimental ; then
+			myconf+=(
+				--enable-dynacl
+				# ACI build as dynamic module not supported (yet)
+				--enable-aci=yes
+			)
+		fi
+
+		for option in modules rlookups slapi; do
+			myconf+=( --enable-${option} )
+		done
+
+		# static SLAPD backends
+		for backend in mdb; do
+			myconf+=( --enable-${backend}=yes )
+		done
+
+		# module SLAPD backends
+		for backend in asyncmeta dnssrv meta null passwd relay sock; do
+			# missing modules: wiredtiger (not available in portage)
+			myconf+=( --enable-${backend}=mod )
+		done
+
+		use perl && myconf+=( --enable-perl=mod )
+
+		if use odbc ; then
+			myconf+=( --enable-sql=mod )
+			if use iodbc ; then
+				myconf+=( --with-odbc="iodbc" )
+				append-cflags -I"${EPREFIX}"/usr/include/iodbc
+			else
+				myconf+=( --with-odbc="unixodbc" )
+			fi
+		fi
+
+		use overlays && myconf+=( --enable-overlays=mod )
+		use autoca && myconf+=( --enable-autoca=mod ) || myconf+=( --enable-autoca=no )
+		# compile-in the syncprov
+		myconf+=( --enable-syncprov=yes )
+
+		# Build the standalone load balancer (lloadd) - also available as a slapd module; --enable-balancer=mod
+		myconf+=( --enable-balancer=yes )
+
+		# SLAPD Password Module Options
+		myconf+=(
+			$(use_enable argon2)
+		)
+
+		# Optional Packages
+		myconf+=(
+			$(use_with systemd)
+			$(multilib_native_use_with sasl cyrus-sasl)
+		)
+	else
+		myconf+=(
+			--disable-backends
+			--disable-slapd
+			--disable-mdb
+			--disable-overlays
+			--disable-autoca
+			--disable-syslog
+			--without-systemd
+		)
+	fi
+
+	# Library Generation & Linking Options
+	myconf+=(
+		$(use_enable static-libs static)
+		--enable-shared
+		--enable-versioning
+		--with-pic
+	)
+
+	# some cross-compiling tests don't pan out well.
+	tc-is-cross-compiler && myconf+=(
+		--with-yielding-select=yes
+	)
+
+	local ssl_lib="no"
+	if use ssl || ( ! use minimal && use samba ) ; then
+		if use gnutls ; then
+			myconf+=( --with-tls="gnutls" )
+		else
+			# disable MD2 hash function
+			append-cflags -DOPENSSL_NO_MD2
+			myconf+=( --with-tls="openssl" )
+		fi
+	else
+		myconf+=( --with-tls="no" )
+	fi
+
+	tc-export AR CC CXX
+
+	ECONF_SOURCE="${S}" econf \
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
+		--localstatedir="${EPREFIX}"/var \
+		--runstatedir="${EPREFIX}"/run \
+		--sharedstatedir="${EPREFIX}"/var/lib \
+		"${myconf[@]}"
+
+	# argument '--runstatedir' seems to have no effect therefore this workaround
+	sed -i \
+		-e 's:^runstatedir=.*:runstatedir=${EPREFIX}/run:' \
+		configure contrib/ldapc++/configure contrib/ldaptcl/configure || die 'could not set runstatedir'
+
+	sed -i \
+		-e "s:/var/run/sasl2/mux:${EPREFIX}/run/sasl2/mux:" \
+		doc/guide/admin/security.sdf || die 'could not fix run path in doc'
+
+	emake depend
+}
+
+src_configure_cxx() {
+	# This needs the libraries built by the first build run.
+	# we have to run it AFTER the main build, not just after the main configure
+	local myconf_ldapcpp=(
+		--with-libldap="${E}/lib"
+		--with-ldap-includes="${S}/include"
+	)
+
+	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die "could not create ${BUILD_DIR}/contrib/ldapc++ directory"
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+
+	local LDFLAGS="${LDFLAGS}"
+	local CPPFLAGS="${CPPFLAGS}"
+
+	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs -L"${BUILD_DIR}"/libraries/libldap/.libs
+	append-cppflags -I"${BUILD_DIR}"/include
+
+	ECONF_SOURCE="${S}"/contrib/ldapc++ econf "${myconf_ldapcpp[@]}"
+	popd &>/dev/null || die "popd contrib/ldapc++"
+}
+
+multilib_src_compile() {
+	tc-export AR CC CXX
+	emake CC="$(tc-getCC)" SHELL="${EPREFIX}"/bin/sh
+
+	if ! use minimal && multilib_is_native_abi ; then
+		if use cxx ; then
+			einfo "Building contrib library: ldapc++"
+			src_configure_cxx
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake
+			popd &>/dev/null || die
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
+
+			MY_DEFS="-DDO_SHADOW"
+			if use samba ; then
+				MY_DEFS="${MY_DEFS} -DDO_SAMBA"
+				MY_KRB5_INC=""
+			fi
+			if use kerberos ; then
+				MY_DEFS="${MY_DEFS} -DDO_KRB5"
+				MY_KRB5_INC="$(krb5-config --cflags)"
+			fi
+
+			emake \
+				DEFS="${MY_DEFS}" \
+				KRB5_INC="${MY_KRB5_INC}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use overlays ; then
+			einfo "Building contrib-module: samba4"
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
+
+			emake \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="$(tc-getCC)" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use kerberos ; then
+			if use kinit ; then
+				build_contrib_module "kinit" "kinit.c" "kinit"
+			fi
+			build_contrib_module "passwd" "pw-kerberos.la"
+		fi
+
+		if use pbkdf2; then
+			build_contrib_module "passwd/pbkdf2"
+		fi
+
+		if use sha2 ; then
+			build_contrib_module "passwd/sha2"
+		fi
+
+		# We could build pw-radius if GNURadius would install radlib.h
+		build_contrib_module "passwd" "pw-netscape.la"
+
+		#build_contrib_module "acl" "posixgroup.la" # example code only
+		#build_contrib_module "acl" "gssacl.la" # example code only, also needs kerberos
+		build_contrib_module "addpartial"
+		build_contrib_module "allop"
+		build_contrib_module "allowed"
+		build_contrib_module "autogroup"
+		build_contrib_module "cloak"
+		# build_contrib_module "comp_match" # really complex, adds new external deps, questionable demand
+		build_contrib_module "denyop"
+		build_contrib_module "dsaschema"
+		build_contrib_module "dupent"
+		build_contrib_module "lastbind"
+		# lastmod may not play well with other overlays
+		build_contrib_module "lastmod"
+		build_contrib_module "noopsrch"
+		#build_contrib_module "nops" https://bugs.gentoo.org/641576
+		#build_contrib_module "nssov" RESO:LATER
+		build_contrib_module "trace"
+		# build slapi-plugins
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
+		einfo "Building contrib-module: addrdnvalues plugin"
+		$(tc-getCC) -shared \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CPPFLAGS} \
+			${CFLAGS} \
+			-fPIC \
+			${LDFLAGS} \
+			-o libaddrdnvalues-plugin.so \
+			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
+		popd &>/dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		cd tests || die
+		pwd
+
+		# Increase various test timeouts/delays, bug #894012
+		# We can't just double everything as there's a cumulative effect.
+		export SLEEP0=2 # originally 1
+		export SLEEP1=10 # originally 7
+		export SLEEP2=20 # originally 15
+		export TIMEOUT=16 # originally 8
+
+		# emake test => runs only lloadd & mdb, in serial; skips ldif,sql,wt,regression
+		# emake partests => runs ALL of the tests in parallel
+		# wt/WiredTiger is not supported in Gentoo
+		TESTS=( plloadd pmdb )
+		#TESTS+=( pldif ) # not done by default, so also exclude here
+		#use odbc && TESTS+=( psql ) # not done by default, so also exclude here
+
+		emake -Onone "${TESTS[@]}"
+	fi
+}
+
+multilib_src_install() {
+	emake CC="$(tc-getCC)" \
+		DESTDIR="${D}" SHELL="${EPREFIX}"/bin/sh install
+
+	if ! use minimal && multilib_is_native_abi; then
+		# openldap modules go here
+		# TODO: write some code to populate slapd.conf with moduleload statements
+		keepdir /usr/$(get_libdir)/openldap/openldap/
+
+		# initial data storage dir
+		keepdir /var/lib/openldap-data
+		use prefix || fowners ldap:ldap /var/lib/openldap-data
+		fperms 0700 /var/lib/openldap-data
+
+		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+		# use our config
+		rm "${ED}"/etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.6.3-slapd-conf slapd.conf
+		configfile="${ED}"/etc/openldap/slapd.conf
+
+		# populate with built backends
+		einfo "populate config with built backends"
+		for x in "${ED}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			einfo "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" \
+			-i "${configfile}" || die
+		use prefix || fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default || die
+
+		# install our own init scripts and systemd unit files
+		einfo "Install init scripts"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-initd-2.4.40-r2 > "${T}"/slapd || die
+		doinitd "${T}"/slapd
+		newconfd "${FILESDIR}"/slapd-confd-2.6.1 slapd
+
+		if use systemd; then
+			# The systemd unit uses Type=notify, so it is useless without USE=systemd
+			einfo "Install systemd service"
+			rm -rf "${ED}"/{,usr/}lib/systemd
+			sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-2.6.1.service > "${T}"/slapd.service || die
+			systemd_dounit "${T}"/slapd.service
+			systemd_install_serviced "${FILESDIR}"/slapd.service.conf
+			newtmpfiles "${FILESDIR}"/slapd.tmpfilesd slapd.conf
+		fi
+
+		# if built without SLP, we don't need to be before avahi
+			sed -i \
+				-e '/before/{s/avahi-daemon//g}' \
+				"${ED}"/etc/init.d/slapd \
+				|| die
+
+		if use cxx ; then
+			einfo "Install the ldapc++ library"
+			cd "${BUILD_DIR}/contrib/ldapc++" || die
+			emake DESTDIR="${D}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			cd "${S}"/contrib/ldapc++ || die
+			newdoc README ldapc++-README
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README smbk5pwd-README
+		fi
+
+		if use overlays ; then
+			einfo "Install the samba4 module"
+			cd "${S}/contrib/slapd-modules/samba4" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README samba4-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules" || die
+		for l in */*.la */*/*.la; do
+			[[ -e ${l} ]] || continue
+			libtool --mode=install cp ${l} \
+				"${ED}"/usr/$(get_libdir)/openldap/openldap || \
+				die "installing ${l} failed"
+		done
+
+		dodoc "${FILESDIR}"/DB_CONFIG.fast.example
+		docinto contrib
+		doman */*.5
+		#newdoc acl/README*
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		newdoc allowed/README allowed-README
+		newdoc autogroup/README autogroup-README
+		newdoc dsaschema/README dsaschema-README
+		newdoc passwd/README passwd-README
+		cd "${S}/contrib/slapi-plugins" || die
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins */*.so
+		docinto contrib
+		newdoc addrdnvalues/README addrdnvalues-README
+
+		insinto /etc/openldap/schema
+		newins "${DISTDIR}"/${BIS_P} ${BIS_PN}
+
+		docinto back-sock ; dodoc "${S}"/servers/slapd/back-sock/searchexample*
+		docinto back-perl ; dodoc "${S}"/servers/slapd/back-perl/SampleLDAP.pm
+
+		dosbin "${S}"/contrib/slapd-tools/statslog
+		newdoc "${S}"/contrib/slapd-tools/README README.statslog
+	fi
+
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README
+	docinto rfc ; dodoc doc/rfc/*.txt
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+	# bug 440470, only display the getting started help there was no openldap before,
+	# or we are going to a non-minimal build
+	! has_version net-nds/openldap || has_version 'net-nds/openldap[minimal]'
+	OPENLDAP_PRINT_MESSAGES=$((! $?))
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		if use systemd; then
+			tmpfiles_process slapd.conf
+		fi
+
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			use prefix || chown ldap:ldap "${EROOT}"/etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT allow' if you want to use them."
+		fi
+
+		if use prefix; then
+			# Warn about prefix issues with slapd
+			eerror "slapd might NOT be usable on Prefix systems as it requires root privileges"
+			eerror "to start up, and requires that certain files directories be owned by"
+			eerror "ldap:ldap.  As Prefix does not support changing ownership of files and"
+			eerror "directories, you will have to manually fix this yourself."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		if [[ -d "${EROOT}"/var/run/openldap ]]; then
+			use prefix || { chown ldap:ldap "${EROOT}"/var/run/openldap || die; }
+			chmod 0755 "${EROOT}"/var/run/openldap || die
+		fi
+		use prefix || chown root:ldap "${EROOT}"/etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${EROOT}"/etc/openldap/slapd.conf{,.default} || die
+		use prefix || chown ldap:ldap "${EROOT}"/var/lib/openldap-data
+	fi
+
+	if has_version 'net-nds/openldap[-minimal]' && ((${OPENLDAP_PRINT_MESSAGES})); then
+		elog "Getting started using OpenLDAP? There is some documentation available:"
+		elog "Gentoo Guide to OpenLDAP Authentication"
+		elog "(https://wiki.gentoo.org/wiki/Centralized_authentication_using_OpenLDAP)"
+	fi
+
+	preserve_old_lib_notify /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+}
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index 3c86543b48..4f68c2e358 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-07-18)
+# dev-cpp/cppdap is not keyworded in most places
+dev-util/cmake -dap
+
 # Marek Szuba <marecki@gentoo.org> (2023-06-29)
 # Now that we globally unmask USE=qt6 for amd64, the mask set
 # in profiles/base/package.use.mask no longer has any effect on this arch.
@@ -26,10 +30,6 @@ dev-python/pyotherside qt6
 # dev-db/mongodb miraculously got keyworded here.
 dev-python/pymongo -test-full
 
-# Sam James <sam@gentoo.org> (2023-06-09)
-# dev-cpp/cppdap is not keyworded on most arches
-dev-util/cmake -debugger
-
 # Sam James <sam@gentoo.org> (2023-05-15)
 # net-libs/rustls-ffi is keyworded here
 www-servers/apache -apache2_modules_tls
@@ -372,11 +372,6 @@ dev-vcs/git -mediawiki
 # Boost.Context can be built on amd64
 dev-libs/boost -context
 
-# Michał Górny <mgorny@gentoo.org> (2013-12-15)
-# mupen64plus' 2.0 new dynamic recompiler is supported on x86 and arm
-# only.
-games-emulation/mupen64plus-core new-dynarec
-
 # Tim Harder <radhermit@gentoo.org> (2013-08-13)
 # dev-lang/luajit keyworded for amd64 (masked in base)
 # dev-scheme/racket keyworded for amd64 (masked in base)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index b0644e5696..40cc5b1b00 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -amd64
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
+# Unmask secureboot flag on arches where sbsigntools is keyworded
+-secureboot
+
 # Jimi Huotari <chiitoo@gentoo.org> (2023-03-03)
 # Unmask on amd64 only for now.
 -qt6
@@ -64,6 +68,7 @@
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # keyworded on amd64
 -clisp
+-clozurecl64
 -ecls
 -gcl
 -sbcl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 56fec00dc6..124d6d5ac0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -27,6 +27,17 @@ dev-python/plotly-geo
 dev-python/chart-studio
 sci-visualization/dash
 sci-visualization/jupyter-dash
+>=dev-python/notebook-7
+dev-python/spyder-notebook
+app-emacs/emacs-ipython-notebook
+dev-python/jupyter
+dev-python/vpython
+dev-python/widgetsnbextension
+dev-python/ipywidgets
+sci-physics/root
+sci-physics/geant4_vmc
+sci-physics/vmc
+sci-libs/spr
 
 # Bernd Waibel <waebbl-gentoo@posteo.net> (2021-02-13)
 # Is reverse-dependency of dev-qt/qtwebengine
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
index 59a5bc5523..ead16de572 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
@@ -1,6 +1,22 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-20)
+# depends on dev-python/notebook which depends on nodejs
+dev-python/ipython notebook
+dev-python/iminuit test
+dev-python/nbdime test
+dev-python/nbclient test
+dev-python/nbconvert test
+dev-python/qiskit-terra visualization
+sci-mathematics/cadabra jupyter
+sci-mathematics/yacas jupyter
+sci-physics/hepmc root
+sci-physics/pythia root
+sci-physics/qmeq examples
+sci-physics/vgm root test
+sci-physics/yoda root
+
 # Guilherme Amadio <amadio@gentoo.org> (2023-06-30)
 # sys-cluster/ceph not keyworded on x86
 >=net-libs/xrootd-5.6.0 ceph
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
index a1e0711b3b..5cbcc08621 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-07-28)
+# media-libs/libffado not marked stable here
+media-video/pipewire ieee1394
+
 # Michał Górny <mgorny@gentoo.org> (2023-04-22)
 # Needs unkeyworded dev-python/sympy
 dev-python/nbval test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
index a7c1a92fb1..988b978b47 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask
@@ -91,7 +91,7 @@ net-misc/spice-gtk smartcard
 
 # Sam James <sam@gentoo.org> (2020-06-29)
 # Deps not yet stable
-dev-python/pymongo test
+dev-python/pymongo test-full
 net-misc/ntpsec rclock_oncore rclock_pps
 dev-util/bcc test
 dev-libs/libisoburn launch-frontend launch-frontend-setuid frontend-optional
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
index 5718f8d24b..506221145d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -arm64
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
+# Unmask secureboot flag on arches where sbsigntools is keyworded
+-secureboot
+
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2023-01-01)
 # unmask synaptics input driver
 -input_devices_synaptics
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 00a675095e..b8b4c3963f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-07-18)
+# dev-cpp/cppdap is not keyworded in most places
+dev-util/cmake dap
+
 # Sam James <sam@gentoo.org> (2023-07-09)
 # sys-libs/libhugetlbfs is broken w/ newer glibc, bug #806079
 sys-apps/nvme-cli hugepages
@@ -9,10 +13,6 @@ sys-apps/nvme-cli hugepages
 # dev-db/mongodb builds practically only on the authors' computer.
 dev-python/pymongo test-full
 
-# Sam James <sam@gentoo.org> (2023-06-09)
-# dev-cpp/cppdap is not keyworded on most arches
-dev-util/cmake debugger
-
 # Sam James <sam@gentoo.org> (2023-05-15)
 # Unkeyworded dependencies
 www-servers/apache apache2_modules_tls
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.stable.mask
index 818466ada9..939d4f9246 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.stable.mask
@@ -1,6 +1,10 @@
 # Copyright 2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-07-28)
+# media-libs/libffado not marked stable on most arches
+media-video/pipewire -ieee1394
+
 # Michał Górny <mgorny@gentoo.org> (2023-04-22)
 # pandoc is stable on amd64 only.
 dev-python/nbclassic doc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 9131415958..3a6a556ad0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
+# Mask secureboot flag on arches where sbsigntools is not keyworded
+secureboot
+
 # matoro <matoro_gentoo@matoro.tk> (2022-09-29)
 # Pulls in dev-util/google-perftools, which is arch-specific
 # Unmask on supported arches.
@@ -202,6 +206,7 @@ abi_s390_64
 # These lisps are available only on some arches
 clisp
 clozurecl
+clozurecl64
 cmucl
 ecls
 gcl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
index b0be4f5987..1cf8b24eca 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_lua5-1 -lua_single_target_luajit
+
 # Sam James <sam@gentoo.org> (2023-04-30)
 # Stacks on HPPA grow upwards and GCC doesn't support SSP or SCP there.
 sys-devel/gcc -default-stack-clash-protection
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index f2c66c477f..350f51f382 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -4,6 +4,14 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv -lua_single_target_lua5-1 lua_single_target_luajit
+
 # Matt Turner <mattst88@gentoo.org> (2023-05-30)
 # sys-apps/dbus-broker is not keyworded
 app-accessibility/at-spi2-core dbus-broker
@@ -341,7 +349,6 @@ dev-python/wsgiproxy2 test
 # Test phase requires dev-db/mongodb which requires dev-util/google-perftools
 # which has not been ported to HPPA (bug #517880, bug #525246)
 dev-libs/mongo-c-driver test
-dev-python/pymongo test
 
 # Jeroen Roovers <jer@gentoo.org> (2014-03-06)
 # USE=gui requires x11-libs/qscintilla,
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
index 20547d7e15..7a58a25f91 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
@@ -1,6 +1,19 @@
 # Copyright 2022-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# WANG Xuerui <xen0n@gentoo.org> (2023-08-05)
+# 1.71.0 is the first Rust version with loong support, so there's no previous
+# version to bootstrap from
+dev-lang/rust:stable/1.71 system-bootstrap
+
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_lua5-1 -lua_single_target_luajit
+
 # WANG Xuerui <xen0n@gentoo.org> (2022-08-13)
 # Force the host target
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index 4c90f0a3bf..8b92846505 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -1,6 +1,33 @@
 # Copyright 2022-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# WANG Xuerui <xen0n@gentoo.org> (2023-08-05)
+# no keyworded lld
+dev-lang/rust wasm
+
+# WANG Xuerui <xen0n@gentoo.org> (2023-07-26)
+# missing llvm:16 and keyworded lld
+dev-lang/spidermonkey clang lto
+
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv -lua_single_target_lua5-1 lua_single_target_luajit
+
+# WANG Xuerui <xen0n@gentoo.org> (2023-07-19)
+# dev-python/watchfiles has too old target-lexicon without loong support
+dev-python/uvicorn test-rust
+
+# WANG Xuerui <xen0n@gentoo.org> (2023-07-19)
+# Examples used by tests have their libc crate Cargo.locked to 0.2.121, that
+# predated Rust's loong support. The package itself works as intended.
+# The atom should be made more accurate once a newer version is released that
+# contains bumped libc deps.
+dev-python/setuptools-rust test
+
 # WANG Xuerui <xen0n@gentoo.org> (2023-07-11)
 # Upstream lacks pmu-events definition file for loong.
 dev-util/perf python
@@ -116,11 +143,6 @@ app-accessibility/espeak-ng man
 # inline asm, so we have no dev-libs/criterion
 app-admin/syslog-ng test
 
-# WANG Xuerui <xen0n@gentoo.org> (2022-12-03)
-# Things requiring net-libs/gnome-online-accounts, which depends on
-# net-libs/webkit-gtk.
-gnome-base/gvfs google
-
 # WANG Xuerui <xen0n@gentoo.org> (2022-12-02)
 # sys-cluster/ceph is not keyworded yet.
 net-analyzer/rrdtool rados
@@ -170,12 +192,6 @@ app-office/libreoffice clang
 dev-util/lldb test
 sys-devel/clang-common default-lld
 
-# WANG Xuerui <xen0n@gentoo.org> (2022-11-18)
-# net-libs/webkit-gtk is not available on loong yet.
-app-text/atril epub
-gnome-extra/evolution-data-server oauth
-mate-base/mate help
-
 # WANG Xuerui <xen0n@gentoo.org> (2022-10-04)
 # Sanitizers partially supported on this architecture.
 #
@@ -188,11 +204,14 @@ mate-base/mate help
 # MSan: https://reviews.llvm.org/D152692 (LLVM 17 since 20230629)
 # DFSan: https://reviews.llvm.org/D140690 (LLVM 17 since 20230703)
 # Profile: https://reviews.llvm.org/D154405 (LLVM 17 since 20230706)
+# XRay: https://reviews.llvm.org/D140727 (LLVM 17 since 20230714)
+# libFuzzer: https://reviews.llvm.org/D140601 (LLVM 17 since 20230718)
 >=sys-libs/compiler-rt-sanitizers-15 -asan
 >=sys-libs/compiler-rt-sanitizers-16 -lsan -safestack -scudo -tsan -ubsan
 >=sys-libs/compiler-rt-sanitizers-17.0.0_pre20230630 -msan
 >=sys-libs/compiler-rt-sanitizers-17.0.0_pre20230705 -dfsan
->sys-libs/compiler-rt-sanitizers-17.0.0_pre20230705 -profile
+>=sys-libs/compiler-rt-sanitizers-17.0.0_pre20230717 -profile -xray
+>sys-libs/compiler-rt-sanitizers-17.0.0_pre20230717 -libfuzzer
 
 # WANG Xuerui <xen0n@gentoo.org> (2022-07-08)
 # virtual/{jdk,jre} is not available on loong yet.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/parent b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/parent
index e234bf836e..eb001c6e8a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/parent
@@ -1,2 +1 @@
 ../base
-../../features/wd40
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
index 2ef4b5d698..958c067166 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
@@ -5,10 +5,6 @@
 # dev-util/babeltrace fails tests on loong
 babeltrace
 
-# WANG Xuerui <xen0n@gentoo.org> (2023-07-05)
-# rest of GNOME not keyworded yet
-gnome-online-accounts
-
 # WANG Xuerui <xen0n@gentoo.org> (2022-12-05)
 # media-libs/xine-lib not tested
 xine
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
index 618df7c4de..b5a2ae4da5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
@@ -105,10 +105,6 @@ clamav
 # Untested on mips, masking for now.
 cdb
 
-# Until someone actually needs fuse, we'll mask it as
-# it holds up stablizing ntfsprogs
-fuse
-
 # Donnie Berkholz <dberkholz@gentoo.org> (2006-03-07)
 # Modular X: mask for architectures lacking direct rendering
 dri
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
index fe09371634..c1a95c0efa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-07-28)
+# media-libs/libffado not marked stable here
+media-video/pipewire ieee1394
+
 # Sam James <sam@gentoo.org> (2021-10-25)
 # Various unstable dependencies:
 # gnome-base/nautilus
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index b4cf3aa4b0..8ab7c49f60 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -170,10 +170,6 @@ net-misc/openssh security-key
 # PPS should work on all arches, but only keyworded on some arches
 >=net-misc/ntp-4.2.6_p3-r1 -parse-clocks
 
-# Jaco Kroon <jaco@uls.co.za> (2019-11-28)
-# Unfortunately net-libs/bcg729 isn't available for ppc
-net-libs/pjproject g729
-
 # Luke Dashjr <luke-jr+gentoobugs@utopios.org> (2019-09-21)
 # iasl is stable on ppc
 sys-firmware/seabios -debug
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.force
index 24fcd31f00..6f146360a1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.force
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_lua5-1 -lua_single_target_luajit
+
 # Samuli Suominen <ssuominen@gentoo.org> (2012-10-30)
 # Only gnome-base/gdm has stable keywording. If x11-misc/lightdm or kde-plasma/kdm gets
 # stable keyword, this line can be removed.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index d21d9c6938..024cd7c151 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv -lua_single_target_lua5-1 lua_single_target_luajit
+
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not yet keyworded, see bug #892183
 dev-python/nbval test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
index 6a29c97d30..bbeece97d8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.force
@@ -1,6 +1,14 @@
-# Copyright 2021-2022 Gentoo Authors
+# Copyright 2021-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv -lua_single_target_luajit lua_single_target_lua5-1
+
 # Mike Rivnak <rivnakm1@gmail.com> (2022-11-30)
 # luajit is currently not supported on riscv, so use lua instead
 app-editors/neovim lua_single_target_lua5-1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index a695a1db6a..e0ca3f7609 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 2019-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_luajit -lua_single_target_lua5-1
+
 # Mike Gilbert <floppym@gentoo.org> (2023-05-27)
 # sd-boot should work here.
 sys-apps/systemd -boot -gnuefi
@@ -187,7 +195,6 @@ app-admin/syslog-ng test
 # Marek Szuba <marecki@gentoo.org> (2021-07-27)
 # dev-db/mongodb does not support riscv, fails src_configure
 dev-libs/mongo-c-driver test
-dev-python/pymongo test
 
 # Alex Fan <alexfanqi@yahoo.com> (2021-07-20)
 # hdf5-1.10 always fails tests with these 2 use flags enabled, otherwise
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
index 1c381636e5..c57fb229f9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -riscv
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
+# Unmask secureboot flag on arches where sbsigntools is keyworded
+-secureboot
+
 # matoro <matoro_gentoo@matoro.tk> (2022-09-29)
 # dev-util/google-perftools is supported here
 -tcmalloc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index 477a16b6bb..8993b33120 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -18,10 +18,6 @@ media-gfx/graphicsmagick jpegxl
 media-gfx/imagemagick jpegxl
 media-libs/imlib2 jpegxl
 
-# Conrad Kostecki <conikost@gentoo.org> (2023-04-23)
-# Needs dev-perl/Math-Int64 which is not keyworded
-dev-perl/IP-Country-DB_File test
-
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not keyworded
 dev-python/nbval test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 666be07eea..39cb0bf513 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-07-21)
+# Requires app-emulation/qemu.
+sys-kernel/gentoo-kernel test
+sys-kernel/vanilla-kernel test
+
+# Sam James <sam@gentoo.org> (2023-07-21)
+# Requires dev-util/pahole.
+sys-kernel/gentoo-kernel debug
+sys-kernel/vanilla-kernel debug
+
 # Sam James <sam@gentoo.org> (2023-06-18)
 # Qt 5 not keyworded here
 app-text/ansifilter gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 024acd9944..e8dcc41772 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -294,10 +294,6 @@ net-analyzer/zmap mongo
 # Unmask arch-specific USE flag available on x86
 net-analyzer/testssl -bundled-openssl
 
-# Tomáš Mózes <hydrapolic@gmail.com> (2018-09-28)
-# Requires dev-db/mongodb which has dropped x86 support
-dev-python/pymongo test
-
 # Rick Farina <zerochaos@gentoo.org> (2018-06-27)
 # Catalyst has support for assembling bootloader on this arch
 dev-util/catalyst -system-bootloader
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
index 96a220f97a..bb3406faf4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -x86
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-11)
+# Unmask secureboot flag on arches where sbsigntools is keyworded
+-secureboot
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2023-06-10)
 # Requires media-libs/opencolorio, broken on x86, bug #884115
 color-management
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
index 3646d139c9..c8eeaa0dd3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
@@ -127,7 +127,7 @@ PYTHONDONTWRITEBYTECODE="1"
 # This MUST be kept in sync with the PYTHON_TARGETS below
 # Mike Gilbert <floppym@gentoo.org> (2018-05-23)
 # sys-apps/baselayout-2.5 needs split-usr enabled.
-BOOTSTRAP_USE="unicode internal-glib pkg-config split-usr xml python_targets_python3_11"
+BOOTSTRAP_USE="unicode internal-glib pkg-config split-usr xml python_targets_python3_11 python_single_target_python3_11"
 
 # Mike Gilbert <floppym@gentoo.org> (2012-05-15)
 # Default target(s) for python-r1.eclass
@@ -153,7 +153,7 @@ TWISTED_DISABLE_WRITING_OF_PLUGIN_CACHE="1"
 
 # Aaron W. Swenson <titanofold@gentoo.org> (2017-07-09)
 # Default target(s) for postgres{,-multi}.eclass
-POSTGRES_TARGETS="postgres12 postgres13"
+POSTGRES_TARGETS="postgres15"
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-11-17)
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 3eae4f7b54..ed168436b9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -1,16 +1,24 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_luajit
+
+# Joonas Niilola <juippis@gentoo.org> (2023-07-21)
+# -system-librnp is currently broken with upstream package.
+~mail-client/thunderbird-115.0 system-librnp
+~mail-client/thunderbird-115.0.1 system-librnp
+
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2023-07-08)
 # Uses attr even if disabling is requested, bug 910070
 # Workaround that should fix some stage builds
 >=sys-devel/gettext-0.22-r1 xattr
 
-# Joonas Niilola <juippis@gentoo.org> (2023-06-06)
-# 114 looks very broken regarding unified build. It has too many 
-# conditions when it works and when it doesn't. Bug #905780
-~www-client/firefox-114.0 jumbo-build
-
 # Patrick McLean <chutzpah@gentoo.org> (2022-06-27)
 # Doesn't build with boost installed on the system, some deps require boost
 # so force the flag on until problem fixed upstream
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 9713485e03..f9334180fd 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,21 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
+# MPV currently[1] has no plans to support >=lua5-3 making luajit
+# the only choice for maintained lua. Apply mask/force to override
+# the profile's defaults, and invert on arches where not keyworded.
+# Done this way also avoids conflicts for users using another default.
+# [1] https://github.com/mpv-player/mpv/wiki/FAQ#why-does-mpv-not-support-lua-53-or-newer
+media-video/mpv lua_single_target_lua5-1
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-21)
+# jemalloc has been a source of sometimes hard to track bugs in the
+# past. It is now masked with the intention to remove it altogether at a
+# later date.
+# See e.g. bugs 617518, 638522, 711302, 802435, 904987
+dev-lang/ruby jemalloc
+
 # Joonas Niilola <juippis@gentoo.org> (2023-07-14)
 # Calendar is broken with some languages on 115.0 release. Bug #910229
 >=mail-client/thunderbird-115.0 system-icu
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/parent
new file mode 100644
index 0000000000..d5a56a13f6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/parent
new file mode 100644
index 0000000000..05b6f4918b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../../features/merged-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/parent
new file mode 100644
index 0000000000..288aeccdce
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/desktop/gnome/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/parent
new file mode 100644
index 0000000000..0317df26cc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/plasma
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/parent
new file mode 100644
index 0000000000..05b6f4918b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../../features/merged-usr
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/parent
new file mode 100644
index 0000000000..5d9d87f6d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/parent
new file mode 100644
index 0000000000..4bb06e4092
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/22.0/la64v100/lp64d/developer/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../targets/developer
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/parent
new file mode 100644
index 0000000000..d5a56a13f6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/parent
new file mode 100644
index 0000000000..288aeccdce
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/gnome/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/desktop/gnome/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/parent
new file mode 100644
index 0000000000..0317df26cc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../targets/desktop/plasma
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/parent
new file mode 100644
index 0000000000..5d9d87f6d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/lp64d/desktop/plasma/systemd/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/parent
new file mode 100644
index 0000000000..b34bc39063
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/gnome/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/desktop/gnome
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/eapi b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/eapi
new file mode 100644
index 0000000000..7ed6ff82de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/eapi
@@ -0,0 +1 @@
+5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/parent
new file mode 100644
index 0000000000..04c17e0738
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/loong/23.0/la64v100/split-usr/lp64d/desktop/plasma/parent
@@ -0,0 +1,2 @@
+..
+../../../../../../../../../targets/desktop/plasma
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/features/musl/make.defaults
index 80a8fdf924..4c680a7340 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 PORTAGE_LIBC="musl"
@@ -6,7 +6,7 @@ ELIBC="musl"
 
 FEATURES="sandbox sfperms strict"
 
-USE="nptl unicode -berkdb -gdbm"
+USE="nptl pic unicode -berkdb -gdbm"
 BOOTSTRAP_USE="${BOOTSTRAP_USE} nptl -berkdb -gdbm"
 
 # All libraries are in /lib or /usr/lib
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index f6248dd0f9..4e73c95631 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -116,20 +116,6 @@ sys-libs/libstdc++-v3
 # bug #713542
 net-misc/casync
 
-# Bernd Waibel <waebbl-gentoo@posteo.net> (2022-03-14)
-# Doesn't build with musl, bug #832742
-app-doc/kicad-doc
-media-gfx/freecad
-media-gfx/prusaslicer
-media-gfx/superslicer
-sci-electronics/kicad
-sci-electronics/kicad-footprints
-sci-electronics/kicad-meta
-sci-electronics/kicad-packages3d
-sci-electronics/kicad-symbols
-sci-electronics/kicad-templates
-sci-libs/opencascade
-
 # Stephan Hartmann <sultan@gentoo.org> (2022-02-10)
 # Doesn't build on musl, bug #833028
 www-client/chromium
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/use.mask
index 21cdca44d1..8188a9fef8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/use.mask
@@ -1,19 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Select the correct ELIBC
 -elibc_musl
 elibc_glibc
 
-# Andrey Grozin <grozin@gentoo.org> (2022-12-01)
-# dev-lisp/sbcl is masked
-sbcl
-
-# Sam James <sam@gentoo.org> (2022-10-04)
-# sci-libs/opencascade is masked on musl
-occ
-opencascade
-
 # Sam James <sam@gentoo.org> (2022-10-04)
 # Mask USE flags which pull in a binary package linked against glibc (rolling
 # mask, use for all such packages)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 14353d51ab..a2d89b488f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -23,12 +23,16 @@ dev-python/aws-sam-translator
 dev-python/cfn-lint
 >=dev-python/cryptography-36
 dev-python/dirty-equals
+dev-python/hatch-jupyter-builder
 dev-python/inflect
 dev-python/jaraco-itertools
 dev-python/josepy
 >=dev-python/jsonschema-4.18.0
 dev-python/jsonschema-spec
 dev-python/jsonschema-specifications
+>=dev-python/jupyter-events-0.7.0
+dev-python/jupyterlab-server
+dev-python/jupyterlab
 dev-python/keyring
 dev-python/libcloud
 dev-python/moto
@@ -39,6 +43,7 @@ dev-python/mkdocs-git-authors-plugin
 dev-python/mkdocs-i18n
 dev-python/mkdocs-material-extensions
 dev-python/mkdocs-git-revision-date-localized-plugin
+>=dev-python/notebook-7
 dev-python/oauthlib
 dev-python/openapi-core
 dev-python/openapi-schema-validator
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
index 95f0fc5457..2ed7b7566f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Alfred Wingate <parona@protonmail.com> (2023-07-22)
+# SSO feature in ZeroTier requires rust.
+net-misc/zerotier sso
+
 # Michał Górny <mgorny@gentoo.org> (2023-06-06)
 # Packages needing dev-python/pydantic.
 dev-python/jaraco-itertools test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 27d60f2956..35593ba85a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,213 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-07-07)
+# Fails to boostrap: https://gcc.gnu.org/PR110926
+=sys-devel/gcc-14.0.0_pre20230806
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2023-07-05)
+# Library without consumers. Bug #906882
+# Removal on 2023-08-05.
+net-libs/nativebiginteger
+
+# Sam James <sam@gentoo.org> (2023-08-04)
+# Stricter behavior which causes some packages to fail, see bug #911721.
+=dev-util/pkgconf-2.0.0
+
+# David Seifert <soap@gentoo.org> (2023-07-29)
+# EAPI 6, fetch restrictions require annoying registration, no other
+# distro packages this, over 10 years old. Removal on 2023-08-28.
+sci-libs/rosetta-db
+
+# Michael Orlitzky <mjo@gentoo.org> (2023-07-27)
+# Obsolete as of dev-php/swoole-4.3.0, according to
+# its github README. Stuck on php-7.4. Removal on or
+# after 30 days.
+dev-php/swoole-async
+
+# William Hubbs <williamh@gentoo.org> (2023-07-25)
+# This package has been replaced by app-accessibility/espeak-ng.
+# Please transition to the new package.
+# Removal: 2023-08-24.  Bug #877221.
+app-accessibility/espeak
+
+# Mike Gilbert <floppym@gentoo.org> (2023-07-24)
+# Migrated to sys-apps/systemd-utils.
+# Removal on 2023-08-24.
+sys-apps/systemd-tmpfiles
+sys-boot/systemd-boot
+sys-fs/udev
+
+# Matt Turner <mattst88@gentoo.org> (2023-07-24)
+# Unmaintained. Looks pretty dead upstream (last commit 1.5 years ago, last tag
+# 3 years ago, last non-alpha release in 2015). Depends on app-text/enchant:0.
+# Removal on 2023-08-24. Bug #905956.
+net-im/vacuum
+
+# Michał Górny <mgorny@gentoo.org> (2023-07-24)
+# Incompatible with modern dev-python/matplotlib versions.  No upstream
+# activity since 2022-02.  No revdeps.
+# Removal on 2023-08-23.  Bug #904734.
+dev-python/tikzplotlib
+
+# Michał Górny <mgorny@gentoo.org> (2023-07-23)
+# Package with no maintainer and tests restricted (also test deps look
+# suspicious).  It was only needed for tests
+# in dev-python/pyvirtualdisplay, and that package didn't support
+# the newest version anyway.  No revdeps left.
+# Removal on 2023-08-22.  Bug #910708.
+dev-python/vncdotool
+
+# David Seifert <soap@gentoo.org> (2023-07-22)
+# Upstream unresponsive and package is pretty much dead. dev-python/tqdm
+# is a modern and fast replacement for dev-python/progressbar.
+# Removal on 2023-08-21. Bug #909929, #910031.
+dev-python/progressbar
+sys-apps/gcp
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-22)
+# Does not compile with modern compilers. Last upstream release in
+# 2011. No activity upstream. No reverse dependencies. Masked for
+# removal on 2023-08-22.
+dev-ruby/fast_xs
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2023-07-21)
+# Broken runtime with ncurses version since last 2 years (unusable at
+# all), no upstream activity of any sort since 2016.
+# Removal on 2023-08-20.  Bug #910649.
+app-cdr/cdw
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-21)
+# Obsolete slot for a package that should not have been slotted. Please
+# use the newer 1.2.3 slot instead. Masked for removal on 2023-08-21.
+dev-ruby/openssl-ccm:1.2.2
+
+# Michał Górny <mgorny@gentoo.org> (2023-07-21)
+# Fragile package requiring custom patching.  The maintainer resigned.
+# No reverse dependencies.
+# Removal on 2023-08-20.  Bug #910619.
+dev-python/cx_Freeze
+
+# Michał Górny <mgorny@gentoo.org> (2023-07-21)
+# The ebuild has not been bumped for a year now.  It doesn't have
+# working tests.  No reverse dependencies.
+# Removal on 2023-08-20.  Bug #907460.
+dev-python/ansible-runner
+
+# Michał Górny <mgorny@gentoo.org> (2023-07-19)
+# Backport package specific to Python 3.9.  No longer necessary now
+# that pypy3 is 3.10.
+# Removal on 2023-08-18.  Bug #910549.
+dev-python/importlib-resources
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-19)
+# Obsolete components for older, removed, cucumber versions that have no
+# value on their own. Masked for removal on 2023-08-19.
+dev-util/cucumber-wire
+dev-util/cucumber-cucumber-expressions:12
+dev-util/cucumber-cucumber-expressions:14
+
+# Mike Pagano <mpagano@gentoo.org> (2023-07-18)
+# Mask impacted kernels vulnerable to StackRot and
+# ones with a memory corruption bug
+# Bug #909829, #794547.
+=sys-kernel/gentoo-kernel-6.1.28
+=sys-kernel/gentoo-kernel-6.1.37*
+=sys-kernel/gentoo-kernel-6.3*
+=sys-kernel/gentoo-kernel-bin-6.1.28
+=sys-kernel/gentoo-kernel-bin-6.1.37*
+=sys-kernel/gentoo-kernel-bin-6.3*
+=sys-kernel/gentoo-sources-6.1.28
+=sys-kernel/gentoo-sources-6.1.37*
+=sys-kernel/gentoo-sources-6.4.0
+=sys-kernel/gentoo-sources-6.4.1*
+=sys-kernel/gentoo-sources-6.4.2
+=sys-kernel/vanilla-kernel-6.1.28
+=sys-kernel/vanilla-kernel-6.1.37*
+=sys-kernel/vanilla-kernel-6.3*
+=sys-kernel/vanilla-sources-6.1.28
+=sys-kernel/vanilla-sources-6.1.37*
+=sys-kernel/vanilla-sources-6.3*
+=sys-kernel/vanilla-sources-6.4.0
+=sys-kernel/vanilla-sources-6.4.1*
+=sys-kernel/vanilla-sources-6.4.2
+=virtual/dist-kernel-6.1.28
+=virtual/dist-kernel-6.1.37*
+=virtual/dist-kernel-6.3*
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-18)
+# Obsolete rubu30-only package, previously a dependency of nanoc. No
+# longer maintained upstream. Masked for removal on 2023-08-18.
+dev-ruby/hamster
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-18)
+# Obsolete slots (for sinatra the slot is ruby30 only) without reverse
+# dependencies. Use the newer slot instead. Masked for removal on
+# 2023-08-18.
+dev-ruby/sinatra:2
+dev-ruby/rack-protection:2
+dev-ruby/rack-test:1.0
+
+# Hans de Graaff <graaff@gentoo.org> (2023-07-18)
+# Obsolete slot without reverse dependencies. Use the newer slot
+# instead. Masked for removal on 2023-08-18.
+dev-ruby/vcr:5
+
+# Florian Schmaus <flow@gentoo.org> (2023-07-17)
+# Obsolete acct-* packages which became leaf packages.
+# Removal on 2023-08-17.
+acct-user/artifactory
+acct-group/artifactory
+acct-user/cinder
+acct-group/cinder
+acct-user/glance
+acct-group/glance
+acct-user/heat
+acct-group/heat
+acct-user/keystone
+acct-group/keystone
+acct-user/litecoin
+acct-group/litecoin
+acct-user/minbif
+acct-group/minbif
+acct-user/minio
+acct-group/minio
+acct-user/netbox
+acct-group/netbox
+acct-user/neutron
+acct-group/neutron
+acct-user/nova
+acct-group/nova
+acct-user/placement
+acct-group/placement
+acct-user/quagga
+acct-group/quagga
+acct-user/rplayd
+acct-group/rplayd
+acct-user/rstudio-server
+acct-group/rstudio-server
+acct-user/rundeck
+acct-group/rundeck
+acct-user/sguil
+acct-group/sguil
+acct-user/sigh
+acct-group/sigh
+acct-user/smokeping
+acct-group/smokeping
+acct-user/sobby
+acct-group/sobby
+acct-user/spread
+acct-group/spread
+acct-user/stg
+acct-group/stg
+acct-user/swift
+acct-group/swift
+acct-user/thttpd
+acct-group/thttpd
+acct-group/gpio
+acct-group/simplevirt
+acct-group/spi
+
 # Matt Turner <mattst88@gentoo.org> (2023-07-16)
 # Last reverse dependency was gnome-base/gnome-vfs, dropped more than a year ago.
 # Removal on 2023-08-16.
@@ -43,6 +250,13 @@ gnome-base/gnome-mime-data
 # old versions of grilo and grilo-plugins.
 # Removal on 2023-08-15. Bug #910105.
 media-sound/pragha
+<media-libs/grilo-0.3.16
+<media-plugins/grilo-plugins-0.3.16
+net-libs/libdmapsharing:3.0
+net-libs/dleyna-connector-dbus
+net-libs/dleyna-core
+net-libs/dleyna-renderer
+net-misc/dleyna-server
 
 # Hans de Graaff <graaff@gentoo.org> (2023-07-14)
 # Obsolete slots or packages specifically for cucumber 7 which is no
@@ -66,13 +280,12 @@ dev-util/cucumber-html-formatter:17
 # Testing. An upgrade from 102 isn't recommended due to downgrading
 # most likely not being possible. Back up your profile before
 # attempting. Fresh install should be fine. Bug #910229
-~mail-client/thunderbird-115.0
+>=mail-client/thunderbird-115.0
 
 # Michał Górny <mgorny@gentoo.org> (2023-07-12)
 # Having scikit-build-core installed still breaks building setuptools
 # extensions in some scenarios.
 # https://github.com/scikit-build/scikit-build-core/issues/426
->=dev-python/iminuit-2.22
 =dev-python/scikit-build-core-0.4.7-r1
 
 # Hans de Graaff <graaff@gentoo.org> (2023-07-08)
@@ -102,18 +315,33 @@ dev-perl/Gtk2-Notify
 
 # Matt Turner <mattst88@gentoo.org> (2023-07-06)
 # GNOME 45 mask
+>=app-editors/gnome-text-editor-45_alpha
+>=app-misc/gnote-45_alpha
+>=app-misc/tracker-3.6_alpha
+>=app-misc/tracker-miners-3.6_alpha
 >=dev-libs/gjs-1.77
+>=dev-libs/libdex-0.3.0
+>=games-puzzle/gnome-sudoku-45_alpha
+>=gnome-base/gnome-settings-daemon-45_alpha
 >=gnome-base/gnome-shell-45_alpha
 >=gnome-base/gsettings-desktop-schemas-45_alpha
+>=gnome-base/nautilus-45_alpha
+>=gnome-extra/gnome-calculator-45_alpha
 >=gnome-extra/gnome-characters-45_alpha
 >=gnome-extra/gnome-shell-extensions-45_alpha
+>=gnome-extra/gnome-software-45_alpha
 >=gnome-extra/gnome-system-monitor-45_alpha
 >=gnome-extra/gnome-weather-45_alpha
+>=gnome-extra/sushi-45_alpha
+>=gui-apps/gnome-console-45_alpha
 >=gui-libs/gtk-4.11
 >=gui-libs/libadwaita-1.4_alpha
 >=media-gfx/gnome-font-viewer-45_alpha
+>=net-misc/gnome-connections-45_alpha
 >=net-misc/gnome-remote-desktop-45_alpha
+>=sci-geosciences/gnome-maps-45_alpha
 >=sys-apps/baobab-45_alpha
+>=sys-apps/xdg-desktop-portal-gnome-45_alpha
 >=x11-themes/gnome-backgrounds-45_alpha
 >=x11-wm/mutter-45_alpha
 
@@ -176,49 +404,15 @@ dev-ruby/multi_test:0
 games-action/descent3
 games-action/descent3-demo
 
-# Hans de Graaff <graaff@gentoo.org> (2023-06-23)
-# Deprecated upstream, who recommends to use the Open3 method instead.
-# No reverse dependencies. Masked for removal on 2023-07-23.
-dev-ruby/subexec
-
-# Hans de Graaff <graaff@gentoo.org> (2023-06-23)
-# Deprecated package. Renamed to dev-ruby/optimist by upstream. No
-# reverse dependencies. Masked for removal on 2023-07-23.
-dev-ruby/trollop
-
 # Sam James <sam@gentoo.org> (2023-06-23)
 # Segfaults with non-bison yacc.
 =app-shells/bash-5.2_p15-r4
 
-# Matt Turner <mattst88@gentoo.org> (2023-06-22)
-# Dead slot. Depends on x11-libs/gtk+:2.
-# Removal on 2023-07-22.  Bug #769500.
-x11-libs/libwnck:1
-
-# Matt Turner <mattst88@gentoo.org> (2023-06-22)
-# Dead package. Depends on x11-libs/libwnck:1.
-# Removal on 2023-07-22.  Bug #774906.
-dev-perl/gnome2-wnck
-
-# Matt Turner <mattst88@gentoo.org> (2023-06-22)
-# Depends on deprecated packages:
-#    - dev-perl/Gtk2
-#    - dev-perl/Gtk2-Notify
-#    - dev-perl/gnome2-wnck
-# No maintainer in Gentoo. Seems unmaintained upstream as well.
-# Removal on 2023-07-22.  Bug #774909.
-media-sound/gmusicbrowser
-
 # Sam James <sam@gentoo.org> (2023-06-22)
 # Causes segfaults in dependent dev-util/conf2struct.
 # See bug #908989 and related bug #908982.
 =dev-perl/Conf-Libconfig-1.0.0
 
-# Fabian Groffen <grobian@gentoo.org> (2023-06-21)
-# Ancient OSX integration package, not keyworded for any current arch
-# Removal on 2023-07-21.  Bug #908938.
-x11-themes/gtk-engines-quartz
-
 # Michał Górny <mgorny@gentoo.org> (2023-06-21)
 # suitesparseconfig-7.0.0 fails to build with multilib enabled
 # because of dependencies that cannot be satisfied.  All the other
@@ -236,17 +430,6 @@ x11-themes/gtk-engines-quartz
 =sci-libs/suitesparseconfig-7.0.0
 =sci-libs/umfpack-6.1.0
 
-# Mike Pagano <mpagano@gentoo.org> (2023-06-18)
-# Last upstream activity in 2018, EAPI 7.
-# See app-crypt/swtpm for an alternative.
-# Removal on 2023-07-18.  Bug #768960, #794547.
-app-crypt/tpm-emulator
-
-# Hans de Graaff <graaff@gentoo.org> (2023-06-18)
-# Obsolete slot. Use the newer slot instead.
-# Masked for removal on 2023-07-18.
-dev-ruby/database_cleaner-active_record:2.0
-
 # Sam James <sam@gentoo.org> (2023-06-16)
 # Please upgrade to >=app-admin/eselect-1.4.22-r1 for a fix to env-update
 # and the files it generates in /etc/env.d: bug #908401, then run env-update
@@ -260,11 +443,6 @@ dev-ruby/database_cleaner-active_record:2.0
 =dev-db/mariadb-10.11.2
 =dev-db/mariadb-10.11.3
 
-# Michał Górny <mgorny@gentoo.org> (2023-06-10)
-# Renamed to dev-python/pypdf.  No revdeps left.
-# Removal on 2023-07-10.  Bug #908227.
-dev-python/PyPDF2
-
 # Sam James <sam@gentoo.org> (2023-06-05)
 # Fails to bootstrap, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110120.
 =sys-devel/gcc-14.0.0_pre20230604
@@ -355,7 +533,7 @@ media-gfx/curaengine
 # Quite broken, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109672.
 =sys-devel/gcc-14.0.0_pre20230430
 
-# Andreas Sturmlechner <asturm@gentoo.org> 2023-04-30
+# Andreas Sturmlechner <asturm@gentoo.org> (2023-04-30)
 # Breaking even latest ~arch version of KDE PIM, bug #905352.
 =dev-libs/ktextaddons-1.3*
 
@@ -393,10 +571,6 @@ media-gfx/curaengine
 # Mask experimental software
 =mail-mta/postfix-3.9*
 
-# Ulrich Müller <ulm@gentoo.org> (2023-04-10)
-# Pretest versions, masked for testing.
-<app-editors/emacs-29.0.9999:29-vcs
-
 # Ionen Wolkens <ionen@gentoo.org> (2023-03-30)
 # NVIDIA dropped support for the 390.xx branch in December 2022[1].
 #
@@ -446,20 +620,11 @@ x11-drivers/nvidia-drivers:0/390
 # not include 5.15.99 and is misleading
 =sys-kernel/gentoo-sources-5.15.99
 
-# Mike Pagano <mpagano@gentoo.org> (2023-02-27)
-# Mask =www-servers/nginx-unit-1.29.0-r1 for testing
-=www-servers/nginx-unit-1.29.0-r1
-
 # Torokhov Sergey <torokhov-s-a@yandex.ru> (2023-02-26)
 # The masked version causes GIMP breaking of Cut/Copy/Paste
 # https://gitlab.gnome.org/GNOME/gimp/-/issues/9175
 =media-libs/babl-0.1.100
 
-# Michał Górny <mgorny@gentoo.org> (2023-02-25)
-# Major update.  Multiple packages are known to be broken.
-# Masked for further testing.
->=dev-python/cython-3
-
 # Ben Kohler <bkohler@gentoo.org> (2023-01-30)
 # Breaks too many revdeps for now
 =app-text/discount-3*
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
index a0d4caecaf..fe6ed33ee3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
@@ -1,6 +1,15 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Benda Xu <heroxbd@gentoo.org> (2023-08-01)
+# embrace guile-3. (bug #825334)
+media-sound/lilypond
+
+# Fabian Groffen <grobian@gentoo.org> (2023-06-24)
+# Fails to link due to missing libintl, already fixed upstream:
+# https://git.savannah.gnu.org/cgit/tar.git/commit/?id=8632df398b2f548465ebe68b8f494c0d6f8d913d
+=app-arch/tar-1.35
+
 # Benda Xu <heroxbd@gentoo.org> (2023-07-09)
 # Requires Glibc <sys/xattr.h> to work properly.
 # For example, 'lgetxattr' is not available on macOS or gnulib.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.unmask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.unmask
new file mode 100644
index 0000000000..c83ace0c1e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.unmask
@@ -0,0 +1,6 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Benda Xu <heroxbd@gentoo.org> (2023-08-01)
+# embrace guile-3. (bug #825334)
+>=dev-scheme/guile-3.0.4
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.mask
index 47b1d8ab9f..732fdb8edf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Benda Xu <heroxbd@gentoo.org> (2023-07-19)
+# Darwin does not use ELF.
+dev-util/patchelf
+
 # Fabian Groffen <grobian@gentoo.org> (2014-01-14)
 # util-linux has no business on Darwin systems
 sys-apps/util-linux
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
index dbb1185a8c..d429df55eb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
@@ -1,6 +1,17 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2023-06-23)
+# Fails to link due to missing libintl, already fixed upstream:
+# https://git.savannah.gnu.org/cgit/tar.git/commit/?id=8632df398b2f548465ebe68b8f494c0d6f8d913d
+=app-arch/tar-1.35
+
+# Fabian Groffen <grobian@gentoo.org> (2023-06-23)
+# Fails to compile due to lchmod, fixed upstream so wait for next
+# release
+# https://github.com/libarchive/libarchive/commit/89712ffa6ede364f261dcd9208adabf068e2e21c
+=app-arch/libarchive-3.7.0
+
 # Benda Xu <heroxbd@gentoo.org> (2023-07-09)
 # Requires Glibc <sys/xattr.h> to work properly.
 # For example, 'lgetxattr' is not available on Solaris or gnulib.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index 932db62891..5e4f49605e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -167,12 +167,19 @@ ia64		default/linux/ia64/17.0/systemd/merged-usr			exp
 
 # LoongArch Profiles
 # @MAINTAINER: loong@gentoo.org
-loong		default/linux/loong/22.0/la64v100/lp64d					stable
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop				dev
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd			dev
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd/merged-usr	dev
-loong		default/linux/loong/22.0/la64v100/lp64d/systemd				stable
-loong		default/linux/loong/22.0/la64v100/lp64d/systemd/merged-usr		stable
+loong		default/linux/loong/22.0/la64v100/lp64d						stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop					stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome				dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd			dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr	dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma				stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd			stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr	stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd				stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd/merged-usr		stable
+loong		default/linux/loong/22.0/la64v100/lp64d/developer				exp
+loong		default/linux/loong/22.0/la64v100/lp64d/systemd					stable
+loong		default/linux/loong/22.0/la64v100/lp64d/systemd/merged-usr			stable
 
 # M68K Profiles
 # @MAINTAINER: m68k@gentoo.org
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
index 38ebc3ebc6..891e53c08c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
@@ -1,6 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2023-07-29)
+# Required by dev-python/PyQt5[multimedia]
+dev-qt/qtmultimedia:5 widgets
+
 # Alexey Sokolov <alexey+gentoo@asokolov.org> (2022-12-27)
 # On desktops it's common to use browser to browse internet, which these
 # days is full of emojis, which wouldn't render properly without the fonts.
@@ -57,14 +61,9 @@ kde-frameworks/kfilemetadata taglib
 dev-lang/php -exif -truetype
 
 # Ilya Tumaykin <itumaykin+gentoo@gmail.com> (2017-02-02)
-# Enable luajit for OSC and youtube-dl support by default.
 # Override default +sdl from desktop profile and disable sdl outputs.
 # These outputs are for systems without a proper audio/video support.
-# NOTE: Needs syncing to negate profile defaults if we decide
-# to keep this up.
-media-video/mpv lua -sdl
-media-video/mpv -lua_single_target_lua5-1
-media-video/mpv lua_single_target_luajit
+media-video/mpv -sdl
 
 # Mike Gilbert <floppym@gentoo.org> (2017-01-04)
 # Needed by x11-misc/xdg-utils.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
index 486718df89..7ea55bb8b7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
@@ -1,2 +1,10 @@
 move dev-python/charset_normalizer dev-python/charset-normalizer
 move dev-python/reedsolomon dev-python/reedsolo
+move dev-python/discogs-client dev-python/python3-discogs-client
+move dev-python/hcloud-python dev-python/hcloud
+move dev-python/sabyenc dev-python/sabctools
+move dev-python/elasticsearch-py dev-python/elasticsearch
+move dev-python/indexed_gzip dev-python/indexed-gzip
+move dev-python/signature_dispatch dev-python/signature-dispatch
+move dev-python/mdx_gh_links dev-python/mdx-gh-links
+move dev-python/nest_asyncio dev-python/nest-asyncio
diff --git a/sdk_container/src/third_party/portage-stable/profiles/use.desc b/sdk_container/src/third_party/portage-stable/profiles/use.desc
index bca8dffc4f..6034f3bf6f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/use.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/use.desc
@@ -278,6 +278,7 @@ screencast - Enable support for remote desktop and screen cast using PipeWire
 sctp - Support for Stream Control Transmission Protocol
 sdl - Add support for Simple Direct Layer (media library)
 seccomp - Enable seccomp (secure computing mode) to perform system call filtering at runtime to increase security of programs
+secureboot - Automatically sign efi executables using user specified key
 selinux - !!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur
 semantic-desktop - Cross-KDE support for semantic search and information retrieval
 session - Add persistent session support
@@ -327,6 +328,7 @@ tk - Add support for Tk GUI toolkit
 truetype - Add support for FreeType and/or FreeType2 fonts
 udev - Enable virtual/udev integration (device discovery, power and storage device support, etc)
 udisks - Enable storage management support (automounting, volume monitoring, etc)
+uefi - Enable support for the Unified Extensible Firmware Interface
 unicode - Add support for Unicode
 unwind - Add support for call stack unwinding and function name resolution
 upnp - Enable UPnP port mapping support
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
new file mode 100644
index 0000000000..a89f0ca74d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/Manifest
@@ -0,0 +1,2 @@
+DIST gentoo-release-test-sigs-20190224.tar.gz 3235 BLAKE2B 924c69a62d5321716f536144f0607bd3ec4a65d76be492adc729864fd9bef82df0086541ae13034a83152ea0c8dc3cbd168be6cff111a3484128a22cbc8ef1d4 SHA512 f8cc2e84bedbdf14ace6abe4aacf8f0c9810c77ff6ae0fac301829d9d4d5cf0c128a76516c773ac993879215bcdb0aab097e1e7e747d8e1a7c4cfc815bd4d3e6
+DIST gentoo-release.asc.20230329.gz 16462 BLAKE2B 3ee5a2b9442731ff4498b448c5defe07b6fb299196f31445ba934360fff295150c0bcac037be01a1e5db97f00de1ccbfdb3a7abbf4ad0ff069d95ab42e28e680 SHA512 6e0720b0894dd80b19b769731aaa1862266371ad45c7d9e0fc9df173454b7d8b0f345dd16a47e3034d8ab34c50c3818a305f863af83edaaf7421f25bb03f4ad4
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/metadata.xml
new file mode 100644
index 0000000000..996eb9fa78
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>mgorny@gentoo.org</email>
+		<name>Michał Górny</name>
+	</maintainer>
+	<stabilize-allarches/>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild
new file mode 100644
index 0000000000..67bbc763b5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-keys/openpgp-keys-gentoo-release/openpgp-keys-gentoo-release-20230329.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="OpenPGP keys used for Gentoo releases (snapshots, stages)"
+HOMEPAGE="https://www.gentoo.org/downloads/signatures/"
+SRC_URI="https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release.asc.${PV}.gz
+	test? ( https://dev.gentoo.org/~mgorny/dist/openpgp-keys/gentoo-release-test-sigs-20190224.tar.gz )"
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+DEPEND="test? ( app-crypt/gnupg )"
+
+S=${WORKDIR}
+
+# Keys included:
+# DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D
+# D99EAC7379A850BCE47DA5F29E6438C817072058
+# 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910
+# EF9538C9E8E64311A52CDEDFA13D0EF1914E7A72
+
+src_test() {
+	local old_umask=$(umask)
+	umask 077
+
+	local -x GNUPGHOME=${T}/.gnupg
+	mkdir "${GNUPGHOME}" || die
+	einfo "Importing keys ..."
+	gpg --import "gentoo-release.asc.${PV}" || die "Key import failed"
+
+	local f
+	for f in gentoo-release-test-sigs*/*.asc; do
+		einfo "Testing ${f##*/} ..."
+		gpg -q --trust-model always --verify "${f}" || die "Verification failed on ${f}"
+	done
+
+	umask "${old_umask}"
+}
+
+src_install() {
+	insinto /usr/share/openpgp-keys
+	newins "gentoo-release.asc.${PV}" gentoo-release.asc
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r1.ebuild
index c167d5b8ae..371710aeb2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-inherit flag-o-matic libtool multilib-minimal usr-ldscript
+inherit flag-o-matic libtool multilib-minimal toolchain-funcs usr-ldscript
 
 DESCRIPTION="Access control list utilities, libraries, and headers"
 HOMEPAGE="https://savannah.nongnu.org/projects/acl"
@@ -42,9 +42,7 @@ multilib_src_configure() {
 	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964
 	# https://savannah.nongnu.org/bugs/index.php?62519
 	# bug #847280
-	if is-flagq '-O[23]' || is-flagq '-Ofast' ; then
-		# We can't unconditionally do this b/c we fortify needs
-		# some level of optimisation.
+	if tc-enables-fortify-source ; then
 		filter-flags -D_FORTIFY_SOURCE=3
 		append-cppflags -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
index 0d5e8c7407..d89fd34d6a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-inherit flag-o-matic libtool multilib-minimal usr-ldscript
+inherit flag-o-matic libtool multilib-minimal toolchain-funcs usr-ldscript
 
 DESCRIPTION="Access control list utilities, libraries, and headers"
 HOMEPAGE="https://savannah.nongnu.org/projects/acl"
@@ -11,7 +11,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="nls static-libs"
 
 RDEPEND="
@@ -46,9 +46,7 @@ multilib_src_configure() {
 	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964
 	# https://savannah.nongnu.org/bugs/index.php?62519
 	# bug #847280
-	if is-flagq '-O[23]' || is-flagq '-Ofast' ; then
-		# We can't unconditionally do this b/c we fortify needs
-		# some level of optimisation.
+	if tc-enables-fortify-source ; then
 		filter-flags -D_FORTIFY_SOURCE=3
 		append-cppflags -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r2.ebuild
index 84f4879368..10a3a8b7f5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r2.ebuild
@@ -33,7 +33,7 @@ else
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
 
-	KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
 fi
 
 SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r3.ebuild
index 17c6950668..29236e76ef 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.3-r3.ebuild
@@ -33,7 +33,7 @@ else
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
 fi
 
 SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/Manifest
index 7ee16cc47d..7bba354bc8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/Manifest
@@ -1 +1,2 @@
 DIST debianutils_5.7.orig.tar.gz 257231 BLAKE2B 61d2e7abcd359c5dc87b7f91e510e91e1926183c15a572c7d87cf4a590dded2e2ee8c9b4e06f7f478353139870c808927575de233200ad69e084a6f971c4bd24 SHA512 79acd8885abca93842d696167171a359011c49a40f38deeb25bc94d62905f95afa3a7b2540d3bd4b0ffd363c5c48a439a1a68139a29d6c033980b019cea75d92
+DIST debianutils_5.8.orig.tar.gz 260865 BLAKE2B 8a2bb3dc06d6e7a41ca53759610c432eaf3797135b13d717d1e8969926388a6955ba020db64a039d1b8dc06a8ee47d5bc960c6f54fe6b9c17e2b361f5636ece3 SHA512 7fddff17804ab334ac1ab3fa4b76a3fed8d83dc2dbf8d9ab1e486b5f226ac8363e98336cfa651c7630eef5fffa4551dbf7a5da1ba60f033b279f9aca624d58a2
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/debianutils-5.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/debianutils-5.8.ebuild
new file mode 100644
index 0000000000..8187ac4515
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/debianutils/debianutils-5.8.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic
+
+DESCRIPTION="A selection of tools from Debian"
+HOMEPAGE="https://packages.qa.debian.org/d/debianutils.html"
+SRC_URI="mirror://debian/pool/main/d/${PN}/${PN}_${PV}.orig.tar.gz"
+
+LICENSE="BSD GPL-2 SMAIL"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+IUSE="+installkernel static"
+
+PDEPEND="
+	installkernel? (
+		|| (
+			sys-kernel/installkernel-gentoo
+			sys-kernel/installkernel-systemd-boot
+		)
+	)"
+
+PATCHES=( "${FILESDIR}"/${PN}-3.4.2-no-bs-namespace.patch )
+
+src_prepare() {
+	# Avoid adding po4a dependency, upstream refreshes manpages.
+	sed -i -e '/SUBDIRS/s|po4a||' Makefile.am || die
+
+	default
+	eautoreconf
+}
+
+src_configure() {
+	use static && append-ldflags -static
+	default
+}
+
+src_install() {
+	into /
+	dobin run-parts
+
+	into /usr
+	dobin ischroot
+	dosbin savelog
+
+	doman ischroot.1 run-parts.8 savelog.8
+
+	dodoc CHANGELOG
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest
index 4ecddd747b..fa88c96b45 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/Manifest
@@ -1,2 +1,4 @@
 DIST file-5.44.tar.gz 1186437 BLAKE2B a90ccae738a95315d75a0aaee7bbff3624425cc9267daf18ba9147b7c9b9ebfb31288b54c63a73e4695eca0e876f206e40bcb81c422f1bf572b976e753b25a42 SHA512 26c3b9c7a6950649d0b2de896bfeca54289febe4cd487c0f91aa6ff1857fa49f9077f8738a17b86100125668a31dae05b586615c564f78da47ac20a1e4a74f63
 DIST file-5.44.tar.gz.asc 195 BLAKE2B a0905d42fec0fa052d75fb5b267c6ae223176451c0f1d3346006d4b760c3d858f2dcda5f0a30c6aa4b09b5afee427b75bc4debd5033d978f39dc1da01d3e1bd1 SHA512 1a4dc39283f4859581441aa35b3ed72b323c4e05ca0960d17126d1b9ec18465c695c0545e24f09f8437a60ab52e582be67b6cbbc656bbb676de00148c3644d23
+DIST file-5.45.tar.gz 1246503 BLAKE2B 30fc77c091e6624f2e9a950f4c6fe69ea6aa46d4a8ad9f20d49320a3675617c5bfbc9ff1ebba5eeb2cf4435c38d71b47b8beeb5146c9f55fe3bac11fe65e89bd SHA512 12611a59ff766c22a55db4b4a9f80f95a0a2e916a1d8593612c6ead32c247102a8fdc23693c6bf81bda9b604d951a62c0051e91580b1b79e190a3504c0efc20a
+DIST file-5.45.tar.gz.asc 163 BLAKE2B 1405080c63412e9c66bfe06086ecee28b276b77cc2ddacb20cfd370c539a0d983812fd29dcf7a33bad69d6490cd439ef8d1219bfaf3928fb835a38da85013af3 SHA512 56bf131b2f35e896788be19b4d8cd1c7ec942c794fb584d5e589375d22fbccebdd04c03e779fafc0c10840586dc41e64251b3de1767ae9ab95f5d3300f9af254
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r1.ebuild
new file mode 100644
index 0000000000..dfa6551489
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r1.ebuild
@@ -0,0 +1,180 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{10..11} )
+
+inherit distutils-r1 toolchain-funcs multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/glensc/file.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/file.asc
+	inherit autotools verify-sig
+	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
+fi
+
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
+HOMEPAGE="https://www.darwinsys.com/file/"
+
+LICENSE="BSD-2"
+SLOT="0"
+IUSE="bzip2 lzip lzma python seccomp static-libs zlib zstd"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	lzip? ( app-arch/lzlib )
+	lzma? ( app-arch/xz-utils[${MULTILIB_USEDEP}] )
+	python? (
+		${PYTHON_DEPS}
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+RDEPEND="
+	${DEPEND}
+	python? ( !dev-python/python-magic )
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+# https://bugs.gentoo.org/898676
+QA_CONFIG_IMPL_DECL_SKIP=( makedev )
+
+PATCHES=(
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
+	"${FILESDIR}/${P}-32-bit-time_t.patch"
+	"${FILESDIR}/${P}-32-bit-time_t-deux.patch"
+	"${FILESDIR}/${P}-weak-magic-shell.patch" #908401
+)
+
+src_prepare() {
+	default
+
+	#if [[ ${PV} == 9999 ]] ; then
+	#	eautoreconf
+	#else
+	#	elibtoolize
+	#fi
+	# Just for file-5.45-32-bit-time_t-deux.patch, drop in 5.46
+	eautoreconf
+
+	# Don't let python README kill main README, bug #60043
+	mv python/README.md python/README.python.md || die
+
+	# bug #662090
+	sed -i 's@README.md@README.python.md@' python/setup.py || die
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-fsect-man5
+		$(use_enable bzip2 bzlib)
+		$(multilib_native_use_enable lzip lzlib)
+		$(use_enable lzma xzlib)
+		$(use_enable seccomp libseccomp)
+		$(use_enable static-libs static)
+		$(use_enable zlib)
+		$(use_enable zstd zstdlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+build_src_configure() {
+	local myeconfargs=(
+		--disable-shared
+		--disable-libseccomp
+		--disable-bzlib
+		--disable-xzlib
+		--disable-zlib
+	)
+
+	econf_build "${myeconfargs[@]}"
+}
+
+need_build_file() {
+	# When cross-compiling, we need to build up our own file
+	# because people often don't keep matching host/target
+	# file versions, bug #362941
+	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
+}
+
+src_configure() {
+	local ECONF_SOURCE="${S}"
+
+	if need_build_file ; then
+		mkdir -p "${WORKDIR}"/build || die
+		cd "${WORKDIR}"/build || die
+		build_src_configure
+	fi
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
+	fi
+}
+
+src_compile() {
+	if need_build_file ; then
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
+		emake -C "${WORKDIR}"/build/src file
+		local -x PATH="${WORKDIR}/build/src:${PATH}"
+	fi
+
+	multilib-minimal_src_compile
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_compile
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		default
+	else
+		emake -C src install-{nodist_includeHEADERS,libLTLIBRARIES} DESTDIR="${D}"
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ChangeLog MAINT # README
+
+	# Required for `file -C`
+	insinto /usr/share/misc/magic
+	doins -r magic/Magdir/*
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_install
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45.ebuild
new file mode 100644
index 0000000000..60dd8e0742
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45.ebuild
@@ -0,0 +1,175 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{10..11} )
+
+inherit distutils-r1 libtool toolchain-funcs multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/glensc/file.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/file.asc
+	inherit verify-sig
+	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
+fi
+
+DESCRIPTION="Identify a file's format by scanning binary data for patterns"
+HOMEPAGE="https://www.darwinsys.com/file/"
+
+LICENSE="BSD-2"
+SLOT="0"
+IUSE="bzip2 lzip lzma python seccomp static-libs zlib zstd"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	lzip? ( app-arch/lzlib )
+	lzma? ( app-arch/xz-utils[${MULTILIB_USEDEP}] )
+	python? (
+		${PYTHON_DEPS}
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+RDEPEND="
+	${DEPEND}
+	python? ( !dev-python/python-magic )
+	seccomp? ( >=sys-libs/libseccomp-2.5.4[${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+# https://bugs.gentoo.org/898676
+QA_CONFIG_IMPL_DECL_SKIP=( makedev )
+
+PATCHES=(
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
+)
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		elibtoolize
+	fi
+
+	# Don't let python README kill main README, bug #60043
+	mv python/README.md python/README.python.md || die
+
+	# bug #662090
+	sed -i 's@README.md@README.python.md@' python/setup.py || die
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-fsect-man5
+		$(use_enable bzip2 bzlib)
+		$(multilib_native_use_enable lzip lzlib)
+		$(use_enable lzma xzlib)
+		$(use_enable seccomp libseccomp)
+		$(use_enable static-libs static)
+		$(use_enable zlib)
+		$(use_enable zstd zstdlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+build_src_configure() {
+	local myeconfargs=(
+		--disable-shared
+		--disable-libseccomp
+		--disable-bzlib
+		--disable-xzlib
+		--disable-zlib
+	)
+
+	econf_build "${myeconfargs[@]}"
+}
+
+need_build_file() {
+	# When cross-compiling, we need to build up our own file
+	# because people often don't keep matching host/target
+	# file versions, bug #362941
+	tc-is-cross-compiler && ! has_version -b "~${CATEGORY}/${P}"
+}
+
+src_configure() {
+	local ECONF_SOURCE="${S}"
+
+	if need_build_file ; then
+		mkdir -p "${WORKDIR}"/build || die
+		cd "${WORKDIR}"/build || die
+		build_src_configure
+	fi
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		# bug #586444
+		emake -C src magic.h
+		emake -C src libmagic.la
+	fi
+}
+
+src_compile() {
+	if need_build_file ; then
+		# bug #586444
+		emake -C "${WORKDIR}"/build/src magic.h
+		emake -C "${WORKDIR}"/build/src file
+		local -x PATH="${WORKDIR}/build/src:${PATH}"
+	fi
+
+	multilib-minimal_src_compile
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_compile
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		default
+	else
+		emake -C src install-{nodist_includeHEADERS,libLTLIBRARIES} DESTDIR="${D}"
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ChangeLog MAINT # README
+
+	# Required for `file -C`
+	insinto /usr/share/misc/magic
+	doins -r magic/Magdir/*
+
+	if use python ; then
+		cd python || die
+		distutils-r1_src_install
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
index c50090845e..60dd8e0742 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi
@@ -72,11 +72,11 @@ src_prepare() {
 		elibtoolize
 	fi
 
-	# Don't let python README kill main README, bug ##60043
+	# Don't let python README kill main README, bug #60043
 	mv python/README.md python/README.python.md || die
 
 	# bug #662090
-	sed 's@README.md@README.python.md@' -i python/setup.py || die
+	sed -i 's@README.md@README.python.md@' python/setup.py || die
 }
 
 multilib_src_configure() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t-deux.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t-deux.patch
new file mode 100644
index 0000000000..8c1e093414
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t-deux.patch
@@ -0,0 +1,29 @@
+https://github.com/file/file/commit/8dc5513908381a14981b16a85d59ba054bf4df52
+
+From 8dc5513908381a14981b16a85d59ba054bf4df52 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Mon, 31 Jul 2023 15:56:12 +0000
+Subject: [PATCH] Check if we support _TIME_BITS. (Werner Fink)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -152,6 +152,18 @@ AC_TYPE_UINT64_T
+ AC_TYPE_INT64_T
+ AC_TYPE_INTPTR_T
+ AC_TYPE_UINTPTR_T
++m4_ifdef([AC_SYS_YEAR2038], [AC_SYS_YEAR2038], [
++# GNU libc only allows setting _TIME_BITS when FILE_OFFSET_BITS is also set.
++# GNU libc defines __TIMESIZE on systems where _TIME_BITS can be set.
++AS_IF([test X"$ac_cv_sys_file_offset_bits" = X"64"], [
++    AC_CHECK_DECL(__TIMESIZE, [
++	AC_DEFINE([_TIME_BITS], [64], [Number of bits in a timestamp, on hosts where this is settable.])
++    ], [], [
++AC_INCLUDES_DEFAULT
++#include <time.h>
++	])
++    ])
++])
+ AC_FUNC_MMAP
+ AC_FUNC_FORK
+ AC_FUNC_MBRTOWC
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t.patch
new file mode 100644
index 0000000000..c86a46207e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-32-bit-time_t.patch
@@ -0,0 +1,34 @@
+https://mailman.astron.com/pipermail/file/2023-July/001206.html
+https://github.com/file/file/commit/218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1
+
+From 218fdf813fd5ccecbb8887a1b62509cd1c6dd3a1 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 28 Jul 2023 14:38:25 +0000
+Subject: [PATCH] deal with 32 bit time_t
+
+--- a/src/file.h
++++ b/src/file.h
+@@ -27,7 +27,7 @@
+  */
+ /*
+  * file.h - definitions for file(1) program
+- * @(#)$File: file.h,v 1.247 2023/07/27 19:40:22 christos Exp $
++ * @(#)$File: file.h,v 1.248 2023/07/28 14:38:25 christos Exp $
+  */
+ 
+ #ifndef __file_h__
+@@ -159,9 +159,11 @@
+ /*
+  * Dec 31, 23:59:59 9999
+  * we need to make sure that we don't exceed 9999 because some libc
+- * implementations like muslc crash otherwise
++ * implementations like muslc crash otherwise. If you are unlucky
++ * to be running on a system with a 32 bit time_t, then it is even less.
+  */
+-#define	MAX_CTIME	CAST(time_t, 0x3afff487cfULL)
++#define	MAX_CTIME \
++    CAST(time_t, sizeof(time_t) > 4 ? 0x3afff487cfULL : 0x7fffffffULL)
+ 
+ #define FILE_BADSIZE CAST(size_t, ~0ul)
+ #define MAXDESC	64		/* max len of text description/MIME type */
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-weak-magic-shell.patch b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-weak-magic-shell.patch
new file mode 100644
index 0000000000..cdcab736b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/files/file-5.45-weak-magic-shell.patch
@@ -0,0 +1,43 @@
+https://bugs.gentoo.org/908401
+https://bugs.astron.com/view.php?id=457
+https://github.com/file/file/commit/1fc9175166fc5c5117838a1dcfb309b7c595eb56
+
+From 1fc9175166fc5c5117838a1dcfb309b7c595eb56 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 30 Jul 2023 16:31:47 +0000
+Subject: [PATCH] Comment out weak magic
+
+--- a/magic/Magdir/printer
++++ b/magic/Magdir/printer
+@@ -1,6 +1,6 @@
+ 
+ #------------------------------------------------------------------------------
+-# $File: printer,v 1.34 2023/06/16 19:27:12 christos Exp $
++# $File: printer,v 1.35 2023/07/30 16:31:47 christos Exp $
+ # printer:  file(1) magic for printer-formatted files
+ #
+ 
+@@ -230,8 +230,9 @@
+ 0	string	PS4
+ >0		use		hpgl
+ # la.hp
+-0	string	BP
+->0		use		hpgl
++# Too weak
++#0	string	BP
++#>0		use		hpgl
+ # miter.hp
+ # Plot Absolute x,y{,x,y{...}}; x and y in range between -32767 and 32768 like: PA4000,3000;
+ 0	string	PA
+@@ -241,8 +242,9 @@
+ #>2	regex	\^([-]{0,1}[0-9]{1,5})	COORDINATE=%s
+ >>0		use		hpgl
+ # pw.hpg	number of pens x
+-0	string	NP
+->0		use		hpgl
++# Too weak
++#0	string	NP
++#>0		use		hpgl
+ # win_1.hp
+ #0	string	\003INCA		WHAT_IS_THAT
+ #>0		use		hpgl
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
index 0a85f53de5..d268aa0ff1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
@@ -1,2 +1,3 @@
 DIST hwdata-0.371.tar.gz 2340297 BLAKE2B bb92b6d4f66879eacc1efae13ff1a5fe58014614c4af1906eca0489053f61d0ae2f4be777532cb6209cb2d133f8787774bc803a4d2cdf11a1014d7218bf25650 SHA512 62739cce61493f5d46a9cec5732bd4f9e0c86adec5b56cca31fa50c0d85e3a48d32f5abeaa5ca26f4ba42fc13affe4350b66a1838e958b037ddec7b30e726e86
 DIST hwdata-0.372.tar.gz 2349386 BLAKE2B 0b3c8a7d23cd999090839d046ce6228098bb4976d0be56a07b6b32bdd968e11933b0d648cf4d596ed9ca09f5b754083c62bf0aba116835de6aed72f228cacf1b SHA512 3a7fda4c1f06dff62892dd0d21095d7603a2ec16e67667215b2f59640a38845a79b2dc2a19bcc40656fd472e4216393ac08e190939ec05ef6d4af3e7e6c9141f
+DIST hwdata-0.373.tar.gz 2356072 BLAKE2B 22be63c94f1ba0fe5e31f1a19d8bf60a302bd6a2a7a15fbeaba0c3399490f86e067c5c84e1bbf5c4cc55a1ec588282d41c5ca9f3cf9e774ae559cac1b95d5812 SHA512 cb940a1cad1b7b6cef0e4bca980b0e6f0af06bf157069645645bb4403d98fbb26bbeef580c984b73091375db09e96c8b672b52d5cf27d75581ff8f0e935d8294
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.373.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.373.ebuild
new file mode 100644
index 0000000000..afddd20d2f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.373.ebuild
@@ -0,0 +1,28 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo
+
+DESCRIPTION="Hardware identification and configuration data"
+HOMEPAGE="https://github.com/vcrhonek/hwdata"
+SRC_URI="https://github.com/vcrhonek/hwdata/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+RESTRICT="test"
+
+src_configure() {
+	# configure is not compatible with econf
+	local conf=(
+		./configure
+		--prefix="${EPREFIX}/usr"
+		--libdir="${EPREFIX}/lib"
+		--datadir="${EPREFIX}/usr/share"
+	)
+
+	edo "${conf[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-633-tinfow.patch b/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-633-tinfow.patch
new file mode 100644
index 0000000000..82ea458cd0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-633-tinfow.patch
@@ -0,0 +1,52 @@
+https://github.com/gwsw/less/pull/403
+
+From 23000c286773af153a5743bc923465707b87613b Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Mon, 17 Jul 2023 22:58:27 +0100
+Subject: [PATCH] configure.ac: Check for tinfow before tinfo
+
+We currently check for ncursesw > ncurses and then tinfo > tinfow. This means
+we can get a mismatch of ncursesw + tinfo, instead of the correct ncursesw + tinfow.
+
+Swap the order so we check for ncursesw first (before other ncurses variants)
+and then tinfow first (before other tinfo variants).
+
+This is needed anyway for correctness, but also needed for certain terminfos
+to work correctly with recent ncurses.
+
+A better fix would be to use pkg-config first which handles this correctly
+and would include the appropriate -ltinfo* in the libraries list for -lncurses*,
+but not doing that for now.
+
+Bug: https://bugs.gentoo.org/910430
+--- a/configure.ac
++++ b/configure.ac
+@@ -63,10 +63,10 @@ fi
+ 
+ if test $curses_broken = 0; then
+ 
+-# -- Try tinfo.
++# -- Try tinfow.
+ if test "x$TERMLIBS" = x; then
+-  if test $have_tinfo = yes; then
+-    TERMLIBS="-ltinfo"
++  if test $have_tinfow = yes; then
++    TERMLIBS="-ltinfow"
+     SAVE_LIBS=$LIBS
+     LIBS="$LIBS $TERMLIBS"
+     AC_LINK_IFELSE([AC_LANG_PROGRAM([[$include_termcap_h]], [[tgetent(0,0); tgetflag(0); tgetnum(0); tgetstr(0,0);]])],[termok=yes],[termok=no])
+@@ -75,10 +75,10 @@ if test "x$TERMLIBS" = x; then
+   fi
+ fi
+ 
+-# -- Try tinfow.
++# -- Try tinfo.
+ if test "x$TERMLIBS" = x; then
+-  if test $have_tinfow = yes; then
+-    TERMLIBS="-ltinfow"
++  if test $have_tinfo = yes; then
++    TERMLIBS="-ltinfo"
+     SAVE_LIBS=$LIBS
+     LIBS="$LIBS $TERMLIBS"
+     AC_LINK_IFELSE([AC_LANG_PROGRAM([[$include_termcap_h]], [[tgetent(0,0); tgetflag(0); tgetnum(0); tgetstr(0,0);]])],[termok=yes],[termok=no])
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-633-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-633-r2.ebuild
new file mode 100644
index 0000000000..5d22949f4f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-633-r2.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+WANT_AUTOMAKE=none
+WANT_LIBTOOL=none
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/gwsw/less"
+	inherit git-r3
+fi
+
+inherit autotools flag-o-matic optfeature
+
+# Releases are usually first a beta then promoted to stable if no
+# issues were found. Upstream explicitly ask "to not generally distribute"
+# the beta versions. It's okay to keyword beta versions if they fix
+# a serious bug, but otherwise try to avoid it.
+
+MY_PV=${PV/_beta/-beta}
+MY_P=${PN}-${MY_PV}
+DESCRIPTION="Excellent text file viewer"
+HOMEPAGE="https://www.greenwoodsoftware.com/less/"
+[[ ${PV} != 9999 ]] && SRC_URI="https://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
+S="${WORKDIR}"/${MY_P/?beta}
+
+LICENSE="|| ( GPL-3 BSD-2 )"
+SLOT="0"
+if [[ ${PV} != 9999 && ${PV} != *_beta* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="pcre"
+# As of 623_beta, lesstest is not included in dist tarballs
+# https://github.com/gwsw/less/issues/344
+RESTRICT="test"
+
+DEPEND="
+	>=app-misc/editor-wrapper-3
+	>=sys-libs/ncurses-5.2:=
+	pcre? ( dev-libs/libpcre2 )
+"
+RDEPEND="${DEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-633-tinfow.patch
+)
+
+src_prepare() {
+	default
+	# Per upstream README to prepare live build
+	[[ ${PV} == 9999 ]] && emake -f Makefile.aut distfiles
+	# Upstream uses unpatched autoconf-2.69, which breaks with clang-16.
+	# https://bugs.gentoo.org/870412
+	eautoreconf
+}
+
+src_configure() {
+	append-lfs-flags # bug #896316
+
+	local myeconfargs=(
+		--with-regex=$(usex pcre pcre2 posix)
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check VERBOSE=1
+}
+
+src_install() {
+	default
+
+	newbin "${FILESDIR}"/lesspipe-r2.sh lesspipe
+	newenvd "${FILESDIR}"/less.envd 70less
+}
+
+pkg_preinst() {
+	optfeature "Colorized output supprt" dev-python/pygments
+
+	if has_version "<${CATEGORY}/${PN}-483-r1" ; then
+		elog "The lesspipe.sh symlink has been dropped.  If you are still setting"
+		elog "LESSOPEN to that, you will need to update it to '|lesspipe %s'."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
index c6edffba45..cbd0aff289 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 fi
 
-inherit autotools optfeature
+inherit autotools flag-o-matic optfeature
 
 # Releases are usually first a beta then promoted to stable if no
 # issues were found. Upstream explicitly ask "to not generally distribute"
@@ -31,9 +31,6 @@ if [[ ${PV} != 9999 && ${PV} != *_beta* ]] ; then
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="pcre"
-# As of 623_beta, lesstest is not included in dist tarballs
-# https://github.com/gwsw/less/issues/344
-RESTRICT="test"
 
 DEPEND="
 	>=app-misc/editor-wrapper-3
@@ -42,6 +39,10 @@ DEPEND="
 "
 RDEPEND="${DEPEND}"
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-633-tinfow.patch
+)
+
 src_prepare() {
 	default
 	# Per upstream README to prepare live build
@@ -52,6 +53,8 @@ src_prepare() {
 }
 
 src_configure() {
+	append-lfs-flags # bug #896316
+
 	local myeconfargs=(
 		--with-regex=$(usex pcre pcre2 posix)
 		--with-editor="${EPREFIX}"/usr/libexec/editor
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/Manifest
index 6bf62dba6f..8b0b62a6f7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/Manifest
@@ -1,2 +1,3 @@
 DIST man-pages-6.04.tar.xz 2188236 BLAKE2B 741ff7e279c9bd961a1d39e432599a985d010516c03eb13978c5bda46a26ef914053c511bce923d49eb9111b3a1f7537e4418df3b5abd2eb0c051faf9f39c7fb SHA512 3f95d15dda419e824f902947a268d8021e9e04c5ba8503e4fe9f96a9ab8363fde8088b2712cc9c795638163ad8432bc5f8c6a3ea320293ec6aa79bb748e85b9e
+DIST man-pages-6.05.01.tar.xz 2194472 BLAKE2B edc40828bc9c75f655a8352f10c214d68b64f90815cc947f65d49794e0b588b103cae28b3644e41bedd8caaa6cef3c77b02525d8c2ccc91ccf887a10b2f2c32a SHA512 ad3f6dc28bb83824faf8c855a5db8983dc0f5ac3b5702624033ed320a6f39a7f1f0845acf0bc62a0a10cdfe42eb66ba9596e2796ba2683cfb29e480710da3d70
 DIST man-pages-gentoo-2.tar.bz2 5141 BLAKE2B c5c7956ab47c8a473e258b1902d5d19d9eb2e9d01786e907d9c3ba691c2a506834ed96cd1f54e8d8415e65d4fea0056659537f0faffe68fcbed33aa728a5e61e SHA512 6e6524b8ad6f1b8c9b147665ee32af49e05603dac61d433acd6b4f1164adef27cd542898f272b07d8659725013dac59c7f34a858968cc054a4785c945e14a770
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.05.01.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.05.01.ebuild
new file mode 100644
index 0000000000..19396bc206
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-pages/man-pages-6.05.01.ebuild
@@ -0,0 +1,122 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes:
+# - Upstream are very friendly, do approach them if have any questions;
+#
+# - It's considered fine (and somewhat encouraged) for us to make snapshots
+#   if we want specific fixes, perhaps aligned with newer kernels, glibc, etc.
+#   Just generate it with 'make dist'. We can set DISTVERSION if we want a vanity
+#   name or if the comit hash is too long;
+#
+# - If we do use a snapshot, *don't* grab it directly from git and use it
+#   raw in the ebuild. Use 'make dist' as above;
+#
+# - Sometimes there's no dist tarball available post-release and upstream
+#   encourage distros to make their own. Set MAN_PAGES_GENTOO_DIST to 1 if none is
+#   available, 0 otherwise.
+MAN_PAGES_GENTOO_DIST=0
+GENTOO_PATCH=2
+
+DESCRIPTION="A somewhat comprehensive collection of Linux man pages"
+HOMEPAGE="https://www.kernel.org/doc/man-pages/"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git"
+	inherit git-r3
+elif [[ ${PV} == *_rc* ]] ; then
+	MY_P=${PN}-${PV/_/-}
+
+	SRC_URI="https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/snapshot/${MY_P}.tar.gz"
+	S="${WORKDIR}"/${MY_P}
+else
+	if [[ ${MAN_PAGES_GENTOO_DIST} -eq 1 ]] ; then
+		SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-gentoo.tar.xz"
+	else
+		SRC_URI="
+			https://www.kernel.org/pub/linux/docs/man-pages/Archive/${P}.tar.xz
+			https://www.kernel.org/pub/linux/docs/man-pages/${P}.tar.xz
+		"
+	fi
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+fi
+
+SRC_URI+="
+	mirror://gentoo/man-pages-gentoo-${GENTOO_PATCH}.tar.bz2
+	https://dev.gentoo.org/~cardoe/files/man-pages-gentoo-${GENTOO_PATCH}.tar.bz2
+"
+
+LICENSE="man-pages GPL-2+ BSD"
+SLOT="0"
+# Keep the following in sync with app-i18n/man-pages-l10n
+MY_L10N=( cs da de el es fi fr hu id it mk nb nl pl pt-BR ro sr sv uk vi )
+IUSE="l10n_ja l10n_ru l10n_zh-CN ${MY_L10N[@]/#/l10n_}"
+RESTRICT="binchecks"
+
+BDEPEND="
+	sys-devel/bc
+"
+# Block packages that used to install colliding man pages:
+# bug #341953, bug #548900, bug #612640, bug #617462
+RDEPEND="
+	virtual/man
+	!<sys-apps/keyutils-1.5.9-r4
+	!<dev-libs/libbsd-0.8.3-r1
+"
+PDEPEND="
+	l10n_ja? ( app-i18n/man-pages-ja )
+	l10n_ru? ( || (
+		app-i18n/man-pages-l10n[l10n_ru(-)]
+		app-i18n/man-pages-ru
+	) )
+	l10n_zh-CN? ( app-i18n/man-pages-zh_CN )
+"
+for lang in "${MY_L10N[@]}"; do
+	PDEPEND+=" l10n_${lang}? ( app-i18n/man-pages-l10n[l10n_${lang}(-)] )"
+done
+unset lang
+
+src_unpack() {
+	default
+
+	[[ ${PV} == 9999 ]] && git-r3_src_unpack
+}
+
+src_prepare() {
+	default
+
+	# passwd.5 installed by sys-apps/shadow, bug #776787
+	rm man5/passwd.5 || die
+}
+
+src_compile() { :; }
+
+src_test() {
+	# We don't use the 'check' target right now because of known errors
+	# https://lore.kernel.org/linux-man/0dfd5319-2d22-a8ad-f085-d635eb6d0678@gmail.com/T/#t
+	emake lint-man-tbl
+}
+
+src_install() {
+	emake install prefix="${EPREFIX}"/usr DESTDIR="${D}"
+	dodoc README Changes*
+
+	# Override with Gentoo specific or additional Gentoo pages
+	cd "${WORKDIR}"/man-pages-gentoo || die
+	doman */*
+	dodoc README.Gentoo
+}
+
+pkg_postinst() {
+	for ver in ${REPLACING_VERSIONS} ; do
+		if ver_test ${ver} -lt 5.13-r2 ; then
+			# Avoid ACCEPT_LICENSE issues for users by default
+			# bug #871636
+			ewarn "This version of ${PN} no longer depends on sys-apps/man-pages-posix!"
+			ewarn "Please install sys-apps/man-pages-posix yourself if needed."
+			break
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.49-prefixify-init-script-shebangs.patch b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.49-prefixify-init-script-shebangs.patch
new file mode 100644
index 0000000000..d4d050c174
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/files/portage-3.0.49-prefixify-init-script-shebangs.patch
@@ -0,0 +1,29 @@
+https://gitweb.gentoo.org/proj/portage.git/commit/?id=6066bb766f43ca06a5b0f08baa5946ff678f0c29
+
+From 6066bb766f43ca06a5b0f08baa5946ff678f0c29 Mon Sep 17 00:00:00 2001
+From: Benda Xu <orv@debian.org>
+Date: Sun, 25 Jun 2023 17:03:00 +0800
+Subject: bin/install-qa-check.d/05prefix: prefixify init-script shebangs.
+
+Init scripts in /etc/init.d have OpenRC shebangs "#!/sbin/openrc-run".
+They should be prefixified like a executable script in a Prefix.
+
+Signed-off-by: Benda Xu <heroxbd@gentoo.org>
+Bug: https://bugs.gentoo.org/640658
+Closes: https://github.com/gentoo/portage/pull/1061
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/bin/install-qa-check.d/05prefix
++++ b/bin/install-qa-check.d/05prefix
+@@ -76,8 +76,8 @@ install_qa_check_prefix() {
+ 			fi
+ 			continue
+ 		fi
+-		# unprefixed shebang, is the script directly in ${PATH}?
+-		if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
++		# unprefixed shebang, is the script directly in ${PATH} or an init script?
++		if [[ ":${PATH}:${EPREFIX}/etc/init.d:" == *":${fp}:"* ]] ; then
+ 			if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ; then
+ 				# is it unprefixed, but we can just fix it because a
+ 				# prefixed variant exists
+-- 
+cgit v1.2.3-18-g5258
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r1.ebuild
index 0108022357..2304427f74 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r1.ebuild
@@ -22,7 +22,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r2.ebuild
new file mode 100644
index 0000000000..bfea826b75
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.49-r2.ebuild
@@ -0,0 +1,303 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DISTUTILS_EXT=1
+PYTHON_COMPAT=( pypy3 python3_{10..12} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+SETUPTOOLS_USE_DISTUTILS=local
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/portage.git
+		https://github.com/gentoo/portage.git
+	"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+	doc? (
+		app-text/xmlto
+		~app-text/docbook-xml-dtd-4.4
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/baselayout-2.9
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=app-admin/eselect-1.2
+		>=app-shells/bash-5.0:0[readline]
+		>=sys-apps/sed-4.0.5
+		>=sec-keys/openpgp-keys-gentoo-release-20230329
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		>=sys-apps/coreutils-6.4
+		>=sys-apps/file-5.44-r3
+	)
+"
+
+PATCHES=(
+	# message patch used in 3.0.48.1 and 3.0.49 (bug 909853)
+	"${FILESDIR}/depgraph.py-fix-no-ebuilds-binpkgs-message.patch"
+	# backport from master to help Prefix bootstraps (bug #640658)
+	"${FILESDIR}/portage-3.0.49-prefixify-init-script-shebangs.patch"
+)
+
+distutils_enable_tests pytest
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	distutils-r1_python_prepare_all
+
+	if [[ ${PV} != 9999 ]] ; then
+		sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+	fi
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir warn-on-large-env"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
index d8eb0c8817..6bb5c1c1d3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
@@ -3,13 +3,11 @@
 
 EAPI=7
 
-DISTUTILS_EXT=1
 PYTHON_COMPAT=( pypy3 python3_{10..12} )
 PYTHON_REQ_USE='bzip2(+),threads(+)'
-SETUPTOOLS_USE_DISTUTILS=local
 TMPFILES_OPTIONAL=1
 
-inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+inherit meson linux-info python-r1 tmpfiles
 
 DESCRIPTION="The package management and distribution system for Gentoo"
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
@@ -28,13 +26,21 @@ fi
 LICENSE="GPL-2"
 SLOT="0"
 IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
 
+# setuptools is still needed as a workaround for Python 3.12+ for now.
+# https://github.com/mesonbuild/meson/issues/7702
+
 BDEPEND="
-	dev-python/setuptools[${PYTHON_USEDEP}]
+	${PYTHON_DEPS}
+	$(python_gen_cond_dep '
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	' python3_12)
 	test? ( dev-vcs/git )
 "
 DEPEND="
+	${PYTHON_DEPS}
 	>=app-arch/tar-1.27
 	dev-lang/python-exec:2
 	>=sys-apps/sed-4.0.5 sys-devel/patch
@@ -50,9 +56,8 @@ DEPEND="
 "
 # Require sandbox-2.2 for bug #288863.
 # For whirlpool hash, require python[ssl] (bug #425046).
-# app-portage/gemato goes without PYTHON_USEDEP since we're calling
-# the executable.
 RDEPEND="
+	${PYTHON_DEPS}
 	acct-user/portage
 	app-arch/zstd
 	>=app-arch/tar-1.27
@@ -92,154 +97,78 @@ PDEPEND="
 	)
 "
 
-distutils_enable_tests pytest
-
 pkg_pretend() {
 	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
 
-	if use native-extensions && tc-is-cross-compiler; then
-		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
-	fi
-
 	check_extra_config
 }
 
-python_prepare_all() {
-	distutils-r1_python_prepare_all
+src_prepare() {
+	default
 
-	if [[ ${PV} != 9999 ]] ; then
-		sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
-	fi
-
-	if use gentoo-dev; then
-		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
-		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
-			-i lib/_emerge/create_depgraph_params.py || \
-			die "failed to patch create_depgraph_params.py"
-
-		einfo "Enabling additional FEATURES for gentoo-dev..."
-		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir warn-on-large-env"' \
-			>> cnf/make.globals || die
-	fi
-
-	if use native-extensions && ! tc-is-cross-compiler; then
-		printf "[build_ext]\nportage_ext_modules=true\n" >> \
-			setup.cfg || die
-	fi
-
-	if ! use ipc ; then
-		einfo "Disabling ipc..."
-		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
-			-i lib/_emerge/AbstractEbuildProcess.py || \
-			die "failed to patch AbstractEbuildProcess.py"
-	fi
-
-	if use xattr && use kernel_linux ; then
-		einfo "Adding FEATURES=xattr to make.globals ..."
-		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
-			|| die "failed to append to make.globals"
-	fi
-
-	if use build || ! use rsync-verify; then
-		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
-			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+	if use prefix-guest; then
+		sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+			-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+			-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
 			-i cnf/repos.conf || die "sed failed"
 	fi
+}
 
-	if [[ -n ${EPREFIX} ]] ; then
-		einfo "Setting portage.const.EPREFIX ..."
-		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
-			-w "/_BINARY/" lib/portage/const.py
+src_configure() {
+	local code_only=false
+	python_foreach_impl my_src_configure
+}
 
-		einfo "Prefixing shebangs ..."
-		> "${T}/shebangs" || die
-		while read -r -d $'\0' ; do
-			local shebang=$(head -n1 "$REPLY")
-			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
-				echo "${REPLY}" >> "${T}/shebangs" || die
-			fi
-		done < <(find . -type f -executable ! -name etc-update -print0)
+my_src_configure() {
+	local emesonargs=(
+		-Dcode-only=${code_only}
+		-Deprefix="${EPREFIX}"
+		-Dportage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}"
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		$(meson_use doc)
+		$(meson_use apidoc)
+		$(meson_use native-extensions)
+		$(meson_use gentoo-dev)
+		$(meson_use ipc)
+		$(meson_use xattr)
+	)
 
-		if [[ -s ${T}/shebangs ]]; then
-			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
-		fi
-
-		einfo "Adjusting make.globals, repos.conf and etc-update ..."
-		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
-
-		if use prefix-guest ; then
-			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
-				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
-				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
-				-i cnf/repos.conf || die "sed failed"
-		fi
-	fi
-
-	cd "${S}/cnf" || die
-	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
-		patch make.conf.example "make.conf.example.${ARCH}".diff || \
-			die "Failed to patch make.conf.example"
+	if use build; then
+		emesonargs+=( -Drsync-verify=false )
 	else
-		eerror ""
-		eerror "Portage does not have an arch-specific configuration for this arch."
-		eerror "Please notify the arch maintainer about this issue. Using generic."
-		eerror ""
-	fi
-}
-
-python_compile_all() {
-	local targets=()
-	use doc && targets+=( docbook )
-	use apidoc && targets+=( apidoc )
-
-	if [[ ${targets[@]} ]]; then
-		esetup.py "${targets[@]}"
-	fi
-}
-
-python_install() {
-	# Install sbin scripts to bindir for python-exec linking
-	# they will be relocated in pkg_preinst()
-	distutils-r1_python_install \
-		--system-prefix="${EPREFIX}/usr" \
-		--bindir="$(python_get_scriptdir)" \
-		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
-		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
-		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
-		--sbindir="$(python_get_scriptdir)" \
-		--sysconfdir="${EPREFIX}/etc" \
-		"${@}"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all
-
-	local targets=()
-	use doc && targets+=(
-		install_docbook
-		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
-	)
-	use apidoc && targets+=(
-		install_apidoc
-		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
-	)
-
-	# install docs
-	if [[ ${targets[@]} ]]; then
-		esetup.py "${targets[@]}"
+		emesonargs+=( $(meson_use rsync-verify) )
 	fi
 
+	meson_src_configure
+	code_only=true
+}
+
+src_compile() {
+	python_foreach_impl meson_src_compile
+}
+
+src_install() {
+	python_foreach_impl my_src_install
 	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
 
-	# Due to distutils/python-exec limitations
-	# these must be installed to /usr/bin.
-	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
-	einfo "Moving admin scripts to the correct directory"
-	dodir /usr/sbin
-	for target in ${sbin_relocations}; do
-		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
-		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
-	done
+	local scripts
+	mapfile -t scripts < <(awk '/^#!.*python/ {print FILENAME} {nextfile}' "${ED}"/usr/{bin,sbin}/* || die)
+	python_replicate_script "${scripts[@]}"
+}
+
+my_src_install() {
+	local pydirs=(
+		"${D}$(python_get_sitedir)"
+		"${D}/usr/lib/portage/${EPYTHON}"
+	)
+
+	meson_src_install
+	python_optimize "${pydirs[@]}"
+	python_fix_shebang "${pydirs[@]}"
+}
+
+src_test() {
+	python_foreach_impl meson_src_test --no-rebuild --verbose
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
index 57d6f41631..6c49a3b116 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
@@ -1 +1,2 @@
 DIST pv-1.6.20.tar.bz2 115310 BLAKE2B b50623f623231e8e8615f960bad83d10e12d5274c57d23ea843d16fce30b3e690284b2d9b01f82a16b9790e2bf26f80f560e226589a62ca677a2cf90ea007691 SHA512 e445f91b298ed285ddab54a3f8a6b5d5297e2e2eb8ad7b2ee2cbacca4adda9c6ca2bf3c77bf2a93373d3875c5b3b0b345d3945cbd91fc2647c6c25f1661a6752
+DIST pv-1.7.24.tar.gz 160435 BLAKE2B a6cff613ac99294d70d1347e78625d838873740d2251802b461a29de28d9c2dda8ebc1fd0a8807fc420c8faf846bc8afc7c6f3e551ff243f02fa5e9ab3caf53e SHA512 46310e2d297bef1a8a7cbf2a23b2e19b21e367902de6cf759fb1a58275e0351d1f6f1ae101a32acaaa579a16c18ed49b116e58f158c87be527533ebacabd7671
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/pv/metadata.xml
index 882536d882..2f5983aa78 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/metadata.xml
@@ -10,7 +10,6 @@
 		<name>Sam James</name>
 	</maintainer>
 	<upstream>
-		<remote-id type="google-code">pipeviewer</remote-id>
 		<remote-id type="github">a-j-wood/pv</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.7.24.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.7.24.ebuild
new file mode 100644
index 0000000000..2888d46d42
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.7.24.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PLOCALES="de fr pl pt"
+PLOCALE_BACKUP="en"
+inherit linux-info toolchain-funcs plocale
+
+DESCRIPTION="Pipe Viewer: a tool for monitoring the progress of data through a pipe"
+HOMEPAGE="https://www.ivarch.com/programs/pv.shtml"
+SRC_URI="https://www.ivarch.com/programs/sources/${P}.tar.gz"
+
+LICENSE="Artistic-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="debug nls"
+
+DOCS=( README.md doc/NEWS.md doc/TODO.md )
+
+pkg_setup() {
+	if use kernel_linux; then
+		CONFIG_CHECK="~SYSVIPC"
+		ERROR_SYSVIPC="You will need to enable CONFIG_SYSVIPC in your kernel to use the --remote option."
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	default
+
+	sed -i configure -e 's|CFLAGS="-g -Wall"|:|g' || die
+
+	# These should produce the same end result (working `pv`).
+	sed -i \
+		-e 's:$(LD) $(LDFLAGS) -o:$(AR) rc:' \
+		autoconf/make/modules.mk~ || die
+
+	disable_locale() {
+		local locale=${1}
+		sed -i configure -e "/ALL_LINGUAS=/s:${locale}::g" || die
+	}
+
+	plocale_find_changes src/nls '' '.po'
+	plocale_for_each_disabled_locale disable_locale
+}
+
+src_configure() {
+	tc-export AR
+
+	econf \
+		$(use_enable debug debugging) \
+		$(use_enable nls)
+}
+
+src_test() {
+	emake -Onone check
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
index d4cda01115..82911784c7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/Manifest
@@ -1,3 +1,5 @@
 DIST sandbox-2.32.tar.xz 456724 BLAKE2B 95eed293ef9427726f62d0d7ac1a0c63bbfd152d71598f6c5f792c8b818999c98600f4d8c71b92c8a90ba9fca595b5619ba408ac5f0edcc012050111d84519e0 SHA512 db0fe755b0bff0888a7861194218e980a73a2c4c0afadb7f0e5bb794dbc8b3d5bfbf7e2510a7167874c9f6fbf7eea428e6eae7b52dcbc91ffbd2aa1b1b54bef8
 DIST sandbox-2.35.tar.xz 459228 BLAKE2B 72a7b48d0bb9021b65093f7ab8ed98e3fecb2544869c67a4cc00e829f3885d936320fa452f8807e95123e75cd14cfaf1797015c17dd30e40ba8694665c9d7e9c SHA512 ba3351c4e6aea2a4390c6d66a7d9de0b4c80e0e6c8a2cb298cb30dcaeeb1618f66d75055ac00c0d8f169a29c9c3175bec5e95a4228f93f353a1d8c8d0a07d177
 DIST sandbox-2.36.tar.xz 459348 BLAKE2B e0544e6e37533009939a6756f4d6c0f5c4aada4679bff539c65dd602024d85d70550912a4128223c691400664fd8e75cefad504e03516b3421cf7c6befdf5fcd SHA512 6590887f0e56ee322d7ff2e55041bfa6cf8edc77f0369a8dcf2287dce5fb7ba845b0336c7d8bb91b2c50e7b9a4f1e52eecaee1d2381d25bb260ea9fd2f9d4587
+DIST sandbox-2.37.tar.xz 459420 BLAKE2B 0f6c701f819139f557a5fccb59e67509b04ba6eb22e79250a69ae990b123f9f7b618bb82a43ea86e1b18614c38d0d884aceb77d17af5a92030b2b4ad89eb2bd4 SHA512 91ddb98aa118f2d606aaf64b20598dbed9239069350842ab9fd3af05b1942380c92841d044387bc2d761317faa9c44848b3010e18747d834c115929f64060056
+DIST sandbox-2.38.tar.xz 460776 BLAKE2B 39a93e77301d5b6ea0a352cf1dc7786a1030a3701b0f8beca62e80a4f0d614b26cb3764ecf0174a9fd77acf27ae5d972de352e6fdec5a169aba83e6146a84038 SHA512 a559e32654b2fd7baca70b85f6dbf0a610e5847ccf28d7a0536485aedbfb1ce8394a080e6efdafcf76e01439b2592eebcef6c8f77a976188ce7e3759a2844d3f
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.37.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.37.ebuild
new file mode 100644
index 0000000000..0fb5f9276a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.37.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+}
+
+multilib_src_configure() {
+	filter-lfs-flags #90228
+
+	ECONF_SOURCE="${S}" econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.38.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.38.ebuild
new file mode 100644
index 0000000000..1efc83d19f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sandbox/sandbox-2.38.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit flag-o-matic multilib-minimal multiprocessing
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Sandbox"
+SRC_URI="https://dev.gentoo.org/~floppym/dist/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+nnp"
+
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
+
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES='-sandbox -usersandbox' emerge sandbox"
+}
+
+src_prepare() {
+	default
+
+	if ! use nnp ; then
+		sed -i 's:PR_SET_NO_NEW_PRIVS:___disable_nnp_hack:' src/sandbox.c || die
+	fi
+
+	# sandbox uses `__asm__ (".symver "...` which does
+	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
+	filter-lto
+}
+
+multilib_src_configure() {
+	filter-lfs-flags #90228
+
+	ECONF_SOURCE="${S}" econf
+}
+
+multilib_src_test() {
+	# Default sandbox build will run with --jobs set to # cpus.
+	emake check TESTSUITEFLAGS="--jobs=$(makeopts_jobs)"
+}
+
+multilib_src_install_all() {
+	doenvd "${FILESDIR}"/09sandbox
+
+	dodoc AUTHORS ChangeLog* README.md
+}
+
+pkg_postinst() {
+	mkdir -p "${EROOT}"/var/log/sandbox
+	chown root:portage "${EROOT}"/var/log/sandbox
+	chmod 0770 "${EROOT}"/var/log/sandbox
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/Manifest
index c8bdef502e..729a30cb14 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/Manifest
@@ -1 +1,2 @@
 DIST smartmontools-7.3.tar.gz 1043932 BLAKE2B 119fd4aded487796ffd38050ddf8c7dd69cc6f3950650cb0315846292fd4a6594d949d87c51ed46717d6aaadb332c68f655514d1fde89600d51f3fe36f8df1ca SHA512 08afe8b0a6a39e742160cd4e4c03fc7aff7b1ae8681b906360f0932277dc99e361b7606b2373bdf42425cf9453480a5f4344bc040ebc2fa26a03bd52f02a6ac0
+DIST smartmontools-7.4.tar.gz 1094955 BLAKE2B fbf7888b92b6be4892a206e1c0fae1cb7c45fe0d62270c5fe713a540616e3599c67dd3297ad8c1cd344987e1fe95ae7c5e92db8e13ef622b3316b3780fbb4052 SHA512 439fbf8d0e77fbe1d5a9fb100e655a7e47a82382ce8e1a4e942541a4dfbdff3391caa635e8d354d0e87c10ae79cb97aa6d24915f9f193620d763b384baf2e753
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4.ebuild
new file mode 100644
index 0000000000..deaefc5a34
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic systemd
+if [[ ${PV} == 9999 ]] ; then
+	ESVN_REPO_URI="https://svn.code.sf.net/p/smartmontools/code/trunk/smartmontools"
+	ESVN_PROJECT="smartmontools"
+	inherit autotools subversion
+else
+	SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+fi
+
+DESCRIPTION="Tools to monitor storage systems to provide advanced warning of disk degradation"
+HOMEPAGE="https://www.smartmontools.org"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="caps +daemon selinux static systemd +update-drivedb"
+
+DEPEND="
+	caps? (
+		static? ( sys-libs/libcap-ng:=[static-libs] )
+		!static? ( sys-libs/libcap-ng:= )
+	)
+	selinux? (
+		sys-libs/libselinux:=
+	)
+"
+RDEPEND="
+	${DEPEND}
+	daemon? ( virtual/mailx )
+	selinux? ( sec-policy/selinux-smartmon )
+	systemd? ( sys-apps/systemd )
+	update-drivedb? (
+		app-crypt/gnupg
+		|| (
+			net-misc/curl
+			net-misc/wget
+			www-client/lynx
+			dev-vcs/subversion
+		)
+	)
+"
+
+REQUIRED_USE="(
+	caps? ( daemon )
+	static? ( !systemd )
+)"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	use static && append-ldflags -static
+	# The build installs /etc/init.d/smartd, but we clobber it
+	# in our src_install, so no need to manually delete it.
+	myeconfargs=(
+		--with-drivedbdir="${EPREFIX}/var/db/${PN}" #575292
+		--with-initscriptdir="${EPREFIX}/etc/init.d"
+		#--with-smartdscriptdir="${EPREFIX}/usr/share/${PN}"
+		$(use_with caps libcap-ng)
+		$(use_with selinux)
+		$(use_with systemd libsystemd)
+		$(use_with update-drivedb gnupg)
+		$(use_with update-drivedb update-smart-drivedb)
+		$(usex systemd "--with-systemdsystemunitdir=$(systemd_get_systemunitdir)" '')
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	local db_path="/var/db/${PN}"
+	insopts -m0644 -p # preserve timestamps
+
+	if use daemon; then
+		default
+
+		newinitd "${FILESDIR}"/smartd-r1.rc smartd
+		newconfd "${FILESDIR}"/smartd.confd smartd
+	else
+		dosbin smartctl
+		doman smartctl.8
+
+		local DOCS=( AUTHORS ChangeL* COPYING INSTALL NEWS README TODO )
+		einstalldocs
+	fi
+
+	if use update-drivedb ; then
+		if ! use daemon; then
+			dosbin "${S}"/update-smart-drivedb
+		fi
+
+		exeinto /etc/cron.monthly
+		doexe "${FILESDIR}/${PN}-update-drivedb"
+	fi
+
+	if use daemon || use update-drivedb; then
+		keepdir "${db_path}"
+
+		# Install a copy of the initial drivedb.h to /usr/share/${PN}
+		# so that we can access that file later in pkg_postinst
+		# even when dealing with binary packages (bug #575292)
+		insinto /usr/share/${PN}
+		doins "${S}"/drivedb.h
+	fi
+
+	# Make sure we never install drivedb.h into the db location
+	# of the acutal image so we don't record hashes because user
+	# can modify that file
+	rm -f "${ED}${db_path}/drivedb.h" || die
+
+	# Bug #622072
+	find "${ED}"/usr/share/doc -type f -exec chmod a-x '{}' \; || die
+}
+
+pkg_postinst() {
+	if use daemon || use update-drivedb; then
+		local initial_db_file="${EROOT}/usr/share/${PN}/drivedb.h"
+		local db_path="${EROOT}/var/db/${PN}"
+
+		if [[ ! -f "${db_path}/drivedb.h" ]] ; then
+			# No initial database found
+			cp "${initial_db_file}" "${db_path}" || die
+			einfo "Default drive database which was shipped with this release of ${PN}"
+			einfo "has been installed to '${db_path}'."
+		else
+			ewarn "WARNING: There's already a drive database in '${db_path}'!"
+			ewarn "Because we cannot determine if this database is untouched"
+			ewarn "or was modified by the user you have to manually update the"
+			ewarn "drive database:"
+			ewarn ""
+			ewarn "a) Replace '${db_path}/drivedb.h' by the database shipped with this"
+			ewarn "   release which can be found in '${initial_db_file}', i.e."
+			ewarn ""
+			ewarn "     cp \"${initial_db_file}\" \"${db_path}\""
+			ewarn ""
+			ewarn "b) Run the following command as root:"
+			ewarn ""
+			ewarn "     /usr/sbin/update-smart-drivedb"
+
+			if ! use update-drivedb ; then
+				ewarn ""
+				ewarn "However, 'update-smart-drivedb' requires that you re-emerge ${PN}"
+				ewarn "with USE='update-drivedb'."
+			fi
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-9999.ebuild
index 9772d62599..deaefc5a34 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-mount-no-statx.patch b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-mount-no-statx.patch
new file mode 100644
index 0000000000..02e8ef20c4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-mount-no-statx.patch
@@ -0,0 +1,34 @@
+https://github.com/util-linux/util-linux/issues/2409
+https://github.com/util-linux/util-linux/commit/91c2cbdf3a04f2f3f4c4bb0d2a6053874bfa11ea
+
+From 91c2cbdf3a04f2f3f4c4bb0d2a6053874bfa11ea Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
+Date: Thu, 3 Aug 2023 07:13:28 +0200
+Subject: [PATCH] libmount: (utils) fix statx fallback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If the systemcall is not available ENOSYS is returned.
+
+Under glibc the statx implementation also has its own fallback logic.
+As AT_STATX_DONT_SYNC can't be implemented correctly in that fallback
+logic the wrapper will return EINVAL in case the emulation is needed and
+AT_STATX_DONT_SYNC is set.
+So also use our own fallback in that case.
+
+Fixes: #2409
+Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
+--- a/libmount/src/utils.c
++++ b/libmount/src/utils.c
+@@ -133,7 +133,8 @@ static int safe_stat(const char *target, struct stat *st, int nofollow)
+ 			st->st_mode = stx.stx_mode;
+ 		}
+ 
+-		if (rc == 0 || errno != EOPNOTSUPP)
++		if (rc == 0 ||
++		    (errno != EOPNOTSUPP && errno != ENOSYS && errno != EINVAL))
+ 			return rc;
+ 	}
+ #endif
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-wall-no-tty.patch b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-wall-no-tty.patch
new file mode 100644
index 0000000000..e95dbc358d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/files/util-linux-2.39.1-wall-no-tty.patch
@@ -0,0 +1,26 @@
+https://bugs.gentoo.org/911336
+https://github.com/util-linux/util-linux/pull/2412
+
+From 7d3713a6d541be0bac0bb78cc8fea1620583fd08 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sat, 29 Jul 2023 17:32:57 -0400
+Subject: [PATCH] wall: do not error for ttys that do not exist
+
+Some wayland display managers (GDM) put strings like "seat0" in the
+ut_line field of utmp entries. These are not valid tty devices.
+
+Avoid writing a confusing error message for ttys that do not exist.
+
+Bug: https://bugs.gentoo.org/911336
+Signed-off-by: Mike Gilbert <floppym@gentoo.org>
+--- a/term-utils/ttymsg.c
++++ b/term-utils/ttymsg.c
+@@ -100,7 +100,7 @@ ttymsg(struct iovec *iov, size_t iovcnt, char *line, int tmout) {
+ 	 * if not running as root; not an error.
+ 	 */
+ 	if ((fd = open(device, O_WRONLY|O_NONBLOCK, 0)) < 0) {
+-		if (errno == EBUSY || errno == EACCES)
++		if (errno == EBUSY || errno == EACCES || errno == ENOENT)
+ 			return NULL;
+ 
+ 		len = snprintf(errbuf, sizeof(errbuf), "%s: %m", device);
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.1-r1.ebuild
new file mode 100644
index 0000000000..f3add5efd6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.1-r1.ebuild
@@ -0,0 +1,402 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+
+inherit toolchain-funcs libtool flag-o-matic bash-completion-r1 usr-ldscript \
+	pam python-r1 multilib-minimal multiprocessing systemd
+
+MY_PV="${PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/karelzak.asc
+	inherit verify-sig
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+	fi
+
+	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.sign )"
+fi
+
+S="${WORKDIR}/${MY_P}"
+
+DESCRIPTION="Various useful Linux utilities"
+HOMEPAGE="https://www.kernel.org/pub/linux/utils/util-linux/ https://github.com/util-linux/util-linux"
+
+LICENSE="GPL-2 GPL-3 LGPL-2.1 BSD-4 MIT public-domain"
+SLOT="0"
+IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode"
+
+# Most lib deps here are related to programs rather than our libs,
+# so we rarely need to specify ${MULTILIB_USEDEP}.
+RDEPEND="
+	virtual/libcrypt:=
+	audit? ( >=sys-process/audit-2.6:= )
+	caps? ( sys-libs/libcap-ng )
+	cramfs? ( sys-libs/zlib:= )
+	cryptsetup? ( >=sys-fs/cryptsetup-2.1.0 )
+	hardlink? ( dev-libs/libpcre2:= )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)?]
+		magic? ( sys-apps/file:0= )
+	)
+	nls? ( virtual/libintl[${MULTILIB_USEDEP}] )
+	pam? ( sys-libs/pam )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	rtas? ( sys-libs/librtas )
+	selinux? ( >=sys-libs/libselinux-2.2.2-r4[${MULTILIB_USEDEP}] )
+	slang? ( sys-libs/slang )
+	!build? ( systemd? ( sys-apps/systemd ) )
+	udev? ( virtual/libudev:= )"
+BDEPEND="
+	virtual/pkgconfig
+	nls? (
+		app-text/po4a
+		sys-devel/gettext
+	)
+	test? ( sys-devel/bc )
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+	acct-group/root
+"
+RDEPEND+="
+	hardlink? ( !app-arch/hardlink )
+	logger? ( !>=app-admin/sysklogd-2.0[logger] )
+	kill? (
+		!sys-apps/coreutils[kill]
+		!sys-process/procps[kill]
+	)
+	su? (
+		!<sys-apps/shadow-4.7-r2
+		!>=sys-apps/shadow-4.7-r2[su]
+	)
+	!net-wireless/rfkill
+"
+
+if [[ ${PV} == 9999 ]] ; then
+	# Required for man-page generation
+	BDEPEND+=" dev-ruby/asciidoctor"
+else
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-karelzak-20230517 )"
+fi
+
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} ) su? ( pam )"
+RESTRICT="!test? ( test )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.39.1-mount-no-statx.patch
+	"${FILESDIR}"/${PN}-2.39.1-wall-no-tty.patch
+)
+
+pkg_pretend() {
+	if use su && ! use suid ; then
+		elog "su will be installed as suid despite USE=-suid (bug #832092)"
+		elog "To use su without suid, see e.g. Portage's suidctl feature."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	if use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
+		xz -d ${MY_P}.tar.xz || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	if use test ; then
+		# Prevent uuidd test failure due to socket path limit, bug #593304
+		sed -i \
+			-e "s|UUIDD_SOCKET=\"\$(mktemp -u \"\${TS_OUTDIR}/uuiddXXXXXXXXXXXXX\")\"|UUIDD_SOCKET=\"\$(mktemp -u \"${T}/uuiddXXXXXXXXXXXXX.sock\")\"|g" \
+			tests/ts/uuid/uuidd || die "Failed to fix uuidd test"
+
+		# Known-failing tests
+		# TODO: investigate these
+		local known_failing_tests=(
+			# Subtest 'options-maximum-size-8192' fails
+			hardlink/options
+
+			# Fails in sandbox
+			lsns/ioctl_ns
+
+			lsfd/mkfds-symlink
+			lsfd/mkfds-rw-character-device
+		)
+
+		local known_failing_test
+		for known_failing_test in "${known_failing_tests[@]}" ; do
+			einfo "Removing known-failing test: ${known_failing_test}"
+			rm tests/ts/${known_failing_test} || die
+		done
+
+	fi
+
+	if [[ ${PV} == 9999 ]] ; then
+		po/update-potfiles
+		eautoreconf
+	else
+		elibtoolize
+	fi
+}
+
+python_configure() {
+	local myeconfargs=(
+		"${commonargs[@]}"
+		--disable-all-programs
+		--disable-bash-completion
+		--without-systemdsystemunitdir
+		--with-python
+		--enable-libblkid
+		--enable-libmount
+		--enable-pylibmount
+	)
+
+	mkdir "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+	popd >/dev/null || die
+}
+
+multilib_src_configure() {
+	# The scanf test in a run-time test which fails while cross-compiling.
+	# Blindly assume a POSIX setup since we require libmount, and libmount
+	# itself fails when the scanf test fails. bug #531856
+	tc-is-cross-compiler && export scanf_cv_alloc_modifier=ms
+
+	# bug #485486
+	export ac_cv_header_security_pam_misc_h=$(multilib_native_usex pam)
+	# bug #545042
+	export ac_cv_header_security_pam_appl_h=$(multilib_native_usex pam)
+
+	# Undo bad ncurses handling by upstream. Fall back to pkg-config.
+	# bug #601530
+	export NCURSES6_CONFIG=false NCURSES5_CONFIG=false
+	export NCURSESW6_CONFIG=false NCURSESW5_CONFIG=false
+
+	# Avoid automagic dependency on ppc*
+	export ac_cv_lib_rtas_rtas_get_sysparm=$(usex rtas)
+
+	# configure args shared by python and non-python builds
+	local commonargs=(
+		--localstatedir="${EPREFIX}/var"
+		--runstatedir="${EPREFIX}/run"
+		--enable-fs-paths-extra="${EPREFIX}/usr/sbin:${EPREFIX}/bin:${EPREFIX}/usr/bin"
+
+		# Temporary workaround until ~2.39.2. 2.39.x introduced a big rewrite.
+		# https://github.com/util-linux/util-linux/issues/2287#issuecomment-1576640373
+		--disable-libmount-mountfd-support
+	)
+
+	local myeconfargs=(
+		"${commonargs[@]}"
+		--with-bashcompletiondir="$(get_bashcompdir)"
+		--without-python
+		$(multilib_native_use_enable suid makeinstall-chown)
+		$(multilib_native_use_enable suid makeinstall-setuid)
+		$(multilib_native_use_with readline)
+		$(multilib_native_use_with slang)
+		$(multilib_native_use_with systemd)
+		$(multilib_native_use_with udev)
+		$(multilib_native_usex ncurses "$(use_with magic libmagic)" '--without-libmagic')
+		$(multilib_native_usex ncurses "$(use_with unicode ncursesw)" '--without-ncursesw')
+		$(multilib_native_usex ncurses "$(use_with !unicode ncurses)" '--without-ncurses')
+		$(multilib_native_use_with audit)
+		$(tc-has-tls || echo --disable-tls)
+		$(use_enable nls)
+		$(use_enable nls poman)
+		$(use_enable unicode widechar)
+		$(use_enable static-libs static)
+		$(use_with ncurses tinfo)
+		$(use_with selinux)
+	)
+
+	if multilib_is_native_abi ; then
+		myeconfargs+=(
+			--disable-chfn-chsh
+			--disable-login
+			--disable-newgrp
+			--disable-nologin
+			--disable-pylibmount
+			--disable-raw
+			--disable-vipw
+			--enable-agetty
+			--enable-bash-completion
+			--enable-line
+			--enable-partx
+			--enable-rename
+			--enable-rfkill
+			--enable-schedutils
+			--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+			$(use_enable caps setpriv)
+			$(use_enable cramfs)
+			$(use_enable fdformat)
+			$(use_enable hardlink)
+			$(use_enable kill)
+			$(use_enable logger)
+			$(use_enable ncurses pg)
+			$(use_enable su)
+			$(use_enable tty-helpers mesg)
+			$(use_enable tty-helpers wall)
+			$(use_enable tty-helpers write)
+			$(use_with cryptsetup)
+		)
+		if [[ ${PV} == *9999 ]] ; then
+			myeconfargs+=( --enable-asciidoc )
+		else
+			# Upstream is shipping pre-generated man-pages for releases
+			myeconfargs+=( --disable-asciidoc )
+		fi
+	else
+		myeconfargs+=(
+			--disable-all-programs
+			--disable-asciidoc
+			--disable-bash-completion
+			--without-systemdsystemunitdir
+			--disable-poman
+
+			# build libraries
+			--enable-libuuid
+			--enable-libblkid
+			--enable-libsmartcols
+			--enable-libfdisk
+			--enable-libmount
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_configure
+	fi
+}
+
+src_configure() {
+	append-lfs-flags
+	multilib-minimal_src_configure
+}
+
+python_compile() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	emake all
+	popd >/dev/null || die
+}
+
+multilib_src_compile() {
+	emake all
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_compile
+	fi
+}
+
+python_test() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot"
+	popd >/dev/null || die
+}
+
+multilib_src_test() {
+	emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot"
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_test
+	fi
+}
+
+python_install() {
+	pushd "${BUILD_DIR}" >/dev/null || die
+	emake DESTDIR="${D}" install
+	python_optimize
+	popd >/dev/null || die
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl python_install
+	fi
+
+	# This needs to be called AFTER python_install call, bug #689190
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi ; then
+		# Need the libs in /
+		gen_usr_ldscript -a blkid fdisk mount smartcols uuid
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc AUTHORS NEWS README* Documentation/{TODO,*.txt,releases/*}
+
+	# e2fsprogs-libs didn't install .la files, and .pc work fine
+	find "${ED}" -name "*.la" -delete || die
+
+	if use pam ; then
+		# See https://github.com/util-linux/util-linux/blob/master/Documentation/PAM-configuration.txt
+		newpamd "${FILESDIR}/runuser.pamd" runuser
+		newpamd "${FILESDIR}/runuser-l.pamd" runuser-l
+
+		newpamd "${FILESDIR}/su-l.pamd" su-l
+	fi
+
+	if use su && ! use suid ; then
+		# Always force suid su, even when USE=-suid, as su is useless
+		# for the overwhelming-majority case without suid.
+		# Users who wish to truly have a no-suid su can strip it out
+		# via e.g. Portage's suidctl or some other hook.
+		# See bug #832092
+		fperms u+s /bin/su
+	fi
+
+	# Note:
+	# Bash completion for "runuser" command is provided by same file which
+	# would also provide bash completion for "su" command. However, we don't
+	# use "su" command from this package.
+	# This triggers a known QA warning which we ignore for now to magically
+	# keep bash completion for "su" command which shadow package does not
+	# provide.
+
+	local ver=$(tools/git-version-gen .tarballversion)
+	local major=$(ver_cut 1 ${ver})
+	local minor=$(ver_cut 2 ${ver})
+	local release=$(ver_cut 3 ${ver})
+	export QA_PKGCONFIG_VERSION="${major}.${minor}.${release:-0}"
+}
+
+pkg_postinst() {
+	if ! use tty-helpers ; then
+		elog "The mesg/wall/write tools have been disabled due to USE=-tty-helpers."
+	fi
+
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog "The agetty util now clears the terminal by default. You"
+		elog "might want to add --noclear to your /etc/inittab lines."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.69-r9.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.69-r9.ebuild
index 3d9b70554f..7b16150352 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.69-r9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.69-r9.ebuild
@@ -10,7 +10,7 @@ else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
 		ftp://alpha.gnu.org/pub/gnu/${PN}/${P}.tar.xz
 		https://dev.gentoo.org/~polynomial-c/dist/${P}-runstatedir_patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 inherit toolchain-autoconf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.71-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.71-r7.ebuild
new file mode 100644
index 0000000000..db7dca39d2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/autoconf-2.71-r7.ebuild
@@ -0,0 +1,90 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/autoconf.git"
+	inherit git-r3
+else
+	# For _beta handling replace with real version number
+	MY_PV="${PV}"
+	MY_P="${PN}-${MY_PV}"
+	#PATCH_TARBALL_NAME="${PN}-2.70-patches-01"
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.xz
+		https://alpha.gnu.org/pub/gnu/${PN}/${MY_P}.tar.xz"
+	#SRC_URI+=" https://dev.gentoo.org/~polynomial-c/${PATCH_TARBALL_NAME}.tar.xz"
+
+	if ! [[ ${PV} == *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain-autoconf
+
+DESCRIPTION="Used to create autoconfiguration files"
+HOMEPAGE="https://www.gnu.org/software/autoconf/autoconf.html"
+
+LICENSE="GPL-3+"
+SLOT="${PV/_*}"
+IUSE="emacs"
+
+# for 2.71, our Perl time resolution patch changes our min Perl from 5.6
+# (vanilla upstream for 2.71) to 5.8.
+BDEPEND=">=sys-devel/m4-1.4.16
+	>=dev-lang/perl-5.8"
+RDEPEND="${BDEPEND}
+	>=sys-devel/autoconf-wrapper-15
+	sys-devel/gnuconfig
+	!~sys-devel/${P}:2.5"
+[[ ${PV} == 9999 ]] && BDEPEND+=" >=sys-apps/texinfo-4.3"
+PDEPEND="emacs? ( app-emacs/autoconf-mode )"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-AC_LANG_CALL_C_cxx.patch
+	"${FILESDIR}"/${P}-time.patch
+	"${FILESDIR}"/${P}-AC_C_BIGENDIAN-lto.patch
+	"${FILESDIR}"/${P}-K-R-decls-clang.patch
+	"${FILESDIR}"/${P}-make-4.4.patch
+	"${FILESDIR}"/${P}-K-R-decls-clang-deux.patch
+	"${FILESDIR}"/${P}-cxx11typo.patch
+	"${FILESDIR}"/${P}-bash52.patch
+)
+
+src_prepare() {
+	# usr/bin/libtool is provided by binutils-apple, need gnu libtool
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		PATCHES+=( "${FILESDIR}"/${PN}-2.71-darwin.patch )
+	fi
+
+	# Save timestamp to avoid later makeinfo call
+	touch -r doc/{,old_}autoconf.texi || die
+
+	local pdir
+	for pdir in "${WORKDIR}"/{upstream_,}patches ; do
+		if [[ -d "${pdir}" ]] ; then
+			eapply ${pdir}
+		fi
+	done
+
+	toolchain-autoconf_src_prepare
+
+	# Restore timestamp to avoid makeinfo call
+	# We already have an up to date autoconf.info page at this point.
+	touch -r doc/{old_,}autoconf.texi || die
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	toolchain-autoconf_src_install
+
+	local f
+	for f in config.{guess,sub} ; do
+		ln -fs ../../gnuconfig/${f} \
+			"${ED}"/usr/share/autoconf-*/build-aux/${f} || die
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-bash52.patch b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-bash52.patch
new file mode 100644
index 0000000000..1c3c91db1d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-bash52.patch
@@ -0,0 +1,65 @@
+From 412166e185c00d6eacbe67dfcb0326f622ec4020 Mon Sep 17 00:00:00 2001
+From: Xi Ruoyao <xry111@xry111.site>
+Date: Fri, 30 Sep 2022 11:36:03 -0400
+Subject: [PATCH] Fix testsuite failures with bash 5.2.
+
+Bash v5.2 includes several new optimizations to the number of
+subshells used for various constructs; as a side effect, the value of
+SHLVL is less stable than it used to be.  Add SHLVL to the list of
+built-in shell variables with unstable values, to be ignored when
+checking for inappropriate differences to the shell environment
+before and after a macro invocation / between two configure runs.
+
+Problem and solution reported by Xi Ruoyao in
+https://lists.gnu.org/archive/html/autoconf/2022-09/msg00015.html
+Problem also reported by Bruce Dubbs in
+https://lists.gnu.org/archive/html/bug-autoconf/2022-09/msg00010.html
+
+* tests/local.at (_AT_CHECK_ENV, AT_CONFIG_CMP): Ignore changes in
+  value of SHLVL.
+Copyright-paperwork-exempt: yes
+---
+ tests/local.at | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/local.at b/tests/local.at
+index 193fd118..a9cf4050 100644
+--- a/tests/local.at
++++ b/tests/local.at
+@@ -352,7 +352,7 @@ m4_define([AT_CHECK_CONFIGURE],
+ # - AC_SUBST'ed variables
+ #   (FIXME: Generate a list of these automatically.)
+ # - _|@|.[*#?$].|argv|ARGC|LINENO|OLDPWD|PIPESTATUS|RANDOM|SECONDS
+-#   |START_TIME|ToD|_AST_FEATURES
++#   |SHLVL|START_TIME|ToD|_AST_FEATURES
+ #   Some variables some shells use and change.
+ #   '.[*#?$].' catches '$#' etc. which are displayed like this:
+ #      | '!'=18186
+@@ -404,7 +404,7 @@ if test -f state-env.before && test -f state-env.after; then
+       [GREP|[EF]GREP|SED],
+       [[_@]|.[*@%:@?$].],
+       [argv|ARGC|LINENO|BASH_ARGC|BASH_ARGV|OLDPWD|PIPESTATUS|RANDOM],
+-      [SECONDS|START_TIME|ToD|_AST_FEATURES]))=' \
++      [SECONDS|SHLVL|START_TIME|ToD|_AST_FEATURES]))=' \
+      $act_file ||
+        test $? -eq 1 || echo failed >&2
+     ) 2>stderr-$act_file |
+@@ -435,6 +435,7 @@ fi
+ #   - PPID [bash, zsh]
+ #   - RANDOM [bash, zsh]
+ #   - SECONDS [bash, zsh]
++#   - SHLVL [bash]
+ #   - START_TIME [NetBSD sh]
+ #   - ToD [NetBSD sh]
+ #   - '$' [zsh]
+@@ -483,6 +484,7 @@ do
+ 	/^PPID=/ d
+ 	/^RANDOM=/ d
+ 	/^SECONDS=/ d
++	/^SHLVL=/ d
+ 	/^START_TIME=/ d
+ 	/^ToD=/ d
+ 	/'\'\\\$\''=/ d
+-- 
+2.39.3
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-cxx11typo.patch b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-cxx11typo.patch
new file mode 100644
index 0000000000..ed3f68ea2b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/autoconf/files/autoconf-2.71-cxx11typo.patch
@@ -0,0 +1,31 @@
+From f460883035ef849a2248b1713f711292ec19f4f0 Mon Sep 17 00:00:00 2001
+From: Emanuele Giaquinta <emanuele.giaquinta@gmail.com>
+Date: Fri, 14 May 2021 09:06:20 +0300
+Subject: [PATCH] _AC_PROG_CXX_STDCXX_EDITION_TRY: fix typo in variable name
+
+The typo causes "ac_prog_cxx_stdcxx" to be always set to "cxx11",
+regardless of whether the C++ compiler supports C++11.
+Message-Id: <YJ4TXAeJcvU0oSec@FSAPPLE2215.fi.f-secure.com>
+(tiny change)
+---
+ lib/autoconf/c.m4 | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/autoconf/c.m4 b/lib/autoconf/c.m4
+index 9f881f0b..47434c89 100644
+--- a/lib/autoconf/c.m4
++++ b/lib/autoconf/c.m4
+@@ -2749,8 +2749,8 @@ AC_DEFUN([_AC_PROG_CXX_STDCXX_EDITION_TRY],
+ [AC_REQUIRE([_AC_CXX_CXX$1_TEST_PROGRAM])]dnl
+ [AS_IF([test x$ac_prog_cxx_stdcxx = xno],
+ [AC_MSG_CHECKING([for $CXX option to enable C++$1 features])
+-AC_CACHE_VAL(ac_cv_prog_cxx_$1,
+-[ac_cv_prog_cxx_$1=no
++AC_CACHE_VAL(ac_cv_prog_cxx_cxx$1,
++[ac_cv_prog_cxx_cxx$1=no
+ ac_save_CXX=$CXX
+ AC_LANG_CONFTEST([AC_LANG_DEFINES_PROVIDED][$][ac_cxx_conftest_cxx$1_program])
+ for ac_arg in '' m4_normalize(m4_defn([_AC_CXX_CXX$1_OPTIONS]))
+-- 
+2.39.3
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/automake/automake-1.16.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/automake/automake-1.16.5-r1.ebuild
index e205633a7d..34c52da4c2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/automake/automake-1.16.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/automake/automake-1.16.5-r1.ebuild
@@ -15,7 +15,7 @@ else
 		MY_P="${P}"
 		SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
 			https://alpha.gnu.org/pub/gnu/${PN}/${MY_P}.tar.xz"
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	else
 		MY_PV="$(ver_cut 1).$(($(ver_cut 2)-1))b"
 		MY_P="${PN}-${MY_PV}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index 524992f61b..0d40f65ef6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -15,4 +15,9 @@ DIST binutils-2.38.tar.xz 23651408 BLAKE2B 19ede396ec97b88e632aded2f69f4684cc505
 DIST binutils-2.39-patches-6.tar.xz 92380 BLAKE2B 39f490f1134fb0e7dc80924a280d3113efe0ed094ee15de97c42ab751c83d2f5aa7448966d8cbbcde722b2af4999a36c1e5aa2f37ca6d2e3942b97b6d90ff152 SHA512 213cd7a86da83987966675f3195e843d898ca4ff412dfc29fd33ed80adb7bbf80a0b2919cd8e7dd49208c73a621ab7b720970f2259418bdc82ed2a568ff62064
 DIST binutils-2.39.tar.xz 25167756 BLAKE2B ac6a5296c6586d53eaadcbffc5c399a6d79edf72450b9bb8b3525ce525129cef3d2eb90c85ef3bb3270b5a03b0e1ffb8f0b705f028158726f9777ebb8685066f SHA512 68e038f339a8c21faa19a57bbc447a51c817f47c2e06d740847c6e9cc3396c025d35d5369fa8c3f8b70414757c89f0e577939ddc0d70f283182504920f53b0a3
 DIST binutils-2.40-patches-5.tar.xz 293628 BLAKE2B b7ed1d1fbf38b420661f984b9519b3d863da45b2a873773a521310021b0c1d5d7c24c152adb3e8a999d40f5619c0e54962114590ec9528380089977af0c30b74 SHA512 6e6df932b18ca20fe245b3ff8d3d06dbdae4daadaec3b668fa44e086d4e8ff56439681b2d810ebc74173b6348020edacb176e8c3cbf20657cce04297b97f4f83
+DIST binutils-2.40-patches-6.tar.xz 299212 BLAKE2B 3a68a924e9747fdd0486327a5bd2490cb72376f2cb6c6a60030d8c6b71357150d956a1e71d91683d43b571cb5bf738270880f72ef175d6c8faa257b090abeb8b SHA512 984dab529276ab4f9d215f643c7c18bd1793f438aaad0be158d209787c9c4a6bb68b10bec2065d3fe14a1594d5f1c29f55b2e9bac34a6f489f4b466c02e24766
+DIST binutils-2.40-patches-7.tar.xz 299188 BLAKE2B 170cd2432e0458889b240c3603461d0b4bfa62d5314634b101a629db455d87235ac14ad44c63920b713d5235fa8b73902960df1019153873ef06a33aa7050b4b SHA512 a60da163caee68fe1fa355385d404e8998ebed0e390d50e0713e95334733a8b4e37bc63d522817284c027953e43848dbc98042461a47131fb53bc69203b4ee87
 DIST binutils-2.40.tar.xz 25241484 BLAKE2B 8d799f7c595f878b9af5b17a490021dd8b8300ac2fe0ed8574c012929d22d2d0493e003a3e631a9436e8e712da801779b777c566167fe42b0bde119ffa5ad1c2 SHA512 a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925
+DIST binutils-2.41-patches-1.tar.xz 13260 BLAKE2B b7431ec92d5ce0e5d4438b31ca356c8d5366bee9aa8ff2f098a77c2add5b7539f733d0a18988337490af34c9192affbb6ccdf56b97413a8dca3192fb2125b313 SHA512 30548e4f3187444dbfa82587b5b8a0d2ab9d536aa06a572393a195649759149124d79c488c07919850c7ed4940481b852462d5a1aa52ed9162d81d6d3b290377
+DIST binutils-2.41-patches-2.tar.xz 20288 BLAKE2B 1cc29e868ded12845856c5da567f23798fe3017961ce079325c20f456b837cab11560d896065f70953b0bab55bf565288541579e9c3e0991a87083edf2a85fa5 SHA512 75619a5e17b75d72f9bdd9d5e5ee3b566c94de64410bfc074f1a9bfb9f08db9ecf8be216efa1053263468aa8ec99b8aa3b2b095e63cb95f3566500ac0c3b9432
+DIST binutils-2.41.tar.xz 26765692 BLAKE2B 3bccec2b52f7e82a727121bf2a2e51a6249ba63dcd74c665fd834e858645c912ffd8245d848435288b938852830b482905606f55c40df4061215fd75c52ffc75 SHA512 5df45d0bd6ddabdce4f35878c041e46a92deef01e7dea5facc97fd65cc06b59abc6fba0eb454b68e571c7e14038dc823fe7f2263843e6e627b7444eaf0fe9374
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
index 010b2316c2..008e30a673 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
@@ -32,7 +32,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86"
 fi
 
 #
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r6.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r6.ebuild
new file mode 100644
index 0000000000..ff5ebb262f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r6.ebuild
@@ -0,0 +1,504 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=5
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	SLOT=${PV}
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	test? (
+		dev-util/dejagnu
+		sys-devel/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	sys-devel/flex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999* ]] ; then
+		patchsetname="from git master"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Fix locale issues if possible, bug #122216
+	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
+		einfo "Fixing misc issues in configure files"
+		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
+			ebegin "  Updating ${f/${S}\/}"
+			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
+				|| eerror "Please file a bug about this"
+			eend $?
+		done
+	fi
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+	# enable gold (installed as ld.gold) and ld's plugin architecture
+	if use gold ; then
+		myconf+=( --enable-gold )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.27) offer a configure flag now.
+		--enable-relro
+		# Newer versions (>=2.24) make this an explicit option, bug #497268
+		--enable-install-libiberty
+		# Available from 2.35 on
+		--enable-textrel-check=warning
+
+		# These hardening options are available from 2.39+ but
+		# they unconditionally enable the behaviour even on arches
+		# where e.g. execstacks can't be avoided.
+		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+		#--enable-warn-execstack
+		#--enable-warn-rwx-segments
+		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
+
+		# Things to think about
+		#--enable-deterministic-archives
+
+		# Works better than vapier's patch, bug #808787
+		--enable-new-dtags
+
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across
+		# {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+	)
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build lto) )
+
+		if use pgo ; then
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake V=1 info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	# bug #637066
+	filter-flags -Wall -Wreturn-type
+
+	emake -k V=1 check
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV}
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET}
+		else
+			binutils-config ${choice}
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV}
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r7.ebuild
new file mode 100644
index 0000000000..bad301c3d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r7.ebuild
@@ -0,0 +1,504 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=6
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	SLOT=${PV}
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	test? (
+		dev-util/dejagnu
+		sys-devel/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	sys-devel/flex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999* ]] ; then
+		patchsetname="from git master"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Fix locale issues if possible, bug #122216
+	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
+		einfo "Fixing misc issues in configure files"
+		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
+			ebegin "  Updating ${f/${S}\/}"
+			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
+				|| eerror "Please file a bug about this"
+			eend $?
+		done
+	fi
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+	# enable gold (installed as ld.gold) and ld's plugin architecture
+	if use gold ; then
+		myconf+=( --enable-gold )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.27) offer a configure flag now.
+		--enable-relro
+		# Newer versions (>=2.24) make this an explicit option, bug #497268
+		--enable-install-libiberty
+		# Available from 2.35 on
+		--enable-textrel-check=warning
+
+		# These hardening options are available from 2.39+ but
+		# they unconditionally enable the behaviour even on arches
+		# where e.g. execstacks can't be avoided.
+		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+		#--enable-warn-execstack
+		#--enable-warn-rwx-segments
+		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
+
+		# Things to think about
+		#--enable-deterministic-archives
+
+		# Works better than vapier's patch, bug #808787
+		--enable-new-dtags
+
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across
+		# {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+	)
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build lto) )
+
+		if use pgo ; then
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake V=1 info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	# bug #637066
+	filter-flags -Wall -Wreturn-type
+
+	emake -k V=1 check
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV}
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET}
+		else
+			binutils-config ${choice}
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV}
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r8.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r8.ebuild
new file mode 100644
index 0000000000..2f1a4e09d8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r8.ebuild
@@ -0,0 +1,504 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=7
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	SLOT=${PV}
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	test? (
+		dev-util/dejagnu
+		sys-devel/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	sys-devel/flex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999* ]] ; then
+		patchsetname="from git master"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Fix locale issues if possible, bug #122216
+	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
+		einfo "Fixing misc issues in configure files"
+		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
+			ebegin "  Updating ${f/${S}\/}"
+			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
+				|| eerror "Please file a bug about this"
+			eend $?
+		done
+	fi
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+	# enable gold (installed as ld.gold) and ld's plugin architecture
+	if use gold ; then
+		myconf+=( --enable-gold )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.27) offer a configure flag now.
+		--enable-relro
+		# Newer versions (>=2.24) make this an explicit option, bug #497268
+		--enable-install-libiberty
+		# Available from 2.35 on
+		--enable-textrel-check=warning
+
+		# These hardening options are available from 2.39+ but
+		# they unconditionally enable the behaviour even on arches
+		# where e.g. execstacks can't be avoided.
+		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+		#--enable-warn-execstack
+		#--enable-warn-rwx-segments
+		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
+
+		# Things to think about
+		#--enable-deterministic-archives
+
+		# Works better than vapier's patch, bug #808787
+		--enable-new-dtags
+
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across
+		# {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+	)
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build lto) )
+
+		if use pgo ; then
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake V=1 info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	# bug #637066
+	filter-flags -Wall -Wreturn-type
+
+	emake -k V=1 check
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV}
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET}
+		else
+			binutils-config ${choice}
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV}
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r1.ebuild
new file mode 100644
index 0000000000..eec1ecb1e0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r1.ebuild
@@ -0,0 +1,527 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=2
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	SLOT=${PV}
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	test? (
+		dev-util/dejagnu
+		sys-devel/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	sys-devel/flex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999* ]] ; then
+		patchsetname="from git master"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Fix locale issues if possible, bug #122216
+	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
+		einfo "Fixing misc issues in configure files"
+		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
+			ebegin "  Updating ${f/${S}\/}"
+			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
+				|| eerror "Please file a bug about this"
+			eend $?
+		done
+	fi
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+	# enable gold (installed as ld.gold) and ld's plugin architecture
+	if use gold ; then
+		myconf+=( --enable-gold )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		--enable-relro
+		--enable-install-libiberty
+		--enable-textrel-check=$(usex hardened error warning)
+		# Things to think about
+		#--enable-deterministic-archives
+		--enable-new-dtags
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+	)
+
+	case ${CTARGET} in
+		x86_64-*|aarch64*|arm64*|i[3456]*)
+			# These hardening options are available from 2.39+ but
+			# they unconditionally enable the behaviour even on arches
+			# where e.g. execstacks can't be avoided.
+			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			#
+			# TODO: Get the logic for this fixed upstream so it doesn't
+			# create impossible broken combinations on some arches, like mips.
+			#
+			# TODO: Get the logic for this fixed upstream so --disable-* works
+			# as expected.
+			myconf+=(
+				--enable-warn-execstack=yes
+				--enable-warn-rwx-segments=yes
+			)
+
+			if use hardened ; then
+				myconf+=(
+					--enable-default-execstack=no
+				)
+			fi
+			;;
+		*)
+			;;
+	esac
+
+	if use elibc_musl ; then
+		# Override our earlier setting for musl, as textrels don't
+		# work there at all. See bug #707660.
+		myconf+=(
+			--enable-textrel-check=error
+		)
+	fi
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build lto) )
+
+		if use pgo ; then
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake tooldir="${EPREFIX}${TOOLPATH}" all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	# bug #637066
+	filter-flags -Wall -Wreturn-type
+
+	emake -k check
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV}
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET}
+		else
+			binutils-config ${choice}
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV}
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41.ebuild
new file mode 100644
index 0000000000..d2afce01c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41.ebuild
@@ -0,0 +1,527 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
+
+DESCRIPTION="Tools necessary to build programs"
+HOMEPAGE="https://sourceware.org/binutils/"
+
+LICENSE="GPL-3+"
+IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
+
+# Variables that can be set here  (ignored for live ebuilds)
+# PATCH_VER          - the patchset version
+#                      Default: empty, no patching
+# PATCH_BINUTILS_VER - the binutils version in the patchset name
+#                    - Default: PV
+# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
+#                      for the patchsets
+
+PATCH_VER=1
+PATCH_DEV=dilfridge
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	SLOT=${PV}
+else
+	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+	PATCH_DEV=${PATCH_DEV:-dilfridge}
+	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://sourceware.org/pub/binutils/releases/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
+	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
+		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+	SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+#
+# The cross-compile logic
+#
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+#
+# The dependencies
+#
+RDEPEND="
+	>=sys-devel/binutils-config-3
+	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( sys-apps/texinfo )
+	test? (
+		dev-util/dejagnu
+		sys-devel/bc
+	)
+	nls? ( sys-devel/gettext )
+	zstd? ( virtual/pkgconfig )
+	sys-devel/flex
+	app-alternatives/yacc
+"
+
+RESTRICT="!test? ( test )"
+
+MY_BUILDDIR=${WORKDIR}/build
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]] ; then
+		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
+		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
+		git-r3_src_unpack
+		mv patches-git/9999 patch || die
+
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		S=${WORKDIR}/binutils
+		EGIT_CHECKOUT_DIR=${S}
+		git-r3_src_unpack
+	else
+		unpack ${P/-hppa64/}.tar.xz
+
+		cd "${WORKDIR}" || die
+		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
+
+		# _p patch versions are Gentoo specific tarballs ...
+		local dir=${P%_p?}
+		dir=${dir/-hppa64/}
+
+		S=${WORKDIR}/${dir}
+	fi
+
+	cd "${WORKDIR}" || die
+	mkdir -p "${MY_BUILDDIR}" || die
+}
+
+src_prepare() {
+	local patchsetname
+	if [[ ${PV} == 9999* ]] ; then
+		patchsetname="from git master"
+	else
+		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
+	fi
+
+	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
+		if ! use vanilla; then
+			einfo "Applying binutils patchset ${patchsetname}"
+			eapply "${WORKDIR}/patch"
+			einfo "Done."
+
+			# This is applied conditionally for now just out of caution.
+			# It should be okay on non-prefix systems though. See bug #892549.
+			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+		fi
+	fi
+
+	# Make sure our explicit libdir paths don't get clobbered, bug #562460
+	sed -i \
+		-e 's:@bfdlibdir@:@libdir@:g' \
+		-e 's:@bfdincludedir@:@includedir@:g' \
+		{bfd,opcodes}/Makefile.in || die
+
+	# Fix locale issues if possible, bug #122216
+	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
+		einfo "Fixing misc issues in configure files"
+		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
+			ebegin "  Updating ${f/${S}\/}"
+			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
+				|| eerror "Please file a bug about this"
+			eend $?
+		done
+	fi
+
+	# Apply things from PATCHES and user dirs
+	default
+
+	# Run misc portage update scripts
+	gnuconfig_update
+	elibtoolize --portage --no-uclibc
+}
+
+toolchain-binutils_bugurl() {
+	printf "https://bugs.gentoo.org/"
+}
+toolchain-binutils_pkgversion() {
+	printf "Gentoo ${PV}"
+	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
+}
+
+src_configure() {
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	# Setup some paths
+	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
+	INCPATH=${LIBPATH}/include
+	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
+	if is_cross ; then
+		TOOLPATH=/usr/${CHOST}/${CTARGET}
+	else
+		TOOLPATH=/usr/${CTARGET}
+	fi
+	BINPATH=${TOOLPATH}/binutils-bin/${PV}
+
+	# Make sure we filter $LINGUAS so that only ones that
+	# actually work make it through, bug #42033
+	strip-linguas -u */po
+
+	# Keep things sane
+	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local x
+	echo
+	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
+		einfo "$(printf '%10s' ${x}:) ${!x}"
+	done
+	echo
+
+	cd "${MY_BUILDDIR}" || die
+	local myconf=()
+
+	if use plugins ; then
+		myconf+=( --enable-plugins )
+	fi
+	# enable gold (installed as ld.gold) and ld's plugin architecture
+	if use gold ; then
+		myconf+=( --enable-gold )
+	fi
+
+	if use nls ; then
+		myconf+=( --without-included-gettext )
+	else
+		myconf+=( --disable-nls )
+	fi
+
+	myconf+=( --with-system-zlib )
+
+	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
+	# logic in toolchain.eclass. bug #446946
+	#
+	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
+	case $(tc-arch) in
+		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
+	esac
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
+
+	is_cross && myconf+=(
+		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
+		--enable-poison-system-directories
+	)
+
+	myconf+=( --enable-secureplt )
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	myconf+=(
+		--prefix="${EPREFIX}"/usr
+		--host=${CHOST}
+		--target=${CTARGET}
+		--datadir="${EPREFIX}"${DATAPATH}
+		--datarootdir="${EPREFIX}"${DATAPATH}
+		--infodir="${EPREFIX}"${DATAPATH}/info
+		--mandir="${EPREFIX}"${DATAPATH}/man
+		--bindir="${EPREFIX}"${BINPATH}
+		--libdir="${EPREFIX}"${LIBPATH}
+		--libexecdir="${EPREFIX}"${LIBPATH}
+		--includedir="${EPREFIX}"${INCPATH}
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		--enable-relro
+		--enable-install-libiberty
+		--enable-textrel-check=$(usex hardened error warning)
+		# Things to think about
+		#--enable-deterministic-archives
+		--enable-new-dtags
+		--disable-jansson
+		--disable-werror
+		--with-bugurl="$(toolchain-binutils_bugurl)"
+		--with-pkgversion="$(toolchain-binutils_pkgversion)"
+		$(use_enable static-libs static)
+		$(use_with zstd)
+
+		# Disable modules that are in a combined binutils/gdb tree, bug #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
+
+		$(use_with debuginfod)
+
+		# Avoid automagic dev-libs/msgpack dep, bug #865875
+		--without-msgpack
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# We can enable this by default in future, but it's brand new
+		# in 2.39 with several bugs:
+		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
+		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
+		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
+		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
+		$(use_enable gprofng)
+	)
+
+	case ${CTARGET} in
+		x86_64-*|aarch64*|arm64*|i[3456]*)
+			# These hardening options are available from 2.39+ but
+			# they unconditionally enable the behaviour even on arches
+			# where e.g. execstacks can't be avoided.
+			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			#
+			# TODO: Get the logic for this fixed upstream so it doesn't
+			# create impossible broken combinations on some arches, like mips.
+			#
+			# TODO: Get the logic for this fixed upstream so --disable-* works
+			# as expected.
+			myconf+=(
+				--enable-warn-execstack=yes
+				--enable-warn-rwx-segments=yes
+			)
+
+			if use hardened ; then
+				myconf+=(
+					--enable-default-execstack=no
+				)
+			fi
+			;;
+		*)
+			;;
+	esac
+
+	if use elibc_musl ; then
+		# Override our earlier setting for musl, as textrels don't
+		# work there at all. See bug #707660.
+		myconf+=(
+			--enable-textrel-check=error
+		)
+	fi
+
+	if ! is_cross ; then
+		myconf+=( $(use_enable pgo pgo-build lto) )
+
+		if use pgo ; then
+			export BUILD_CFLAGS="${CFLAGS}"
+		fi
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running if doc is unset.
+	if ! use doc ; then
+		sed -i \
+			-e '/^MAKEINFO/s:=.*:= true:' \
+			Makefile || die
+	fi
+}
+
+src_compile() {
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake tooldir="${EPREFIX}${TOOLPATH}" all
+
+	# only build info pages if the user wants them
+	if use doc ; then
+		emake info
+	fi
+
+	# we nuke the manpages when we're left with junk
+	# (like when we bootstrap, no perl -> no manpages)
+	find . -name '*.1' -a -size 0 -delete
+}
+
+src_test() {
+	cd "${MY_BUILDDIR}" || die
+
+	# bug #637066
+	filter-flags -Wall -Wreturn-type
+
+	emake -k check
+}
+
+src_install() {
+	local x d
+
+	cd "${MY_BUILDDIR}" || die
+
+	# see Note [tooldir hack for ldscripts]
+	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	rm -rf "${ED}"/${LIBPATH}/bin || die
+	use static-libs || find "${ED}" -name '*.la' -delete
+
+	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
+	cd "${ED}"/${LIBPATH} || die
+	for d in ../* ; do
+		[[ ${d} == ../${PV} ]] && continue
+		mv ${d}/* . || die
+		rmdir ${d} || die
+	done
+
+	# Now we collect everything intp the proper SLOT-ed dirs
+	# When something is built to cross-compile, it installs into
+	# /usr/$CHOST/ by default ... we have to 'fix' that :)
+	if is_cross ; then
+		cd "${ED}"/${BINPATH} || die
+		for x in * ; do
+			mv ${x} ${x/${CTARGET}-} || die
+		done
+
+		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
+			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
+			rm -r "${ED}"/usr/${CHOST}/{include,lib}
+		fi
+	fi
+
+	insinto ${INCPATH}
+	local libiberty_headers=(
+		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
+		demangle.h
+		dyn-string.h
+		fibheap.h
+		hashtab.h
+		libiberty.h
+		objalloc.h
+		splay-tree.h
+	)
+	doins "${libiberty_headers[@]/#/${S}/include/}"
+	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
+		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
+		rm -r "${ED}"/${LIBPATH}/lib || die
+	fi
+
+	# Generate an env.d entry for this binutils
+	insinto /etc/env.d/binutils
+	cat <<-EOF > "${T}"/env.d
+		TARGET="${CTARGET}"
+		VER="${PV}"
+		LIBPATH="${EPREFIX}${LIBPATH}"
+	EOF
+	newins "${T}"/env.d ${CTARGET}-${PV}
+
+	# Handle documentation
+	if ! is_cross ; then
+		cd "${S}" || die
+		dodoc README
+
+		docinto bfd
+		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
+
+		docinto binutils
+		dodoc binutils/ChangeLog binutils/NEWS binutils/README
+
+		docinto gas
+		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
+
+		docinto gprof
+		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
+
+		docinto ld
+		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
+
+		docinto libiberty
+		dodoc libiberty/ChangeLog* libiberty/README
+
+		docinto opcodes
+		dodoc opcodes/ChangeLog*
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
+
+	# Trim all empty dirs
+	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
+}
+
+pkg_postinst() {
+	# Make sure this ${CTARGET} has a binutils version selected
+	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
+	binutils-config ${CTARGET}-${PV}
+}
+
+pkg_postrm() {
+	local current_profile=$(binutils-config -c ${CTARGET})
+
+	# If no other versions exist, then uninstall for this
+	# target ... otherwise, switch to the newest version
+	# Note: only do this if this version is unmerged.  We
+	#       rerun binutils-config if this is a remerge, as
+	#       we want the mtimes on the symlinks updated (if
+	#       it is the same as the current selected profile)
+	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
+		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
+		choice=${choice//$'\n'/ }
+		choice=${choice/* }
+		if [[ -z ${choice} ]] ; then
+			binutils-config -u ${CTARGET}
+		else
+			binutils-config ${choice}
+		fi
+	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
+		binutils-config ${CTARGET}-${PV}
+	fi
+}
+
+# Note [slotting support]
+# -----------------------
+# Gentoo's layout for binutils files is non-standard as Gentoo
+# supports slotted installation for binutils. Many tools
+# still expect binutils to reside in known locations.
+# binutils-config package restores symlinks into known locations,
+# like:
+#    /usr/bin/${CTARGET}-<tool>
+#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
+#    /usr/include/
+#
+# Note [tooldir hack for ldscripts]
+# ---------------------------------
+# Build system does not allow ./configure to tweak every location
+# we need for slotting binutils hence all the shuffling in
+# src_install(). This note is about SCRIPTDIR define handling.
+#
+# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
+# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
+# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
+# Thus we can't just move files around after compilation finished.
+#
+# Our goal is the following:
+# - at build-time set scriptdir to point to symlinked location:
+#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
+# - at install-time set scriptdir to point to slotted location:
+#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index d8c2553ece..11e84c53af 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -9,7 +9,7 @@ DESCRIPTION="Tools necessary to build programs"
 HOMEPAGE="https://sourceware.org/binutils/"
 
 LICENSE="GPL-3+"
-IUSE="cet doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla zstd"
+IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
 
 # Variables that can be set here  (ignored for live ebuilds)
 # PATCH_VER          - the patchset version
@@ -19,7 +19,7 @@ IUSE="cet doc gold gprofng multitarget +nls pgo +plugins static-libs test vanill
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=2
+PATCH_VER=1
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999* ]]; then
@@ -32,7 +32,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 #
@@ -52,6 +52,9 @@ is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
 RDEPEND="
 	>=sys-devel/binutils-config-3
 	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
 	zstd? ( app-arch/zstd:= )
 "
 DEPEND="${RDEPEND}"
@@ -247,30 +250,20 @@ src_configure() {
 		--libdir="${EPREFIX}"${LIBPATH}
 		--libexecdir="${EPREFIX}"${LIBPATH}
 		--includedir="${EPREFIX}"${INCPATH}
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
 		--enable-obsolete
 		--enable-shared
 		--enable-threads
-		# Newer versions (>=2.27) offer a configure flag now.
 		--enable-relro
-		# Newer versions (>=2.24) make this an explicit option, bug #497268
 		--enable-install-libiberty
-		# Available from 2.35 on
-		--enable-textrel-check=warning
-
-		# These hardening options are available from 2.39+ but
-		# they unconditionally enable the behaviour even on arches
-		# where e.g. execstacks can't be avoided.
-		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
-		#--enable-warn-execstack
-		#--enable-warn-rwx-segments
-		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
-
+		--enable-textrel-check=$(usex hardened error warning)
 		# Things to think about
 		#--enable-deterministic-archives
-
-		# Works better than vapier's patch, bug #808787
 		--enable-new-dtags
-
 		--disable-jansson
 		--disable-werror
 		--with-bugurl="$(toolchain-binutils_bugurl)"
@@ -280,16 +273,12 @@ src_configure() {
 
 		# Disable modules that are in a combined binutils/gdb tree, bug #490566
 		--disable-{gdb,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
+		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
 		--without-stage1-ldflags
-		# Change SONAME to avoid conflict across
-		# {native,cross}/binutils, binutils-libs. bug #666100
+		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
 		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
 
-		# Avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
+		$(use_with debuginfod)
 
 		# Avoid automagic dev-libs/msgpack dep, bug #865875
 		--without-msgpack
@@ -308,6 +297,41 @@ src_configure() {
 		$(use_enable gprofng)
 	)
 
+	case ${CTARGET} in
+		x86_64-*|aarch64*|arm64*|i[3456]*)
+			# These hardening options are available from 2.39+ but
+			# they unconditionally enable the behaviour even on arches
+			# where e.g. execstacks can't be avoided.
+			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			#
+			# TODO: Get the logic for this fixed upstream so it doesn't
+			# create impossible broken combinations on some arches, like mips.
+			#
+			# TODO: Get the logic for this fixed upstream so --disable-* works
+			# as expected.
+			myconf+=(
+				--enable-warn-execstack=yes
+				--enable-warn-rwx-segments=yes
+			)
+
+			if use hardened ; then
+				myconf+=(
+					--enable-default-execstack=no
+				)
+			fi
+			;;
+		*)
+			;;
+	esac
+
+	if use elibc_musl ; then
+		# Override our earlier setting for musl, as textrels don't
+		# work there at all. See bug #707660.
+		myconf+=(
+			--enable-textrel-check=error
+		)
+	fi
+
 	if ! is_cross ; then
 		myconf+=( $(use_enable pgo pgo-build lto) )
 
@@ -316,7 +340,7 @@ src_configure() {
 		fi
 	fi
 
-	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
 
 	# Prevent makeinfo from running if doc is unset.
 	if ! use doc ; then
@@ -330,11 +354,11 @@ src_compile() {
 	cd "${MY_BUILDDIR}" || die
 
 	# see Note [tooldir hack for ldscripts]
-	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
+	emake tooldir="${EPREFIX}${TOOLPATH}" all
 
 	# only build info pages if the user wants them
 	if use doc ; then
-		emake V=1 info
+		emake info
 	fi
 
 	# we nuke the manpages when we're left with junk
@@ -348,7 +372,7 @@ src_test() {
 	# bug #637066
 	filter-flags -Wall -Wreturn-type
 
-	emake -k V=1 check
+	emake -k check
 }
 
 src_install() {
@@ -357,7 +381,7 @@ src_install() {
 	cd "${MY_BUILDDIR}" || die
 
 	# see Note [tooldir hack for ldscripts]
-	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
 	rm -rf "${ED}"/${LIBPATH}/bin || die
 	use static-libs || find "${ED}" -name '*.la' -delete
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/metadata.xml
index 9b80e61912..3cc1068634 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/metadata.xml
@@ -13,6 +13,7 @@
 		<flag name="pgo">Build binutils with Profile Guided Optimization (PGO) and LTO</flag>
 		<flag name="plugins">Enable plugin support in tools</flag>
 		<flag name="multitarget">Adds support to binutils for cross compiling (does not work with gas)</flag>
+		<flag name="debuginfod">Enable debuginfod support via <pkg>dev-libs/elfutils</pkg> libdebuginfod</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:gnu:binutils</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index a09a2e56af..0afe738e9b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -5,9 +5,8 @@ DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
 DIST gcc-11-20230427.tar.xz 76165128 BLAKE2B dd896b418c1fce35a61005d5b5c90cfd1246d37d23c2a8fc08bacd7d7ca84c353f3ccf5de2370ae5e5ca95c7ae3deab3565b3f65eb78b611dbe5ad4a256516f0 SHA512 fada917a832be5d2e15ee32f24e19fc87b851dc8e6fc75d1be6d25d3510dba408ae3ef3b245ff239c51aa3d243c95f12269695611e5c8965ba55f5aa4730778d
 DIST gcc-11-20230622.tar.xz 76199316 BLAKE2B a769dc6be63eabca3bc33944b471d727bf230e506773c85977156b187f12664f2cd3e0992a1faefda8ec88ff85d1a8d12795121baadc7e8b9653d69a8025e46e SHA512 8dbc5a4b54f2bc52458914705af40a00b33e46061dd5b335b4b4a6e96d17206fe480d3fec564dd11ebcca6168f054984d706b1b26b7e694e8b327692a13ae7d1
-DIST gcc-11-20230629.tar.xz 76208088 BLAKE2B c2ced5e441c93f985a8747a763f908dbbadcef905a1038db89a771c478c15dc516faca038daa4ed6356ef6848b132177a8a0ebeb333abf6f7149445782f1eecd SHA512 183af1d37650d57232d56f4a46d2f17064683189061b55db314ab8e66e5ecc8d8cd31114c1427339c1dda242a04fe989730cf5a169f13dc6629c60ccd61fdd53
-DIST gcc-11-20230706.tar.xz 76209132 BLAKE2B 87522d0e5cffd9eedfcf20dfc2431fc3c0f4405d9c311e1455e530a58ef9b2e878c6e1067494a9d3b3d7d13a3715f45bdb463bce4a4b60a9c0a9f2b7c7c92b7d SHA512 eff4422c7cc954d6387e0d8bf18844f3c2ee310954aaffee51c9da0d6e9ad372e8942394c8a7f20df434fae0b0c2f1a003d8fb99e5d92a4cec89008a8f99baf9
-DIST gcc-11-20230713.tar.xz 76215136 BLAKE2B 6972eb897aa11245f9eb8000d4731f37cf14f3bf75b433a322fece1308403ba1359dd0d96a3e1e2dfc7d94343a0bf1c917d3663b9e34424f379329b6fe85ed33 SHA512 fd16be7fb803154f4d6e374d373bc40d7f41afcda7a7bac77e943d66434d4c8a19470a51c3cf68b1d501eaa346abf8516762a085d688babc37f27fbba168209e
+DIST gcc-11-20230727.tar.xz 76213292 BLAKE2B 8d15efab47a39695997b15d606c27929794c3b8a96da0243f336c78076daad4b322d37ddfca3d928b73ca7a68c25b05a7834596a27ac79d11d2c77777573f118 SHA512 e64b10ab59548695d538d0ca471efb7bb29dd751e719a8e7c1434182a8cf7433e28348fb08c3babe90bda952ee2e739a9fd055ac8b9ed883417066c836d2ffd3
+DIST gcc-11-20230803.tar.xz 76202192 BLAKE2B e268c236873635c7059a4f0c88f192eb3634eeba9d8f4d1cf974a2ceae60237024097f4b7a2015694144509492dc3a412c8f77af6f20e0611f2f73f25ce48e36 SHA512 df25cff801f93a858a8326baf74e0d3060208cfde85bce2c1ac1ed38860de04ca1c2c509ca1d43b413bcb4b12cb429cd7aa193bc38fb8a42128e31f0ac92ac21
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
 DIST gcc-11.4.0-patches-10.tar.xz 13852 BLAKE2B 54937d13e30e2a5303c7e197fae09eeed35ca0b9783625e02578fcee829b5503fb22d664366322b304df7d01ae807d00af7c93db3e3ceebe4851e15647724f87 SHA512 31b4d7a2e7cc589e92e12c3583d13d41c523cafbd309bc0532df9b68ea2473c89daef4c0edd3ce2917b5823d81a7792f145b9449f16277d0d64c22ceff50bbb9
 DIST gcc-11.4.0-patches-9.tar.xz 14704 BLAKE2B 9aa2ecbac493d3040694e9930738e57d59a764b90ab92b91709c319b883f28ad108767e5d11e8b62af40bf1e583d5ff83a03e8c895f904bc6f41315ce9ab4f0a SHA512 ac8b7c6c382ffacc4e9d08299440fc237fa366ec36fb8eb7a8d426b64a4186384a262e6380dc83ed7f7240125ce26a8435c8a4e0e13976ef2652067a7129bd17
@@ -15,22 +14,21 @@ DIST gcc-11.4.0.tar.xz 79837032 BLAKE2B 6e3b095a5837d4b5512719f848f4b9c4b4a6d7dc
 DIST gcc-12-20230428.tar.xz 79744932 BLAKE2B f9d0000cdd2f1b0af79f281851b3b0fe0ac50f14468844e1ee596f8ed1ccf33f55c7617464d88df7e4b3435d58fedecf640592e0661fd1be9ba163acd26dae68 SHA512 992f9cd71f9910efea401048540ba2b43360170f76ce992cf356b1ab383240f481e29c5b0ad32fa4efb2bdbb397477506cb83a825268cfbdd2cde7044d43c758
 DIST gcc-12-20230526.tar.xz 79780444 BLAKE2B 6f6eca272ab506e16a231003c399e28572595c82fbaaec9deb14b78ff9fc493fb24afe1c375d4f2fd75e9813805934857ef2ceb6c05b7977dbfe2e50abdc3ec9 SHA512 fb190ce5bf3d38a1899016475c1551550d44c6f71f1f1a71ced545cbb2aff0446bd2765230b0920379579a13103a507ffc1e197ac69afb0a4f08efe11b50918d
 DIST gcc-12-20230623.tar.xz 79782948 BLAKE2B 6eeabdd1495482b8bc5a6f2f90cd7d7967b66664d277c5f755f1ee98ac2c99db1552ab13b1c69f4c47d1d0b8de584e6a5f024b45e3c5934f49179cf65ca30acc SHA512 09aa0304a8a916aea7a4714eb3a7541b2015e3bdb8ae9bd40bc289553c4ec86f91b054925d2af45f33af9d20a7422949e691c0f552d68ee1d5206b4007310a88
-DIST gcc-12-20230630.tar.xz 79795960 BLAKE2B 8d7a10afbf63f0de348f6e32913320428a2017f0ced5f330dc8084ff8f954c0c73b638387eade230a0c47ede32917fd1b89fdc31d83d02fb226600e1dc72528a SHA512 f7bf3d9a12f2b96c242a7dfaa17f47bdf368a787bcff1da5efdf1cb07910c2506d3c944598eb47a0fa708bcccb6b1a5a6994122d44fc6fd4fda09d0b0169b430
-DIST gcc-12-20230707.tar.xz 79783628 BLAKE2B 58ef775c177acda2afc46eb0211902424256cb4a12eb8d39e5a50f84b04626b0392ffaebb792b526c17f5b3e8b725e1df60975366cde8a908152a7a61ff27ce1 SHA512 da17f92aa39339b357ae8a247e68364c91d377b9baf1c7c13e95b64ded6c69df955586a60411c6ab52b81959442af558be7e3e97ccfdb19d720dd816ac937eca
-DIST gcc-12-20230714.tar.xz 79794260 BLAKE2B add530733b1b84b594439a6f8029fb65132ae2903e5b2b6b1562d8f784571f84a0ef11183e52fbbf4fcf17950aad1cf7e90cdac54982300ef92e1e5ce4db1380 SHA512 ea8e4fa199028979efadebc85ef7d73efbc7eeca04ad61a5bb11dfea8014701c2848a908f22d37df99bd437f7977a45f3148c7aed652e91f2e8fa6866e7daa8c
+DIST gcc-12-20230728.tar.xz 79813460 BLAKE2B 89db12fbdc7d75d298335fdd61b15439c161090deb94e224d13592d25fa64fd21c289f75fbe77e5c0d10f90e18019a12c343014e73ef446281ac8c471a39b937 SHA512 20c8bbe3918ed41b05b00cc3fa90e1ee59faf9ece876faf3e93ab01b2a79e6b83b55812e41d662ad1b9a420ca3f891f46cd70aa9f7f6bcf292dda0f57b56681e
+DIST gcc-12-20230804.tar.xz 79785996 BLAKE2B 6af25c245bed3affa42a265e56afc59afe7001603572223226b236efb67c804697a53b8f31ad68a5ddcaee1533212de87725bbad4acbb67a75e9b007e69fc071 SHA512 44b0c202f913913c586313a0f76bd721566e4519824a18b5569339e3996d556c866e7b980c341aa1d433f56fc8f18d2a11fc47e5bc91b693a3ecfdce37b9082b
 DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
 DIST gcc-12.3.0-patches-2.tar.xz 14236 BLAKE2B 06c43662c9abb0fa3cf90d5e2273c69aecb9158e6cf6f23c04754ed5d686be2616e81e2502eb16f4298ddd50518ca7677e13249da9e9b091162d3931ff65e4fe SHA512 b0d4b85dbf1a54aaaa1997203b872e3106906b4ad49cde57e1428bc22b2f8e2d73b8cb10ae0d0b792aebaf664594da4d1dea04c44ddc34e59047410766db04d1
 DIST gcc-13-20230527.tar.xz 83956360 BLAKE2B 86a2131b88144817673a6300c73b29c2dbb8559a7057609601029aaf60aeb4c4926fa4b99c4e1768726cde09f994159685768b62b3ca73d7b606847788301e82 SHA512 87566c74258f9981742eae77f552361c220f79fa6f17c36d5b5a9e73f41c50d8a2cab16b9ffb17f07829005f0d42b4b1d524150d3dcba9710091532cbfad7152
-DIST gcc-13-20230624.tar.xz 83969940 BLAKE2B 8a145ade87b38226d25161a0494b781e3cba1cfda229ffa367ed570aa97cdd3c38a520ae14e9ed9050fe844b229ac7bd8c2ef37544c472d39b8d75f7b9ecc3af SHA512 98e5fe2e780646f67f6d8ed2e9f8338a9be27ade40c2cfa78b7fa3f9c9a0a74771292b3eb81c5713f230f90bdec46104fa655ca4286bb9e6065432ae10122f54
-DIST gcc-13-20230701.tar.xz 83971804 BLAKE2B 3f5bab12f47e44f57556c320d2d9a8ca4a64ba392af62e59d34188aca1cad759358fc3082ec3b959c938d03f6819f9c2974f6252754e0038baec6652f325cb5b SHA512 68d5ade55c082ef80dd4b66bcac1c5fc59f82f5dabaf6b4f703d7f4bc04a92c34e9a554bfa7794861630af97df668b5c7b81548ee7692e22cad25c0a5eb651ef
-DIST gcc-13-20230708.tar.xz 83997508 BLAKE2B b19c5f8bb90bb38f8e30e5cc04ddc7c26db007b309ce4007163b0be2d73fa0f8adbbcc318e9933e58ecdb52fa17d4b70221df4ac48f1b5fa28599e418bb71ae9 SHA512 c3fc449a6ec66786d3a6bd665749eed94108295e1c787c95e27e46311fd86d17f0e501636f2fb5db5d9f90d4a137632933056a8ff5fcb1988ffd4310adce95e3
-DIST gcc-13-20230715.tar.xz 84006392 BLAKE2B f55758258546e9a9a4ccc0f54be79d6a79a6975289fa0b5f28d843e1f2a28dca77fd8d7f3bd4d3bd5585340a05b65bcea44ffbced86735c8fae75b9261744a2b SHA512 8fb6e33644b9bd991daa7f86359ca67a0b89c2093ea1e194c30e82d2eead87e5b26bfe798ef822cc057d0384eee4cf57a6dedc2c2cd27cff945ee74f2195407f
+DIST gcc-13-20230729.tar.xz 84264252 BLAKE2B 85e0b8af941c6d57317bf68503ea278ecd9e0927e994e73b65b2a674610daa83d3081c9aa87326034b22e694e841d714734187a69ffc80d63d1f5e48d9514772 SHA512 46a42d79de118a16dc195605fd461034e9b41856fb11fee3bcce962517e713094935704aa88e1ca05f896176bee9eecfef835ee8858ea584421b924390fe3812
+DIST gcc-13-20230805.tar.xz 84271272 BLAKE2B a8898131c3d597417cd349a91d9015d27a7dcbd9bcdbf75c96da45b07fd48b0a2bb240e5e90cb138ebbe7ac9df7c43fc7ca768e88fc1ffe388ab38c4c07cd219 SHA512 386cf5ae6948f7dff45d82910bb52418e0e040a8d2802a658c05cc0bb0be16c880878a18af4fba7a5025132b77657c50b20e84e3ea77c1520a7a135013879750
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
-DIST gcc-14-20230625.tar.xz 84461556 BLAKE2B 231980a191e231a3f7dabc8f69ab364ecf1f3cf9a165a7e0bcbb9ad4ed17bda0616be325fe6cd2996321f6bfbc69f5e8d4a13513c3126132a0797d9d1c5c422f SHA512 d794a977a7a6b759729386eb13bff934f90c093716c47e89b7490dbd36ea489f5dfb03d0c6c0f7d57e1d4214dad8a82d886438c8eb5af53620cf2a85236f0b45
-DIST gcc-14-20230702.tar.xz 84492372 BLAKE2B f78631cadce2926dba3f5d5a7b139cb8c29fe16a12fc430b393061529a181598a633d92a6bc927644f372fab3514a9c42faeda7e9bbc115478fc472657848776 SHA512 33e37d41c00f48b674061d37f142fc9b1bf23f0f77311877910a97dc86c617857b32559aae994421867b549659b8f0669c5953ee58a884e008e9e33115839942
-DIST gcc-14-20230709.tar.xz 84551412 BLAKE2B 0c60b49481d72b8a08410a726158c7a071c41a71553a4988c15be5072a412e806d3524a7df4712a167c35022984ae80b242e54ed2cd6c66218c13947d5e78693 SHA512 4023fcb3e3b4a730c46d7affd504efa53d7fd8f941b7028af90f4b0f27e9687e4554d91220d38eb5aec214728d19ee9c07ccf5a921c9e9516d71dfeb52d1b61f
-DIST gcc-14-20230716.tar.xz 84628612 BLAKE2B 61498db17a0dc46c8fbbc051765065ed867abc58cec4e709ac374d716ed3a1ab134fd20aabe809490d5d00115f98fc4a4b3c6a3d4ed132dbc3aebb4ce15600f4 SHA512 7b17380723d1578ec8bbcaeff6421755957d3ba84fa9707be4a6704817952d084b70528060f4ae70bb80659a53ad7bd40db6dd11a35b82c1347bda80fe7b4865
+DIST gcc-13.2.0-patches-4.tar.xz 35284 BLAKE2B 230932b5df961518dc0c1aea219e65bd49a64bfcbe0621f90012d8fa18c099fbaa9ce865fb7b95e403e9b227d4cc86bf701668837519a3962a76769f49cd1356 SHA512 5464a6de67ed16a5b3200d513069e8ea10d57d0c78eb84523d30f7abfcaa2611c5462e83f9bbdb079e42b4f702e5f2ecd1db0f370fdf0fe6c0216a08cf2801d7
+DIST gcc-13.2.0-patches-5.tar.xz 34672 BLAKE2B f675575477aab22b1ef4105ecbf636b53dde1fc463e8fc79645f0828ff57417a028100ce48eb8ac0b6ca6e8bae91072f3ed2878b9c00fb49397ffcf736606160 SHA512 15b7db29cc03dcdc023551a3cf01f3756724b7caf8fe0d5ed7831ca78f02d9f0a72fb96326cad79bcd9cb358005676d3cb4217dc1b8fccdcd7906ae1a4bee851
+DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
+DIST gcc-14-20230723.tar.xz 84677324 BLAKE2B d9bc3aeaac971984178eedc70bc4b1b1314a3c299c17a60992fe843e01c35aee63fd0742d97449f2bd14e1b2adda3c8a2095cc26b4e4eb3a8d1620af9706ea43 SHA512 53490f78fcebf3e795ad012fe7462390f0e40fc541e3ee6d9edcedba78d645029a35d74e5d16aa0d1ee487c43f7de10f5911043f875e8a5787603c37e1708a7c
+DIST gcc-14-20230730.tar.xz 85008220 BLAKE2B 93a253408aec27af68f98d00f63d0498445385bab2f324b615aba0f488cdbc55ea4d91a3a8934ba46e275aa7ebf3439ee76cfa0571948cbc9dbd6618760abfa2 SHA512 0314fbd44e359f9d183e8027c3f2c70cc6aff07b7a3f7d55b62718e5ec72a70698c30464460a5e3cebabc4bfb369ebde327fc1c13d7dd8667f597f1c4e143656
+DIST gcc-14-20230806.tar.xz 85043088 BLAKE2B 1026c65f39cb9930e996c865b80db9b7d3ba24ad7a56566a8a3fa49bf468d8ab1610d8235ff14ba469fb33448cca43cb997eb06692847515db3f6a773b799bbd SHA512 09fb47b3e7d2072095696e68e87f864cb1f14ef3027d904202bbc34a16df93a0c4805185fa0a8572155b11c40bc107074655c4dae078fe371593048f9318e1ab
 DIST gcc-14.0.0-musl-patches-1.tar.xz 3576 BLAKE2B 692baee8a7709905d53aeb150d73a3721c4ba47ee5f397cfb1b5be905cf003ca02b60c94ee294d90ac39645cd5cdf186c7a3aa950c47d8cf680c128ed705b807 SHA512 0592ab98a7142e404623a6511c67dff61e9ade32c3fb2c0e75b456306e0af3799ad13252b50b3d2fdd31e5815d7f0b16b0ad63ab8386fe4d78729fc9c182d617
 DIST gcc-14.0.0-patches-2.tar.xz 11484 BLAKE2B 6ff968051d286f21eb7f4ec80303b232530c153cca8d9e61ddfdf3675ef8c5740223a8b720ec9d5c4561b505993c675cc6fc7a9bab659ee1db99e1d97911eb74 SHA512 b255338d6110d9bfe211ba14da7b186f69b81503dba6e4ec19ee6fa37d44c0690e713c763abe27ce934ff7f9e5d0c8788a54c30587f07f65858b1e817cbf7247
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 72bc0e8a42..475550cac5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -37,7 +37,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230713.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230713.ebuild
deleted file mode 100644
index 02c58f02f0..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230713.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230629.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230727.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230629.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230727.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230706.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230803.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230706.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230803.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230714.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230714.ebuild
deleted file mode 100644
index 1ffe2b97a4..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230714.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230630.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230728.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230630.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230728.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230707.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230804.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230707.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230804.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230701.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230701.ebuild
deleted file mode 100644
index 994717045f..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230701.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="3"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230708.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230708.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
index 994717045f..66a56715f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230708.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
@@ -37,7 +37,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230624.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230624.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild
index 994717045f..845eb61fac 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230624.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="13.2.0"
-PATCH_VER="3"
+PATCH_VER="4"
 MUSL_VER="2"
 MUSL_GCC_VER="13.2.0"
 
@@ -37,7 +37,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230715.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230715.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild
index 994717045f..3c29ee8184 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230715.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="13.2.0"
-PATCH_VER="3"
+PATCH_VER="5"
 MUSL_VER="2"
 MUSL_GCC_VER="13.2.0"
 
@@ -37,7 +37,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.9999.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.9999.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230716.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230716.ebuild
deleted file mode 100644
index 59534d9e96..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230716.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230625.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230723.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230625.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230723.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230702.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230730.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230702.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230730.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230709.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230806.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230709.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230806.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r1.ebuild
index 09dfedaf1e..83b9a838d2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r1.ebuild
@@ -74,7 +74,7 @@ LICENSE="GPL-3+ LGPL-2.1+"
 SLOT="0"
 IUSE="cet guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
 if [[ -n ${REGULAR_RELEASE} ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 fi
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r2.ebuild
new file mode 100644
index 0000000000..d5ff38e376
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.2-r2.ebuild
@@ -0,0 +1,311 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# See https://sourceware.org/gdb/wiki/DistroAdvice for general packaging
+# tips & notes.
+
+PYTHON_COMPAT=( python3_{10..11} )
+inherit flag-o-matic python-single-r1 strip-linguas toolchain-funcs
+
+export CTARGET=${CTARGET:-${CHOST}}
+
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
+
+case ${PV} in
+	9999*)
+		# live git tree
+		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
+		inherit git-r3
+		SRC_URI=""
+		;;
+	*.*.50_p2???????|*.*.90_p2???????)
+		# Weekly snapshots
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-weekly-${MY_PV}.tar.xz
+			https://sourceware.org/pub/gdb/snapshots/current/gdb-weekly-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-weekly-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+
+		# e.g. 13.1.90_p20230325 is a snapshot on the stable branch, so it's fine
+		if [[ ${PV} == *.[123456789].9?_p2??????? ]] ; then
+			REGULAR_RELEASE=1
+		fi
+		;;
+	*.*.9?)
+		# Prereleases
+		MY_PV="${PV/_p/.}"
+		SRC_URI="
+			https://sourceware.org/pub/gdb/snapshots/branch/gdb-${MY_PV}.tar.xz
+			https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/gdb-${MY_PV}.tar.xz
+		"
+		S="${WORKDIR}/${PN}-${MY_PV}"
+		;;
+	*)
+		# Normal upstream release
+		SRC_URI="
+			mirror://gnu/gdb/${P}.tar.xz
+			https://sourceware.org/pub/gdb/releases/${P}.tar.xz
+		"
+
+		REGULAR_RELEASE=1
+esac
+
+PATCH_DEV=""
+PATCH_VER=""
+DESCRIPTION="GNU debugger"
+HOMEPAGE="https://sourceware.org/gdb/"
+SRC_URI="
+	${SRC_URI}
+	${PATCH_DEV:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${P}-patches-${PATCH_VER}.tar.xz}
+	${PATCH_VER:+mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz}
+"
+
+LICENSE="GPL-3+ LGPL-2.1+"
+SLOT="0"
+IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
+if [[ -n ${REGULAR_RELEASE} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+fi
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/mpfr:=
+	dev-libs/gmp:=
+	>=sys-libs/ncurses-5.2-r2:=
+	>=sys-libs/readline-7:=
+	sys-libs/zlib
+	elibc_glibc? ( net-libs/libnsl:= )
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
+	lzma? ( app-arch/xz-utils )
+	python? ( ${PYTHON_DEPS} )
+	guile? ( >=dev-scheme/guile-2.0 )
+	xml? ( dev-libs/expat )
+	source-highlight? (
+		dev-util/source-highlight
+	)
+	xxhash? (
+		dev-libs/xxhash
+	)
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/xz-utils
+	sys-apps/texinfo
+	app-alternatives/yacc
+	nls? ( sys-devel/gettext )
+	source-highlight? ( virtual/pkgconfig )
+	test? ( dev-util/dejagnu )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
+	"${FILESDIR}"/${P}-fix-sparc-debugging.patch
+)
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	strip-linguas -u bfd/po opcodes/po
+
+	# Avoid using ancient termcap from host on Prefix systems
+	sed -i -e 's/termcap tinfow/tinfow/g' \
+		gdb/configure{.ac,} || die
+}
+
+gdb_branding() {
+	printf "Gentoo ${PV} "
+
+	if ! use vanilla && [[ -n ${PATCH_VER} ]] ; then
+		printf "p${PATCH_VER}"
+	else
+		printf "vanilla"
+	fi
+
+	[[ -n ${EGIT_COMMIT} ]] && printf " ${EGIT_COMMIT}"
+}
+
+src_configure() {
+	strip-unsupported-flags
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or gdb's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+
+		--with-pkgversion="$(gdb_branding)"
+		--with-bugurl='https://bugs.gentoo.org/'
+		--disable-werror
+		# Disable modules that are in a combined binutils/gdb tree. bug #490566
+		--disable-{binutils,etc,gas,gold,gprof,gprofng,ld}
+
+		$(use_with debuginfod)
+
+		$(use_enable test unit-tests)
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+
+		# Helps when cross-compiling. Not to be confused with --with-sysroot.
+		--with-build-sysroot="${ESYSROOT}"
+	)
+
+	is_cross && myconf+=(
+		--with-sysroot="\${prefix}/${CTARGET}"
+		--includedir="\${prefix}/include/${CTARGET}"
+		--with-gdb-datadir="\${datadir}/gdb/${CTARGET}"
+	)
+
+	# gdbserver only works for native targets (CHOST==CTARGET).
+	# it also doesn't support all targets, so rather than duplicate
+	# the target list (which changes between versions), use the
+	# "auto" value when things are turned on, which is triggered
+	# whenever no --enable or --disable is given
+	if is_cross || use !server ; then
+		myconf+=( --disable-gdbserver )
+	fi
+
+	myconf+=(
+		--enable-64-bit-bfd
+		--disable-install-libbfd
+		--disable-install-libiberty
+		--enable-obsolete
+		# This only disables building in the readline subdir.
+		# For gdb itself, it'll use the system version.
+		--disable-readline
+		--with-system-readline
+		# This only disables building in the zlib subdir.
+		# For gdb itself, it'll use the system version.
+		--without-zlib
+		--with-system-zlib
+		--with-separate-debug-dir="${EPREFIX}"/usr/lib/debug
+		$(use_with xml expat)
+		$(use_with lzma)
+		$(use_enable nls)
+		$(use_enable sim)
+		$(use_enable source-highlight)
+		$(use multitarget && echo --enable-targets=all)
+		$(use_with python python "${EPYTHON}")
+		$(use_with xxhash)
+		$(use_with guile)
+		$(use_with zstd)
+
+		# Find libraries using the toolchain sysroot rather than the configured
+		# prefix. Needed when cross-compiling.
+		#
+		# Check which libraries to apply this to with:
+		# "${S}"/gdb/configure --help | grep without-lib | sort
+		--without-lib{babeltrace,expat,gmp,iconv,ipt,lzma,mpfr,xxhash}-prefix
+	)
+
+	# source-highlight is detected with pkg-config: bug #716558
+	export ac_cv_path_pkg_config_prog_path="$(tc-getPKG_CONFIG)"
+
+	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+	# ensure proper compiler is detected for Clang builds: bug #831202
+	export GCC_FOR_TARGET="${CC_FOR_TARGET:-$(tc-getCC)}"
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Run the unittests (nabbed invocation from Fedora's spec file) at least
+	emake -k -C gdb run GDBFLAGS='-batch -ex "maintenance selftest"'
+
+	# Too many failures
+	# In fact, gdb's test suite needs some work to get passing.
+	# See e.g. https://sourceware.org/gdb/wiki/TestingGDB.
+	# As of 11.2, on amd64: "# of unexpected failures    8600"
+	# Also, ia64 kernel crashes when gdb testsuite is running.
+	#emake -k check
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	find "${ED}"/usr -name libiberty.a -delete || die
+
+	# Delete translations that conflict with binutils-libs. bug #528088
+	# Note: Should figure out how to store these in an internal gdb dir.
+	if use nls ; then
+		find "${ED}" \
+			-regextype posix-extended -regex '.*/(bfd|opcodes)[.]g?mo$' \
+			-delete || die
+	fi
+
+	# Don't install docs when building a cross-gdb
+	if [[ ${CTARGET} != ${CHOST} ]] ; then
+		rm -rf "${ED}"/usr/share/{doc,info,locale} || die
+		local f
+		for f in "${ED}"/usr/share/man/*/* ; do
+			if [[ ${f##*/} != ${CTARGET}-* ]] ; then
+				mv "${f}" "${f%/*}/${CTARGET}-${f##*/}" || die
+			fi
+		done
+		return 0
+	fi
+
+	# Install it by hand for now:
+	# https://sourceware.org/ml/gdb-patches/2011-12/msg00915.html
+	# Only install if it exists due to the twisted behavior (see
+	# notes in src_configure above).
+	[[ -e gdbserver/gdbreplay ]] && dobin gdbserver/gdbreplay
+
+	docinto gdb
+	dodoc gdb/CONTRIBUTE gdb/README gdb/MAINTAINERS \
+		gdb/NEWS gdb/PROBLEMS
+	docinto sim
+	dodoc sim/{MAINTAINERS,README-HACKING}
+
+	if use server ; then
+		docinto gdbserver
+		dodoc gdbserver/README
+	fi
+
+	# Remove shared info pages
+	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
+
+	if use python ; then
+		python_optimize "${ED}"/usr/share/gdb/python/gdb
+	fi
+}
+
+pkg_postinst() {
+	# Portage doesn't unmerge files in /etc
+	rm -vf "${EROOT}"/etc/skel/.gdbinit
+
+	if use prefix && [[ ${CHOST} == *-darwin* ]] ; then
+		ewarn "gdb is unable to get a mach task port when installed by Prefix"
+		ewarn "Portage, unprivileged.  To make gdb fully functional you'll"
+		ewarn "have to perform the following steps:"
+		ewarn "  % sudo chgrp procmod ${EPREFIX}/usr/bin/gdb"
+		ewarn "  % sudo chmod g+s ${EPREFIX}/usr/bin/gdb"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-9999.ebuild
index f234645144..085df52dac 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-9999.ebuild
@@ -72,7 +72,7 @@ SRC_URI="
 
 LICENSE="GPL-3+ LGPL-2.1+"
 SLOT="0"
-IUSE="cet guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
+IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
 if [[ -n ${REGULAR_RELEASE} ]] ; then
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 fi
@@ -86,6 +86,9 @@ RDEPEND="
 	>=sys-libs/readline-7:=
 	sys-libs/zlib
 	elibc_glibc? ( net-libs/libnsl:= )
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
 	lzma? ( app-arch/xz-utils )
 	python? ( ${PYTHON_DEPS} )
 	guile? ( >=dev-scheme/guile-2.0 )
@@ -149,8 +152,9 @@ src_configure() {
 	local myconf=(
 		# portage's econf() does not detect presence of --d-d-t
 		# because it greps only top-level ./configure. But not
-		# gnulib's or gdb's configure.
+		# libiberty's or gdb's configure.
 		--disable-dependency-tracking
+		--disable-silent-rules
 
 		--with-pkgversion="$(gdb_branding)"
 		--with-bugurl='https://bugs.gentoo.org/'
@@ -158,9 +162,7 @@ src_configure() {
 		# Disable modules that are in a combined binutils/gdb tree. bug #490566
 		--disable-{binutils,etc,gas,gold,gprof,gprofng,ld}
 
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
+		$(use_with debuginfod)
 
 		$(use_enable test unit-tests)
 
@@ -232,10 +234,6 @@ src_configure() {
 	econf "${myconf[@]}"
 }
 
-src_compile() {
-	emake V=1
-}
-
 src_test() {
 	# Run the unittests (nabbed invocation from Fedora's spec file) at least
 	emake -k -C gdb run GDBFLAGS='-batch -ex "maintenance selftest"'
@@ -249,7 +247,7 @@ src_test() {
 }
 
 src_install() {
-	emake V=1 DESTDIR="${D}" install
+	emake DESTDIR="${D}" install
 
 	find "${ED}"/usr -name libiberty.a -delete || die
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/metadata.xml
index 5baff33ff4..2e08f18a34 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/metadata.xml
@@ -15,6 +15,7 @@
 		<flag name="source-highlight">Enable listing highlighting via <pkg>dev-util/source-highlight</pkg></flag>
 		<flag name="xml">Support parsing XML data files needed (at least) for cpu features, memory maps, and syscall tracing</flag>
 		<flag name="xxhash">Use <pkg>dev-libs/xxhash</pkg> to speed up internal hashing.</flag>
+		<flag name="debuginfod">Enable debuginfod support via <pkg>dev-libs/elfutils</pkg> libdebuginfod</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:gnu:gdb</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
index d704bd09bd..c43105bc4d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
@@ -1,2 +1,3 @@
 DIST gnuconfig-20221007.tar.xz 71208 BLAKE2B 9112bd82af083043d5eae3a5ffde8174df842f3a817b1b42c17e3202a9189cff8e9f422e956e1cdd82e326949a23e27a353f72f98a6f63818e5a67096f650fed SHA512 91ca2faca02d5d78f937da70a4af026b1ba585519b9eaa2463cacd79f0f6a85ef6e1f7e0bed4243474b6e880c0b6387ca09f00eb2d40a27c3a26b6817b1bb70a
 DIST gnuconfig-20230121.tar.xz 71276 BLAKE2B c136c11f2836cc01c4a75b54853b14943b1e4b29a99102360b436854b1a6e445f578fea494b5c7fe2f744d35941c0ea888a08a386dff716b99dd231a308bffcf SHA512 5ac6c50b9c0abe7c007717aeff2d2d6a8e616d7c8514ed22489ad0164c16966cf44f2312bc3295765f5beaf98bb14022d91c5c59e9fb41e920617092a22d42ec
+DIST gnuconfig-20230731.tar.xz 73112 BLAKE2B c6502d6b339e56440dbfc9abb0ba49e3eec5a573c5e44779dd326e6f11b55b7fc3a6d99fec73abbcc271e8f6f125699ce87f512cb3a825144307cf820df0067a SHA512 d8e24a30f86f1983c69a37a901e2357a0aefbe15fcd3f8a331d1c6f8eabc81b7436930055756a764ae874e406090d8029403f1c0faa3737acb94bd937cd577ef
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230731.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230731.ebuild
new file mode 100644
index 0000000000..bbfd2430e7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230731.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 99999999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/r/config.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	S="${WORKDIR}"
+fi
+
+DESCRIPTION="Updated config.sub and config.guess file from GNU"
+HOMEPAGE="https://savannah.gnu.org/projects/config"
+
+LICENSE="GPL-3+-with-autoconf-exception"
+SLOT="0"
+
+maint_pkg_create() {
+	cd "${S}" || die
+
+	emake ChangeLog
+	local ver=$(gawk '{ gsub(/-/, "", $1); print $1; exit }' ChangeLog)
+	[[ ${#ver} != 8 ]] && die "invalid version '${ver}'"
+
+	local tar="${T}/gnuconfig-${ver}.tar.xz"
+	tar -Jcf "${tar}" ./* || die "creating tar failed"
+	einfo "Packaged tar now available:"
+	einfo "$(du -b "${tar}")"
+}
+
+src_unpack() {
+	if [[ ${PV} == 99999999 ]] ; then
+		git-r3_src_unpack
+		maint_pkg_create
+	else
+		unpack ${A}
+	fi
+}
+
+src_install() {
+	insinto /usr/share/${PN}
+	doins config.{sub,guess}
+	fperms +x /usr/share/${PN}/config.{sub,guess}
+	dodoc ChangeLog
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230613_p20230520.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230613_p20230520.ebuild
index 8f5ab87433..5d1ff1e7f4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230613_p20230520.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230613_p20230520.ebuild
@@ -43,7 +43,7 @@ S="${WORKDIR}"
 
 LICENSE="intel-ucode"
 SLOT="0"
-KEYWORDS="-* ~amd64 ~x86"
+KEYWORDS="-* amd64 x86"
 IUSE="hostonly initramfs +split-ucode vanilla"
 REQUIRED_USE="|| ( initramfs split-ucode )"
 RESTRICT="binchecks strip"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.6.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.6.ebuild
index 0a6fecdf1a..f51ab51059 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.6.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.5.ebuild
index 28275e8445..95274e7588 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/multipath-tools/multipath-tools-0.9.5.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/opensvc/${PN}/archive/refs/tags/${PV}.tar.gz -> ${P}
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~ia64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~alpha amd64 ~arm arm64 ~ia64 ~loong ppc ppc64 ~riscv x86"
 IUSE="systemd test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
index 496df6a3ba..b0812c9347 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
@@ -11,4 +11,8 @@ DIST binutils-2.38.tar.xz 23651408 BLAKE2B 19ede396ec97b88e632aded2f69f4684cc505
 DIST binutils-2.39-patches-6.tar.xz 92380 BLAKE2B 39f490f1134fb0e7dc80924a280d3113efe0ed094ee15de97c42ab751c83d2f5aa7448966d8cbbcde722b2af4999a36c1e5aa2f37ca6d2e3942b97b6d90ff152 SHA512 213cd7a86da83987966675f3195e843d898ca4ff412dfc29fd33ed80adb7bbf80a0b2919cd8e7dd49208c73a621ab7b720970f2259418bdc82ed2a568ff62064
 DIST binutils-2.39.tar.xz 25167756 BLAKE2B ac6a5296c6586d53eaadcbffc5c399a6d79edf72450b9bb8b3525ce525129cef3d2eb90c85ef3bb3270b5a03b0e1ffb8f0b705f028158726f9777ebb8685066f SHA512 68e038f339a8c21faa19a57bbc447a51c817f47c2e06d740847c6e9cc3396c025d35d5369fa8c3f8b70414757c89f0e577939ddc0d70f283182504920f53b0a3
 DIST binutils-2.40-patches-5.tar.xz 293628 BLAKE2B b7ed1d1fbf38b420661f984b9519b3d863da45b2a873773a521310021b0c1d5d7c24c152adb3e8a999d40f5619c0e54962114590ec9528380089977af0c30b74 SHA512 6e6df932b18ca20fe245b3ff8d3d06dbdae4daadaec3b668fa44e086d4e8ff56439681b2d810ebc74173b6348020edacb176e8c3cbf20657cce04297b97f4f83
+DIST binutils-2.40-patches-6.tar.xz 299212 BLAKE2B 3a68a924e9747fdd0486327a5bd2490cb72376f2cb6c6a60030d8c6b71357150d956a1e71d91683d43b571cb5bf738270880f72ef175d6c8faa257b090abeb8b SHA512 984dab529276ab4f9d215f643c7c18bd1793f438aaad0be158d209787c9c4a6bb68b10bec2065d3fe14a1594d5f1c29f55b2e9bac34a6f489f4b466c02e24766
 DIST binutils-2.40.tar.xz 25241484 BLAKE2B 8d799f7c595f878b9af5b17a490021dd8b8300ac2fe0ed8574c012929d22d2d0493e003a3e631a9436e8e712da801779b777c566167fe42b0bde119ffa5ad1c2 SHA512 a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925
+DIST binutils-2.41-patches-1.tar.xz 13260 BLAKE2B b7431ec92d5ce0e5d4438b31ca356c8d5366bee9aa8ff2f098a77c2add5b7539f733d0a18988337490af34c9192affbb6ccdf56b97413a8dca3192fb2125b313 SHA512 30548e4f3187444dbfa82587b5b8a0d2ab9d536aa06a572393a195649759149124d79c488c07919850c7ed4940481b852462d5a1aa52ed9162d81d6d3b290377
+DIST binutils-2.41-patches-2.tar.xz 20288 BLAKE2B 1cc29e868ded12845856c5da567f23798fe3017961ce079325c20f456b837cab11560d896065f70953b0bab55bf565288541579e9c3e0991a87083edf2a85fa5 SHA512 75619a5e17b75d72f9bdd9d5e5ee3b566c94de64410bfc074f1a9bfb9f08db9ecf8be216efa1053263468aa8ec99b8aa3b2b095e63cb95f3566500ac0c3b9432
+DIST binutils-2.41.tar.xz 26765692 BLAKE2B 3bccec2b52f7e82a727121bf2a2e51a6249ba63dcd74c665fd834e858645c912ffd8245d848435288b938852830b482905606f55c40df4061215fd75c52ffc75 SHA512 5df45d0bd6ddabdce4f35878c041e46a92deef01e7dea5facc97fd65cc06b59abc6fba0eb454b68e571c7e14038dc823fe7f2263843e6e627b7444eaf0fe9374
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
index 59a647521f..6ff6d3fee0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
@@ -22,7 +22,7 @@ SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
 LICENSE="|| ( GPL-3 LGPL-3 )"
 SLOT="0/${PV%_p?}"
 IUSE="64-bit-bfd cet multitarget nls static-libs test"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~x64-macos ~x64-solaris"
 RESTRICT="!test? ( test )"
 
 BDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild
new file mode 100644
index 0000000000..45c549b9f0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r7.ebuild
@@ -0,0 +1,163 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PATCH_VER=6
+PATCH_DEV=dilfridge
+
+inherit libtool toolchain-funcs multilib-minimal
+
+MY_PN="binutils"
+MY_P="${MY_PN}-${PV}"
+PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+PATCH_DEV=${PATCH_DEV:-dilfridge}
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+SLOT="0/${PV%_p?}"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+S="${WORKDIR}/${MY_P%_p?}"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gold,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# avoid automagic dependency on (currently prefix) systems
+		# systems with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_compile() {
+	emake V=1
+}
+
+multilib_src_install() {
+	emake V=1 DESTDIR="${D}" install
+
+	# Provided by sys-devel/gdb instead
+	rm "${ED}"/usr/share/info/sframe-spec.info || die
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r2.ebuild
new file mode 100644
index 0000000000..18e76e3fa5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41-r2.ebuild
@@ -0,0 +1,166 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PATCH_VER=2
+PATCH_DEV=dilfridge
+
+inherit libtool toolchain-funcs multilib-minimal
+
+MY_PN="binutils"
+MY_P="${MY_PN}-${PV}"
+PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+PATCH_DEV=${PATCH_DEV:-dilfridge}
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+
+SLOT="0/${PV%_p?}.0"
+
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+S="${WORKDIR}/${MY_P%_p?}"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gold,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# avoid automagic dependency on (currently prefix) systems
+		# systems with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Provided by sys-devel/gdb instead
+	rm "${ED}"/usr/share/info/sframe-spec.info || die
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41.ebuild
new file mode 100644
index 0000000000..f8d9487028
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.41.ebuild
@@ -0,0 +1,164 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PATCH_VER=1
+PATCH_DEV=dilfridge
+
+inherit libtool toolchain-funcs multilib-minimal
+
+MY_PN="binutils"
+MY_P="${MY_PN}-${PV}"
+PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
+PATCH_DEV=${PATCH_DEV:-dilfridge}
+
+DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
+HOMEPAGE="https://sourceware.org/binutils/"
+SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+SLOT="0/${PV%_p?}"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
+DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
+# Need a newer binutils-config that'll reset include/lib symlinks for us.
+RDEPEND="${DEPEND}
+	>=sys-devel/binutils-config-5
+"
+
+S="${WORKDIR}/${MY_P%_p?}"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/bfd.h
+)
+
+src_prepare() {
+	if [[ -n ${PATCH_VER} ]] ; then
+		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
+		eapply "${WORKDIR}/patch"/*.patch
+	fi
+
+	# Fix cross-compile relinking issue, bug #626402
+	elibtoolize
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# somehow libtool/configure is messed up and (custom patch at
+		# upstream?) and misdetects (basically assumes) nm can be called
+		# with -B arg -- can't run eautoreconf (fails), so patch up
+		# manually, this would break any target that needs -B to nm
+		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
+			libctf/configure || die
+	fi
+
+	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
+	# Avoid really confusing logs from subconfigure spam, makes logs far
+	# more legible.
+	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
+
+	default
+}
+
+pkgversion() {
+	printf "Gentoo ${PVR}"
+	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
+		--enable-obsolete
+		--enable-shared
+		--enable-threads
+		# Newer versions (>=2.24) make this an explicit option. #497268
+		--enable-install-libiberty
+		--disable-werror
+		--with-bugurl="https://bugs.gentoo.org/"
+		--with-pkgversion="$(pkgversion)"
+		$(use_enable static-libs static)
+		# The binutils eclass enables this flag for all bi-arch builds,
+		# but other tools often don't care about that support.  Put it
+		# beyond a flag if people really want it, but otherwise leave
+		# it disabled as it can slow things down on 32bit arches. #438522
+		$(use_enable 64-bit-bfd)
+		# This only disables building in the zlib subdir.
+		# For binutils itself, it'll use the system version. #591516
+		--without-zlib
+		--with-system-zlib
+		# We only care about the libs, so disable programs. #528088
+		--disable-{binutils,etc,ld,gas,gold,gprof,gprofng}
+		# Disable modules that are in a combined binutils/gdb tree. #490566
+		--disable-{gdb,libdecnumber,readline,sim}
+		# Strip out broken static link flags.
+		# https://gcc.gnu.org/PR56750
+		--without-stage1-ldflags
+		# We pull in all USE-flags that change ABI in an incompatible
+		# way. #666100
+		# USE=multitarget change size of global arrays
+		# USE=64-bit-bfd changes data structures of exported API
+		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
+
+		# avoid automagic dependency on (currently prefix) systems
+		# systems with debuginfod library, bug #754753
+		--without-debuginfod
+
+		# Revisit if it's useful, we do have binutils[zstd] though
+		--without-zstd
+
+		# Allow user to opt into CET for host libraries.
+		# Ideally we would like automagic-or-disabled here.
+		# But the check does not quite work on i686: bug #760926.
+		$(use_enable cet)
+	)
+
+	# mips can't do hash-style=gnu ...
+	if [[ $(tc-arch) != mips ]] ; then
+		myconf+=( --enable-default-hash-style=gnu )
+	fi
+
+	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
+
+	use nls \
+		&& myconf+=( --without-included-gettext ) \
+		|| myconf+=( --disable-nls )
+
+	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
+		# fix underlinking in opcodes
+		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
+			"${S}"/opcodes/Makefile.in || die
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	# Prevent makeinfo from running as we don't build docs here.
+	# bug #622652
+	sed -i \
+		-e '/^MAKEINFO/s:=.*:= true:' \
+		Makefile || die
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	# Provided by sys-devel/gdb instead
+	rm "${ED}"/usr/share/info/sframe-spec.info || die
+
+	# Provide libiberty.h directly.
+	dosym libiberty/libiberty.h /usr/include/libiberty.h
+}
+
+multilib_src_install_all() {
+	use static-libs || find "${ED}"/usr -name '*.la' -delete
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
index 7fba8685ac..ff8e25103f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
@@ -3,3 +3,4 @@ DIST ldb-2.5.2.tar.gz 1730347 BLAKE2B a0d3a9ae02f79c27b396314b804195ecd37b8bcd84
 DIST ldb-2.5.3.tar.gz 1736354 BLAKE2B dcd4d33f7a0ce3583bc96762b274d195c20e868337a29fd7793d6edf092069632f5c4f7f805693e3b330bbda1cc24540a989e2937f6325ac68bacf15d0f12db4 SHA512 b6f62dfb4887927514a98f01771b2178ac781886fc361600be0f59e513fc5762e3a421e48f452b1dd4452795f04b5c7c95e4dd4a9cc97573e563f5f528af4a35
 DIST ldb-2.6.2.tar.gz 1738908 BLAKE2B 44998efdff46486f94deb115225119cb3f6f23e15192672a5ac59c27e06c074fbcf2e1dba7d89d5ce273748cf08bc2261a10f7818cc2d02c4b25fd5403b158a9 SHA512 091111b8cf6cd93d662737890dacb64439e930b287d29299d2fc2cb18709f61d1e8a8c17d44f7224d8370dda6dc89af91e4ce8959816903ad5363388d8e37d8f
 DIST ldb-2.7.2.tar.gz 1737849 BLAKE2B 0aa70d8a4827448e41874db97130f18d17683c800b8f03f9940b4852e24fd6092052f6e70aae845c587939b9be16c80d7a920f6b874a746f923c4513b73d2afc SHA512 beb2cd83a8f128713e0b43ec6e80d0f87ab0883c6c8f0cefbbf5bf49e29dfa327b245b78467d1906917cb5f3f11e01cb76cc6bcca58a47c5deac4f05c2e9dfbd
+DIST ldb-2.8.0.tar.gz 1747616 BLAKE2B 19fd4cc0893ca36e7aa65eb605b050e3faeb7add6c00a2dfd8415334c58b7dc644ffaad41c24fe358b39292aaa581e3231e6b8161b03c073e903cdae16050ac5 SHA512 b6f289af3137e02a8e3ee0588bc300d1756b8980558e0b3a3a9eee4449100ccd42ed873187dbdb334e7e7834a8bff8478cd4f20588d4ca834d9ea14c0ee2c2f9
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.4.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.4.4.ebuild
index e059951959..a55b9fe509 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.4.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.4.4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.2.ebuild
index bce94cbb00..ed21ae51c6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.3.ebuild
index fdd9422216..97a29deb9f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.5.3.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
@@ -17,7 +17,7 @@ KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~
 IUSE="doc ldap +lmdb python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
-	test? ( lmdb python )"
+	test? ( lmdb )"
 
 RESTRICT="!test? ( test )"
 
@@ -67,6 +67,13 @@ pkg_setup() {
 
 src_prepare() {
 	default
+
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
 	multilib_copy_sources
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.6.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.6.2.ebuild
index 318abf8bb3..d0c4881fb1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.6.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.6.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
@@ -17,7 +17,7 @@ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv
 IUSE="doc ldap +lmdb python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
-	test? ( lmdb python )"
+	test? ( lmdb )"
 
 RESTRICT="!test? ( test )"
 
@@ -99,6 +99,12 @@ src_prepare() {
 
 	check_samba_dep_versions
 
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
 	multilib_copy_sources
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.7.2.ebuild
index 7a780a6184..13af13b433 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.7.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="threads(+)"
 inherit python-single-r1 waf-utils multilib-minimal
 
@@ -13,11 +13,11 @@ SRC_URI="https://samba.org/ftp/pub/${PN}/${P}.tar.gz"
 
 LICENSE="LGPL-3"
 SLOT="0/${PV}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="doc ldap +lmdb python test"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}
-	test? ( lmdb python )"
+	test? ( lmdb )"
 
 RESTRICT="!test? ( test )"
 
@@ -99,6 +99,12 @@ src_prepare() {
 
 	check_samba_dep_versions
 
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
 	multilib_copy_sources
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.8.0.ebuild
new file mode 100644
index 0000000000..82c5075edc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.8.0.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit python-single-r1 waf-utils multilib-minimal
+
+DESCRIPTION="LDAP-like embedded database"
+HOMEPAGE="https://ldb.samba.org"
+SRC_URI="https://samba.org/ftp/pub/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0/${PV}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc ldap +lmdb python test"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}
+	test? ( lmdb )"
+
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.1"
+TDB_VERSION="1.4.9"
+TEVENT_VERSION="0.15.0"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	dev-libs/popt[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tdb-${TDB_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tevent-${TEVENT_VERSION}[${MULTILIB_USEDEP}]
+	ldap? ( net-nds/openldap:= )
+	lmdb? ( >=dev-db/lmdb-0.9.16:=[${MULTILIB_USEDEP}] )
+	python? (
+		${PYTHON_DEPS}
+		sys-libs/talloc[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tdb[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tevent[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	virtual/libcrypt
+	test? ( >=dev-util/cmocka-1.1.3[${MULTILIB_USEDEP}] )
+"
+BDEPEND="${PYTHON_DEPS}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-doc/doxygen )
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+MULTILIB_WRAPPED_HEADERS=( /usr/include/pyldb.h )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.5.2-optional_packages.patch
+	"${FILESDIR}"/${PN}-1.1.31-fix_PKGCONFIGDIR-when-python-disabled.patch
+	"${FILESDIR}"/${PN}-2.4.2-skip-32bit-time_t-tests.patch
+	"${FILESDIR}"/${PN}-2.5.2-skip-waf-tevent-check.patch
+)
+
+pkg_setup() {
+	# Package fails to build with distcc
+	export DISTCC_DISABLE=1
+	export PYTHONHASHSEED=1
+
+	# waf requires a python interpreter
+	python-single-r1_pkg_setup
+}
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+
+	actual_tdb_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tdb/wscript || die)
+	if [[ ${actual_tdb_version} != ${TDB_VERSION} ]] ; then
+		eerror "Source tdb version: ${TDB_VERSION}"
+		eerror "Ebuild tdb version: ${actual_tdb_version}"
+		die "Ebuild needs to fix TDB_VERSION!"
+	fi
+
+	actual_tevent_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tevent/wscript || die)
+	if [[ ${actual_tevent_version} != ${TEVENT_VERSION} ]] ; then
+		eerror "Source tevent version: ${TEVENT_VERSION}"
+		eerror "Ebuild tevent version: ${actual_tevent_version}"
+		die "Ebuild needs to fix TEVENT_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	local myconf=(
+		$(usex ldap '' --disable-ldap)
+		$(usex lmdb '' --without-ldb-lmdb)
+		--disable-rpath
+		--disable-rpath-install
+		--with-modulesdir="${EPREFIX}"/usr/$(get_libdir)/samba
+		--bundled-libraries="${bundled_libs}"
+		--builtin-libraries=NONE
+	)
+
+	if ! use python || ! multilib_is_native_abi; then
+		myconf+=( --disable-python )
+	fi
+
+	waf-utils_src_configure "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+	multilib_is_native_abi && use doc && doxygen Doxyfile
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		WAF_MAKE=1 \
+		PATH=buildtools/bin:../../../buildtools/bin:${PATH}:"${BUILD_DIR}"/bin/shared/private/ \
+		LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:"${BUILD_DIR}"/bin/shared/private/:"${BUILD_DIR}"/bin/shared \
+		waf test || die
+	fi
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	if multilib_is_native_abi && use doc; then
+		doman  apidocs/man/man3/*.3
+		docinto html
+		dodoc -r apidocs/html/.
+	fi
+
+	# bug #726454
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	if has_version sys-auth/sssd; then
+		ewarn "You have sssd installed. It is known to break after ldb upgrades,"
+		ewarn "so please try to rebuild it before reporting bugs."
+		ewarn "See https://bugs.gentoo.org/404281"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
index 8c54524960..afbb7fec10 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
@@ -1,2 +1,3 @@
 DIST talloc-2.3.4.tar.gz 674196 BLAKE2B 1fac0a45a4ba16c7741e6d810e1a1e56352c04f266b99de62770177c1218a8c8253be2d5d1793aae67ce61e6a1159cbcd4888a49702822e6817b86eb7a1fea31 SHA512 c46488deda99753fd79566d42cae88899b71196513a127813be2cb855e7f36b77132f0552297ee4153ba4d8f177cea3bb0dc93340caabf321c026657744684d9
 DIST talloc-2.4.0.tar.gz 676054 BLAKE2B 71b3f21fa7cd114579e1dc064aadda447c0d196beaa27a5919acebdce668f6b768dd7c293c056ae4c096f31d8e931255ee2b71728c4b7b0bbb7818169380e9ca SHA512 810d92a614d0b9e0ac6fe403c1643c4dda435f79c4627d3c3be228f94b4b2ee8e528efbbed07f7d1a16043d6e55bdf4f10826f31fb8ca1c649c4126ea09a3aff
+DIST talloc-2.4.1.tar.gz 679160 BLAKE2B a7913b25930c77da53c17c2e0d71386402b1059f93c751084037c5068a035bd543c2d7e24a2d8dc989bb4eea13fa1a3c7a362e4d6c14af0b2030fbfb2f513801 SHA512 4de3b66d7cd1ff3f53e28e86bf9e89528635465c67868e1262aab6946106c228b2c184e988561361c3194fb260d83e016477254c9dbea7abff40c4dc0d31c76c
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild
new file mode 100644
index 0000000000..c3c90959ff
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils python-single-r1 multilib-minimal
+
+DESCRIPTION="Samba talloc library"
+HOMEPAGE="https://talloc.samba.org/"
+SRC_URI="https://www.samba.org/ftp/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3 LGPL-3+ LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+IUSE="compat +python test valgrind"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!elibc_SunOS? (
+		!elibc_Darwin? (
+			dev-libs/libbsd[${MULTILIB_USEDEP}]
+		)
+	)
+	python? ( ${PYTHON_DEPS} )
+"
+# Valgrind is automagic here but it's a build-only dep so it's not so bad.
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-util/valgrind )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-libs/libxslt
+	sys-devel/gettext
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# python goes only for native
+	/usr/include/pytalloc.h
+)
+
+pkg_setup() {
+	# Try to turn off distcc and ccache for people that have a problem with it
+	export DISTCC_DISABLE=1
+	export CCACHE_DISABLE=1
+
+	python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Drop irritating ABI names (e.g. cpython-37m)
+		# We're only installing one implementation anyway
+		sed -i "s/+ conf.all_envs\['default'\]\['PYTHON_SO_ABI_FLAG'\]//" wscript || die
+		sed -i "s/name = bld.pyembed_libname('pytalloc-util')/name = 'pytalloc-util'/" wscript || die
+	fi
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 test_pytalloc.py || die
+	fi
+
+	# WAF
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local extra_opts=(
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+
+		$(usev compat --enable-talloc-compat1)
+		$(multilib_native_usex python '' --disable-python)
+		$([[ ${CHOST} == *-solaris* ]] && echo '--disable-symbol-versions')
+	)
+
+	waf-utils_src_configure "${extra_opts[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	# waf is stupid, and no, we can't fix the build-system, since it's provided
+	# as a brilliant binary blob thats decompressed on the fly
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		install_name_tool \
+			-id "${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+			"${ED}"/usr/$(get_libdir)/libtalloc.${PV}.dylib || die
+
+		if use python ; then
+			install_name_tool \
+				-id "${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.${PV}.dylib || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.${PV}.dylib || die
+
+			install_name_tool \
+				-id "${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.dylib || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.dylib || die
+
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libpytalloc-util.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.dylib \
+				"${D}"$(python_get_sitedir)/talloc*.bundle || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${D}"$(python_get_sitedir)/talloc*.bundle || die
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
index 56b9d8f6ca..e452caa9ba 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
@@ -1,2 +1,3 @@
 DIST tdb-1.4.7.tar.gz 741714 BLAKE2B ec2f991bbaa61d46f16b7a68a4e47a2f690cda261dd0e9fd9708e51ad64eefeb54ac8b1102cde6935916f840d3c89d7a2903f58175cceb78ea4ef889e82ddbc6 SHA512 2b5b20c299b60545943f106d854b6e0d4a559e16f08a7ed62fe57ee962bebc888c2e663bd5fef907aace05b316826fe8fbbf3f323b6d3427531e59ffe47d48e4
 DIST tdb-1.4.8.tar.gz 742791 BLAKE2B dc2705cb16ee59f4d5bf25602032b25fd5338caa890db19939996a40cd19c4c999f9a74786d5754dbbd1de54d818541cf56844beeb33008aaee507d5dfcdba85 SHA512 763beebe923aa04303cbb91ce5970e6bbd13546888cff75ea9ab025afff3ef88fee539ae173fc2fb7ec661b6c337b0c2da361ce3d318f51ef6627bdb3fe6ca63
+DIST tdb-1.4.9.tar.gz 746608 BLAKE2B 2cdcf636b9ef5445d48ca2aab79d4ffd137a8409b6d7b1fcdbcd28797d4bbe617f768a5ef92a14c4ae6dddfc37576f5d411cf4d67edeb4319f46a1a15ffd94ee SHA512 6b0109075826b8630f6b5a7e7ade2fcff95c5d05338340af78219422610947c520707b3e484ff13fbd40bbfffe13977976e8ddcb1be7b13e13ac78b4e3ec06c2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild
new file mode 100644
index 0000000000..5b6c8e1e54
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils multilib-minimal python-single-r1
+
+DESCRIPTION="Simple database API"
+HOMEPAGE="https://tdb.samba.org/"
+SRC_URI="https://samba.org/ftp/tdb/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="python test"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	python? ( ${PYTHON_DEPS} )
+"
+DEPEND="
+	${RDEPEND}
+	virtual/libcrypt
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-text/docbook-xml-dtd:4.2
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+src_prepare() {
+	default
+
+	python_fix_shebang .
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 python/tests/simple.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	#MAKEOPTS+=" -j1"
+
+	local extra_opts=(
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+	)
+
+	if ! multilib_is_native_abi || ! use python ; then
+		extra_opts+=( --disable-python )
+	fi
+
+	waf-utils_src_configure "${extra_opts[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_test() {
+	# the default src_test runs 'make test' and 'make check', letting
+	# the tests fail occasionally (reason: unknown)
+	emake check
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+	use python && python_optimize
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
index 5d24c61a6c..e0b9daa2d1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
@@ -2,3 +2,4 @@ DIST tevent-0.12.1.tar.gz 879683 BLAKE2B 51521aa26dc3ac38dcf69cdb77a7ad33fede889
 DIST tevent-0.13.0.tar.gz 880601 BLAKE2B 4e2a2c055bac28cecae1a95b7ddab349ed780f44427e74709eca497d6242bc4f46a91878d3d253c1af4819887ce7df522fe41f88f6059ec5f6c706c7e071ee35 SHA512 7aa05c09e3c708769e31cda88b319cee3629c88c51bda559193a85d4ab32204a8b4ba11f142861dbca06b578bf54953f2aca1ad847e99995a4fc40bf08618a93
 DIST tevent-0.14.0.tar.gz 878142 BLAKE2B 8c1c2b4cb683a3ca2630181904566c3cf9d0151c7e280f86e0ce24febfc5d0a1e85757e3ad9d635205bbcbe3e0d0a060dedb3207fb4e91ea76f36246f0a2704a SHA512 5e9525b2f8f8014d1147244dcccd6cf5ac49e383c49b19480ac1256dc7ccf60705960e87b8f63348fca3f4f496861f3d307ee5e0fde8189d93a596c5e689f2b1
 DIST tevent-0.14.1.tar.gz 881979 BLAKE2B 272b7d0029061dfd172a39135d806b937ee6f5bb9eb4c9c8d68a6e5cb3d9eca01582f7ddf5a15d7f033d3322c7fd4d6e87d697f76e4d44565c8e757398a5f0f8 SHA512 0bcc87c10f84e947edad8f8c31f3923253c599b7a69a1db1c21ab292e02937ccb8bad9f0f70e27420ead687aaed1a9b3830b6daa903b8a9bd48cc035a6e5f4ec
+DIST tevent-0.15.0.tar.gz 884634 BLAKE2B 071906dc0cc199a9b550e74ca7fcd3555e54a1c48a9be2c107c498ccf2157521336c3ec63fd776e3551064e9baf1ebcf9c7ff5eb0f04375b7d714056331476aa SHA512 470cc4489255a4f122ba1d680669589ba375d4081ff46631dd56f5104202d175bfb13356820eb9108a6b768b3837b2f5d26cc7b0acc3071c4787fb070df3cbab
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.15.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.15.0.ebuild
new file mode 100644
index 0000000000..d5297a130f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.15.0.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils multilib-minimal python-single-r1
+
+DESCRIPTION="Samba tevent library"
+HOMEPAGE="https://tevent.samba.org/"
+SRC_URI="https://samba.org/ftp/tevent/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+IUSE="python test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.1"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	python? (
+		${PYTHON_DEPS}
+		>=sys-libs/talloc-${TALLOC_VERSION}[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	elibc_glibc? (
+		net-libs/libtirpc[${MULTILIB_USEDEP}]
+		net-libs/rpcsvc-proto
+	)
+	test? ( >=dev-util/cmocka-1.1.3 )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		# (depsite the name. bindings.py is just for Python tests.)
+		truncate -s0 bindings.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test ; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	waf-utils_src_configure \
+		--libdir="${EPREFIX}/usr/$(get_libdir)" \
+		--disable-dependency-tracking \
+		--disable-warnings-as-errors \
+		--bundled-libraries="${bundled_libs}" \
+		--builtin-libraries=NONE \
+		$(multilib_native_usex python '' '--disable-python')
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	multilib_is_native_abi && use python && python_domodule tevent.py
+}
+
+multilib_src_install_all() {
+	insinto /usr/include
+	doins tevent_internal.h
+}