diff --git a/changelog/security/2025-04-15-weekly-updates.md b/changelog/security/2025-04-15-weekly-updates.md
new file mode 100644
index 0000000000..3be0ddc4a4
--- /dev/null
+++ b/changelog/security/2025-04-15-weekly-updates.md
@@ -0,0 +1,2 @@
+- go ([CVE-2025-22871](https://www.cve.org/CVERecord?id=CVE-2025-22871))
+- perl ([CVE-2024-56406](https://www.cve.org/CVERecord?id=CVE-2024-56406))
diff --git a/changelog/updates/2025-04-15-weekly-updates.md b/changelog/updates/2025-04-15-weekly-updates.md
new file mode 100644
index 0000000000..a5492a446c
--- /dev/null
+++ b/changelog/updates/2025-04-15-weekly-updates.md
@@ -0,0 +1,8 @@
+- SDK: go ([1.24.2](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: perl ([5.40.2](https://perldoc.perl.org/perl5402delta) (includes [5.40.1](https://perldoc.perl.org/perl5401delta))
+- SDK: pkgcheck ([0.10.34](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.34))
+- azure, dev, gce, sysext-python: python ([3.11.12](https://www.python.org/downloads/release/python-31112/))
+- base, dev: sqlite ([3.49.1](https://sqlite.org/releaselog/3_49_1.html) (includes [3.49.0](https://sqlite.org/releaselog/3_49_0.html), [3.48.0](https://sqlite.org/releaselog/3_48_0.html)))
+- dev: bash-completion ([2.16.0](https://github.com/scop/bash-completion/releases/tag/2.16.0))
+- dev: pahole ([1.29](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.29) (includes [1.28](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.28)))
+- sysext-python: setuptools ([78.1.0](https://github.com/pypa/setuptools/blob/v78.1.0/NEWS.rst) (includes [78.0.2](https://github.com/pypa/setuptools/blob/v78.0.2/NEWS.rst), [78.0.1](https://github.com/pypa/setuptools/blob/v78.0.1/NEWS.rst), [78.0.0](https://github.com/pypa/setuptools/blob/v78.0.0/NEWS.rst), [77.0.3](https://github.com/pypa/setuptools/blob/v77.0.3/NEWS.rst), [77.0.2](https://github.com/pypa/setuptools/blob/v77.0.2/NEWS.rst), [77.0.1](https://github.com/pypa/setuptools/blob/v77.0.1/NEWS.rst), [77.0.0](https://github.com/pypa/setuptools/blob/v77.0.0/NEWS.rst), [76.1.0](https://github.com/pypa/setuptools/blob/v76.1.0/NEWS.rst), [76.0.0](https://github.com/pypa/setuptools/blob/v76.0.0/NEWS.rst)))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/0001-cmd-link-stop-forcing-binutils-gold-dependency-on-aa.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/0001-cmd-link-stop-forcing-binutils-gold-dependency-on-aa.patch
deleted file mode 100644
index 55c3fa2f40..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/0001-cmd-link-stop-forcing-binutils-gold-dependency-on-aa.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 6d265b008e3d106b2706645e5a88cd8e2fb98953 Mon Sep 17 00:00:00 2001
-From: Dirk Müller <dirk@dmllr.de>
-Date: Wed, 09 Mar 2022 17:47:23 +0100
-Subject: [PATCH] cmd/link: stop forcing binutils-gold dependency on aarch64
-
-The bfd linker appears to be working just fine at least in version
-2.41 or above. Reject the known broken one instead, which
-avoids an architecture specific linker dependency that
-is cumbersome for distributions.
-
-Fixes #22040.
-
-Change-Id: I9f377e47c22ef20497479c0978c053ed5de46a38
----
-
-diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
-index 2d8f964..fcf0bc7 100644
---- a/src/cmd/link/internal/ld/lib.go
-+++ b/src/cmd/link/internal/ld/lib.go
-@@ -1670,27 +1670,6 @@
- 			// Use lld to avoid errors from default linker (issue #38838)
- 			altLinker = "lld"
- 		}
--
--		if ctxt.Arch.InFamily(sys.ARM64) && buildcfg.GOOS == "linux" {
--			// On ARM64, the GNU linker will fail with
--			// -znocopyreloc if it thinks a COPY relocation is
--			// required. Switch to gold.
--			// https://sourceware.org/bugzilla/show_bug.cgi?id=19962
--			// https://go.dev/issue/22040
--			altLinker = "gold"
--
--			// If gold is not installed, gcc will silently switch
--			// back to ld.bfd. So we parse the version information
--			// and provide a useful error if gold is missing.
--			name, args := flagExtld[0], flagExtld[1:]
--			args = append(args, "-fuse-ld=gold", "-Wl,--version")
--			cmd := exec.Command(name, args...)
--			if out, err := cmd.CombinedOutput(); err == nil {
--				if !bytes.Contains(out, []byte("GNU gold")) {
--					log.Fatalf("ARM64 external linker must be gold (issue #15696, 22040), but is not: %s", out)
--				}
--			}
--		}
- 	}
- 	if ctxt.Arch.Family == sys.ARM64 && buildcfg.GOOS == "freebsd" {
- 		// Switch to ld.bfd on freebsd/arm64.
-diff --git a/src/make.bash b/src/make.bash
-index b67ae15..7df4910 100755
---- a/src/make.bash
-+++ b/src/make.bash
-@@ -94,6 +94,16 @@
- 	;;
- esac
- 
-+# Test for bad bfd.ld
-+if test "$(uname -m)" = "aarch64" && ld -v | grep -E "GNU ld.* 2\.([0-3]|40)"; then
-+	echo 'ERROR: Your system uses bfd.LD 2.40 or older which has issues with dynamic linking on aarch64'
-+	echo 'Consider upgrading or switching to binutils-gold.'
-+	echo
-+	echo 'See https://sourceware.org/bugzilla/show_bug.cgi?id=30437'
-+
-+	exit 1
-+fi
-+
- # Test for bad ld.
- if ld --version 2>&1 | grep 'gold.* 2\.20' >/dev/null; then
- 	echo 'ERROR: Your system has gold 2.20 installed.'
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/README.md
deleted file mode 100644
index 77663c42ec..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `0001-cmd-link-stop-forcing-binutils-gold-dependency-on-aa.patch`
-drops the use of the gold linker. Track the following to see when it
-needs to be dropped:
-
-- https://go-review.googlesource.com/c/go/+/391115
-- https://github.com/golang/go/issues/22040
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 0f78484df8..be48ab3f22 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -30,6 +30,16 @@
 
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
+
+# Needed to address CVE-2025-22871 and to bring in a patch disabling
+# gold linker on arm64.
+=dev-lang/go-1.24.2-r1 ~amd64 ~arm64
+
+# Needed to address CVE-2024-56406.
+=dev-lang/perl-5.40.2 ~amd64 ~arm64
+
+# Keep versions on both arches in sync.
+=dev-lang/python-3.11.12 ~amd64
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
@@ -42,9 +52,6 @@
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/luksmeta-9-r1 **
 
-# Keep versions on both arches in sync.
-=dev-util/bpftool-7.5.0 ~arm64
-
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-9999.ebuild
index da72a148ab..2ec66e0aa9 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit meson-multilib usr-ldscript
+inherit meson-multilib
 
 DESCRIPTION="A high-quality data compressor used extensively by Gentoo Linux"
 HOMEPAGE="https://gitlab.com/bzip2/bzip2"
@@ -33,14 +33,6 @@ multilib_src_configure() {
 	meson_src_configure
 }
 
-multilib_src_install() {
-	meson_src_install
-
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a bz2
-	fi
-}
-
 multilib_src_install_all() {
 	dodir /bin
 	mv "${ED}"/usr/bin/bzip2 "${ED}"/bin/bzip2-reference || die
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
index 49accba5c1..f948138923 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
@@ -1,4 +1,4 @@
 DIST gzip-1.13.tar.xz 838248 BLAKE2B f0e3b4c28bafcd3b59b65ac2d71218dc58d81b52c6921c1be038757c99e99184178c5d0e9674caa5099713b8b64e8c85cf061f4abfa20b73b478288f121fb05d SHA512 e3d4d4aa4b2e53fdad980620307257c91dfbbc40bcec9baa8d4e85e8327f55e2ece552c9baf209df7b66a07103ab92d4954ac53c86c57fbde5e1dd461143f94c
 DIST gzip-1.13.tar.xz.sig 833 BLAKE2B 42e38fa7b3a6b6d21a18308cf662844ed84e1a142a945f3f3142db0a14212c0e642de514abb1307ec12ee7bb9644472cc3aed40582d9c266ab24808acbca0215 SHA512 f95e016f61f4a67cb4cec6cede2510af6bb5567d72bbd3d70210a6d5cf3ee5fea8f0cbf8f7b612fa52f2ecfd9dba050d9cd4494075ce5ac4abac7b74eaa7ccbc
-DIST gzip-1.13_p20250405.tar.xz 892960 BLAKE2B a3b52fbc4db6594ebc98d0f49d04f18073036bd2b29ac1aedb77ce124f8ac232e502450763d260d9d836066d21106b4770561f67dbe833bf43ed9b6c12987389 SHA512 8c439fbb15924eb38e421b04919fc2013e5a814445c83b665e4538f34f9b4b8c73dfe1910aba8c38ef98ee4bd57f01082798e6056802a12aa95d0c82e4a08412
-DIST gzip-1.13_p20250405.tar.xz.sig 833 BLAKE2B b47479ee151f093e6fa81abfe9587c887994562bb19631da9b3506a020ec8ccbc34eb79df29f61e4e441b46fb3e7b5e603357d75edf5d13973ca52737967f897 SHA512 162488d2085664514f8893128fbe6227860e8c8e152a979196c311f68706781c058fdada3fe659e41059aaaf281f0539b035f358e5e633d59e9c5634edbefadb
+DIST gzip-1.14.tar.xz 885748 BLAKE2B 32f7241bd9f3b7f73a59905a5bc9abf4e360e787f692cbb00ad28d48abee52744846d10c07ce2f7aaa3e66bc4b6ab9cd4f1b8e98854bb7d1ec010ae0d5146932 SHA512 82aef53188b3e69b51b7ddab5b8c44a11a5b73c0039b22a315a0c7d244694feab0146748add4265901eb1b4c0cee8a9eb69594995f098830d964091af97079c5
+DIST gzip-1.14.tar.xz.sig 833 BLAKE2B a13ade68035fe32d69c24a1b5791ae6d7163cbbbebda396b4c773f2dc82ea6c619a44c39adc53dcd8fff094962a1c2dddfabfc7ec2cf54561202ef9a2be325ae SHA512 a5abd09e3b7bda8d87e5af7d2bd943e6021272cb0b6aa05625ddfeae45838aede1ffd91d7e0cb4e170f7f3078035f735f8441bc15cc115c51d302e0a11be44cf
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13_p20250405.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index d21eea9b85..9a395cd2f8 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,4 +1,2 @@
-DIST libarchive-3.7.8.tar.xz 5493312 BLAKE2B ba058b2fa2afbfe53127d6ffd0a7ab00d9e8faf62340ae2eb8871a0ca232c2de482dbff2c4eedf2c45d944eb555123d765c462818158046bb72951f6421d9ea0 SHA512 a2b6c8c337e75bcce73126c30a3b564dc586df973780d9c7d5a9eed693dbe3779bf762b64c49c47203c2768c92a4a7d2dc8c0445b1dc398eafd2d58b0ba5aae6
-DIST libarchive-3.7.8.tar.xz.asc 659 BLAKE2B 2050214592b0add7cbd758b815c4289a8760bfb2e5b5db581afdbe741d348252b73f99919641cacd908b586cf4f8fc30a591d88b869bd607adc837251d8fbd4e SHA512 3f1d70318f5e2369fa59e94f91bf8473630a448ded11e2ff3502657380221b9e11e849dc98ba0806c3110c7267cee251f7d681db27751e2a45a948f6ad558404
 DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
 DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.8.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.8.ebuild
deleted file mode 100644
index 3747ae4675..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.8.ebuild
+++ /dev/null
@@ -1,173 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-inherit libtool multilib-minimal toolchain-funcs verify-sig
-
-DESCRIPTION="Multi-format archive and compression library"
-HOMEPAGE="
-	https://www.libarchive.org/
-	https://github.com/libarchive/libarchive/
-"
-SRC_URI="
-	https://www.libarchive.de/downloads/${P}.tar.xz
-	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
-"
-
-LICENSE="BSD BSD-2 BSD-4 public-domain"
-SLOT="0/13"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="
-	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
-	static-libs test xattr +zstd
-"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	sys-libs/zlib:=[${MULTILIB_USEDEP}]
-	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
-	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
-	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
-	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
-	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
-	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
-	dev-libs/openssl:=[${MULTILIB_USEDEP}]
-	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
-	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
-	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}
-	kernel_linux? (
-		virtual/os-headers
-		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
-	)
-	test? (
-		app-arch/lrzip
-		app-arch/lz4
-		app-arch/lzip
-		app-arch/lzop
-		app-arch/xz-utils
-		app-arch/zstd
-		lzma? ( app-arch/xz-utils[extra-filters(+)] )
-	)
-"
-BDEPEND="
-	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
-	elibc_musl? ( sys-libs/queue-standalone )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
-
-# false positives (checks for libc-defined hash functions)
-QA_CONFIG_IMPL_DECL_SKIP=(
-	SHA256_Init SHA256_Update SHA256_Final
-	SHA384_Init SHA384_Update SHA384_Final
-	SHA512_Init SHA512_Update SHA512_Final
-)
-
-PATCHES=(
-	# https://github.com/libarchive/libarchive/issues/2069
-	# (we can simply update the command since we don't support old lrzip)
-	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
-)
-
-src_prepare() {
-	default
-
-	# Needed for flags to be respected w/ LTO
-	elibtoolize
-}
-
-multilib_src_configure() {
-	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
-
-	local myconf=(
-		$(use_enable acl)
-		$(use_enable static-libs static)
-		$(use_enable xattr)
-		$(use_with blake2 libb2)
-		$(use_with bzip2 bz2lib)
-		$(use_with expat)
-		$(use_with !expat xml2)
-		$(use_with iconv)
-		$(use_with lz4)
-		$(use_with lzma)
-		$(use_with lzo lzo2)
-		$(use_with nettle)
-		--with-zlib
-		$(use_with zstd)
-
-		# Windows-specific
-		--without-cng
-	)
-	if multilib_is_native_abi ; then
-		myconf+=(
-			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
-			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
-		)
-	else
-		myconf+=(
-			--disable-bsdcat
-			--disable-bsdcpio
-			--disable-bsdtar
-			--disable-bsdunzip
-		)
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi ; then
-		emake
-	else
-		emake libarchive.la
-	fi
-}
-
-src_test() {
-	mkdir -p "${T}"/bin || die
-	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
-	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
-	# workaround lrzip broken on 32-bit arches with >= 10 threads
-	# https://bugs.gentoo.org/927766
-	cat > "${T}"/bin/lrzip <<-EOF || die
-		#!/bin/sh
-		exec "$(type -P lrzip)" -p1 "\${@}"
-	EOF
-	chmod +x "${T}/bin/lrzip" || die
-	local -x PATH=${T}/bin:${PATH}
-	multilib-minimal_src_test
-}
-
-multilib_src_test() {
-	# sandbox is breaking long symlink behavior
-	local -x SANDBOX_ON=0
-	local -x LD_PRELOAD=
-	# some locales trigger different output that breaks tests
-	local -x LC_ALL=C.UTF-8
-	emake check
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi ; then
-		emake DESTDIR="${D}" install
-	else
-		local install_targets=(
-			install-includeHEADERS
-			install-libLTLIBRARIES
-			install-pkgconfigDATA
-		)
-		emake DESTDIR="${D}" "${install_targets[@]}"
-	fi
-
-	# Libs.private: should be used from libarchive.pc instead
-	find "${ED}" -type f -name "*.la" -delete || die
-	# https://github.com/libarchive/libarchive/issues/1766
-	sed -e '/Requires\.private/s:iconv::' \
-		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild
index af10ff4683..3747ae4675 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild
@@ -16,7 +16,7 @@ SRC_URI="
 
 LICENSE="BSD BSD-2 BSD-4 public-domain"
 SLOT="0/13"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="
 	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
 	static-libs test xattr +zstd
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild
index 7b95b15830..5b3ebfb91f 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/lz4/lz4/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="BSD-2 GPL-2"
 SLOT="0/1.10.0-meson"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
index 1a06b858fa..dc4bdc2c0d 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest
@@ -1,2 +1,3 @@
 DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46b72b6c437efbd01ed890c5ae9c5d812464bc6d10e32aea20fd0c6df00d98cd30502dd73f9a27b0d8d143a5542976d9 SHA512 86eb24acfa5d4d87ae396f8888e2484693823fad897a29f1a5ada78e2318640927cfcff1e85415bfd6c66f5417e582203eb94976d52e3dd373997e6e2cbae354
 DIST containerd-2.0.3.tar.gz 10450757 BLAKE2B 5dec56a40dc2874fb0b6fd4d72704f6417858eefd983c8ec5dfb2c9ef8be1e9e309cff83395e03c2d5fef30ed5c0561329ffbcd3dfba91e40d8017f7a605771b SHA512 9528a65d9d9f13d15d861f7ce71ab483958020bda83947d18868b477204e9e2e33eccc69280502c54b2be9ce577724e3e2b1772229c99636099b04bac1079ac1
+DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9da8e33b1140c0b5866dcc61e17fe1040f31ef09bdb07ad98a52def5e9eb12cfeb635e96b2c5f64fdb4d8cfb6c84b885 SHA512 f84e0cc0b82313df010b95989faf56e81ebfbbc321585b968c8c706917b91a9f0d895692fa5046f24f1c370de7a74b50daf83da617fe0595e5a8ff69ed658727
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.0.4.ebuild
new file mode 100644
index 0000000000..e7315295f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.0.4.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=06b99ca80cdbfbc6cc8bd567021738c9af2b36ce
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
index 9b854c8d3b..31c6c92306 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest
@@ -1,2 +1,4 @@
 DIST docker-cli-28.0.1-man.tar.xz 70360 BLAKE2B 395736a74b314530fbbd6bf4016f7f211a3ee4754179cde0d8edf16f489c3fd92565cf73033defb80fd8280e4ef1e2add15541102944401123cfb251b06492f9 SHA512 b72e4f35a80d72d18f701edcace46eb11fbcf1ba40a1ab8efa913edc74e265dafbdc58c7c0d442293d71ce2cfc952fcbed5afee5d5f3ba52d9d25741d5a12593
 DIST docker-cli-28.0.1.tar.gz 7413092 BLAKE2B 69075ba24eb7c46593d7c4ab80499b67994119af8096409f55eec9524173cb8d37263159cd834e3cfaf4e8d169b568232d400633b2d9b08112ced05c78338f92 SHA512 c3d7ca21b88c5f6925f6c99519a67581fd6c264cc96e6c0bc00751f87de6580a2d443cbe59b2e36771e37a78fe05ea054e292675e19bc4d73fcacfda047e0490
+DIST docker-cli-28.0.4-man.tar.xz 70440 BLAKE2B 676eeafda725c759074124e1ccef693d3f0232e2acf3c2b468d28f48e7228b36c885d690cf041bab775b8410e65c1c6f1403b712a869a5610a03ae788f175a0b SHA512 e36dccb3ea043b722993001ebc36180874b65df5fdd446c52ad2902812097a456ee5d1d432e4c5f5db553213c9956c1f2ef3d07e171760f1e29248f3a6dedf9f
+DIST docker-cli-28.0.4.tar.gz 7504883 BLAKE2B c975eff2bb4c0dd5430a67418804e8649c733a59ac6b2beb9f2a454a8e8839e12afbf61afccb1e3bd0cb2e38c51fbd59fee3de45490a02ec9ad074cd365ece2c SHA512 fd7562815686fece20a0ea95501612e049e90192305464b06770643ae864baa87b0fb87fddadeb4f9beb33352940cef63ffd24af8b989e309cd5be5f32eddf62
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
new file mode 100644
index 0000000000..ec5fe43c9a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.0.4.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=b8034c0ed70494a90c133461d145cd072d920d7c
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="hardened selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	insinto /usr/share/fish/vendor_completions.d/
+	doins contrib/completion/fish/docker.fish
+	insinto /usr/share/zsh/site-functions
+	doins contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
index 2a0ba14294..63457dfcf8 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
@@ -1 +1,2 @@
 DIST docker-28.0.1.tar.gz 17553228 BLAKE2B 8c172d58fb75d307983ace06b509e86ed533729d75a27af114939cad9022980f692368249f6ef514912aa90f1fa09998fd658377e28d2e2577d53b6f745cf5db SHA512 58c77ae139e5d32c4c263fa14ec4457f50240a15cd7934b4d2576af0295bfb5b62abbeef0ba78815f9041a01dbe3a8b35351eaebea1f584f54ef0d4192734048
+DIST docker-28.0.4.tar.gz 17579330 BLAKE2B 3b1ecb6ddceea0fe772bd597bf6b3c4b5867b691e35bbb0b05ad6ab0c4dc79193dbde02cdcb45c607c0dd704aeaa9629deffb098a0d1533dd3f5e9fb882ef34f SHA512 dfa6bc18c7cecf82c80e45c6a615e0cccb866a993ad2b6c3134e0f0d5d069b5abb0b8201029019a5396353f666252b5fd36b6a34080723af46291d3fda1c2608
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.4.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.4.ebuild
new file mode 100644
index 0000000000..b28b8e31e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.0.4.ebuild
@@ -0,0 +1,333 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=6430e49a55babd9b8f4d08e70ecb2b68900770fe
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.0.4[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
index d3e2e40f67..48951b8333 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
@@ -1,2 +1,3 @@
 DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
 DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
+DIST runc-1.2.6.tar.gz 2763135 BLAKE2B d5e40e95f8c0069073d0010d120aca1828e585b103ecd671fca072138ef3528a316414cfac5ca725f45cb84f23ab4216d9e6f466beb118fb2813ab4be3a18e92 SHA512 9a89295e001914726dfc1040729301f62ad6b630943c65f7ade6ed460ef4a2f5f35cf40662730a9e8a6c6d0301a3c9959a85973097ceb8db05c043f9c1a86248
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.6.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.6.ebuild
new file mode 100644
index 0000000000..70f1124cb3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.6.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=e89a29929c775025419ab0d218a43588b4c12b9a
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
index 98971cd787..70de6a23a1 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild
@@ -34,7 +34,7 @@ LICENSE="GPL-2 LGPL-2.1"
 # Bump FUDGE if a release is made which breaks ABI without changing SONAME.
 # (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
 SLOT="1/11.6.15.2"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0794.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0794.ebuild
index 44626cc641..0136fe9abd 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0794.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0794.ebuild
@@ -16,7 +16,7 @@ if [[ ${PV} == 9999* ]] ; then
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
 		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 S="${WORKDIR}/vim-${PV}"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0794.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0794.ebuild
index 9ea9fe31a4..3b8964d898 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0794.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0794.ebuild
@@ -21,7 +21,7 @@ if [[ ${PV} == 9999* ]] ; then
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
 		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="Vim, an improved vi-style text editor"
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0.ebuild
index c6b9132f3f..9b9a744cd3 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="+eselect test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 47b4aec0e9..1eb6b3cda0 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -22,10 +22,9 @@ DIST bash-5.1.tar.gz 10458638 BLAKE2B 42059556694b604911b5b7936f94d42d8923f2931f
 DIST bash-5.1.tar.gz.sig 95 BLAKE2B ac9209d6a4ab4436c511a7a195594e9036d7d1aef7887972f61a0e97378a9685b882621d7f95f5326b155dc155c41635417ce2ca41ac6d0dda78bd293ea4249f SHA512 3966404c0f683c7ef214fcf283b551e5441af3897009f778308c2e34067d98d57c95561453416a54ca5b1daf9a1288dbf950fe3f13353703cead12f5eec5fad8
 DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30919a13271e39e1cb66a0672f242df75fc7d71627ea873dfbce53ec35c0c56a71c5167143070a7811343fd9 SHA512 5647636223ba336bf33e0c65e516d8ebcf6932de8b44f37bc468eedb87579c628ad44213f78534beb10f47aebb9c6fa670cb0bed3b4e7717e5faf7e9a1ef81ae
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
-DIST bash-5.3-beta.tar.gz 10667630 BLAKE2B d6d3a1efd5ed69b131e2831e35c4a620968132e7d9da079de155decb4d3c736cd6c9f1180523e85dd41aeecdb9b380e4768bc551afafaee478168c462ce90929 SHA512 f8f02b4a90312c8e7c589efd1a0a43a4db3bcb47d19cb95190961e4ae254b2d6d26472197ce216868d914fe1adf62741f927552239559a1c3b2c64dfcfaa8cb0
-DIST bash-5.3-beta.tar.gz.sig 94 BLAKE2B a4b85d5755e200abddd5669c3d21b1ee6be8036b27934e25473c14b15ffc1bc7cbbd5a94f39a0dc6bf6050908590509f0ba39d28c33947154cc966e11d454c8c SHA512 72184ca2afe3d0c8c2165516499a61da2aecc0c8c83661cab0038c3d849623115729d2ade73c4b5973ea9b5e8169af4bc2aea51f0b70356af26342285adab2f5
-DIST bash-5.3_beta_p20250331-a6767763de5e7859107711b166a64a9e4a77a8ae.tar.gz 15771417 BLAKE2B 79257460482c2d6fca55bb8101c0fbfcc9f0810f3e0e54eb8e94e352e87eea2c54873e2822caa963acb752f1c4156780398e4bf44b57986a2b2f600919149094 SHA512 850ae02f4e924165ec75a71fdd5956e13f4ee40916e5a7854ff90cfde6cd73124a46cb4c8a89f750fc78eb912905835a9b303b0f5febbd40666678af81f0f1fa
-DIST bash-5.3_beta_p20250404-2e113467f061587a3475b692d25ca449717834c8.tar.gz 15769616 BLAKE2B f1bd12beaff9d72675ddb58a5454da9414c30ae2e0170c971094142eaae43f8b56f92489fafb373a3df2ab76029cd78eddf103ac08c73de169375de9383b971e SHA512 03ba3aabc4e91bcea5cb99b56dbd6e7110801fc5d640514283058c44b64e6448f678caca350f7887657ede3dfe7541df9a9aaec1e5f66047fff52a154da14694
+DIST bash-5.3-rc1.tar.gz 10742642 BLAKE2B 846414fe545da1ee62b541a8861d68e1dc57114276d40c6af2a9ab1f91cedb220d060f1bd81a811d6dacd841cd1b66e0ed7d8462b3c7066ad204f3786d6af0ec SHA512 16a74fcb31a8ea20cf9505a8cee584a02baed1d2c47b75556e4ae6752712db8f9e0b4b202d2cbe77990fec1ff141ff35e410d4495887ed90f5457c032079c5e5
+DIST bash-5.3-rc1.tar.gz.sig 95 BLAKE2B cc7916f92eddd881ac4d791918b7bb579396df4badbd671a7d0664fd814cee37327dce31d288a8fb03bc66a23536873b5fcd72f2e08e294b9ff9f2ef889741e3 SHA512 a275ff17f9318b5626450eeeb9f49157c9b20df974e004adb26f6585c84deea8d68fc0e1670f990096675ecadd652b58895f74c4e40c8e142a3c2ed414145248
+DIST bash-5.3_rc1_p20250409-42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c.tar.gz 15866668 BLAKE2B 472b67d397dd0f4ba070d4899bb1ecde08a90a7d2f5fc16b8f79c7113d2ca66cbc353e128ace17128069ebc7f8560605dda1441019174a942abb0dd345629746 SHA512 43614445ac11d25258ba6c47f020a1b87d8fa33b139e4d2237683ea0465bf24b03cf84e7e2771de4b038bbecab44c923bb307e4a60b9590b42936ea4e7c86e73
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta.ebuild
deleted file mode 100644
index 2d3d4c9c97..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta.ebuild
+++ /dev/null
@@ -1,411 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic toolchain-funcs prefix verify-sig
-
-# Uncomment if we have a patchset.
-#GENTOO_PATCH_DEV="sam"
-#GENTOO_PATCH_VER="${PV}"
-
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-# The version of readline this bash normally ships with. Note that we only use
-# the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="bb56d620e075e3c96ae84b52de6b74683d9ab320"
-	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${BASH_COMMIT}
-else
-	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
-
-	# bash-5.1 -> bash51
-	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
-
-	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
-		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
-		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
-		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
-	done
-
-	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
-	S=${WORKDIR}/${MY_P}
-
-	unset -v my_urls my_p my_patch_idx my_patch_ver
-fi
-
-if [[ ${GENTOO_PATCH_VER} ]]; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:=
-	nls? ( virtual/libintl )
-"
-if (( PLEVEL >= 0 )); then
-	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
-fi
-RDEPEND="
-	${DEPEND}
-"
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
-BDEPEND="
-	pgo? ( dev-util/gperf )
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-# EAPI 8 tries to append it but it doesn't exist here.
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-PATCHES=(
-	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
-
-	# Patches to or from Chet, posted to the bug-bash mailing list.
-	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
-)
-
-pkg_setup() {
-	# bug #7332
-	if is-flag -malign-double; then
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-
-	if use bashlogger; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Include official patches.
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases. The
-	# touch utility is invoked for the benefit of config.status.
-	if (( PLEVEL >= 0 )); then
-		rm -rf lib/{readline,termcap}/* \
-		&& touch lib/{readline,termcap}/Makefile.in \
-		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
-		|| die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches, bug #407985.
-	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
-	&& touch -r . doc/* \
-	|| die
-
-	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
-	rm tests/run-jobs || die
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local -a myconf
-
-	# Upstream only test with Bison and require GNUisms like YYEOF and
-	# YYERRCODE. The former at least may be in POSIX soon:
-	# https://www.austingroupbugs.net/view.php?id=1269.
-	# configure warns on use of non-Bison but doesn't abort. The result
-	# may misbehave at runtime.
-	unset -v YACC
-
-	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
-	# upstream to Chet by email.
-	filter-lto
-
-	myconf=(
-		--disable-profiling
-
-		# Force linking with system curses ... the bundled termcap lib
-		# sucks bad compared to ncurses.  For the most part, ncurses
-		# is here because readline needs it.  But bash itself calls
-		# ncurses in one or two small places :(.
-		--with-curses
-
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h.
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	use nls || myconf+=( --disable-nls )
-
-	if (( PLEVEL >= 0 )); then
-		# Historically, we always used the builtin readline, but since
-		# our handling of SONAME upgrades has gotten much more stable
-		# in the PM (and the readline ebuild itself preserves the old
-		# libs during upgrades), linking against the system copy should
-		# be safe.
-		# Exact cached version here doesn't really matter as long as it
-		# is at least what's in the DEPEND up above.
-		export ac_cv_rl_version=${READLINE_VER%%_*}
-
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
-	else
-		# Disable the plugins logic by hand since bash doesn't provide
-		# a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-
-		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
-	fi
-
-	# bug #444070
-	tc-export AR
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	local -a pgo_generate_flags pgo_use_flags
-	local flag
-
-	# -fprofile-partial-training because upstream notes the test suite isn't
-	# super comprehensive.
-	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	if use pgo; then
-		pgo_generate_flags=(
-			-fprofile-update=atomic
-			-fprofile-dir="${T}"/pgo
-			-fprofile-generate="${T}"/pgo
-		)
-		pgo_use_flags=(
-			-fprofile-use="${T}"/pgo
-			-fprofile-dir="${T}"/pgo
-		)
-		if flag=$(test-flags-CC -fprofile-partial-training); then
-			pgo_generate_flags+=( "${flag}" )
-			pgo_use_flags+=( "${flag}" )
-		fi
-	fi
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
-
-	# Build Bash and run its tests to generate profiles.
-	if (( ${#pgo_generate_flags[@]} )); then
-		# Used in test suite.
-		unset -v A
-
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
-		fi
-
-		# Rebuild Bash using the profiling data we just generated.
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
-	fi
-}
-
-src_test() {
-	# Used in test suite.
-	unset -v A
-
-	default
-}
-
-src_install() {
-	local d f
-
-	default
-
-	my_prefixify() {
-		while read -r; do
-			if [[ $REPLY == *$1* ]]; then
-				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
-			fi
-			printf '%s\n' "${REPLY}" || ! break
-		done < "$2" || die
-	}
-
-	dodir /bin
-	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
-
-	insinto /etc/bash/bashrc.d
-	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
-	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
-	if [[ ! ${EPREFIX} ]]; then
-		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
-	fi
-
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc}; do
-		newins "${FILESDIR}/dot-${f}" ".${f}"
-	done
-
-	if use plugins; then
-		exeinto "/usr/$(get_libdir)/bash"
-		set -- examples/loadables/*.o
-		doexe "${@%.o}"
-
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples; then
-		for d in examples/{functions,misc,scripts,startup-files}; do
-			exeinto "/usr/share/doc/${PF}/${d}"
-			docinto "${d}"
-			for f in "${d}"/*; do
-				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
-					doexe "${f}"
-				else
-					dodoc "${f}"
-				fi
-			done
-		done
-	fi
-
-	# Install bash_builtins.1 and rbash.1.
-	emake -C doc DESTDIR="${D}" install_builtins
-	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
-	doman "${T}"/rbash.1
-
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
-		mkdir -p -- "${EROOT}"/etc/bash \
-		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
-		|| die
-	fi
-}
-
-pkg_postinst() {
-	local old_ver
-
-	# If /bin/sh does not exist, provide it.
-	if [[ ! -e ${EROOT}/bin/sh ]]; then
-		ln -sf -- bash "${EROOT}"/bin/sh || die
-	fi
-
-	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]]; then
-		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
-		return
-	fi
-
-	while read -r; do ewarn "${REPLY}"; done <<'EOF'
-Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
-
-Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
-characteristics of the operating environment, it may contain a command to set
-the terminal's window title. Those who were already choosing to customise the
-PROMPT_COMMAND variable are now advised to append their commands like so:
-
-PROMPT_COMMAND+=('custom command goes here')
-
-Gentoo no longer defaults to having bash set the window title in the case
-that the terminal is controlled by sshd(8), unless screen is launched on the
-remote side or the terminal reliably supports saving and restoring the title
-(as alacritty, foot and tmux do). Those wanting for the title to be set
-regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
-drop-in - to set PROMPT_COMMMAND like so:
-
-PROMPT_COMMAND=(genfun_set_win_title)
-
-Those who would prefer for bash never to interfere with the window title may
-now opt out of the default title setting behaviour, either with the "unset -v
-PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
-EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
index 9a968611af..d495d9e3b9 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1.ebuild
@@ -30,7 +30,7 @@ esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.3_beta"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
index 0ba5de29ee..b8c4d806b7 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_rc1_p20250409.ebuild
@@ -30,7 +30,7 @@ esac
 
 # The version of readline this bash normally ships with. Note that we only use
 # the bundled copy of readline for pre-releases.
-READLINE_VER="8.3_alpha"
+READLINE_VER="8.3_beta"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
@@ -45,7 +45,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="a6767763de5e7859107711b166a64a9e4a77a8ae"
+	BASH_COMMIT="42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index 8e6b3dbe3f..047c7e2c90 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -9,7 +9,13 @@ DIST cmake-3.31.5.tar.gz 11706495 BLAKE2B 16375229d7344b10db40c76fe2fc8a3f906266
 DIST cmake-3.31.6-SHA-256.txt 1646 BLAKE2B f5d3bb67759b4b227bd38eb7de8405052fd55cef528d3a4d4754d77815cdb018831fadcb51e590186faa5e7911bd6d9ceba29d971a7d125435df06132276a00d SHA512 8e3d939ccab2260380fce92c31ba8244c7b4d19c7245d5bc9607e9352f2e7fa1e0e4ecc8555f8418f9659f53c142111dd34aba0739d947f387e5a88345dd6b46
 DIST cmake-3.31.6-SHA-256.txt.asc 833 BLAKE2B a99307a7e8011a1df30a2f364ae68b2f5d286d0d98f8a9b5d27283aa109963d6989218a8b3787666d7aa3a7e37e4d6468077c16b6550727efd1295f8c0504caa SHA512 c7a728110790a85ba89dace68c9bd4c22c81ae4482a758297fdb49e7eb11ccf0056d0d4fcf100be71eed7cc2ae3f633722df801dba2d61dd0fafb476d5b09128
 DIST cmake-3.31.6.tar.gz 11710589 BLAKE2B ea1bee1a98568407dfc164f82bf0e3ab082124bbbb12cfa18489bdbe9964418ee30fb62b4915bc06645bcd2cf1e17bfb9c210812da070acbba848db186d06044 SHA512 839d06b6ebd0bf78cbe8f7ae3a7c00026e70d759a81ac51aa103f35ad985ac69be9e667aae7b5fe48c5e0c41baec791259279679dbdf2ddd8b63a48382a8a2a0
+DIST cmake-3.31.7-SHA-256.txt 1646 BLAKE2B a3b52506b586ee81cb4192ddbfa52c8f2c4456d99ce3e0f1c2e88c22a756d58905219498e41b726bce6258b5bbe44fb2c58bb0c5972303a6ca8c2dc37de59676 SHA512 eb967dbc6a4c18d1b0b97910b89a5e9392e29bd1a8c169c92899215ee15f5a8a4852c06b3643c5ce420a57ef93c9153380d75f68f23092475032850390d1ab4e
+DIST cmake-3.31.7-SHA-256.txt.asc 833 BLAKE2B 9ddb47b9aa26875b294d4e3db27b4c9518c3a01f3a11d1a50afae08ef7871f52367c0d275415cd801613b036ae88f92611d03bb5d576e8bcd324c3ec46d943e1 SHA512 9b7234c8fe122cf458a42c5d5ba71bd7694c2cb610cc989d2ea2a710a5615a0f49f0747b3ab4321d0bb69987321e8256b335a3e5d29de4bc783d683b7dedae93
+DIST cmake-3.31.7.tar.gz 11711975 BLAKE2B 8bf3ea288695f6e1a9f301f8ad471e1007061cb9ed69b8a432d5de7e1779580ffbbd4050a85b1a3df30a85ee971ed0421ce14d9a77b026f7147d73ca8fee7ec9 SHA512 896f29e8e7c897e6e346141496d3f338aeaced8300fb2fd1fedcd0236742bfe4842de1c94253adf54f4847b17c5d9699c92d199cbb4a74c99ee14972c939b09e
 DIST cmake-4.0.0-SHA-256.txt 2015 BLAKE2B 8f3737f51768c61a16543e8d4a4bc6c359f2f2c128b1d7a5b80cae6c09e64d8ed28147619336172b217d0ea264ce424b2ef519b36bc6e30771a7144bee6d67b1 SHA512 50abb18d59e2685ea462d1e4cbafb005172030c1dc7f77a959e178caba744347d67b575318d3a09c1f44966f5efcfdb2fa0dd2dbbddb1fc8487f54c0e4207d69
 DIST cmake-4.0.0-SHA-256.txt.asc 833 BLAKE2B 2e9fe03e6db837dffe703740c76b312fced691ac2b2a5df6c8c199489902ce36ab8bef6ba599734470e5c4ded7ab4ad75eb374578b2204ed72d5711ad8af843d SHA512 93da422a75ce068d26b96e0a50746511f7ee3da6f8fd8d232bf9fd6a95853290ae98858ab8a00719091b79a9a6064bf7c0f840d45fa773baaa48b489ea4f54fc
 DIST cmake-4.0.0.tar.gz 11824527 BLAKE2B 21ab208f663498a4851e312bdee884fae9a711234ffd7da73c56894a51d2cd7a479f18fc0d3f276c9eee964e97965d0d57ccfe9a95a10f1bb7ad319c8fe0b7af SHA512 6892f68a48f428b7d7321e646b75d72f751a20b44e74696d445c90dc0dc8be7894f546d70e3749ff44a1bbea0371e9f4d509a9c116c17c231db65affe60945df
 DIST cmake-4.0.0_rc1-docs.tar.xz 577536 BLAKE2B 74a742ffef8e1af1652746e1c177d4198155145a039635e6a0ea40af463f3a2d45b6c6ce7d3a9b1fee24f0c1cfd1c3aa95c27669ca3c6281d54e701fc0ece202 SHA512 74c20067d3b82493024b2f2711b55b93998ce3b5f35ab5a154f33a8268a35a29d01127c55ce6b85b80ff252d15284ed1065e1338422124f6722a4190a984637c
+DIST cmake-4.0.1-SHA-256.txt 2015 BLAKE2B 3b6f2c889d4e67b459c1cd4a86470f1429f0153ff596bef7deb178050ad79686b4fc3ad0663a243219ebc2d626b3382ec747ee5a0d65c9a030444b8c60e50801 SHA512 f5b23ec12ac172c6d567722ac8d37c1325ad9da6d22944e1ed2cebb77dd645ac948f10f8f2060061990788d82209a1266848f334dd77c6014ce7c11d308aae95
+DIST cmake-4.0.1-SHA-256.txt.asc 833 BLAKE2B 67c5984baf0d3ed4bc263ee39963e9a540bf6328786101d62adebe3cba550e14d291edb0dee40cdabadb6763c02c1959208956b43532f760db878d6796a32f7d SHA512 5a80e483a4f280969ad8f7bf31f3cc3b1b1cb13b4853a1bf1616414e8f2c2cac381658126bfe23aa229eb40af5a423f5e2d0e076b5f02e7e667b4b83d007b7b3
+DIST cmake-4.0.1.tar.gz 11826844 BLAKE2B beedd233ce7a40a694394ec0b23a14e2ad566a98e6c04b0ffa8d66844cf66b4545974635647ffde247021a00378f48d09f0f8fa0d0e100fc6a55b258bb01fe83 SHA512 25f3e93b1fe09b4aacf6f6361942f829c4833075a05ad26a9bdbd1278f5f6a78389e619e478152e2ecc4108a4bccc3ed901f96db0571dc05f1feba4e04f8f516
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild
new file mode 100644
index 0000000000..e384162dd9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.7.ebuild
@@ -0,0 +1,313 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == *9999* ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? ( dev-qt/qtbase:6[gui,widgets] )
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}"/${PN}-3.30.3-cudahostld.patch
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+pkg_pretend() {
+	if [[ -z ${EPREFIX} ]] ; then
+		local file
+		local errant_files=()
+
+		# See bug #599684 and  bug #753581 (at least)
+		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
+			if [[ -e ${file} ]]; then
+				errant_files+=( "${file}" )
+			fi
+		done
+
+		# If errant files exist
+		if [[ ${#errant_files[@]} -gt 0 ]]; then
+			eerror "Errant files found!"
+			eerror "The presence of these files is known to confuse CMake's"
+			eerror "library path logic. Please (re)move these files:"
+
+			for file in "${errant_files[@]}"; do
+				eerror " mv ${file} ${file}.bak"
+			done
+
+			die "Stray files found in /etc/, see above message"
+		fi
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actually bootstrap it every time so why test it?
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
new file mode 100644
index 0000000000..41639c300a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-4.0.1.ebuild
@@ -0,0 +1,321 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=4.0.0_rc1
+#CMAKE_DOCS_VERSION=${PV}
+#CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == *9999* ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+	inherit verify-sig
+
+	SRC_URI+=" verify-sig? (
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt
+		https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}-SHA-256.txt.asc
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt
+		https://github.com/Kitware/CMake/releases/download/v${PV/_/-}/${MY_P}-SHA-256.txt.asc
+	)"
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20240902 )"
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? ( dev-qt/qtbase:6[gui,widgets] )
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.31.6-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	# Cuda
+	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+pkg_pretend() {
+	if [[ -z ${EPREFIX} ]] ; then
+		local file
+		local errant_files=()
+
+		# See bug #599684 and  bug #753581 (at least)
+		for file in /etc/arch-release /etc/redhat-release /etc/debian_version ; do
+			if [[ -e ${file} ]]; then
+				errant_files+=( "${file}" )
+			fi
+		done
+
+		# If errant files exist
+		if [[ ${#errant_files[@]} -gt 0 ]]; then
+			eerror "Errant files found!"
+			eerror "The presence of these files is known to confuse CMake's"
+			eerror "library path logic. Please (re)move these files:"
+
+			for file in "${errant_files[@]}"; do
+				eerror " mv ${file} ${file}.bak"
+			done
+
+			die "Stray files found in /etc/, see above message"
+		fi
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	# 4.0.0_rc1 is missing this, fails to configure
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/26712
+	touch .clang-tidy Utilities/.clang-tidy || die
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=6 )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actually bootstrap it every time so why test it?
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
index c0b8ef7a46..c41ab7e07c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/Manifest
@@ -1,2 +1,2 @@
 DIST azure-sdk-for-cpp-4b913e073e50466e8b2d674e65234e7b66d7db49.tar.gz 3130918 BLAKE2B 09f85c1d984b74de2ecfe7de3953b5d4d9898dd087d5a507f4a9a26ab79782a03022adf0fe5cd27cf998fbe277279a3dc0b3cc1977a8599338229146263fffaa SHA512 d243465b248b671495cf94c6d6a53639f6976cfd888a7963e98ba7381ae2b659e39af0102be31e2ad6912b4d3c78bbfc8038318fb98cfb736f5aa99d38207d93
-DIST azure-sdk-for-cpp-c7d19e283278af1eb9e8a8eb8375c7ce65956195.tar.gz 3152357 BLAKE2B 83063aed51cd25d623af6252f70e72284fce07a646d92d0221b2c35d0a0aec55af718146a8d342ef1bbbea9fdcf6be5a84033bf14befeff90a777cc004e064a1 SHA512 a70b2dfc64db5c5799352101bdade9e6acea0bf89cc0896386e5e46344734a674af10463ecb6d141a59257ab21d2b59f7cf663b30c1272560cb2d657132732c3
+DIST azure-sdk-for-cpp-e8d34efc671b7dff133bd32bd2fe65aab4737ef2.tar.gz 3330505 BLAKE2B 3693cc1d587ad3cba32f5dfdbbc650fbd077f05092f0bd44809d1b99b27a2e3e4a9eeb6fa725e5385f117cd76fb09101839e74c3fdc1e082b45d824cad059fb4 SHA512 ffa0ec9e10dfefd948607761dcc328d39bbb3ed56aa9d1df7c1e370fcfd61e91df6f207c85a97e84fb1bd5ad7f2ec848f2f5f1cb85181174c6c7850ade265eeb
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.10.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.11.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.10.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.11.ebuild
index ce20d08c4c..a91721b4d6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/azure-identity/azure-identity-1.11.ebuild
@@ -1,11 +1,11 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 inherit cmake
 
-COMMIT="c7d19e283278af1eb9e8a8eb8375c7ce65956195"
+COMMIT="e8d34efc671b7dff133bd32bd2fe65aab4737ef2"
 MY_P="azure-sdk-for-cpp-${COMMIT}"
 DESCRIPTION="Azure SDK for C++"
 HOMEPAGE="https://azure.github.io/azure-sdk-for-cpp/"
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.47.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.47.2-r1.ebuild
index 044a48ee68..5848daf52e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.47.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.47.2-r1.ebuild
@@ -24,7 +24,7 @@ else
 	"
 	S="${WORKDIR}/${PN}-src-${SRC_PV}"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="public-domain"
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
index 1218150a38..84ed78442d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
@@ -24,7 +24,7 @@ else
 	"
 	S="${WORKDIR}/${PN}-src-${SRC_PV}"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="public-domain"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index 2bf0730f64..fc05341cc0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,2 +1,3 @@
 DIST go1.23.7.src.tar.gz 28181215 BLAKE2B d3c9bff18438f90f6730e1ad9580a3f97d266f90533552cd73b63b512c694de76466435f274dc2b190c672cdbd83ffaf735e4e74c12e426cac920b81dbfd88af SHA512 79192b760ab6fcc9512fd879a9484a3566fdeec5eace36c54b728cd9cb033e7ac68065a42fc657b351a106d684b79fdbefbf682cf63209c0191e7e7c8c0a0147
-DIST go1.24.1.src.tar.gz 30777528 BLAKE2B 76217ec25a721183591a434b012bd9cfb6d6206410aafffce4490bff8053440f2aa590bac0cfb839f10c19a3368fe60515a61123a21d187f5289ba0ae1399c1c SHA512 a924d6bdc7e7101917e6d063bc7b471390525394e79224c152997564657c4362b5600e0c8bf6ee857d345129ccf7368bdf4ed2251ab740446ea2abda144e6353
+DIST go1.23.8.src.tar.gz 28182772 BLAKE2B 568b9fcc7ed12cb19e10b458fc1890a5977c97660657e9eb7c171aa16382f6790a78cb87df99ed72ec18d5ff1654ee4d15a4d603332ad0812ee97f6500866198 SHA512 8e352a01484c168894026080ee4501180e327d734fb3d892ab17daac193964fcd5fd90033c9cf86d6ffe8b7e4da64bda83ba4501a6c05919bcefbe9e2467c771
+DIST go1.24.2.src.tar.gz 30787666 BLAKE2B bb5f998a87e6527def304347b854c4addb0860a03da82e711f60e2af460bd43c36273b25126c643a679ae22fca226e6a4fc5ba55967d21965ffdc8f564781e35 SHA512 6366a32f6678e7908b138f62dafeed96f7144b3b93505e75fba374b33727da8b1d087c1f979f493382b319758ebfcbeb30e9d7dadcb2923b628c8abe7db41c6f
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/files/go-1.24-dont-force-gold-arm.patch b/sdk_container/src/third_party/portage-stable/dev-lang/go/files/go-1.24-dont-force-gold-arm.patch
new file mode 100644
index 0000000000..4869b38593
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/files/go-1.24-dont-force-gold-arm.patch
@@ -0,0 +1,55 @@
+Don't default to -fuse-ld=gold on arm64. The gold linker is deprecated in
+GNU Binutils and the referenced bfd bug which led to this default being
+added is long-fixed.
+
+https://src.fedoraproject.org/rpms/golang/raw/rawhide/f/0006-Default-to-ld.bfd-on-ARM64.patch
+https://bugs.gentoo.org/893956
+https://github.com/golang/go/issues/22040
+https://github.com/golang/go/pull/49748
+https://sourceware.org/PR19962
+
+From 46ec67413008607e2150e3395668e54e538c5b6b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= <asm@redhat.com>
+Date: Wed, 19 Jun 2024 10:18:58 +0200
+Subject: [PATCH] Default to ld.bfd on ARM64
+
+---
+ src/cmd/link/internal/ld/lib.go | 20 +++++++-------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
+index eab74dc328..b401f58727 100644
+--- a/src/cmd/link/internal/ld/lib.go
++++ b/src/cmd/link/internal/ld/lib.go
+@@ -1620,22 +1620,16 @@ func (ctxt *Link) hostlink() {
+ 		}
+ 
+ 		if ctxt.Arch.InFamily(sys.ARM64) && buildcfg.GOOS == "linux" {
+-			// On ARM64, the GNU linker will fail with
+-			// -znocopyreloc if it thinks a COPY relocation is
+-			// required. Switch to gold.
+-			// https://sourceware.org/bugzilla/show_bug.cgi?id=19962
+-			// https://go.dev/issue/22040
+-			altLinker = "gold"
+-
+-			// If gold is not installed, gcc will silently switch
+-			// back to ld.bfd. So we parse the version information
+-			// and provide a useful error if gold is missing.
++			// Use ld.bfd as the default linker
++			altLinker = "bfd"
++
++			// Provide a useful error if ld.bfd is missing
+ 			name, args := flagExtld[0], flagExtld[1:]
+-			args = append(args, "-fuse-ld=gold", "-Wl,--version")
++			args = append(args, "-fuse-ld=bfd", "-Wl,--version")
+ 			cmd := exec.Command(name, args...)
+ 			if out, err := cmd.CombinedOutput(); err == nil {
+-				if !bytes.Contains(out, []byte("GNU gold")) {
+-					log.Fatalf("ARM64 external linker must be gold (issue #15696, 22040), but is not: %s", out)
++				if !bytes.Contains(out, []byte("GNU ld")) {
++					log.Fatalf("ARM64 external linker must be ld.bfd, but is not: %s", out)
+ 				}
+ 			}
+ 		}
+-- 
+2.45.1
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild
new file mode 100644
index 0000000000..240ec7d23b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.8.ebuild
@@ -0,0 +1,163 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+
+# See "Bootstrap" in release notes
+GO_BOOTSTRAP_MIN=1.20.14
+MY_PV=${PV/_/}
+
+inherit go-env toolchain-funcs
+
+case ${PV}  in
+*9999*)
+	EGIT_REPO_URI="https://github.com/golang/go.git"
+	inherit git-r3
+	;;
+*)
+	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
+	S="${WORKDIR}"/go
+	case ${PV} in
+	*_beta*|*_rc*) ;;
+	*)
+		KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		;;
+	esac
+esac
+
+DESCRIPTION="A concurrent garbage collected and typesafe programming language"
+HOMEPAGE="https://go.dev"
+
+LICENSE="BSD"
+SLOT="0/${PV}"
+IUSE="cpu_flags_x86_sse2"
+
+RDEPEND="
+arm? ( sys-devel/binutils[gold(-)] )
+arm64? ( sys-devel/binutils[gold(-)] )"
+BDEPEND="|| (
+		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
+		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
+
+# the *.syso files have writable/executable stacks
+QA_EXECSTACK='*.syso'
+
+# Do not complain about CFLAGS, etc, since Go doesn't use them.
+QA_FLAGS_IGNORED='.*'
+
+# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
+QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
+
+# This package triggers "unrecognized elf file(s)" notices on riscv.
+# https://bugs.gentoo.org/794046
+QA_PREBUILT='.*'
+
+# Do not strip this package. Stripping is unsupported upstream and may
+# fail.
+RESTRICT=" strip"
+
+DOCS=(
+	CONTRIBUTING.md
+	PATENTS
+	README.md
+	SECURITY.md
+)
+
+go_tuple() {
+	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
+}
+
+go_cross_compile() {
+	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
+}
+
+PATCHES=(
+	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
+	"${FILESDIR}"/go-never-download-newer-toolchains.patch
+)
+
+src_compile() {
+	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
+		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
+	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
+		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
+	else
+		eerror "Go cannot be built without go or go-bootstrap installed"
+		die "Should not be here, please report a bug"
+	fi
+
+	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
+	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
+	export GOHOSTOS=$(go-env_goos ${CBUILD})
+	export CC=$(tc-getBUILD_CC)
+
+	export GOARCH=$(go-env_goarch)
+	export GOOS=$(go-env_goos)
+	export CC_FOR_TARGET=$(tc-getCC)
+	export CXX_FOR_TARGET=$(tc-getCXX)
+	use arm && export GOARM=$(go-env_goarm)
+	use x86 && export GO386=$(go-env_go386)
+
+	cd src
+	bash -x ./make.bash || die "build failed"
+}
+
+src_test() {
+	go_cross_compile && return 0
+
+	cd src
+
+	# https://github.com/golang/go/issues/42005
+	rm cmd/link/internal/ld/fallocate_test.go || die
+
+	PATH="${GOBIN}:${PATH}" \
+	./run.bash -no-rebuild -k || die "tests failed"
+	cd ..
+	rm -fr pkg/*_race || die
+	rm -fr pkg/obj/go-build || die
+}
+
+src_install() {
+	dodir /usr/lib/go
+	# The use of cp is deliberate in order to retain permissions
+	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
+	einstalldocs
+
+	insinto /usr/lib/go
+	doins go.env VERSION*
+
+	# testdata directories are not needed on the installed system
+	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
+
+	local bin_path
+	if go_cross_compile; then
+		bin_path="bin/$(go_tuple)"
+	else
+		bin_path=bin
+	fi
+	local f x
+	for x in ${bin_path}/*; do
+		f=${x##*/}
+		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
+	done
+
+	# install the @golang-rebuild set for Portage
+	insinto /usr/share/portage/config/sets
+	newins "${FILESDIR}"/go-sets.conf go.conf
+}
+
+pkg_postinst() {
+	[[ -z ${REPLACING_VERSIONS} ]] && return
+	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
+	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
+	elog "due to the static linking nature of go."
+	elog "If this is not done, the packages compiled with the older"
+	elog "version of the compiler will not be updated until they are"
+	elog "updated individually, which could mean they will have"
+	elog "vulnerabilities."
+	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
+	elog "See https://bugs.gentoo.org/752153 for more info"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r1.ebuild
new file mode 100644
index 0000000000..2be24178ea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2-r1.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+
+# See "Bootstrap" in release notes
+GO_BOOTSTRAP_MIN=1.22.12
+MY_PV=${PV/_/}
+
+inherit go-env toolchain-funcs
+
+case ${PV}  in
+*9999*)
+	EGIT_REPO_URI="https://github.com/golang/go.git"
+	inherit git-r3
+	;;
+*)
+	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
+	S="${WORKDIR}"/go
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	;;
+esac
+
+DESCRIPTION="A concurrent garbage collected and typesafe programming language"
+HOMEPAGE="https://go.dev"
+
+LICENSE="BSD"
+SLOT="0/${PV}"
+IUSE="cpu_flags_x86_sse2"
+
+BDEPEND="|| (
+		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
+		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
+
+# the *.syso files have writable/executable stacks
+QA_EXECSTACK='*.syso'
+
+# Do not complain about CFLAGS, etc, since Go doesn't use them.
+QA_FLAGS_IGNORED='.*'
+
+# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
+QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
+
+# This package triggers "unrecognized elf file(s)" notices on riscv.
+# https://bugs.gentoo.org/794046
+QA_PREBUILT='.*'
+
+# Do not strip this package. Stripping is unsupported upstream and may
+# fail.
+RESTRICT=" strip"
+
+DOCS=(
+	CONTRIBUTING.md
+	PATENTS
+	README.md
+	SECURITY.md
+)
+
+go_tuple() {
+	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
+}
+
+go_cross_compile() {
+	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
+}
+
+PATCHES=(
+	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
+	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
+	"${FILESDIR}"/go-never-download-newer-toolchains.patch
+)
+
+src_compile() {
+	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
+		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
+	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
+		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
+	else
+		eerror "Go cannot be built without go or go-bootstrap installed"
+		die "Should not be here, please report a bug"
+	fi
+
+	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
+	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
+	export GOHOSTOS=$(go-env_goos ${CBUILD})
+	export CC=$(tc-getBUILD_CC)
+
+	export GOARCH=$(go-env_goarch)
+	export GOOS=$(go-env_goos)
+	export CC_FOR_TARGET=$(tc-getCC)
+	export CXX_FOR_TARGET=$(tc-getCXX)
+	use arm && export GOARM=$(go-env_goarm)
+	use x86 && export GO386=$(go-env_go386)
+
+	cd src
+	bash -x ./make.bash || die "build failed"
+}
+
+src_test() {
+	go_cross_compile && return 0
+	cd src
+	PATH="${GOBIN}:${PATH}" \
+	./run.bash -no-rebuild -k || die "tests failed"
+}
+
+src_install() {
+	dodir /usr/lib/go
+	# The use of cp is deliberate in order to retain permissions
+	cp -R . "${ED}"/usr/lib/go
+	einstalldocs
+
+	# testdata directories are not needed on the installed system
+	# The other files we remove are installed by einstalldocs
+	rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die
+	rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die
+	rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die
+
+	local bin_path
+	if go_cross_compile; then
+		bin_path="bin/$(go_tuple)"
+	else
+		bin_path=bin
+	fi
+	local f x
+	for x in ${bin_path}/*; do
+		f=${x##*/}
+		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.2.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
index f371daa283..923732906b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-9999.ebuild
@@ -31,9 +31,6 @@ LICENSE="BSD"
 SLOT="0/${PV}"
 IUSE="cpu_flags_x86_sse2"
 
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
 BDEPEND="|| (
 		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
 		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
@@ -71,6 +68,7 @@ go_cross_compile() {
 }
 
 PATCHES=(
+	"${FILESDIR}"/go-1.24-dont-force-gold-arm.patch
 	"${FILESDIR}"/go-never-download-newer-toolchains.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
index d496ffbfcf..3d8c1f04f1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
@@ -1,5 +1,7 @@
 DIST perl-5.40.0-patches-2.tar.xz 17072 BLAKE2B 7cc1085a0a701f72cf1fce2b7f18ac949eb03a9e40716c37082396483045df577ef13bbca58ef06f20868e52e9c78e18fa5b8a3434ceea272ff49832a086a1f5 SHA512 d31a25894e3b34c8e80f439ebd423dd8f28eac056ce42d69376882c1655b1f7289ef22f8aa8d30147eaebbe6693f4d86d1570e153b55d58d7b30e5832e7bea60
 DIST perl-5.40.0.tar.xz 13804184 BLAKE2B cf191c3ccaf6f395c0c7d08c2ad3456c1dd622d4fe78e7fb3a74c741e9a84f1d39a55f5bc6adbea54c9520b1b387e72e957f9a7544ab8f24968d233cd5b959ae SHA512 a2fb1a24c6367b4043f4e929b2d74fc3bad1415e53b791ed1f219f1701064ae21b2bd3164ba95fcf24eaf458bd54433024ccae43725c0bb82a1ec6a98dc7052d
 DIST perl-5.40.1.tar.xz 13930924 BLAKE2B 2f421a9eb6c68e2f12b95e6ac70ede3819c0d31c6f25ec5e45337faa053eaf21911413573624e3e84d82e4d863ed21799dbf471865c7e04519dcb81eac9c5c36 SHA512 3ff16b3462ce43ff38dab21b3dfc20f81772b8c9eac19ab96ba2d5e6cbb390e2302fa76c4879f915249357cd11c7ec0d548bcbf3ab2c156df1b9fca95da3f545
+DIST perl-5.40.2.tar.xz 13923524 BLAKE2B e37d0a71fcf91c065f7d6a75077be257c679eb1b8f167a569e4cfd532baa7af621ff887691293a3ec39cd35b960aa3de59f826f3351938994d77d00b44501bca SHA512 1324b119e4370bbeb47a343d152f46c637addb0373ff07f0e214aa9d5912c03cd2bd23987a6e86d43453166412d3a03a52e780201941f679ef4186df16590e41
 DIST perl-cross-1.6.1.tar.gz 124122 BLAKE2B b1b78b30f2cf8c5ba12e3df6177b7d102033c8eaceeea9f12a1aeb2bfdf97edda83842e32de797b7ffa3ef6bc66dfba6ccbbacc25367b6f7bc2d137ce58aca93 SHA512 35a4f7966f1f94ef0b6bfe7a82e8a50e0daf6e5e0c1ed99c7c4767aa4f0708db05e8cc01a883257f970703991f617a189609cd57eec63767e2e73de3d6155bdf
+DIST perl-cross-1.6.2.tar.gz 123761 BLAKE2B c3c51d5a86940914c3a037d1cace49c6def531cdc380771f968461a3552c0200c8a802f4ff74ddb5fcd494ab1e1b582a4c1c5214be4faae8712fc506b19ca04f SHA512 51b45bf972304634d706d09e27d457636e43f9f27f739004eca529b21245ba78612dcb08b54225fc7ca19511983642c37915939ea8aa1c1a4560093474d9e76b
 DIST perl-cross-1.6.tar.gz 121973 BLAKE2B b3a17d92dd7621a3bc253a6c4e56eccd3adec2c2b52e606c956a08f48d786a16a3ac5beb056a732ba3df92227f210193b0f516fd9d73cac362a04ec52efab029 SHA512 980af804513ec126e40eb9d8200ca54ba805bbb13b38d20a45daaf8d98d6b257e2eebc1ecad56cd47f60e235fa1141f6df9518d748db4f18d5219180750ca615
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.2.ebuild
new file mode 100644
index 0000000000..fe9ee9f4f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.40.2.ebuild
@@ -0,0 +1,868 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
+
+PATCH_VER=2
+CROSS_VER=1.6.2
+PATCH_BASE="perl-5.40.0-patches-${PATCH_VER}"
+PATCH_DEV=dilfridge
+
+DIST_AUTHOR=SHAY
+
+# Greatest first, don't include yourself
+# Devel point-releases are not ABI-intercompatible, but stable point releases are
+# BIN_OLDVERSEN contains only C-ABI-intercompatible versions
+PERL_BIN_OLDVERSEN=""
+
+if [[ "${PV##*.}" == "9999" ]]; then
+	DIST_VERSION=5.40.0
+else
+	DIST_VERSION="${PV/_rc/-RC}"
+fi
+SHORT_PV="${DIST_VERSION%.*}"
+
+# Even numbered major versions are ABI intercompatible
+# Odd numbered major versions are not
+if [[ $(( ${SHORT_PV#*.} % 2 )) == 1 ]]; then
+	SUBSLOT="${DIST_VERSION%-RC*}"
+else
+	SUBSLOT="${DIST_VERSION%.*}"
+fi
+
+# Used only in tar paths
+MY_P="perl-${DIST_VERSION}"
+# Used in library paths
+MY_PV="${DIST_VERSION%-RC*}"
+
+DESCRIPTION="Larry Wall's Practical Extraction and Report Language"
+
+HOMEPAGE="https://www.perl.org/"
+
+SRC_URI="
+	mirror://cpan/src/5.0/${MY_P}.tar.xz
+	mirror://cpan/authors/id/${DIST_AUTHOR:0:1}/${DIST_AUTHOR:0:2}/${DIST_AUTHOR}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${PATCH_BASE}.tar.xz
+	https://github.com/arsv/perl-cross/releases/download/${CROSS_VER}/perl-cross-${CROSS_VER}.tar.gz
+"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="|| ( Artistic GPL-1+ )"
+
+SLOT="0/${SUBSLOT}"
+
+if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+IUSE="berkdb perl_features_debug doc gdbm perl_features_ithreads minimal perl_features_quadmath"
+
+RDEPEND="
+	berkdb? ( sys-libs/db:= )
+	gdbm? ( >=sys-libs/gdbm-1.8.3:= )
+	app-arch/bzip2
+	>=sys-libs/zlib-1.2.12
+	virtual/libcrypt:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="${RDEPEND}"
+PDEPEND="
+	!minimal? (
+		>=app-admin/perl-cleaner-2.31
+		>=virtual/perl-CPAN-2.290.0
+		>=virtual/perl-Encode-3.120.0
+		>=virtual/perl-File-Temp-0.230.400-r2
+		>=virtual/perl-Data-Dumper-2.154.0
+		>=virtual/perl-Math-BigInt-1.999.842
+		virtual/perl-Test-Harness
+	)
+"
+
+# bug 390719, bug 523624
+# virtual/perl-Test-Harness is here for the bundled ExtUtils::MakeMaker
+
+dual_scripts() {
+	src_remove_dual      perl-core/Archive-Tar        3.20.10_rc    ptar ptardiff ptargrep
+	src_remove_dual      perl-core/CPAN               2.360.0       cpan
+	src_remove_dual      perl-core/Digest-SHA         6.40.0        shasum
+	src_remove_dual      perl-core/Encode             3.210.0       enc2xs piconv
+	src_remove_dual      perl-core/ExtUtils-MakeMaker 7.700.0       instmodsh
+	src_remove_dual      perl-core/ExtUtils-ParseXS   3.510.0       xsubpp
+	src_remove_dual      perl-core/IO-Compress        2.212.0       zipdetails
+	src_remove_dual      perl-core/JSON-PP            4.160.0       json_pp
+	src_remove_dual      perl-core/Module-CoreList    5.202.504.134_rc  corelist
+	src_remove_dual      perl-core/Pod-Checker        1.770.0       podchecker
+	src_remove_dual      perl-core/Pod-Perldoc        3.280.100     perldoc
+	src_remove_dual      perl-core/Pod-Usage          2.30.0        pod2usage
+	src_remove_dual      perl-core/Test-Harness       3.480.0       prove
+	src_remove_dual      perl-core/podlators          5.10.200_rc   pod2man pod2text
+	src_remove_dual_man  perl-core/podlators          5.10.200_rc   /usr/share/man/man1/perlpodstyle.1
+}
+
+check_rebuild() {
+	# Fresh install
+	if [[ -z ${REPLACING_VERSIONS} ]]; then
+		return 0
+	fi
+
+	# Major Upgrade
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		[[ ${v%.*} == "${SHORT_PV}" ]] && continue
+		echo ""
+		ewarn "UPDATE THE PERL MODULES:"
+		ewarn "After updating dev-lang/perl the installed Perl modules"
+		ewarn "have to be re-installed. In most cases, this is done automatically"
+		ewarn "by the package manager, but subsequent steps are still recommended"
+		ewarn "to ensure system consistency."
+		ewarn
+		ewarn "You should start with a depclean to remove any unused perl dependencies"
+		ewarn "that may confuse portage in future. Regular depcleans are also encouraged"
+		ewarn "as part of your regular update cycle, as that will keep perl upgrades working."
+		ewarn "Recommended: emerge --depclean -va"
+		ewarn
+		ewarn "You should then call perl-cleaner to clean up any old files and trigger any"
+		ewarn "remaining rebuilds portage may have missed."
+		ewarn "Use: perl-cleaner --all"
+		return 0
+	done
+
+	# Reinstall w/ USE Change
+	if
+		 (   use perl_features_ithreads && ( has_version '<dev-lang/perl-5.38.2-r3[-ithreads]' || has_version '>=dev-lang/perl-5.38.2-r3[-perl_features_ithreads]' ) ) || \
+		 ( ! use perl_features_ithreads && ( has_version '<dev-lang/perl-5.38.2-r3[ithreads]'  || has_version '>=dev-lang/perl-5.38.2-r3[perl_features_ithreads]'  ) ) || \
+		 (   use perl_features_quadmath && ( has_version '<dev-lang/perl-5.38.2-r3[-quadmath]' || has_version '>=dev-lang/perl-5.38.2-r3[-perl_features_quadmath]' ) ) || \
+		 ( ! use perl_features_quadmath && ( has_version '<dev-lang/perl-5.38.2-r3[quadmath]'  || has_version '>=dev-lang/perl-5.38.2-r3[perl_features_quadmath]'  ) ) || \
+		 (   use perl_features_debug    && ( has_version '<dev-lang/perl-5.38.2-r3[-debug]'    || has_version '>=dev-lang/perl-5.38.2-r3[-perl_features_debug]'    ) ) || \
+		 ( ! use perl_features_debug    && ( has_version '<dev-lang/perl-5.38.2-r3[debug]'     || has_version '>=dev-lang/perl-5.38.2-r3[perl_features_debug]'     ) ) ; then
+		echo ""
+		ewarn "TOGGLED PERL FEATURES WARNING:"
+		ewarn "You changed one of the PERL_FEATURES flags ithreads, quadmath, or debug."
+		ewarn "You must rebuild all perl-modules installed. Mostly this should be done automatically"
+		ewarn "via the flag changes of the packages. If the rebuild fails, use perl-cleaner."
+		ewarn "Use: perl-cleaner --modules ; perl-cleaner --force --libperl"
+		ewarn
+		ewarn "NOTE: Previous to perl-5.38.2-r3, these flags were useflags for dev-lang/perl."
+		ewarn "If you just upgraded and do not intend to change anything, carry the same settings over"
+		ewarn "into a global PERL_FEATURES variable set in make.conf. E.g., "
+		ewarn "dev-lang/perl[ithreads,quadmath] becomes PERL_FEATURES=\"ithreads quadmath\""
+	fi
+}
+
+pkg_pretend() {
+	if \
+		 (   use perl_features_ithreads && has_version '<dev-lang/perl-5.38.2-r3[-ithreads]' ) || \
+		 ( ! use perl_features_ithreads && has_version '<dev-lang/perl-5.38.2-r3[ithreads]'  ) || \
+		 (   use perl_features_quadmath && has_version '<dev-lang/perl-5.38.2-r3[-quadmath]' ) || \
+		 ( ! use perl_features_quadmath && has_version '<dev-lang/perl-5.38.2-r3[quadmath]'  ) || \
+		 (   use perl_features_debug    && has_version '<dev-lang/perl-5.38.2-r3[-debug]'    ) || \
+		 ( ! use perl_features_debug    && has_version '<dev-lang/perl-5.38.2-r3[debug]'     ) ;  \
+	then
+		echo ""
+		ewarn "As of dev-lang/perl-5.38.2-r3, the useflags debug, ithreads, quadmath move into"
+		ewarn "a use-expand variable PERL_FEATURES, which should be set globally in make.conf."
+		ewarn "It appears that you have not set this variable properly yet."
+		ewarn ""
+		ewarn "Giving you a chance to abort and read the corresponding news item now..."
+		for n in 10 9 8 7 6 5 4 3 2 1 ; do
+			echo -n "${n} "
+			sleep 2
+		done;
+		echo "continuing."
+	fi
+}
+
+pkg_setup() {
+	case ${CHOST} in
+		*-darwin*)    osname="darwin" ;;
+		*-solaris*)   osname="solaris" ;;
+		*)            osname="linux" ;;
+	esac
+
+	myarch="${CHOST%%-*}-${osname}"
+	if use perl_features_debug ; then
+		myarch+="-debug"
+	fi
+	if use perl_features_quadmath ; then
+		myarch+="-quadmath"
+	fi
+	if use perl_features_ithreads ; then
+		mythreading="-multi"
+		myarch+="-thread"
+	fi
+
+	PRIV_BASE="/usr/$(get_libdir)/perl5"
+	SITE_BASE="/usr/local/$(get_libdir)/perl5"
+	VENDOR_BASE="/usr/$(get_libdir)/perl5/vendor_perl"
+
+	LIBPERL="libperl$(get_libname ${MY_PV} )"
+
+	PRIV_LIB="${PRIV_BASE}/${SUBSLOT}"
+	ARCH_LIB="${PRIV_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	SITE_LIB="${SITE_BASE}/${SUBSLOT}"
+	SITE_ARCH="${SITE_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	VENDOR_LIB="${VENDOR_BASE}/${SUBSLOT}"
+	VENDOR_ARCH="${VENDOR_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+
+	dual_scripts
+}
+
+src_remove_dual_file() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				alternatives_auto_makesym "${i}" "${i}-[0-9]*"
+			done
+			;;
+		setup)
+			for i in "$@" ; do
+				if [[ -f ${EROOT}${i} && ! -h ${EROOT}${i} ]] ; then
+					has_version ${pkg} && ewarn "You must reinstall ${pkg} !"
+					break
+				fi
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i}{,-${ver}-${P}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual_man() {
+	local i pkg ver ff
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				ff=`echo "${EROOT}${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}}"*`
+				ff=${ff##*${i#${i%.[0-9]}}}
+				alternatives_auto_makesym "${i}${ff}" "${i%.[0-9]}-[0-9]*"
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i} "${ED}"${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	for i in "$@" ; do
+		src_remove_dual_file  "${pkg}" "${ver}" "/usr/bin/${i}"
+		src_remove_dual_man   "${pkg}" "${ver}" "/usr/share/man/man1/${i}.1"
+	done
+}
+
+src_prepare_perlcross() {
+	cp -a ../perl-cross-${CROSS_VER}/* . || die
+
+	# bug 794463, needs further analysis what is exactly wrong here
+	eapply "${FILESDIR}/perl-5.34.0-crossfit.patch"
+
+	# bug 604072
+	MAKEOPTS+=" -j1"
+	export MAKEOPTS
+}
+
+src_prepare_dynamic() {
+	ln -s ${LIBPERL} libperl$(get_libname ${SHORT_PV}) || die
+	ln -s ${LIBPERL} libperl$(get_libname ) || die
+}
+
+# Copy a patch into the patch series
+# add_patch SRC_PATH DEST_NAME ['description'] ['bug'] ['bug']
+# - description is optional, but recommended
+# - all arguments after descriptions are bug URLs
+add_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local src_name dest_name desc
+	src_name="$1"
+	dest_name="$2"
+	desc="$3"
+	shift; shift; shift;
+	einfo "Adding ${dest_name} to patch bundle"
+	cp "${src_name}" "${patchdir}/${dest_name}" || die "Couldn't copy ${src_name} to ${dest_name}"
+	if [[ -n "${desc}" ]]; then
+		printf "%s" "${desc}" > "${infodir}/${dest_name}.desc" || die "Couldn't write ${dest_name}.desc"
+	fi
+	if [[ $# -gt 0 ]]; then
+		# Note: when $@ is more than one element, this emits a
+		# line for each element
+		printf "%s\n" "$@" > "${infodir}/${dest_name}.bugs" || die "Couldn't write ${dest_name}.bugs"
+	fi
+}
+
+# Remove a patch using a glob expr
+# eg:
+#	 rm_patch *-darwin-Use-CC*
+#
+rm_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local expr="$1"
+	local patch="$( cd "${patchdir}"; echo $expr )"
+	einfo "Removing $patch ($expr) from patch bundle"
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		rm -f "${patchdir}/${patch}" || die "Can't remove ${patch} ( $expr )"
+	else
+		ewarn "No ${expr} found in ${patchdir} to remove"
+	fi
+}
+
+# Yes, this is a reasonable amount of code for something seemingly simple
+# but this is far easier to debug when things go wrong, and things went wrong
+# multiple times while I was getting the exact number of slashes right, which
+# requires circumnavigating both bash and sed escape mechanisms.
+c_escape_string() {
+	local slash dquote
+	slash='\'
+	dquote='"'
+	re_slash="${slash}${slash}"
+	re_dquote="${slash}${dquote}"
+
+	# Convert \ to \\,
+	#         " to \"
+	echo "$1" |\
+		sed "s|${re_slash}|${re_slash}${re_slash}|g" |\
+		sed "s|${re_dquote}|${re_slash}${re_dquote}|g"
+}
+c_escape_file() {
+	c_escape_string "$(cat "$1")"
+}
+
+apply_patchdir() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local patchoutput="patchlevel-gentoo.h"
+
+	# Inject Patch-Level info into description for patchlevel.h patch
+	# to show in -V
+	local patch_expr="*List-packaged-patches*"
+	local patch="$( cd "${patchdir}"; echo $patch_expr )";
+	einfo "Injecting patch-level info into ${patch}.desc ( $patch_expr )"
+
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		printf "List packaged patches for %s(%s) in patchlevel.h" "${PF}" "${PATCH_BASE}"\
+			>"${infodir}/${patch}.desc" || die "Can't rewrite ${patch}.desc"
+	else
+		eerror "No $patch_expr found in ${patchdir}"
+	fi
+
+	# Compute patch list to apply
+	# different name other than PATCHES to stop default
+	# reapplying it
+	# Single depth is currently only supported, as artifacts can reside
+	# from the old layout being multiple-directories, as well as it grossly
+	# simplifying the patchlevel_gentoo.h generation.
+	local PERL_PATCHES=($(
+		find "${patchdir}" -maxdepth 1 -mindepth 1 -type f -printf "%f\n" |\
+			grep -E '[.](diff|patch)$' |\
+			sort -n
+	))
+
+	for patch in "${PERL_PATCHES[@]}"; do
+		eapply "${WORKDIR}"/patches/${patch}
+	done
+
+	einfo "Generating $patchoutput"
+
+	# This code creates a header file, each iteration
+	# creates one-or-more-lines for each entry found in PERL_PATCHES
+	# and STDOUT is redirected to the .h file
+	for patch in "${PERL_PATCHES[@]}"; do
+		local desc_f="${infodir}/${patch}.desc"
+		local bugs_f="${infodir}/${patch}.bugs"
+
+		printf ',"%s"\n' "${patch}"
+		if [[ ! -e "${desc_f}" ]]; then
+			ewarn "No description provided for ${patch} (expected: ${desc_f} )"
+		else
+			local desc="$(c_escape_file "${desc_f}")"
+			printf ',"- %s"\n' "${desc}"
+		fi
+		if [[ -e "${bugs_f}" ]]; then
+			while read -d $'\n' -r line; do
+				local esc_line="$(c_escape_string "${line}")"
+				printf ',"- Bug: %s"\n' "${esc_line}"
+			done <"${bugs_f}"
+		fi
+	done > "${S}/${patchoutput}"
+	printf "%s\n" "${patchoutput}" >> "${S}/MANIFEST"
+
+}
+
+src_prepare() {
+
+	local patchdir="${WORKDIR}/patches"
+
+	# mv -v "${WORKDIR}/perl-patchset-${PATCH_BASE}/patches" "${WORKDIR}/patches" || die
+	# mv -v "${WORKDIR}/perl-patchset-${PATCH_BASE}/patch-info" "${WORKDIR}/patch-info" || die
+
+	# Prepare Patch dir with additional patches / remove unwanted patches
+	# Inject bug/desc entries for perl -V
+	# Old example:
+	# add_patch "${FILESDIR}/${PN}-5.26.2-hppa.patch" "100-5.26.2-hppa.patch"\
+	#		"Fix broken miniperl on hppa"\
+	#		"https://bugs.debian.org/869122" "https://bugs.gentoo.org/634162"
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# do NOT mess with nsl, on Solaris this is always necessary,
+		# when -lsocket is used e.g. to get h_errno
+		rm_patch "*-nsl-and-cl*"
+	fi
+
+	apply_patchdir
+
+	tc-is-cross-compiler && src_prepare_perlcross
+
+	tc-is-static-only || src_prepare_dynamic
+
+	if use gdbm; then
+		sed -i "s:INC => .*:INC => \"-I${ESYSROOT}/usr/include/gdbm\":g" \
+			ext/NDBM_File/Makefile.PL || die
+	fi
+
+	# Use errno.h from prefix rather than from host system, bug #645804
+	if use prefix && [[ -e "${EPREFIX}"/usr/include/errno.h ]] ; then
+		sed -i "/my..sysroot/s:'':'${EPREFIX}':" ext/Errno/Errno_pm.PL || die
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# set a soname, fix linking against just built libperl
+		sed -i -e 's/netbsd\*/netbsd*|solaris*/' Makefile.SH || die
+	fi
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name (soname) not to reference $D
+		sed -i -e '/install_name `pwd/s/`pwd`/\\$(shrpdir)/' Makefile.SH || die
+
+		# fix environ linkage absence (only a real issue on Darwin9)
+		if [[ ${CHOST##*-darwin} -le 9 ]] ; then
+			sed -i -e '/^PLDLFLAGS =/s/=/= -include crt_externs.h -Denviron="(*_NSGetEnviron())"/' \
+				Makefile.SH || die
+		fi
+	fi
+
+	default
+}
+
+myconf() {
+	# the myconf array is declared in src_configure
+	myconf=( "${myconf[@]}" "$@" )
+}
+
+# Outputs a list of versions which have been seen in any of the
+# primary perl @INC prefix paths, such as:
+#  /usr/lib64/perl5/<NUMBER>
+#  /usr/local/lib64/perl5/<NUMBER>
+#  /usr/lib64/perl5/vendor_perl/<NUMBER>
+#
+# All values of NUMBER must be like "5.x.y" or like "5.x"
+#
+find_candidate_inc_versions() {
+	local regex='.*/5[.][0-9]+\([.][0-9]+\|\)$'
+	local dirs=(
+		"${EROOT}${PRIV_BASE}"
+		"${EROOT}${SITE_BASE}"
+		"${EROOT}${VENDOR_BASE}"
+	)
+	for dir in "${dirs[@]}"; do
+		if [[ ! -e "${dir}" ]]; then
+			continue
+		fi
+		# Without access to readdir() on these dirs, find will not be able
+		# to reveal any @INC directories inside them, and will subsequently prune
+		# them from the built perl's @INC support, breaking our compatiblity options
+		# entirely.
+		if [[ ! -r "${dir}" || ! -x "${dir}" ]]; then
+			eerror "Bad permissions on ${dir}, this will probably break things"
+			eerror "Ensure ${dir} is +rx for at least uid=$EUID"
+			eerror "Recommended permission is +rx for all"
+			eerror "> chmod o+rx ${dir}"
+		fi
+	done
+	einfo "Scanning for old @INC dirs matching '$regex' in: ${dirs[*]}"
+	find "${dirs[@]}" -maxdepth 1 -mindepth 1 -type d -regex "${regex}" -printf "%f "  2>/dev/null
+}
+
+# Sort versions passed versiony-ly, remove self-version if present
+# dedup. Takes each version as an argument
+sanitize_inc_versions() {
+	local vexclude="${SUBSLOT}"
+	einfo "Normalizing/Sorting candidate list: $*"
+	einfo " to remove '${vexclude}'"
+	# Note, general numeric sort has to be used
+	# for the last component, or unique will convert
+	#  5.30.0 + 5.30 into just 5.30
+	printf "%s\n" "$@" |\
+		grep -vxF "${vexclude}" |\
+		sort -u -nr -t'.' -k1,1rn -k2,2rn -k3,3rg
+}
+
+versions_to_inclist() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+
+	for v;	do
+			has "${v}" ${oldv} && echo -n "${v}/${myarch}${mythreading}/ ";
+			echo -n "${v}/ ";
+	done
+}
+
+versions_to_gentoolibdirs() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+	local root
+	local v
+	for v;	do
+		for root in "${PRIV_BASE}" "${VENDOR_BASE}" "${SITE_BASE}"; do
+			local fullpath="${EROOT}${root}/${v}"
+			if [[ -e "${fullpath}" ]]; then
+				has "${v}" ${oldv} && printf "%s:" "${fullpath}/${myarch}${mythreading}";
+				printf "%s:" "${fullpath}"
+			fi
+		done
+	done
+}
+
+src_configure() {
+	declare -a myconf
+
+	export LC_ALL="C"
+	[[ ${COLUMNS:-1} -ge 1 ]] || unset COLUMNS # bug #394091
+
+	# Perl has problems compiling with -Os in your flags with glibc
+	replace-flags "-Os" "-O2"
+
+	# xlocale.h is going away in glibc-2.26, so it's counterproductive
+	# if we use it and include it in CORE/perl.h ... Perl builds just
+	# fine with glibc and locale.h only.
+	# However, the darwin prefix people have no locale.h ...
+	use elibc_glibc && myconf -Ui_xlocale
+
+	# Perl relies on -fwrapv semantics
+	filter-flags -ftrapv
+
+	# This flag makes compiling crash in interesting ways
+	filter-flags "-malign-double"
+
+	# On musl we dont want to use largefile *64 types, since 1) normal
+	# types are 64bit / largefile anyway and 2) the *64 types are going
+	# away in 1.2.4... bug #911233
+	use elibc_musl && myconf -Ud_off64_t
+
+	use sparc && myconf -Ud_longdbl
+
+	# This urgently needs debugging - on m68k, miniperl crashes during
+	# build otherwise..
+	use m68k && append-ldflags -Wl,-z,norelro
+
+	export BUILD_BZIP2=0
+	export BZIP2_INCLUDE=${ESYSROOT}/usr/include
+	export BZIP2_LIB=${ESYSROOT}/usr/$(get_libdir)
+
+	export BUILD_ZLIB=False
+	export ZLIB_INCLUDE=${ESYSROOT}/usr/include
+	export ZLIB_LIB=${ESYSROOT}/usr/$(get_libdir)
+
+	# allow either gdbm to provide ndbm (in <gdbm/ndbm.h>) or db1
+	myndbm='U'
+	mygdbm='U'
+	mydb='U'
+	if use gdbm ; then
+		mygdbm='D'
+		if use berkdb ; then
+			myndbm='D'
+		fi
+	fi
+	if use berkdb ; then
+		mydb='D'
+		has_version '=sys-libs/db-1*' && myndbm='D'
+	fi
+
+	myconf "-${myndbm}i_ndbm" "-${mygdbm}i_gdbm" "-${mydb}i_db"
+
+	if use alpha && [[ "$(tc-getCC)" = "ccc" ]] ; then
+		ewarn "Perl will not be built with berkdb support, use gcc if you need it..."
+		myconf -Ui_db -Ui_ndbm
+	fi
+
+	use perl_features_ithreads && myconf -Dusethreads
+
+	use perl_features_quadmath && myconf -Dusequadmath
+
+	if use perl_features_debug ; then
+		append-cflags "-g"
+		myconf -DDEBUGGING
+	elif [[ ${CFLAGS} == *-g* ]] ; then
+		myconf -DDEBUGGING=-g
+	else
+		myconf -DDEBUGGING=none
+	fi
+
+	# modifying 'optimize' prevents cross configure script from appending required flags
+	if tc-is-cross-compiler; then
+		append-cflags "-fwrapv"
+		tc-export_build_env
+
+		# Needed for the CHOST build too (bug #932385)
+		export CFLAGS="${CFLAGS} -D_GNU_SOURCE"
+
+		# bug #913171
+		export \
+			HOSTCC=$(tc-getBUILD_CC) \
+			HOSTCFLAGS="${CFLAGS_FOR_BUILD} -D_GNU_SOURCE" \
+			HOSTLDFLAGS="${LDFLAGS_FOR_BUILD}"
+	fi
+
+	# bug #877659, bug #821577
+	append-cflags -fno-strict-aliasing
+
+	# Autodiscover all old version directories, some of them will even be newer
+	# if you downgrade
+	if [[ -z ${PERL_OLDVERSEN} ]]; then
+		PERL_OLDVERSEN="$( find_candidate_inc_versions )"
+	fi
+
+	# Fixup versions, removing self match, fixing order and dupes
+	PERL_OLDVERSEN="$( sanitize_inc_versions ${PERL_OLDVERSEN} )"
+
+	# Experts who want a "Pure" install can set PERL_OLDVERSEN to an empty string
+	if [[ -n "${PERL_OLDVERSEN// }" ]]; then
+		local inclist="$( versions_to_inclist ${PERL_OLDVERSEN} )"
+		einfo "This version of perl may partially support modules previously"
+		einfo "installed in any of the following paths:"
+		for incpath in ${inclist}; do
+			[[ -e "${EROOT}${VENDOR_BASE}/${incpath}" ]] && einfo " ${EROOT}${VENDOR_BASE}/${incpath}"
+			[[ -e "${EROOT}${PRIV_BASE}/${incpath}"   ]] && einfo " ${EROOT}${PRIV_BASE}/${incpath}"
+			[[ -e "${EROOT}${SITE_BASE}/${incpath}"   ]] && einfo " ${EROOT}${SITE_BASE}/${incpath}"
+		done
+		einfo "This is a temporary measure and you should aim to cleanup these paths"
+		einfo "via world updates and perl-cleaner"
+		# myconf -Dinc_version_list="${inclist}"
+		myconf -Dgentoolibdirs="$( versions_to_gentoolibdirs ${PERL_OLDVERSEN} )"
+	fi
+
+	[[ ${ELIBC} == "FreeBSD" ]] && myconf "-Dlibc=/usr/$(get_libdir)/libc.a"
+
+	# Make sure we can do the final link #523730, need to set deployment
+	# target to override hardcoded 10.3 which breaks on modern OSX
+	[[ ${CHOST} == *-darwin* ]] && \
+		myconf "-Dld=env MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET} $(tc-getCC)"
+
+	# Older macOS with non-Apple GCC chokes on inline in system headers
+	# using c89 mode as injected by cflags.SH, in addition, we override
+	# cflags, so we loose PERL_DARWIN which enables compat code that
+	# apparently on more recent macOS releases is no longer necessary
+	[[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] && tc-is-gcc && \
+		append-cflags -Dinline=__inline__ -DPERL_DARWIN
+
+	# Prefix: the host system needs not to follow Gentoo multilib stuff, and in
+	# Prefix itself we don't do multilib either, so make sure perl can find
+	# something compatible.
+	if use prefix ; then
+		# Set a hook to check for each detected library whether it actually works.
+		export libscheck="
+			( echo 'int main(){}' > '${T}'/conftest.c &&
+				$(tc-getCC) -o '${T}'/conftest '${T}'/conftest.c -l\$thislib >/dev/null 2>/dev/null
+			) || xxx=/dev/null"
+
+		# Use all host paths that might contain useful stuff, the hook above will filter out bad choices.
+		local paths="/lib/*-linux-gnu /usr/lib/*-linux-gnu /lib64 /lib/64 /usr/lib64 /usr/lib/64 /lib32 /usr/lib32 /lib /usr/lib"
+		myconf "-Dlibpth=${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir) ${paths}"
+	elif [[ $(get_libdir) != "lib" ]] ; then
+		# We need to use " and not ', as the written config.sh use ' ...
+		myconf "-Dlibpth=/usr/local/$(get_libdir) /$(get_libdir) /usr/$(get_libdir)"
+	fi
+
+	# don't try building ODBM, bug #354453
+	disabled_extensions="ODBM_File"
+
+	if ! use gdbm ; then
+		# workaround for bug #157774: don't try building GDBM related stuff with USE="-gdbm"
+		disabled_extensions="${disabled_extensions} GDBM_File NDBM_File"
+	fi
+
+	myconf -Dnoextensions="${disabled_extensions}"
+
+	[[ "${PV##*.}" == "9999" ]] && myconf -Dusedevel -Uversiononly
+
+	[[ -n "${EXTRA_ECONF}" ]] && ewarn During Perl build, EXTRA_ECONF=${EXTRA_ECONF}
+	# allow fiddling via EXTRA_ECONF, bug 558070
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+
+	myconf \
+		-Duseshrplib \
+		-Darchname="${myarch}" \
+		-Dar="$(tc-getAR)" \
+		-Dcc="$(tc-getCC)" \
+		-Dcpp="$(tc-getCPP)" \
+		-Dld="$(tc-getCC)" \
+		-Dnm="$(tc-getNM)" \
+		-Dranlib="$(tc-getRANLIB)" \
+		-Accflags="${CFLAGS} -DNO_PERL_RAND_SEED" \
+		-Doptimize="${CFLAGS}" \
+		-Dldflags="${LDFLAGS}" \
+		-Dprefix="${EPREFIX}"'/usr' \
+		-Dsiteprefix="${EPREFIX}"'/usr/local' \
+		-Dvendorprefix="${EPREFIX}"'/usr' \
+		-Dscriptdir="${EPREFIX}"'/usr/bin' \
+		-Dprivlib="${EPREFIX}${PRIV_LIB}" \
+		-Darchlib="${EPREFIX}${ARCH_LIB}" \
+		-Dsitelib="${EPREFIX}${SITE_LIB}" \
+		-Dsitearch="${EPREFIX}${SITE_ARCH}" \
+		-Dvendorlib="${EPREFIX}${VENDOR_LIB}" \
+		-Dvendorarch="${EPREFIX}${VENDOR_ARCH}" \
+		-Dman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dsiteman1dir="${EPREFIX}"/usr/local/man/man1 \
+		-Dsiteman3dir="${EPREFIX}"/usr/local/man/man3 \
+		-Dvendorman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dvendorman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dman1ext='1' \
+		-Dman3ext='3pm' \
+		-Dlibperl="${LIBPERL}" \
+		-Dlocincpth="${EPREFIX}"'/usr/include ' \
+		-Dglibpth="${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir)"' ' \
+		-Duselargefiles \
+		-Dd_semctl_semun \
+		-Dcf_by='Gentoo' \
+		-Dmyhostname='localhost' \
+		-Dperladmin='root@localhost' \
+		-Ud_csh \
+		-Dsh="${BROOT}"/bin/sh \
+		-Dtargetsh="${EPREFIX}"/bin/sh \
+		-Uusenm \
+		"${EXTRA_ECONF[@]}"
+
+	if tc-is-cross-compiler; then
+		./configure \
+			--target="${CHOST}" \
+			--build="${CBUILD}" \
+			-Dinstallprefix='' \
+			-Dinstallusrbinperl='undef' \
+			-Dusevendorprefix='define' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	else
+		sh Configure \
+			-des \
+			-Dinstallprefix="${EPREFIX}"'/usr' \
+			-Dinstallusrbinperl='n' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	fi
+}
+
+src_test() {
+	export NO_GENTOO_NETWORK_TESTS=1;
+	export GENTOO_ASSUME_SANDBOXED="${GENTOO_ASSUME_SANDBOXED:-1}"
+	export GENTOO_NO_PORTING_TESTS="${GENTOO_NO_PORTING_TESTS:-1}"
+	if [[ ${EUID} == 0 ]] ; then
+		ewarn "Test fails with a sandbox error (#328793) if run as root. Skipping tests..."
+		return 0
+	fi
+	TEST_JOBS="$(makeopts_jobs)" make test_harness || die "test failed"
+}
+
+src_install() {
+	local i
+	local coredir="${ARCH_LIB}/CORE"
+
+	emake DESTDIR="${D}" install
+
+	rm -f "${ED}/usr/bin/perl${MY_PV}"
+	ln -s perl "${ED}"/usr/bin/perl${MY_PV} || die
+
+	if ! tc-is-static-only ; then
+		dolib.so "${ED}"${coredir}/${LIBPERL}
+		rm -f "${ED}"${coredir}/${LIBPERL}
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname) || die
+
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/${LIBPERL} || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname) || die
+	fi
+
+	rm -rf "${ED}"/usr/share/man/man3 || die "Unable to remove module man pages"
+
+	# This removes ${D} from Config.pm
+	for i in $(find "${D}" -iname "Config.pm" ) ; do
+		einfo "Removing ${D} from ${i}..."
+		sed -i -e "s:${D}::" "${i}" || die "Sed failed"
+	done
+
+	dodoc Changes* README AUTHORS
+
+	if use doc ; then
+		# HTML Documentation
+		# We expect errors, warnings, and such with the following.
+
+		dodir /usr/share/doc/${PF}/html
+		LD_LIBRARY_PATH=. ./perl installhtml \
+			--podroot='.' \
+			--podpath='lib:ext:pod:vms' \
+			--recurse \
+			--htmldir="${ED}/usr/share/doc/${PF}/html"
+	fi
+
+	[[ -d ${ED}/usr/local ]] && rm -r "${ED}"/usr/local
+
+	dual_scripts
+}
+
+pkg_preinst() {
+	check_rebuild
+}
+
+pkg_postinst() {
+	dual_scripts
+
+	if [[ -z "${ROOT}" ]] ; then
+		local INC DIR file
+		INC=$(perl -e 'for $line (@INC) { next if $line eq "."; next if $line =~ m/'${SHORT_PV}'|etc|local|perl$/; print "$line\n" }')
+		einfo "Removing old .ph files"
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				for file in $(find "${DIR}" -name "*.ph" -type f ) ; do
+					rm -f "${file}"
+					einfo "<< ${file}"
+				done
+			fi
+		done
+		# Silently remove the now empty dirs
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				find "${DIR}" -depth -type d -print0 | xargs -0 -r rmdir &> /dev/null
+			fi
+		done
+
+	fi
+}
+
+pkg_postrm() {
+	dual_scripts
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 936505d374..0c247ed3fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -2,23 +2,42 @@ DIST Python-2.7.18.tar.xz 12854736 BLAKE2B 060a621c91dd8e3d321aec99d44c17aa67381
 DIST Python-2.7.18.tar.xz.asc 833 BLAKE2B 1d98770e46171971fb99994508d238c01d2755281d2f94353314014d9e83e0ec5f0b3e3950ea1fdf5fce9ba6b8f55312355845c2a3fc4291c27ee56fe6215448 SHA512 c2a5f5a52f47dec52460ad3275758d4e5de6e7075c3def4353c988d74d563a39b42cae2d5eb24e2a23a6247cef69100f91620b11a49c2359fbf99b203c9cbda8
 DIST Python-3.10.16.tar.xz 19610392 BLAKE2B bcc5ff71904b8a936363c6b07b8ffbcb981640c29c1e537a90f838c0a7fa45c1bdd764eae48bcb6d16d7260a44c235e9f5538ada45903b1627527e24c49212a5 SHA512 a6b004974db93f21590f00b9b1a569dfd8c3e334f8c6a8eb8997dec5646fa4515cfc02a7dabea9e4f75f908938dc64333ce4899b9a26aff97f9ffcb027fa2bca
 DIST Python-3.10.16.tar.xz.asc 833 BLAKE2B 4fd4ce76ade6d64539e5eb641c64b0d99ade71a8514f97594097207e78412bd2d09afeab6788598a3159f045b98ccd5537c6771e59eeba52d4820c0c0a6c0dcb SHA512 18032fdb60a022d6381b1137789ada1c4bb198049616ed158fb548e728dd1fb95d116a86c41c852ca2acc9127baf3cdd9644a1e2df90ae9c3ffcd66eabf454d6
+DIST Python-3.10.17.tar.xz 19608144 BLAKE2B 9caebdcdc21c07037f423bc4831b0e4654dea4264b7a176b2caed625a930f0d6e8e2f6d581dee6f666a1fc17139d1ccd8bcf13c958df14dfd8de31f321d3e048 SHA512 11b1e647f8db05041bcafe110698af8bf5e9f7c8d23c0e9eb568a60544bb9a9e9c3ac94b34f0898f0d4e6c23da3cb81f844ae9d9c8b750058763502eaba39880
+DIST Python-3.10.17.tar.xz.asc 833 BLAKE2B 9468dc33530d8a4ec911e7a2bacd2d1c3533e6819a91c1307e8d577cefe6c6bdb9e9dc7f2abc078cd35186db7f58efd89eb4170fb20887bb2de5a5aa68b3c1f4 SHA512 f5fea78e2ea413c9befb6181787b3a5ea3bc0f5dbf808a94465b558c09353482cd34631a4c505f72aa343a2f4fae291453324cd8e6b18df214baaf4680fc17cf
 DIST Python-3.11.11.tar.xz 20085792 BLAKE2B a9a778eff94529e1029ae252ef28ecdc2f0673a4406d831865e12de3cba21ea48905542d0e806e428802b05947239ca6a44eff3573bd541469b01644790c7377 SHA512 3ff90f15f725fa8d06686158aaddb887a247b03ca4dc1fdfd81a8efb53373db3e8673bd0b3de30bb7669f3f07d9854e9d8a2dbcd49b18d15b8172787a53a0a9e
 DIST Python-3.11.11.tar.xz.asc 833 BLAKE2B 6a9d873e181d636712567ea46823ad7f972f872d038092506e67bada24187441188b8fde4672c205ce6d37e60c4e0c69a8f3cc5d1915fd8f5dd8743292a16d1b SHA512 d71b0b42537fb636e8c469d62d13ff020149e4fb9d87eb17f8c999301195e418d134dbdb7e4ab49b06de16e96f8ef6bbcf2a749956fffca2ce03185f191c181d
+DIST Python-3.11.12.tar.xz 20112232 BLAKE2B 95f82af070e86ecf48881103ce6d7211a4a915a93a49b1407eaf445364b7a7daec406cf07eb9334ed47a59397a9796f6a5c70dcc9b7b47103beb3bffc6aa56d7 SHA512 5c95900de73cd187f5d7a89a05314ef85f4d680308d0d5fff5e6ada81f8ecf030018bef0f1a819d007e8b6d01b52e50395572c2d1a56d2c164492e13a69a9926
+DIST Python-3.11.12.tar.xz.asc 833 BLAKE2B b874df8019eb3c548598f8723fa38c89189cc375d6ced7cae180ffdc35a8e7b0ba93638861412e19037aa1fee76749186f10c4929dc7f4fb4ef7a8f4561d325c SHA512 cb1f82d44be6de67182747f8ad1054e85cca22753c0c86ff12b95ec7044c5c6c37f40a876e5707a6c422d58f483257b8ddbb3ea87893679f81b9299c48373f20
+DIST Python-3.12.10.tar.xz 20520960 BLAKE2B f05805da36958e3ebb68c69353e8119b20ee4c1a123f4492e9bf614e7faa856180ef2017f2a698bcacf19cac01d89329ed5ee45e00c98b255d4854090a2e6926 SHA512 520c30e3958d0be3c127e5dbb1c52bb3bfc404b5b3c7eb56525e25b9b59af9b21b53bee192f323f470e1df806f6cb2dd3411eb90cbc1c4b7d9b6b0777c29e644
+DIST Python-3.12.10.tar.xz.asc 963 BLAKE2B 45e1ec67311d1ac5679cb5a05b92e61f3e5e6e9d3ffa5462c09c2aa066fda7ea915df13f6e5ad33aa924f6ce1f18e2d78a31af15412a10c093fc8a5b536c5133 SHA512 7edfa6fd816cf2a052abdb775d464e2f389105ed3e782cacf90805613aaca54bf71308504a5336ee1204e872e7db28df32413fb10b057056b0d5cb3c7a20a9f1
 DIST Python-3.12.9.tar.xz 20502440 BLAKE2B df1a8ba4996219c018fc14156958ca9c0e8af4854819064fbcf0c927258ecb3c5f46e562213799a87dafb35ae5bd647e1ce280affe2ac8ce6a85c351822b6693 SHA512 c840b14aa21e6a963d18c06ebaafb551d9c9a101b3866417e762fc4a2fde071a7a25fa257faba2956c7344bbc2413ed61690a712d26fba4d0dbeaa50e49b2574
 DIST Python-3.12.9.tar.xz.asc 963 BLAKE2B d90b9c1a3aafa1a942ef8d978b566829656db1114b74f1565b7cbba188cf3bf5637c1dbeec3432ae0af0f826a154c40f27fd8fc46350a757ef91f5c426908149 SHA512 b59251ca3a0a17c06ff7d165f6c025eb91127c80be0782642590f5c922297e0710544ac5a9ae977378e393f1c4861149576a0515af5ec0e54e6827c4010d544f
 DIST Python-3.13.2.tar.xz 22621108 BLAKE2B 79c7dff8a15fd2487d62847a8e654c02433a89887aa4f93819020b60a30587e3ba92b101553d971b59e132677f9f74dfc41cd7c7901db78a7787607ec96c6664 SHA512 bb1c0598914c6d4326554faa568f660f10b20c701d0f36bf1fa58837b6498d728a407416b06ede39604caea1ca93f60545b83b01ae8ee65f55d4cc83242b63fe
 DIST Python-3.13.2.tar.xz.asc 963 BLAKE2B 95a36c305dd452df23b4f119de05e1d3a2b2c9e0c2778a52dc4065f82b52752b68d89eb737cc54cced70623ad4a7b48c85fdff781bf7d7e3b747dacb1ef77db0 SHA512 5f019be530f688b0adf5d5cc9f2c2243e2f1dc7338559db14c1eedd12aadc85404d42c7aafd74e41828205d85f13f278876662ac30c8f3382a1ee081ba5f29f2
+DIST Python-3.13.3.tar.xz 22654240 BLAKE2B 24ac47c13cbfa4dc9ce6ae4d18d7b5310f83ac1f4f18722138ef07e01cb8ac37edf6f4301983cb468f533b9b475b5a9d761d3044e61c7ccaa99dceadb954fe34 SHA512 f7559b6dceae69f48742af0a6497fbec42cd1e5304f64b6eb9d89222a1171ccf12fa186cc0decabb4e98d05223184967a4a7537754c01083dacdc9073cb1a578
+DIST Python-3.13.3.tar.xz.asc 963 BLAKE2B 4a98965305b80e985512f54d9ce8ab88a74fe0d3ee48e300fbc2b4e251c0f499f4eb935e0aeb6d5ad8262338643325126f094fff926da1e2b9a2b3a2247701dc SHA512 54f8da5f4a4dcadc9830cb07aecf695a26a2de48ab98e1f42b09fdde1c70989476d07ce7ea81337216f1e5fcbf6b688e0608c88a2545ced416b01640108e94db
 DIST Python-3.14.0a6.tar.xz 22956068 BLAKE2B e8605da0dfa0f4ecf2f21cd770a074e73a2fbb24182d8adb27b1583da0ab48157bd9e70438c8efbb8fd17a66447e934a33128e0d50d9f253bde2f6c17df80375 SHA512 0fca503199bed0744139823aaf3ead30d7876556750b476fa6e1f701ae71fa7fe333cd46c775929c26729cf71bef6ba545fdc0118a0efca17c2434de3cadabe1
 DIST Python-3.14.0a6.tar.xz.sigstore 5227 BLAKE2B 1e517fc1205a2d9ec448fe17afac2c6a1874c08904b78f1f0ef6bb4140696ebc03e34080bb973eeae6fbb4adc9b0e3ad3a9133fbef0b48ba4aca99ae81f59862 SHA512 e1824480165f68597822e8934a58e744e3c4098b8646006548d20d42b8e8809ca95f129cc23edd49bd9dbaf158a36d60b7bc5bfd449c08af9e08e8e552e21f7d
+DIST Python-3.14.0a7.tar.xz 23015952 BLAKE2B f12039695a3a7fdd6352adfca803bad066af3b320159faa1d85bdd914732e8170bc2494427151fad140d699db13645066fa41d8e74dc697226957e793a6305ef SHA512 f7e50c201cb1bbc4779d898e65408147637de7b9d9d85a2e6ad4f8dda758ec150dfb95ee1f12c686a3f46c29a986a75b45323bcbab87b81b319d91236989f6b0
+DIST Python-3.14.0a7.tar.xz.sigstore 4795 BLAKE2B ba10cb295cc4ca7eb41783fad9a85994c0ccf53983b19a73afbf32739248d9dd2282e998c15223d45259b780d6b7de25f418563a9c2e6fc2ef4f0d12290de539 SHA512 daee7d607851092e1c8e7b05b5419e464b8d2c4d65a746a206838709d612412680362c9adb3c67751641893e945e2f6b06b4e6e235e7b18ec4a208af9633525a
 DIST Python-3.8.20.tar.xz 18962788 BLAKE2B 715c75e0c0a3d3b77af7f07478311bb0554b80aac72915be703aa2d0dd6459a972e5669808e64da14a0b91bb183e00655055c1726f302dc3ccd8721e3b4ae3e6 SHA512 3c9341ee1fd33cb687958dcf2b7c0c7700489726c4d530c3e9d9537d46a6ab534541a4b312232d8505bea395a07e4518c42d75fb7571103e6b266f8f44115c61
 DIST Python-3.8.20.tar.xz.asc 833 BLAKE2B 5c86c15a1090b42e42bb7512565b1a7ad9d2137d59e9fd1ab0f83fdfc37dfcf184389418d6703db809e9c8c04a169af292665a2b58bf5dc61b7724ecbb4132d9 SHA512 a751ae0407a593d97acac4d5f8a0456580c753efa12a7d960125c219b4897fdb26fc1ffd43d8ea33ad1449162dd3b2904c16b6c51c57561ba73de3ffa62e0eed
 DIST Python-3.9.21.tar.xz 19647056 BLAKE2B 7f77a7fb38d9a9f4fda7007587f744ade5f32b7bcd911dd72ab82b00d324173f28ddfbe492c71bf0f71edb8494e61314b4bf6f70298289b0e5796c6d002ff738 SHA512 cc84c967cd7a05361ec144d87ca044bd416032ee92dfb78658758d4e1274971f5fb288876d9c599a729bb21258974a786089341bce6bdcffd9c30ebd69b7ca58
 DIST Python-3.9.21.tar.xz.asc 833 BLAKE2B f6e666179d745638a38ace35e13c26cc3e07c116a8c8362cc260a74113cd29a5c1909d2091f2eed4bb088bc71b79ed18c5503739d1cc3cb7ff95d625f4311421 SHA512 1e5e5a5db8074a7ee5eb51e6c789d6e46467165d72d2d636d1fc0d3e15d4355051f9f7ad3063ba43b37b611095765c9d654ed890067c201c087da1eecb620ef9
+DIST Python-3.9.22.tar.xz 19652572 BLAKE2B 59f2d2cecde8179064115b52205c2195b26cd0f37aec3e88b0fe2a1a7893a7df8ae38a024814d42064d5e4916e4054a76dddeec0a0dcf29af576d52dbcf65f4c SHA512 c5a76c579455626bf40bb41ee99cab6e444aa5d5085dab7cf622c70ded750e31710c2c30f032917f0d4069350c01a889ed9831d77fcc2d52fcec54055dd07496
+DIST Python-3.9.22.tar.xz.asc 833 BLAKE2B 2bc75d7e39ebee63b8cfd9ee1af2941bc0bd659becf89d291ea33f5baea2b606a34841c7ac5c597eac51b19602cf24ccec123964a1022d43fd251553fb3f90f7 SHA512 9a04fcf7d7fc0521873d29efad3a80a9ff63df4fc4fe4108059246db6517b22d967f4d4e0eebb32c79417f66ee3b60fe00428be155fc1cbea163aa36c1a3ddee
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.16_p2.tar.xz 29428 BLAKE2B fa63d2fcdbb53e3b6381eaadfbcfca02a03eddd7035dd4776c706fd1aa0226a2c809260ba5a543a209a63563dab12ea109bf03a2026ea4b5797fa6afc7b45c52 SHA512 0186abf035632a3f8018052f8021c1d0dadbc28b7d03551f6992a658fe53878ac9ea86b79512e0e147efecedfda133cf7936746946238177918be9c695248f15
+DIST python-gentoo-patches-3.10.17.tar.xz 28784 BLAKE2B 7f1c1f9f49876b99d80a3f40b66061ab96796821e1a5396f5edfa08e3878b8b9970688d3c861d9c5d08701a8850584eb87a223e3ba84c5536ae689f59145ad43 SHA512 3e89b334d81702f0e6fa00e9b70daf6ff4df439c280c6cff33aa8874dde29f63d809697757df39daea07bf746207e931f211558811c9e731df9ca846a8559483
 DIST python-gentoo-patches-3.11.11_p2.tar.xz 16224 BLAKE2B d8404c8c87e109d2c699dbab63c20a319c6efd5b62dab5fcc1b53b5b291e25686e69ef92b495eed0d80491cfa29ae9f523df6b53c7c6a12c3f713c53e3c5b7c6 SHA512 f1bf897305678c2b113aef4553d14e916e83312708352765725d754dffbf2f5dd7ef0f7cd84a774e4a8c18dde8a517d7eaf8e58720d73d25430b28fe49906258
+DIST python-gentoo-patches-3.11.12.tar.xz 15616 BLAKE2B 5d4a47058fc35c4ae966e3dff823f91129852bf81cd586d5b3a34a6daf672732918daf00199394f2f982411ec30a291f45bba55b3ffa3d96a179ecd600ea4647 SHA512 77973ef88403f94d55162e0138cd29b4d8959a8fcf4cec730daf7ddd8fb4a3acfcd0dd1fdaacbdd2b218bd15f6c6715ce339df4eba48227d17520243d96eeb39
+DIST python-gentoo-patches-3.12.10.tar.xz 10744 BLAKE2B 2abf4874018156d6735cf8604c410dc4726ac9365bc7500abe6b82472aad100aac7268957256692f4275b02965773e58178519ed8038e121f1ffa3c53770d238 SHA512 62066405aa00f46f9645e9c747d53bb93bf510fc791d14d49e00edfd79981778e6c8e07bfa7bac88d76407a0ffd8f7321dea89f81d90b01dbf13f4d381b6a1a3
 DIST python-gentoo-patches-3.12.9.tar.xz 10736 BLAKE2B 1f87d1bba8c094936e5cd3e0ef2eede0dbca3e658430f81b398735d8f02fff1f87739914014dbcb17163f8a969ffc5e7e4cce7d71557ce3c2e58487e6ed8b80f SHA512 342f11df85926e32455d52115d06b817a17f7ae104e3ea8e852046d321d829835bba7c07803c50dd5433ac8b615499428d5bc1a088b484ca0c4304eb8b2cb879
 DIST python-gentoo-patches-3.13.2.tar.xz 8316 BLAKE2B 2367808924c83c02b8b2ca765fd4768d4f12cb8e8451eab9d084ce5950a5a81829e573d415f9a16db2e053105def90b5f52c91423fc71e57cd182a1d9c824d8c SHA512 580332ca037c1453f314d5811f96f7bf74defc16cfe515c4fe82ea08a7bf3679aa88d5456db846d988bcf4fbc9eeb4ebe7cee01d135bd55c87931206250e301a
+DIST python-gentoo-patches-3.13.3.tar.xz 8336 BLAKE2B 66393886fbd034eb14732e4f81f5798e77650ea3fe1c4f8176bd93808b711c8977a53c3f52be6c9b97a368299258b851d9bdb6d4c8e0c75695c6aea784d48b44 SHA512 c1ed31d6aaef81addf786c2ccc1013309b122b791c42fe10e467a677d0db8f149e8b1cc21928c146298918c7ceb851b4b19d1e59f491cb161004e1c9386db289
 DIST python-gentoo-patches-3.14.0a6.tar.xz 5680 BLAKE2B 704014b9935db57b28e9191b1a9d478b2e3d17c66fc1bbe1d5df4de0197f51ae184ad44c8434d22c3113545c3267fa8838dc8fa90bab00aa50223e38c9f1be7e SHA512 e5446d9bf25334f117e7967d5d77424bfd8b4a5a277358b8e4c27aaa15686a0fd0c6957b4fd0306622dc83f02de5e2d2f02d1f9a5675412915bfbab4b072e94d
+DIST python-gentoo-patches-3.14.0a7.tar.xz 5680 BLAKE2B 72fdb5debdcae47143724a100736272994298f4b9c7c4954a1a506b247b93fc06f5dc25140c0fd1f5fdc9110d41b93d33451e11fa07219d394728f987324d7b5 SHA512 e4091ff450bf1ba328961c6e9fbfea233ba8027ded4682355129a67767827080ec2cf23995f7fde9517bc65fbc135820bf89578bdccd539e4559c7944345d15a
 DIST python-gentoo-patches-3.8.20_p6.tar.xz 50876 BLAKE2B df0df21c75972fb73e36f66f0c90d3f953b14d7a59bf97ce4214dce6e6d937ed52fbf3db8f3eaf42cde141bfe4d7a731b06e41723285517461c790912706be9e SHA512 48ef567f6972e7975cb61d34a876d8c0db42f1a3c0b832f9366091dd5f2ca854c02887808843d314816c8cf6d7b0738c40e7835fedbba7b84e57f2515dde45e2
+DIST python-gentoo-patches-3.8.20_p7.tar.xz 54544 BLAKE2B e31fc9fb5e98b62b0f70165670ec58ed4fa932cfc95d5287c249015a3a372fdbf0d1ba08cb98f63c2dc500700edfd6ffea6db670385d2c86a4fdb92ffb991192 SHA512 a9e7e4976be226931a503af2c986da207d060d4ce436af61f5e8427da513639adbed32bb0061963b83fef275a5de91707ab13b7a9abf3a7472ee0e2c5310eda1
 DIST python-gentoo-patches-3.9.21_p1.tar.xz 35404 BLAKE2B 7b5ac27e814b06791fa5f0566763711c1b65a7c82ba66f97e237eebc6076f0bfdad3d8269ece6c4d4c238b62cc75b01f68ea3a5d7c4fffc46e88f79b2ba3e7fc SHA512 92c8548b31100a921378c72cc94a81062c96fd795fa2cd001c57a71e4af39e91b21b99e9e84db12adb142d9c4bda809445519c5c8a35545bd10230926bd7eded
+DIST python-gentoo-patches-3.9.22.tar.xz 35388 BLAKE2B b6acfa681bdb589f74094ea04bd053bfc122ef9f36b3413c33c352cfae4e101027b0348770b47b9fee769eaba8109406acb6418c1cb8c431fbc7cf1c69124dcb SHA512 335c32d696f9660c957dec0c9a54e2f04e34003d2dbb438e6c9e74ce0a6352b5849e8626397939e3ffa7dc3172ac88cfa2168dd0d120be306e8c898dc7b6b3dc
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17.ebuild
new file mode 100644
index 0000000000..2e9d941cb3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.17.ebuild
@@ -0,0 +1,595 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-debug/valgrind )
+	test? ( app-arch/xz-utils )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
new file mode 100644
index 0000000000..ff6ee57dda
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.12.ebuild
@@ -0,0 +1,631 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs eapi9-ver flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# force-disable modules we don't want built
+	local disable_modules=( NIS )
+	use gdbm || disable_modules+=( _GDBM _DBM )
+	use sqlite || disable_modules+=( _SQLITE3 )
+	use ssl || disable_modules+=( _HASHLIB _SSL )
+	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
+	use readline || disable_modules+=( READLINE )
+	use tk || disable_modules+=( _TKINTER )
+
+	local mod
+	for mod in "${disable_modules[@]}"; do
+		echo "MODULE_${mod}_STATE=disabled"
+	done >> Makefile || die
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.11.0_beta4-r2; then
+		ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+		ewarn "installed previously are no longer valid and will be regenerated"
+		ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+		ewarn "when installing some packages and checksum mismatches when removing"
+		ewarn "old versions.  To actively prevent this, rebuild all packages"
+		ewarn "installing Python 3.11 modules, e.g. using:"
+		ewarn
+		ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
new file mode 100644
index 0000000000..f4a9569ac1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.10.ebuild
@@ -0,0 +1,614 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
new file mode 100644
index 0000000000..a02ac6833e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3-r100.ebuild
@@ -0,0 +1,639 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
new file mode 100644
index 0000000000..fc5eb4346c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.3.ebuild
@@ -0,0 +1,634 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
new file mode 100644
index 0000000000..eff6e9f28d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7-r100.ebuild
@@ -0,0 +1,640 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_alpha/a}
+MY_P="Python-${MY_PV%_p*}"
+PYVER="$(ver_cut 1-2)t"
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="Freethreading (no-GIL) version of Python programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	ewarn "Freethreading build is considered experimental upstream.  Using it"
+	ewarn "could lead to unexpected breakage, including race conditions"
+	ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+	ewarn "you can reproduce the problem with dev-lang/python.  Instead,"
+	ewarn "please consider reporting freethreading problems upstream."
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--disable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	# Fix collision with GIL-enabled build.
+	rm "${ED}/usr/bin/python${PYVER%t}" || die
+	mv "${ED}"/usr/bin/pydoc{${PYVER%t},${PYVER}} || die
+	mv "${ED}"/usr/share/man/man1/python{${PYVER%t},${PYVER}}.1 || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if use tk; then
+		# rename to avoid collision with dev-lang/python
+		mv "${ED}"/usr/bin/idle{${PYVER%t},${PYVER}} || die
+	else
+		rm -r "${ED}/usr/bin/idle${PYVER%t}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
new file mode 100644
index 0000000000..53ffce4948
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.14.0_alpha7.ebuild
@@ -0,0 +1,635 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 19 )
+LLVM_OPTIONAL=1
+VERIFY_SIG_METHOD=sigstore
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic linux-info llvm-r1
+inherit multiprocessing pax-utils python-utils-r1 toolchain-funcs
+inherit verify-sig
+
+MY_PV=${PV/_alpha/a}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.sigstore
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}
+			llvm-core/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+# https://www.python.org/downloads/metadata/sigstore/
+VERIFY_SIG_CERT_IDENTITY=hugo@python.org
+VERIFY_SIG_CERT_OIDC_ISSUER=https://github.com/login/oauth
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER%t}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+declare -rgA PYTHON_KERNEL_CHECKS=(
+	["CROSS_MEMORY_ATTACH"]="test_external_inspection" #bug 938589
+	["DNOTIFY"]="test_fcntl" # bug 938662
+)
+
+pkg_pretend() {
+	if use pgo || use test; then
+		check-reqs_pkg_pretend
+	fi
+
+	if use jit; then
+		ewarn "USE=jit is considered experimental upstream.  Using it"
+		ewarn "could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[-jit].  Instead,"
+		ewarn "please consider reporting JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	if [[ ${MERGE_TYPE} != binary ]]; then
+		use jit && llvm-r1_pkg_setup
+		if use test || use pgo; then
+			check-reqs_pkg_setup
+
+			local CONFIG_CHECK
+			for f in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+				CONFIG_CHECK+="~${f} "
+			done
+			linux-info_pkg_setup
+		fi
+	fi
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sigstore}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# this is actually test_gdb.test_pretty_print
+		-x test_pretty_print
+		# https://bugs.gentoo.org/933840
+		-x test_perf_profiler
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		arm*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		hppa*)
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_gdb
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_gdb
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# Kernel-config specific skips
+	for option in "${!PYTHON_KERNEL_CHECKS[@]}"; do
+		if ! linux_config_exists || ! linux_chkconfig_present "${option}"
+		then
+			COMMON_TEST_SKIPS+=( -x "${PYTHON_KERNEL_CHECKS[${option}]}" )
+		fi
+	done
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		# PGO sometimes fails randomly
+		local -x PROFILE_TASK="${profile_task_flags[*]} || true"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+		--enable-gil
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" TEST_MODULES=no altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
new file mode 100644
index 0000000000..c6e038ea7c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.20_p7.ebuild
@@ -0,0 +1,491 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	rm Lib/distutils/command/wininst*.exe || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
new file mode 100644
index 0000000000..e8160fe107
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.22.ebuild
@@ -0,0 +1,584 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		-x test_gdb
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+				-x test_multiprocessing_spawn
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-system-libmpdec
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+		local -x TMPDIR=/var/tmp
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	local -x TMPDIR=/var/tmp
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0-r1.ebuild
index 9f30d1dcc2..d4f1a5db1a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0-r1.ebuild
@@ -57,7 +57,7 @@ if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
 fi
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="$(ver_cut 1-2)"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild
index 83b5a9c1a3..2afcbad622 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.0-r1.ebuild
@@ -68,7 +68,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
index b6f28c029f..c988553043 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.84.1-r1.ebuild
@@ -68,7 +68,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild
index 9bfbad9c86..87c6951a53 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0-r1.ebuild
@@ -94,7 +94,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0.ebuild
index 88b742cc51..cdcb5e6504 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.0.ebuild
@@ -94,7 +94,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1.ebuild
index 9bfbad9c86..87c6951a53 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.85.1.ebuild
@@ -94,7 +94,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
index 41f407880e..a5a82e00ca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0-r1.ebuild
@@ -68,7 +68,7 @@ for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
 done
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="$(ver_cut 1-2)"
+SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
 
 IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
 
@@ -94,7 +94,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
@@ -719,7 +719,7 @@ src_install() {
 		# we need realpath on /usr/bin/* symlink return version-appended binary path.
 		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
 		# need to fix eselect-rust to remove this hack.
-		local ver_i="${i}-${SLOT}"
+		local ver_i="${i}-${PV%%_*}"
 		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
 			einfo "Installing ${i} symlink"
 			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
@@ -728,7 +728,6 @@ src_install() {
 			ewarn "please report this"
 		fi
 		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
-		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${i}-${PV%%_*}"
 	done
 
 	# symlinks to switch components to active rust in eselect
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
index 72e6409056..39292c5cb8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-9999.ebuild
@@ -94,7 +94,7 @@ BDEPEND="${PYTHON_DEPS}
 		>=sys-devel/gcc-4.7[cxx]
 		>=llvm-core/clang-3.5
 	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
+	lto? ( system-llvm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') ) )
 	!system-llvm? (
 		>=dev-build/cmake-3.13.4
 		app-alternatives/ninja
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.0.ebuild
index 0f59f82703..add8a31560 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.1.ebuild
index 0f59f82703..add8a31560 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.7.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
index ea0f982cfb..7c4baa3252 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://pagure.io/libaio.git"
 else
 	SRC_URI="https://releases.pagure.org/${PN}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="LGPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/files/libdnet-1.18.0-fix-incompatible-function-pointer.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/files/libdnet-1.18.0-fix-incompatible-function-pointer.patch
index 054bb9853c..836296f389 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/files/libdnet-1.18.0-fix-incompatible-function-pointer.patch
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libdnet/files/libdnet-1.18.0-fix-incompatible-function-pointer.patch
@@ -3,13 +3,16 @@ https://github.com/ofalk/libdnet/pull/104
 From de57a2349172148496386e284db91abe6406b02a Mon Sep 17 00:00:00 2001
 From: "Z. Liu" <zhixu.liu@gmail.com>
 Date: Wed, 19 Feb 2025 11:37:37 +0800
-Subject: [PATCH] python/dnet.pyx: fix incompatible-function-pointer-types for
- modern compiler
+Subject: [PATCH 1/2] python/dnet.pyx: fix incompatible-function-pointer-types
+ for modern compiler
 
 which is error now, see https://bugs.gentoo.org/933360,
 clang 19 (maybe earlier) has the same problem too
 
 Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
+---
+ python/dnet.pyx | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
 
 diff --git a/python/dnet.pyx b/python/dnet.pyx
 index 4e3604f..04db2c6 100644
@@ -108,3 +111,73 @@ index 4e3604f..04db2c6 100644
 -- 
 2.45.2
 
+
+From 0a742400b2167f67067e13bfcbecb9f17a7eefe8 Mon Sep 17 00:00:00 2001
+From: "Z. Liu" <zhixu.liu@gmail.com>
+Date: Thu, 3 Apr 2025 08:09:26 +0000
+Subject: [PATCH 2/2] python/dnet.pyx: fix -Wincompatible-pointer-types
+ reported by gcc14
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+./dnet.c:8451:52: error: passing argument 2 of ‘PyObject_AsReadBuffer’ from incompatible pointer type [-Wincompatible-pointer-types]
+ 8451 |   __pyx_t_1 = (PyObject_AsReadBuffer(__pyx_v_pkt, (&__pyx_v_p), (&__pyx_v_n)) == 0);
+      |                                                   ~^~~~~~~~~~~
+      |                                                    |
+      |                                                    char **
+/usr/include/python3.12/abstract.h:370:52: note: expected ‘const void **’ but argument is of type ‘char **’
+  370 |                                       const void **buffer,
+      |                                       ~~~~~~~~~~~~~^~~~~~
+./dnet.c:8451:66: error: passing argument 3 of ‘PyObject_AsReadBuffer’ from incompatible pointer type [-Wincompatible-pointer-types]
+ 8451 |   __pyx_t_1 = (PyObject_AsReadBuffer(__pyx_v_pkt, (&__pyx_v_p), (&__pyx_v_n)) == 0);
+      |                                                                 ~^~~~~~~~~~~
+      |                                                                  |
+      |                                                                  int *
+/usr/include/python3.12/abstract.h:371:51: note: expected ‘Py_ssize_t *’ {aka ‘long int *’} but argument is of type ‘int *’
+  371 |                                       Py_ssize_t *buffer_len);
+      |                                       ~~~~~~~~~~~~^~~~~~~~~~
+
+Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
+---
+ python/dnet.pyx | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/python/dnet.pyx b/python/dnet.pyx
+index 04db2c6..6aefaa2 100644
+--- a/python/dnet.pyx
++++ b/python/dnet.pyx
+@@ -25,7 +25,7 @@ cdef extern from "dnet.h":
+ cdef extern from "Python.h":
+     object  PyBytes_FromStringAndSize(char *s, int len)
+     int     PyBytes_Size(object o)
+-    int     PyObject_AsReadBuffer(object o, char **pp, int *lenp)
++    int     PyObject_AsReadBuffer(object o, const void **pp, ssize_t *lenp)
+     int     PyLong_Check(object o)
+     int     PyLong_Check(object o)
+     long    PyLong_AsLong(object o)
+@@ -294,8 +294,8 @@ def ip_checksum(pkt):
+     """
+     cdef char buf[2048]
+     cdef char *p
+-    cdef int n
+-    if PyObject_AsReadBuffer(pkt, &p, &n) == 0:
++    cdef ssize_t n
++    if PyObject_AsReadBuffer(pkt, <const void **>&p, &n) == 0:
+         if n < 2048:
+             memcpy(buf, p, n)
+             __ip_checksum(buf, n)
+@@ -310,8 +310,8 @@ def ip_checksum(pkt):
+ 
+ def ip_cksum_add(buf, int sum):
+     cdef char *p
+-    cdef int n
+-    if PyObject_AsReadBuffer(buf, &p, &n) == 0:
++    cdef ssize_t n
++    if PyObject_AsReadBuffer(buf, <const void **>&p, &n) == 0:
+         return __ip_cksum_add(p, n, sum)
+     else:
+         raise TypeError
+-- 
+2.45.2
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
index 25ec05a4fe..703f69f686 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/Manifest
@@ -1,3 +1,4 @@
 DIST libffi-3.4.4.tar.gz 1362394 BLAKE2B 189fe1ffe9507f204581b0ab09995dc7e7b761bb4eac7e338e9f5ff81431aebcef6c182c1839c9f9acb2706697a260c67e6d1351cf7e2aed7c4eb5d694f6f8fd SHA512 88680aeb0fa0dc0319e5cd2ba45b4b5a340bc9b4bcf20b1e0613b39cd898f177a3863aa94034d8e23a7f6f44d858a53dcd36d1bb8dee13b751ef814224061889
 DIST libffi-3.4.6.tar.gz 1391684 BLAKE2B af8402a09bdbd59b4e9400d2d71bd5ce98f6f1d981d35d1ab40d77a831b13b32c5bd34ca54ff75999e39f0d8a9c066381fae7a8d6c5216d955e064f929f08b88 SHA512 033d2600e879b83c6bce0eb80f69c5f32aa775bf2e962c9d39fbd21226fa19d1e79173d8eaa0d0157014d54509ea73315ad86842356fc3a303c0831c94c6ab39
 DIST libffi-3.4.7.tar.gz 1393979 BLAKE2B 0dd17b4fd358beb9842889168437443137445a5dba1f0a7e8669ae420d8efb927815c08602c1b1b141acfdfdbaa12b417863402a5c8df5f36519fd3e772d3f37 SHA512 d19f59a5b5d61bd7d9e8a7a74b8bf2e697201a19c247c410c789e93ca8678a4eb9f13c9bee19f129be80ade8514f6b1acb38d66f44d86edd32644ed7bbe31dd6
+DIST libffi-3.4.8.tar.gz 1397992 BLAKE2B 10b3d970dc598fb8689bca49751cda499ddc5216baf89d38625385b0d42d57f10d15cce3c4c044c9c73a4fce384c26f2a8e1b99269e9db1174c2631201c6bfd4 SHA512 05344c6c1a1a5b44704f6cf99277098d1ea3ac1dc11c2a691c501786a214f76184ec0637135588630db609ce79e49df3dbd00282dd61e7f21137afba70e24ffe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
new file mode 100644
index 0000000000..e000b77b4e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libffi/libffi-3.4.8.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit multilib-minimal preserve-libs
+
+MY_PV=${PV/_rc/-rc}
+MY_P=${PN}-${MY_PV}
+
+DESCRIPTION="Portable, high level programming interface to various calling conventions"
+HOMEPAGE="https://sourceware.org/libffi/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/libffi/libffi"
+	inherit autotools git-r3
+else
+	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+# This is a core package which is depended on by e.g. Python.
+# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
+# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
+SLOT="0/8" # SONAME=libffi.so.8
+IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
+
+RESTRICT="!test? ( test )"
+BDEPEND="test? ( dev-util/dejagnu )"
+
+src_prepare() {
+	default
+
+	[[ ${PV} == 9999 ]] && eautoreconf
+
+	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
+		# ensure we use aarch64 asm, not x86 on arm64
+		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
+			configure configure.host || die
+	fi
+}
+
+multilib_src_configure() {
+	# --includedir= path maintains a few properties:
+	# 1. have stable name across libffi versions: some packages like
+	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
+	#    ${includedir} at build-time. Don't require those to be
+	#    rebuilt unless SONAME changes. bug #695788
+	#
+	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
+	#
+	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
+	#
+	#    We use /usr/$(get_libdir)/... to have ABI identifier.
+	ECONF_SOURCE="${S}" econf \
+		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
+		--disable-multi-os-directory \
+		$(use_enable static-libs static) \
+		$(use_enable exec-static-trampoline exec-static-tramp) \
+		$(use_enable pax-kernel pax_emutramp) \
+		$(use_enable debug)
+}
+
+multilib_src_test() {
+	emake -Onone check
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.20.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.20.0.ebuild
index de6371cccc..4fb6ca4dcc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.20.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.20.0.ebuild
@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 
 LICENSE="LGPL-2.1+"
 SLOT="0/6" # subslot = libtasn1 soname version
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
index 6210f5053d..d749d0c3ae 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/Manifest
@@ -1,3 +1,2 @@
-DIST libusb-1.0.26.tar.bz2 620534 BLAKE2B 0cc397ecf4de0066abbff9b286a9e4fcd48658698d5e0d6b736abf56b48c1b55a05f15fff7be53fd33f767621e0c25d87275a47e05a4bcb44c4b8ac9221cd081 SHA512 fcdb85c98f21639668693c2fd522814d440972d65883984c4ae53d0555bdbdb7e8c7a32199cd4b01113556a1eb5be7841b750cc73c9f6bda79bfe1af80914e71
 DIST libusb-1.0.27.tar.bz2 643680 BLAKE2B bec2eb053159ffa719c794d234f8e99b895a4fae336b862a3197b88deb3d307a53ebb98d2aa993a2f390f14264f796b96ac47274c19f56db30440484ee336c8a SHA512 42abbbcf2564f86cc2f05826aeefa6beb03c9f89dc9fe05bdfa351caa3dbd07713ce193daadecf29557604dd3cbc770c8031a78e1ad0a8df3627c3f551d28ff0
 DIST libusb-1.0.28.tar.bz2 658053 BLAKE2B 9bf506455fc1b981de155600936ab229f089ea28e58491076eab632455c4e814bf0336cd9326056a255508aa3956643c503af3ff2feda80bac036cf5cad86e80 SHA512 0f4efa6b54e6195d2e5446652c2dc07358583e205d63bf438c4409511b8637d1700a71268c40499755747827d23cc730d9122267386f847bf781993c045c519f
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.26.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.26.ebuild
deleted file mode 100644
index d362e5c8ac..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libusb/libusb-1.0.26.ebuild
+++ /dev/null
@@ -1,74 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit multilib-minimal usr-ldscript
-
-DESCRIPTION="Userspace access to USB devices"
-HOMEPAGE="https://libusb.info/ https://github.com/libusb/libusb"
-SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.bz2"
-
-LICENSE="LGPL-2.1"
-SLOT="1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
-IUSE="debug doc examples static-libs test udev"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="static-libs? ( !udev )"
-
-RDEPEND="udev? ( >=virtual/libudev-208:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}
-	!udev? ( virtual/os-headers )"
-BDEPEND="doc? ( app-text/doxygen )"
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable static-libs static)
-		$(use_enable udev)
-		$(use_enable debug debug-log)
-		$(use_enable test tests-build)
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	emake
-
-	if multilib_is_native_abi; then
-		use doc && emake -C doc
-	fi
-}
-
-multilib_src_test() {
-	emake check
-
-	# noinst_PROGRAMS from tests/Makefile.am
-	if [[ -e /dev/bus/usb ]]; then
-		tests/stress || die
-	else
-		# bug #824266
-		ewarn "/dev/bus/usb does not exist, skipping stress test"
-	fi
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi; then
-		gen_usr_ldscript -a usb-1.0
-
-		use doc && dodoc -r doc/api-1.0
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -type f -name "*.la" -delete || die
-
-	dodoc AUTHORS ChangeLog NEWS PORTING README TODO
-
-	if use examples; then
-		docinto examples
-		dodoc examples/*.{c,h}
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
index 908c7de93e..1fe2d986a8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.13.7.ebuild
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	inherit gnome.org
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 SRC_URI+="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.0.ebuild
index 8c22d70a67..d6898be0ef 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/mpdecimal/mpdecimal-4.0.0.ebuild
@@ -14,7 +14,7 @@ SRC_URI="
 
 LICENSE="BSD-2"
 SLOT="$(ver_cut 1)"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="cxx test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
index 652f7c6c91..2e07c50a0d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest
@@ -13,3 +13,5 @@ DIST openssl-3.3.3.tar.gz 18102481 BLAKE2B c2033e357963e339faaf3b35b18c660da4861
 DIST openssl-3.3.3.tar.gz.asc 833 BLAKE2B dbb8436f7e8e015eca740ccddcbfc159884089c7540e47d03d65efcc607a28d29889f7eaf53412e50362d201941df3061e7877b6216215d4cab04bdb149d23a7 SHA512 2fde16310fc0a2985ea9df5b8485c17391a589297679687634b833b453e9c5d04ddb3b8b4f117259af9b13813ca0ea9ee6cec2d854dfc7e1add3dbb78962ccd0
 DIST openssl-3.4.1.tar.gz 18346056 BLAKE2B 328a2a4f0536b15ffe6421afc99bdb5dcdf3d29f44437fdd80bbf4089f5f2658ca10907e033eda2e04c6b862e49b150ea59d8ab1807d14a3dcf64e10c32e78af SHA512 1de6307c587686711f05d1e96731c43526fa3af51e4cd94c06c880954b67f6eb4c7db3177f0ea5937d41bc1f8cadcf5bce75025b5c1a46a469376960f1001c5f
 DIST openssl-3.4.1.tar.gz.asc 833 BLAKE2B 321a5593ce5a1ff07553dcca722b0da0e9e9f3ef639176d663b6a92be2a32d3379536a788930f7f78dccc4e4d4922fe696f8d1bd65aa54f51c3c75accad34b1f SHA512 b007d5a35a7904d5d5e053e232a54b2ba75fb43f80bf1fe2175528e86e31cca8161da09d7417b50359008ce1955497e4d11c46794f15cc7c3220aa92eff99ccb
+DIST openssl-3.5.0.tar.gz 53136912 BLAKE2B 9bf55ad242863123ec117296ff4d3067a27da9e0aa104a70203009536440198bacbb155c6431801e139dee6deaf6a26e0ac9a5e71fdcf963d00ba3ec7434440f SHA512 39cc80e2843a2ee30f3f5de25cd9d0f759ad8de71b0b39f5a679afaaa74f4eb58d285ae50e29e4a27b139b49343ac91d1f05478f96fb0c6b150f16d7b634676f
+DIST openssl-3.5.0.tar.gz.asc 833 BLAKE2B 3c92d7f08ae64b175140215be633e72b80fb49de0ef3485ab0738999fa339b40ca09bdc3ae9fb4b0738ae7182b3d5821cb4d04811796775e6648621fcfc8941b SHA512 6a73755c34f4caabf531d2b4335bf1c800548b41c6e6436ed4bf3ab25cf7c01f1a0594d641deac7e1aa66c3beed00091265d49c2711dadaacd8bba1ce2075d02
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
new file mode 100644
index 0000000000..41de3131f2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.0.ebuild
@@ -0,0 +1,293 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
new file mode 100644
index 0000000000..41de3131f2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild
@@ -0,0 +1,293 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
index e947731a59..fcac9b8ecb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
@@ -51,7 +51,13 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( >=dev-cpp/gtest-1.11[${MULTILIB_USEDEP}] )
+	test? (
+		|| (
+			dev-cpp/abseil-cpp[test-helpers(-)]
+			dev-cpp/abseil-cpp[test]
+		)
+		dev-cpp/gtest[${MULTILIB_USEDEP}]
+	)
 "
 RDEPEND="
 	${COMMON_DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
index e53658010c..659a39c826 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
@@ -52,7 +52,13 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( >=dev-cpp/gtest-1.11[${MULTILIB_USEDEP}] )
+	test? (
+		|| (
+			dev-cpp/abseil-cpp[test-helpers(-)]
+			dev-cpp/abseil-cpp[test]
+		)
+		dev-cpp/gtest[${MULTILIB_USEDEP}]
+	)
 "
 RDEPEND="
 	${COMMON_DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
index 8ce1e903d9..1d23dc9b0c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
@@ -52,7 +52,13 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( >=dev-cpp/gtest-1.11[${MULTILIB_USEDEP}] )
+	test? (
+		|| (
+			dev-cpp/abseil-cpp[test-helpers(-)]
+			dev-cpp/abseil-cpp[test]
+		)
+		dev-cpp/gtest[${MULTILIB_USEDEP}]
+	)
 "
 RDEPEND="
 	${COMMON_DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
index b100f58a75..71bf1e316d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
@@ -49,7 +49,13 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( dev-cpp/gtest[${MULTILIB_USEDEP}] )
+	test? (
+		|| (
+			dev-cpp/abseil-cpp[test-helpers(-)]
+			dev-cpp/abseil-cpp[test]
+		)
+		dev-cpp/gtest[${MULTILIB_USEDEP}]
+	)
 "
 RDEPEND="
 	${COMMON_DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
index b100f58a75..71bf1e316d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
@@ -49,7 +49,13 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( dev-cpp/gtest[${MULTILIB_USEDEP}] )
+	test? (
+		|| (
+			dev-cpp/abseil-cpp[test-helpers(-)]
+			dev-cpp/abseil-cpp[test]
+		)
+		dev-cpp/gtest[${MULTILIB_USEDEP}]
+	)
 "
 RDEPEND="
 	${COMMON_DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.24.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.24.3.ebuild
index d8e3393bf8..96a4a2a64a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.24.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/tree-sitter/tree-sitter-0.24.3.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
 else
 	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 fi
 
 LICENSE="MIT"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index ba11525c42..08380f5685 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1,4 +1,3 @@
-DIST cython-3.0.11.gh.tar.gz 2775463 BLAKE2B f5f53c328a1b48b04548f1ee7be3988451d2a8e339b785285e2d973e63b37dabc6021f32ba1691ae8dbe9ee7706a5feda399b071b4893a3be4fe4afcd608f46b SHA512 8f7982af5be1db1072b1090257a9d487dc341d79522f442f4608303d18b388349a7d586ec74e66fbffd0ce88c00ca622202729907fe7cefef71828cfd3f68fe6
 DIST cython-3.0.12.gh.tar.gz 2777066 BLAKE2B 3e2730b7b0ef90ba6a7d4a510dbaa24b7c966d68c397196727b6d63b435c6775aa818a7d1b741819a7940ad44cadbc83be4aa48117b2dcf7bd844f4c9bc268bc SHA512 bbf2cc662b846cf5ff9b686046ec210ea9d3893482e2b5a2696d2ad44f12facd15075b168a3eb6d1f4ea799786f676868eab2593451bceb2937aec2cb1aea99e
 DIST cython-3.0.12.tar.gz 2757617 BLAKE2B 064549e36e03424065eab081b60e2761d198490cfd4d7836ea236b833ada3962e6ed42ba1710b33418f8a31ac282cdc156ceb544ee21be80ee34b7a3d3f6c7fb SHA512 c4e85596eeea444fae983d32ce8731cc5d0d612d1f96b998db3aa7946e8be151a7ea62c6df163d875111e306c870656b82a8468dd873cacf84c7bd5671a39bc3
 DIST cython-3.1.0b1.tar.gz 3192916 BLAKE2B 13a8fa48319d9c4c8cc634d3cf5af599b867466d5de4cf3a24dd342b7812a392e854d9a6152309c6ef84a2925ebfa2257792d0f4e0c8fa36580d7138a663105a SHA512 ced9d57536d3bacd274b5edc4137d400a6182b4b7a89a28cf358f843dcbb0e0e7171fb0842441a81e1d2ac12acb6fd6a3df7018fe2a8708cb188a96cb184d799
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.11.ebuild
deleted file mode 100644
index bf364b2787..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.11.ebuild
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_TESTED=( python3_{10..12} )
-PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 python3_13 )
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 multiprocessing toolchain-funcs
-
-MY_P=${P/_rc/rc}
-DESCRIPTION="A Python to C compiler"
-HOMEPAGE="
-	https://cython.org/
-	https://github.com/cython/cython/
-	https://pypi.org/project/Cython/
-"
-SRC_URI="
-	https://github.com/cython/cython/archive/${PV/_rc/rc}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-BDEPEND="
-	${RDEPEND}
-	test? (
-		$(python_gen_cond_dep '
-			<dev-python/numpy-2[${PYTHON_USEDEP}]
-		' "${PYTHON_TESTED[@]}")
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
-	"${FILESDIR}/${PN}-0.29.23-test_exceptions-py310.patch"
-	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
-)
-
-distutils_enable_sphinx docs \
-	dev-python/jinja2 \
-	dev-python/sphinx-issues \
-	dev-python/sphinx-tabs
-
-python_compile() {
-	# Python gets confused when it is in sys.path before build.
-	local -x PYTHONPATH=
-
-	distutils-r1_python_compile
-}
-
-python_test() {
-	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
-		einfo "Skipping tests on ${EPYTHON} (xfail)"
-		return
-	fi
-
-	# Needed to avoid confusing cache tests
-	unset CYTHON_FORCE_REGEN
-
-	tc-export CC
-	# https://github.com/cython/cython/issues/1911
-	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
-	"${PYTHON}" runtests.py \
-		-vv \
-		-j "$(makeopts_jobs)" \
-		--work-dir "${BUILD_DIR}"/tests \
-		--no-examples \
-		--no-code-style \
-		|| die "Tests fail with ${EPYTHON}"
-}
-
-python_install_all() {
-	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
-	distutils-r1_python_install_all
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12.ebuild
index 730510625a..b784ea2727 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12.ebuild
@@ -26,7 +26,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
index d48ec68092..e7e5589f3b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_USE_PEP517=flit
 PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
 
-inherit distutils-r1 optfeature pypi
+inherit distutils-r1 pypi
 
 DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
 HOMEPAGE="
@@ -72,9 +72,3 @@ python_install_all() {
 		install_txt_doc "${doc}"
 	done < <(find docs tools -name '*.txt' -print0)
 }
-
-pkg_postinst() {
-	optfeature \
-		"auto-detecting the image dimensions when using the 'scale' option" \
-		dev-python/pillow
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
index b76c3f6972..473fddfd3c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-78.1.0.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 src_install() {
 	insinto /usr/lib/python/ensurepip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
index 655b4ff5b5..cf5c2428e8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
@@ -1,2 +1 @@
-DIST flit_core-3.11.0.tar.gz 52038 BLAKE2B 6b6e0c606429fdb8123aa2dc17336003d8348f576bf26745ffa116a5e0159e20be5b8a20c541c570a825cdb2c970380f290599a09fdcc9e3bcf4158329aff9d2 SHA512 628ffd0950da88f1775c1b193ee5c6f1af06046877ca0ad66d7ae5af7df4b49759f19a4494cf15d7a1480d34c19925ce11205e7359df9fc223bca6595f94525d
 DIST flit_core-3.12.0.tar.gz 53690 BLAKE2B 2dbc8cb1803d2b05693d458ab29d141631af268ad1620ccd91d7fe1636eab6c776c5482d94fdd2006dafa8b5cb45cb41d29fb80ac91e29877b43ba8e94ac2bd5 SHA512 189dcd674722164b165e18b11c4dc72b8309fa2e3c82fc1ed6a9160bb5c6c1f86e2b2cfa111603cf73dca0dba74a496a664d5cbb6242587b47f139c42f7ae8bd
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.11.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.11.0.ebuild
deleted file mode 100644
index 1a99d14666..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.11.0.ebuild
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright 2019-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Simplified packaging of Python modules (core module)"
-HOMEPAGE="
-	https://pypi.org/project/flit-core/
-	https://github.com/pypa/flit/
-"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	$(python_gen_cond_dep '
-		dev-python/tomli[${PYTHON_USEDEP}]
-	' 3.{9..10})
-"
-BDEPEND="
-	test? ( dev-python/testpath[${PYTHON_USEDEP}] )
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	distutils-r1_src_prepare
-
-	# unbundle deps
-	rm -r flit_core/vendor || die
-	sed -i -e 's:from \.vendor ::' flit_core/*.py || die
-	sed -i -e '/license-files/d' pyproject.toml || die
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
index 2ec3fb6c9f..1a99d14666 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.12.0.ebuild
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	$(python_gen_cond_dep '
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
index f6b090d7eb..2b8cc0a12e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
@@ -1,4 +1,5 @@
 DIST pillow-11.1.0.gh.tar.gz 46815201 BLAKE2B 7990683c90359e0a72e17a13e1a29455bc3ace8ce3616d6af59360edfc1ac87541bd1fd6967160bd8d7dd25cfedfc9d2e9b058c3ed433a6208379834f15bc312 SHA512 bb0622fae0b9c3903ddd945dced8e2b94348b2bd06c14bc74da00d8aa3a795aab2daaff39ca6c40b712dcce4f10218cd30739f0eb616c9dfbc16efcf80886f1e
 DIST pillow-11.2.0.gh.tar.gz 47097571 BLAKE2B d59e87e7249e7a2b64dd420702d08f6da1d29d91fd32d7043eacac7c5cf33e4cef6d378545454bcb460ea1ae49052e2e684335966e00f6003e018e9241ad50eb SHA512 4ab01472accb056ef48feab6c945a3792b622053c1dc166daf0095597a2df846562ae5ee56e66e595d65e76e7b7bfaf3d5b0cf7847777603a1abdc7af135ec44
+DIST pillow-11.2.1.gh.tar.gz 47086538 BLAKE2B 306c3f4292681caea75835dc972229854e12260190f7e7b63ad5292091fcbb28a16fe102c9b2359fe72b99ad97821fa37715f5934bfe79a983efa81b07abf2a4 SHA512 4b5eee712b6cedf175e251ca29bb6e6dda27491585d343ef71ed416819e91510c4add6be50fe1151ab5f178f4686968de111beff4143a978b7a32519293a5725
 DIST pillow-test-images-716bdc4adaf97601e5b9a31c9be25f8975381ee1.gh.tar.gz 57416881 BLAKE2B 8ea5fff2231567f957fc911120c1b50610722477da99559639317e4513e4bc4e73b8b49368a6d95c6938333f0c48db7672c3713eaef70494f7896dadd07cc42d SHA512 b00009be0f5ca85ec0c761fa780f0e650c1877b456b9a9426a4d2300a0c5654358495299e129ded411fccb641e4add7e460bcb3ca7be055f3b207407ccefb33c
 DIST pythoncapi_compat.h 61109 BLAKE2B 9b8d9f774a6803dee73aedc5465519f2956c284bf70314f5e046d0d5522a10891bf55358a85fea5a156d4063736424c0f019bc71dd18592bbf56c364db7b6bce SHA512 d0ca43186fdc3cd8d0e993135b50fc86eeea05e8b84cba529d89f60ce28bc9502f8d3825eb508be5d68d1fbfc53423a69756c0e79fe0fe7adf94c602b1cf79ff
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
new file mode 100644
index 0000000000..7133b8b848
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.1.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+# setuptools wrapper
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_REQ_USE='tk?,threads(+)'
+
+inherit distutils-r1 toolchain-funcs virtualx
+
+MY_PN=Pillow
+MY_P=${MY_PN}-${PV}
+
+# upstream always fetches from main
+TEST_IMAGE_COMMIT="716bdc4adaf97601e5b9a31c9be25f8975381ee1"
+
+DESCRIPTION="Python Imaging Library (fork)"
+HOMEPAGE="
+	https://python-pillow.org/
+	https://github.com/python-pillow/Pillow/
+	https://pypi.org/project/pillow/
+"
+SRC_URI="
+	https://github.com/python-pillow/Pillow/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	test? (
+		https://github.com/python-pillow/test-images/archive/${TEST_IMAGE_COMMIT}.tar.gz
+			-> pillow-test-images-${TEST_IMAGE_COMMIT}.gh.tar.gz
+	)
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="HPND"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+IUSE="avif examples imagequant +jpeg jpeg2k lcms test tiff tk truetype webp xcb zlib"
+REQUIRED_USE="test? ( jpeg jpeg2k lcms tiff truetype )"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	avif? ( media-libs/libavif:= )
+	imagequant? ( media-gfx/libimagequant:= )
+	jpeg? ( media-libs/libjpeg-turbo:= )
+	jpeg2k? ( media-libs/openjpeg:2= )
+	lcms? ( media-libs/lcms:2= )
+	tiff? ( media-libs/tiff:=[jpeg,zlib] )
+	truetype? (
+		media-libs/freetype:2=
+		media-libs/harfbuzz:=
+	)
+	webp? ( media-libs/libwebp:= )
+	xcb? ( x11-libs/libxcb )
+	zlib? ( sys-libs/zlib:= )
+"
+RDEPEND="
+	${DEPEND}
+	dev-python/olefile[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	>=dev-python/setuptools-77[${PYTHON_USEDEP}]
+	dev-python/wheel[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	test? (
+		dev-python/defusedxml[${PYTHON_USEDEP}]
+		dev-python/packaging[${PYTHON_USEDEP}]
+		dev-python/pytest-timeout[${PYTHON_USEDEP}]
+		|| (
+			media-gfx/imagemagick[png]
+			media-gfx/graphicsmagick[png]
+		)
+	)
+"
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_prepare() {
+	local PATCHES=(
+		# https://github.com/python-pillow/pillow/pull/7634
+		"${FILESDIR}/${PN}-10.2.0-cross.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	if use test; then
+		mv "${WORKDIR}/test-images-${TEST_IMAGE_COMMIT}"/* \
+			Tests/images || die
+	fi
+}
+
+usepil() {
+	usex "${1}" enable disable
+}
+
+python_configure_all() {
+	cat >> setup.cfg <<-EOF || die
+		[build_ext]
+		debug = True
+		disable_platform_guessing = True
+		$(usepil avif)_avif = True
+		$(usepil truetype)_freetype = True
+		$(usepil jpeg)_jpeg = True
+		$(usepil jpeg2k)_jpeg2000 = True
+		$(usepil lcms)_lcms = True
+		$(usepil tiff)_tiff = True
+		$(usepil imagequant)_imagequant = True
+		$(usepil webp)_webp = True
+		$(usepil xcb)_xcb = True
+		$(usepil zlib)_zlib = True
+	EOF
+	if use truetype; then
+		# these dependencies are implicitly disabled by USE=-truetype
+		# and we can't pass both disable_* and vendor_*
+		# https://bugs.gentoo.org/935124
+		cat >> setup.cfg <<-EOF || die
+			vendor_raqm = False
+			vendor_fribidi = False
+		EOF
+	fi
+
+	tc-export PKG_CONFIG
+}
+
+src_test() {
+	virtx distutils-r1_src_test
+}
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# TODO (is clipboard unreliable in Xvfb?)
+		Tests/test_imagegrab.py::TestImageGrab::test_grabclipboard
+		# requires xz-utils[extra-filters]?
+		Tests/test_file_libtiff.py::TestFileLibTiff::test_lzma
+	)
+
+	case ${ARCH} in
+		ppc)
+			EPYTEST_DESELECT+=(
+				# https://github.com/python-pillow/Pillow/issues/7008
+				# (we've reverted the upstream patch because it was worse
+				# than the original issue)
+				Tests/test_file_libtiff.py::TestFileLibTiff::test_exif_ifd
+			)
+			;;
+	esac
+
+	"${EPYTHON}" selftest.py --installed || die "selftest failed with ${EPYTHON}"
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# leak tests are fragile and broken under xdist
+	epytest -k "not leak" -p timeout || die "Tests failed with ${EPYTHON}"
+}
+
+python_install() {
+	python_doheader src/libImaging/*.h
+	distutils-r1_python_install
+}
+
+python_install_all() {
+	if use examples ; then
+		docinto example
+		dodoc docs/example/*
+		docompress -x /usr/share/doc/${PF}/example
+	fi
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
index f57414ffa0..f85cc1d403 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-78.1.0.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.1-r1.ebuild
index 7daad9224e..51f2175b9f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tree-sitter/tree-sitter-0.23.1-r1.ebuild
@@ -22,7 +22,7 @@ S=${WORKDIR}/py-${P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 # setuptools is needed for distutils import
 DEPEND="<dev-libs/tree-sitter-0.25.0:="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index 5e73de1e3d..30d46a5d09 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1 +1,2 @@
 DIST trove_classifiers-2025.3.19.19.tar.gz 16280 BLAKE2B be2679f7ea31e9cafa1e161e6b5932a1ba05f84c3ad2e74ca8a1711c75ddb99016e82b72e1fbdd0193fb2c59c96af53edb5a01747c580893adec5b865b211cc9 SHA512 2e531939642f0436650cbd12b8d40faa2a32211575c39a23508194ea65c2d0b01ade63fe2c59d6098e6e92f2a6648ded3b55a3d359ff5d5b056722f1af9291cc
+DIST trove_classifiers-2025.4.11.15.tar.gz 16321 BLAKE2B b011b524d267506aef4d91ac6d365e08e419fb57b424259b080de8cb7205cd8c4c6df52e29532b9dc19ca36f41b0793ac25a8824e9d2328735357efa369b2157 SHA512 5eb5d892a751105319c003e4a370d2f69b614a1f2bea8904865b7da9f4d2648ffe57fba1cebc1ec21dab74d02b3223eb72af478ddd69635e45b0424621cefa9a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
new file mode 100644
index 0000000000..6c47615649
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2025.4.11.15.ebuild
@@ -0,0 +1,42 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
+HOMEPAGE="
+	https://github.com/pypa/trove-classifiers/
+	https://pypi.org/project/trove-classifiers/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease hatchling bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "trove-classifiers"
+		version = "${PV}"
+		description = "Canonical source for classifiers on PyPI (pypi.org)."
+	EOF
+}
+
+python_test() {
+	epytest
+	"${EPYTHON}" -m tests.lib || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index e8a56df076..e3d3e8bfde 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1,3 +1,3 @@
 DIST typing_extensions-4.12.2.tar.gz 85321 BLAKE2B 8f32740675f5da226c6fd5fa95e0b903794d76cc25d759bee6b136913a3eedc7a702cdc7709587cae13ba3b3d44a7bb1acbdad61333fe655382e3d01d63a3fa7 SHA512 b06f26ae55194f37ee48dcb894bf583051c9e74f639f25195990f56330eae7b585ab4b8655ca575539f48254c20f1920628db6db10512953d1f6364e3c076a27
-DIST typing_extensions-4.13.0.tar.gz 106520 BLAKE2B 65aff07587aae79fce1e69c127dc02955169288f944542e560347e33eff3e65d86380efcbf647efffa0b6d253096ee409f065345adc97c913d3ae0f079099024 SHA512 5d2a9fc8f0ef41e585f5c0ad155672018e9e6e76391ebe294ed32a2e8934ace8ad997b40dd14d335ebe2d74dbee5eb477f7816fbf29d832d3f3118cfcfd18e31
 DIST typing_extensions-4.13.1.tar.gz 106633 BLAKE2B 766e4adb9e534c0c998407f101862ad38ee4407fd844548c05f7a4a59c70e839620700daf6aa30fd7204f84117b6e88145daa2d3d7b7474abddd5eb3c4a385e5 SHA512 63775b10380a02e9bd7ec5f5fe59952731e0fefa9cd9b25073bbd2b12f71718d4c44926809f6785a04c2cdd2d9486f4c35c91345cda2cc9ada034deb006c404c
+DIST typing_extensions-4.13.2.tar.gz 106967 BLAKE2B 6a0dfd0cb94f8411342f547f2b209a3c8afd32c818ec837c9ce63191392ba5f89c31279f35d7ca8c0a2f2cda99ea23084c3fad4bc3787f20e31741665e174645 SHA512 2cd798939362ee0d7ddbffe69b1d0fdd72b9574c1bd7300caee73d36c457ea64ea635c87ecc6188db9ffaaca272b1c8dd978a42c591ae0dfdca5632317ddb18c
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.12.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.12.2.ebuild
index 8a3b8c4bdc..e1bfa7efa7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.12.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.12.2.ebuild
@@ -17,6 +17,8 @@ HOMEPAGE="
 LICENSE="PSF-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
 
 distutils_enable_tests unittest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild
index fddc778a16..12a88c1d97 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild
@@ -17,6 +17,8 @@ HOMEPAGE="
 LICENSE="PSF-2"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
 
 BDEPEND="
 	>=dev-python/flit-core-3.11[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild
index fddc778a16..12a88c1d97 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.2.ebuild
@@ -17,6 +17,8 @@ HOMEPAGE="
 LICENSE="PSF-2"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
 
 BDEPEND="
 	>=dev-python/flit-core-3.11[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
index 5a560f0a21..77b3867f53 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/Manifest
@@ -1,2 +1,3 @@
 DIST hypercorn-d1719f8c1570cbd8e6a3719ffdb14a4d72880abb.gh.tar.gz 156216 BLAKE2B fcb5f49653401e6e4079e1c770d3cd407602d4d6764437b735bd4ec04191dec59cdc930822fa2aff726ee25cddd0f71fd457dedf31026bff1da121d93af8b768 SHA512 62d6787d88a2e716f0ac04fc49f6cdc586e473a660ee754ff66961922ae78bcc75d1f78b091e78557dd60f006e8e480114738c7b4ff71beac804e4fc9603240b
 DIST urllib3-2.3.0.tar.gz 307268 BLAKE2B 516c3b8b538682bf7b37324568757cf033df0d6a785f5fe0cdb3eaa81c68532958dd0801a007508523ca9674ec2b8ea3c9130c44b6742f6e05e9dc929ba41d01 SHA512 cf33a9082c304d8782fa054412686f9fac65fa860404243b72c75374f7459bf6c7668297b37b5fadc978f9a85b3e7653ddc7b2c415903f7eee5a70fe9ae281cb
+DIST urllib3-2.4.0.tar.gz 390672 BLAKE2B 2c5aa1f5fb210d13cd26b022a4c81b9d1dbe8a8bac26dadcf2b3c1a515df5fc2376b26aedd07badbcd36241920a1de2889c4190f02ceeafdae4732aa83055321 SHA512 d5c5ffc6ace356769f0fa80279ce1f07f3fe5913942acadac93d965612a9225bc3da94f711184ecd5b76bf893a29c7c854903c2c4e4de84edc490e6d72a80693
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
new file mode 100644
index 0000000000..0fefa74896
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/urllib3/urllib3-2.4.0.ebuild
@@ -0,0 +1,99 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYTHON_TESTED=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="ssl(+)"
+
+inherit distutils-r1 pypi
+
+# The package has a test dependency on their own hypercorn fork.
+HYPERCORN_COMMIT=d1719f8c1570cbd8e6a3719ffdb14a4d72880abb
+DESCRIPTION="HTTP library with thread-safe connection pooling, file post, and more"
+HOMEPAGE="
+	https://github.com/urllib3/urllib3/
+	https://pypi.org/project/urllib3/
+"
+SRC_URI+="
+	test? (
+		https://github.com/urllib3/hypercorn/archive/${HYPERCORN_COMMIT}.tar.gz
+			-> hypercorn-${HYPERCORN_COMMIT}.gh.tar.gz
+	)
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="brotli http2 test zstd"
+RESTRICT="!test? ( test )"
+
+# [secure] extra is deprecated and slated for removal, we don't need it:
+# https://github.com/urllib3/urllib3/issues/2680
+RDEPEND="
+	>=dev-python/pysocks-1.5.8[${PYTHON_USEDEP}]
+	<dev-python/pysocks-2.0[${PYTHON_USEDEP}]
+	brotli? ( >=dev-python/brotlicffi-0.8.0[${PYTHON_USEDEP}] )
+	http2? (
+		<dev-python/h2-5[${PYTHON_USEDEP}]
+		>=dev-python/h2-4[${PYTHON_USEDEP}]
+	)
+	zstd? ( >=dev-python/zstandard-0.18.0[${PYTHON_USEDEP}] )
+"
+BDEPEND="
+	dev-python/hatch-vcs[${PYTHON_USEDEP}]
+	test? (
+		$(python_gen_cond_dep "
+			${RDEPEND}
+			dev-python/brotlicffi[\${PYTHON_USEDEP}]
+			dev-python/freezegun[\${PYTHON_USEDEP}]
+			dev-python/h2[\${PYTHON_USEDEP}]
+			dev-python/httpx[\${PYTHON_USEDEP}]
+			dev-python/pytest[\${PYTHON_USEDEP}]
+			dev-python/pytest-rerunfailures[\${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[\${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[\${PYTHON_USEDEP}]
+			dev-python/quart[\${PYTHON_USEDEP}]
+			dev-python/quart-trio[\${PYTHON_USEDEP}]
+			dev-python/trio[\${PYTHON_USEDEP}]
+			>=dev-python/tornado-4.2.1[\${PYTHON_USEDEP}]
+			>=dev-python/trustme-0.5.3[\${PYTHON_USEDEP}]
+			>=dev-python/zstandard-0.18.0[\${PYTHON_USEDEP}]
+		" "${PYTHON_TESTED[@]}")
+	)
+"
+
+src_prepare() {
+	# upstream considers 0.5 s to be "long" for a timeout
+	# we get tons of test failures on *fast* systems because of that
+	sed -i -e '/LONG_TIMEOUT/s:0.5:5:' test/__init__.py || die
+	distutils-r1_src_prepare
+}
+
+python_test() {
+	local -x PYTHONPATH=${WORKDIR}/hypercorn-${HYPERCORN_COMMIT}/src
+	local -x CI=1
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping tests on ${EPYTHON}"
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# TODO: timeouts
+		test/contrib/test_pyopenssl.py::TestSocketClosing::test_timeout_errors_cause_retries
+		test/with_dummyserver/test_socketlevel.py::TestSocketClosing::test_timeout_errors_cause_retries
+		# TODO
+		test/contrib/test_pyopenssl.py::TestSocketClosing::test_socket_shutdown_stops_recv
+		test/with_dummyserver/test_socketlevel.py::TestSocketClosing::test_socket_shutdown_stops_recv
+		# hangs randomly
+		test/contrib/test_pyopenssl.py::TestHTTPS_TLSv1_{2,3}::test_http2_probe_blocked_per_thread
+		test/with_dummyserver/test_https.py::TestHTTPS_TLSv1_{2,3}::test_http2_probe_blocked_per_thread
+	)
+
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	local EPYTEST_XDIST=1
+	epytest -p timeout -p rerunfailures --reruns=10 --reruns-delay=2
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
index ade4a826f2..a53c5bc2c0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
@@ -1,2 +1,3 @@
 DIST wheel-0.45.1.tar.gz 107545 BLAKE2B 13c8d60a2e39ded3d911c9e03915b01bda201f7e8cd6de456484ce6eeb2a990861a01f26e5d9f2ac4ca0ab2b6d0fea9db437d6f82cb39db9b1059c3c53202ec0 SHA512 df45f00e9eaeae2f27f813f31591590c961da2f6bff15bba6fb2a14d529c221f39b29894b8da408fe49cd4b760840a0e05c4baef377ccfacd9983c0bba83d6d8
 DIST wheel-0.46.0.tar.gz 49842 BLAKE2B de27540cc6a31be0b834c28e3861040e8fe2949d4c5d048ce1c708cf17ffa8efbea48c00fb5429f7be32ab5ccd0ec0918c72f9e131250ceb3159c16a9f887ed7 SHA512 ca3632b03ffb4b23008c6e897a32993ef5926d34103fea9b978206bdeda573650678f1292c6d4f810390703f50012781a87482a732b14fd61bf292aa32e97357
+DIST wheel-0.46.1.tar.gz 54400 BLAKE2B 078ffb044d3c156e61081d0708d1f559f715a47d071f678af73cfdafe9e80a66121cd8f489783383de87a9963e377f05e60df6da27825d6e3ed0285fdeaa3030 SHA512 69219fb100d47da42999e0d0e4a023ac43489eb7f1755cb08f6d72a26bda1d435b3a9738340379b1a7f0054330711c7ca9865736cb0463a3f49004c25b61ebfe
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.1.ebuild
new file mode 100644
index 0000000000..575c8758eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.1.ebuild
@@ -0,0 +1,41 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A built-package format for Python"
+HOMEPAGE="
+	https://github.com/pypa/wheel/
+	https://pypi.org/project/wheel/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/packaging-24.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fails if any setuptools plugin imported the module first
+	tests/test_bdist_wheel.py::test_deprecated_import
+)
+
+distutils_enable_tests pytest
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild
index 931ad8d588..7b4453ce86 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild
@@ -36,7 +36,7 @@ else
 		S="${WORKDIR}/bpftool-libbpf-v${PV}-sources"
 	fi
 
-	KEYWORDS="amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv x86"
 fi
 
 LICENSE="|| ( GPL-2 BSD-2 )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/gperf/Manifest
index 5be2532280..3f3da6166c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gperf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/Manifest
@@ -1 +1,3 @@
 DIST gperf-3.1.tar.gz 1215925 BLAKE2B bc4c54ade3f7dce484714d77cb5759dcc02b7a607d7b1aff6bdbcd06ee4c83e9449038a7217d5f25bcbef058ba56e1fce9383b9599de005154e5a9b566ac9c69 SHA512 855ebce5ff36753238a44f14c95be7afdc3990b085960345ca2caf1a2db884f7db74d406ce9eec2f4a52abb8a063d4ed000a36b317c9a353ef4e25e2cca9a3f4
+DIST gperf-3.2-c++.patch.xz 2096 BLAKE2B acaf0d685434afe6eb5dc2cabc507b2ebff182af65d7297a4526af547280ab49ea030edca79500414420d590e4ba1493ad061a9018a48421243276228636164b SHA512 dd405440790fd30f4cf36f1be735900fc7b6850e5477f74482d24bd7c1ce9dbe3f795158c44901cff407e51bcba669be3798efa853ca182b796be5ff77db34d4
+DIST gperf-3.2.tar.gz 1268603 BLAKE2B 6c90d665ff6b7f07862668b250ce06c5df386e6c746398ecb7d40912ed1ca820455addb9ecd17650925b6ef7cd2ff00b8ed9174e55da16a410f84d87b244e8f8 SHA512 97addf85e5b6f801f0f7084ec065d0d4a24a07f3fb6e60e2bc57b0f8813bd5db1bb4bed4f51fb96d0a8b278ffde1dfd0e42302cae911a619b95cc3cc46254fb3
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/files/gperf-3.2-tests.patch b/sdk_container/src/third_party/portage-stable/dev-util/gperf/files/gperf-3.2-tests.patch
new file mode 100644
index 0000000000..191b8216f6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/files/gperf-3.2-tests.patch
@@ -0,0 +1,46 @@
+https://git.savannah.gnu.org/gitweb/?p=gperf.git;a=commit;h=1a8e476f99335ad5a553f24f1956a084fc6adc10
+
+From 1a8e476f99335ad5a553f24f1956a084fc6adc10 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Wed, 9 Apr 2025 13:10:17 +0200
+Subject: [PATCH] Fix "make check" failure with an ISO C 23 conforming C
+ compiler.
+
+Prompted by
+<https://lists.gnu.org/archive/html/bug-gperf/2025-04/msg00002.html>.
+
+* tests/smtp.gperf (my_case_strcmp, main): Convert from K&R C syntax
+to ISO C 90 syntax.
+---
+ ChangeLog        | 8 ++++++++
+ tests/smtp.gperf | 8 ++------
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/tests/smtp.gperf b/tests/smtp.gperf
+index da6ec7d..a5c448d 100644
+--- a/tests/smtp.gperf
++++ b/tests/smtp.gperf
+@@ -124,9 +124,7 @@ Xref
+ #include <ctype.h>
+ 
+ static int
+-my_case_strcmp (s1, s2)
+-     register const char *s1;
+-     register const char *s2;
++my_case_strcmp (const char *s1, const char *s2)
+ {
+   for (;;)
+     {
+@@ -143,9 +141,7 @@ my_case_strcmp (s1, s2)
+ }
+ 
+ int
+-main (argc, argv)
+-     int argc;
+-     char *argv[];
++main (int argc, char *argv[])
+ {
+   int i, j, k, n, exitcode;
+   size_t len;
+-- 
+2.17.1
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2-r1.ebuild
new file mode 100644
index 0000000000..c1857b2012
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2-r1.ebuild
@@ -0,0 +1,30 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="A perfect hash function generator"
+HOMEPAGE="https://www.gnu.org/software/gperf/"
+SRC_URI="mirror://gnu/gperf/${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-c++.patch.xz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+PATCHES=(
+	"${WORKDIR}"/${P}-c++.patch
+	"${FILESDIR}"/${P}-tests.patch
+)
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e "/^CPPFLAGS /s:=:+=:" \
+		*/Makefile.in || die #444078
+}
+
+src_configure() {
+	econf --cache-file="${S}"/config.cache
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2.ebuild
new file mode 100644
index 0000000000..0eb955fb06
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gperf/gperf-3.2.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="A perfect hash function generator"
+HOMEPAGE="https://www.gnu.org/software/gperf/"
+SRC_URI="mirror://gnu/gperf/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e "/^CPPFLAGS /s:=:+=:" \
+		*/Makefile.in || die #444078
+}
+
+src_configure() {
+	econf --cache-file="${S}"/config.cache
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.29.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.29.ebuild
index 6996620bd8..f0eb87e0d0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.29.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.29.ebuild
@@ -13,6 +13,7 @@ DESCRIPTION="pahole (Poke-a-Hole) and other DWARF utilities"
 HOMEPAGE="https://git.kernel.org/cgit/devel/pahole/pahole.git/"
 
 if [[ ${PV} == 9999 ]] ; then
+	EGIT_BRANCH="next"
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/devel/pahole/pahole.git"
 	inherit git-r3
 else
@@ -29,7 +30,7 @@ else
 	fi
 	S="${WORKDIR}"/${MY_P}
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-arnaldocarvalhodemelo )"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 LICENSE="GPL-2" # only
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
index 6996620bd8..aec4fed1de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-9999.ebuild
@@ -13,6 +13,7 @@ DESCRIPTION="pahole (Poke-a-Hole) and other DWARF utilities"
 HOMEPAGE="https://git.kernel.org/cgit/devel/pahole/pahole.git/"
 
 if [[ ${PV} == 9999 ]] ; then
+	EGIT_BRANCH="next"
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/devel/pahole/pahole.git"
 	inherit git-r3
 else
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild
index ad3b084458..e186903e8d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999 ]] ; then
 		https://github.com/pkgcore/pkgcheck.git"
 	inherit git-r3
 else
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 	inherit pypi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
index 4765809e91..85274c9112 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
@@ -24,7 +24,7 @@ inherit toolchain-funcs
 # @DESCRIPTION:
 # Return all the flag variables that our high level functions operate on.
 all-flag-vars() {
-	echo {ADA,C,CPP,CXX,CCAS,F,FC,LD}FLAGS
+	echo {ADA,C,CPP,CXX,CCAS,F,FC,GDC,LD}FLAGS
 }
 
 # @FUNCTION: setup-allowed-flags
diff --git a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
index ae590284db..a9ccfed4cf 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
@@ -68,7 +68,7 @@ fi
 # Definitive list of Rust slots and the associated LLVM slot, newest first.
 declare -A -g -r _RUST_LLVM_MAP=(
 	["9999"]=20
-	["1.86"]=19
+	["1.86.0"]=19
 	["1.85.1"]=19
 	["1.85.0"]=19
 	["1.84.1"]=19
@@ -94,7 +94,7 @@ declare -A -g -r _RUST_LLVM_MAP=(
 # this array is used to store the Rust slots in a more convenient order for iteration.
 declare -a -g -r _RUST_SLOTS_ORDERED=(
 	"9999"
-	"1.86"
+	"1.86.0"
 	"1.85.1"
 	"1.85.0"
 	"1.84.1"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
index 754d23f91c..baf032bbd4 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain-funcs.eclass
@@ -21,8 +21,6 @@ case ${EAPI} in
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
-inherit multilib
-
 # tc-getPROG <VAR [search vars]> <default> [tuple]
 _tc-getPROG() {
 	local tuple=$1
@@ -1147,139 +1145,6 @@ tc-enables-ssp-all() {
 	tc-cpp-is-true "defined(__SSP_ALL__)" ${CPPFLAGS} ${CFLAGS} ${CXXFLAGS}
 }
 
-
-# @FUNCTION: gen_usr_ldscript
-# @USAGE: [-a] <list of libs to create linker scripts for>
-# @DESCRIPTION:
-# This function is deprecated. Use the version from
-# usr-ldscript.eclass instead.
-gen_usr_ldscript() {
-	ewarn "${FUNCNAME}: Please migrate to usr-ldscript.eclass"
-
-	local lib libdir=$(get_libdir) output_format="" auto=false suffix=$(get_libname)
-
-	tc-is-static-only && return
-	use prefix && return
-
-	# We only care about stuffing / for the native ABI, bug #479448
-	if [[ $(type -t multilib_is_native_abi) == "function" ]] ; then
-		multilib_is_native_abi || return 0
-	fi
-
-	# Eventually we'd like to get rid of this func completely, bug #417451
-	case ${CTARGET:-${CHOST}} in
-		*-darwin*) ;;
-		*-android*) return 0 ;;
-		*linux*) use prefix && return 0 ;;
-		*) return 0 ;;
-	esac
-
-	# Just make sure it exists
-	dodir /usr/${libdir}
-
-	if [[ $1 == "-a" ]] ; then
-		auto=true
-		shift
-		dodir /${libdir}
-	fi
-
-	# OUTPUT_FORMAT gives hints to the linker as to what binary format
-	# is referenced ... makes multilib saner
-	local flags=( ${CFLAGS} ${LDFLAGS} -Wl,--verbose )
-	if $(tc-getLD) --version | grep -q 'GNU gold' ; then
-		# If they're using gold, manually invoke the old bfd, bug #487696
-		local d="${T}/bfd-linker"
-		mkdir -p "${d}"
-		ln -sf $(type -P ${CHOST}-ld.bfd) "${d}"/ld
-		flags+=( -B"${d}" )
-	fi
-	output_format=$($(tc-getCC) "${flags[@]}" 2>&1 | sed -n 's/^OUTPUT_FORMAT("\([^"]*\)",.*/\1/p')
-	[[ -n ${output_format} ]] && output_format="OUTPUT_FORMAT ( ${output_format} )"
-
-	for lib in "$@" ; do
-		local tlib
-		if ${auto} ; then
-			lib="lib${lib}${suffix}"
-		else
-			# Ensure /lib/${lib} exists to avoid dangling scripts/symlinks.
-			# This especially is for AIX where $(get_libname) can return ".a",
-			# so /lib/${lib} might be moved to /usr/lib/${lib} (by accident).
-			[[ -r ${ED}/${libdir}/${lib} ]] || continue
-			#TODO: better die here?
-		fi
-
-		case ${CTARGET:-${CHOST}} in
-		*-darwin*)
-			if ${auto} ; then
-				tlib=$(scanmacho -qF'%S#F' "${ED}"/usr/${libdir}/${lib})
-			else
-				tlib=$(scanmacho -qF'%S#F' "${ED}"/${libdir}/${lib})
-			fi
-			[[ -z ${tlib} ]] && die "unable to read install_name from ${lib}"
-			tlib=${tlib##*/}
-
-			if ${auto} ; then
-				mv "${ED}"/usr/${libdir}/${lib%${suffix}}.*${suffix#.} "${ED}"/${libdir}/ || die
-				# some install_names are funky: they encode a version
-				if [[ ${tlib} != ${lib%${suffix}}.*${suffix#.} ]] ; then
-					mv "${ED}"/usr/${libdir}/${tlib%${suffix}}.*${suffix#.} "${ED}"/${libdir}/ || die
-				fi
-				rm -f "${ED}"/${libdir}/${lib}
-			fi
-
-			# Mach-O files have an id, which is like a soname, it tells how
-			# another object linking against this lib should reference it.
-			# Since we moved the lib from usr/lib into lib this reference is
-			# wrong.  Hence, we update it here.  We don't configure with
-			# libdir=/lib because that messes up libtool files.
-			# Make sure we don't lose the specific version, so just modify the
-			# existing install_name
-			if [[ ! -w "${ED}/${libdir}/${tlib}" ]] ; then
-				chmod u+w "${ED}${libdir}/${tlib}" # needed to write to it
-				local nowrite=yes
-			fi
-			install_name_tool \
-				-id "${EPREFIX}"/${libdir}/${tlib} \
-				"${ED}"/${libdir}/${tlib} || die "install_name_tool failed"
-			[[ -n ${nowrite} ]] && chmod u-w "${ED}${libdir}/${tlib}"
-			# Now as we don't use GNU binutils and our linker doesn't
-			# understand linker scripts, just create a symlink.
-			pushd "${ED}/usr/${libdir}" > /dev/null
-			ln -snf "../../${libdir}/${tlib}" "${lib}"
-			popd > /dev/null
-			;;
-		*)
-			if ${auto} ; then
-				tlib=$(scanelf -qF'%S#F' "${ED}"/usr/${libdir}/${lib})
-				[[ -z ${tlib} ]] && die "unable to read SONAME from ${lib}"
-				mv "${ED}"/usr/${libdir}/${lib}* "${ED}"/${libdir}/ || die
-				# some SONAMEs are funky: they encode a version before the .so
-				if [[ ${tlib} != ${lib}* ]] ; then
-					mv "${ED}"/usr/${libdir}/${tlib}* "${ED}"/${libdir}/ || die
-				fi
-				rm -f "${ED}"/${libdir}/${lib}
-			else
-				tlib=${lib}
-			fi
-			cat > "${ED}/usr/${libdir}/${lib}" <<-END_LDSCRIPT
-			/* GNU ld script
-			   Since Gentoo has critical dynamic libraries in /lib, and the static versions
-			   in /usr/lib, we need to have a "fake" dynamic lib in /usr/lib, otherwise we
-			   run into linking problems.  This "fake" dynamic lib is a linker script that
-			   redirects the linker to the real lib.  And yes, this works in the cross-
-			   compiling scenario as the sysroot-ed linker will prepend the real path.
-
-			   See bug https://bugs.gentoo.org/4411 for more info.
-			 */
-			${output_format}
-			GROUP ( ${EPREFIX}/${libdir}/${tlib} )
-			END_LDSCRIPT
-			;;
-		esac
-		fperms a+x "/usr/${libdir}/${lib}" || die "could not change perms on ${lib}"
-	done
-}
-
 # @FUNCTION: tc-get-cxx-stdlib
 # @DESCRIPTION:
 # Attempt to identify the C++ standard library used by the compiler.
@@ -1291,7 +1156,12 @@ gen_usr_ldscript() {
 #
 # If the library is not recognized, the function returns 1.
 tc-get-cxx-stdlib() {
-	local code='#include <ciso646>
+	local code='
+#if __cplusplus >= 202002L
+	#include <version>
+#else
+	#include <ciso646>
+#endif
 
 #if defined(_LIBCPP_VERSION)
 	HAVE_LIBCXX
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index bf883c5370..b6cc4df536 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -1921,10 +1921,13 @@ toolchain_src_configure() {
 			# respect USE=graphite here in case the user passes some
 			# graphite flags rather than try strip them out.
 			$(use_with graphite isl)
-			$(use_with zstd)
 			--with-system-zlib
 		)
 
+		if tc_has_feature zstd ; then
+			confgcc_jit+=( $(use_with zstd) )
+		fi
+
 		if tc_version_is_at_least 15.0.0_pre20241124 ${PV} ; then
 			confgcc_jit+=( $(use_enable libgdiagnostics) )
 		fi
@@ -2132,11 +2135,6 @@ gcc_do_filter_flags() {
 		filter-flags -fdiagnostics-set-output=text:experimental-nesting=yes
 	fi
 
-	if is_d ; then
-		# bug #940750
-		filter-flags -Warray-bounds
-	fi
-
 	# Please use USE=lto instead (bug #906007).
 	filter-lto
 
@@ -2325,23 +2323,31 @@ gcc_do_make() {
 		STAGE1_CFLAGS=${STAGE1_CFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CFLAGS}"}
 		# multilib.eclass lacks get_abi_CXXFLAGS (bug #940501)
 		STAGE1_CXXFLAGS=${STAGE1_CXXFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CXXFLAGS}"}
+		# Default to CFLAGS for GDCFLAGS if unset
+		STAGE1_GDCFLAGS=${STAGE1_GDCFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CFLAGS}"}
 		STAGE1_LDFLAGS=${STAGE1_LDFLAGS-"${abi_ldflags} ${LDFLAGS}"}
 		BOOT_CFLAGS=${BOOT_CFLAGS-"$(get_abi_CFLAGS ${TARGET_DEFAULT_ABI}) ${CFLAGS}"}
 		BOOT_LDFLAGS=${BOOT_LDFLAGS-"${abi_ldflags} ${LDFLAGS}"}
 		LDFLAGS_FOR_TARGET="${LDFLAGS_FOR_TARGET:-${LDFLAGS}}"
 
-		# If we need to in future, we could really simplify this
-		# to just be unconditional for stage1. It doesn't really
-		# matter there. If we want to go in the other direction
-		# and make this more conditional, we could check if
-		# the bootstrap compiler is < GCC 12. See bug #940470.
-		if _tc_use_if_iuse d && use hardened ; then
-			STAGE1_CXXFLAGS+=" -U_GLIBCXX_ASSERTIONS"
+		if _tc_use_if_iuse d ; then
+			# If we need to in future, we could really simplify this
+			# to just be unconditional for stage1. It doesn't really
+			# matter there. If we want to go in the other direction
+			# and make this more conditional, we could check if
+			# the bootstrap compiler is < GCC 12. See bug #940470.
+			if use hardened ; then
+				STAGE1_CXXFLAGS+=" -U_GLIBCXX_ASSERTIONS"
+			fi
+
+			# This can be dropped a while after 2025-03-31 (bug #940750).
+			STAGE1_GDCFLAGS+=" -Wno-array-bounds"
 		fi
 
 		emakeargs+=(
 			STAGE1_CFLAGS="${STAGE1_CFLAGS}"
 			STAGE1_CXXFLAGS="${STAGE1_CXXFLAGS}"
+			STAGE1_GDCFLAGS="${STAGE1_GDCFLAGS}"
 			STAGE1_LDFLAGS="${STAGE1_LDFLAGS}"
 			BOOT_CFLAGS="${BOOT_CFLAGS}"
 			BOOT_LDFLAGS="${BOOT_LDFLAGS}"
diff --git a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/Manifest b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/Manifest
index e32bffb010..0fd1fce838 100644
--- a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/Manifest
@@ -1,2 +1 @@
 DIST minicom-2.10.tar.gz 798751 BLAKE2B 1828b2670a71f8c94099cabc49b1e85ad35bd0491a78fe99a92d32176811d25b76afa74b417491f44bec40c1a7273e1bbc0ab9729dfa2626291b069b4447b919 SHA512 ced271a21b0ba97ad0b09093f341112d4c4f64f6b72631502acc136d2fb92eeb14965d4187fd8cfed0e0e2519b603b6e54d8dd780e666119ecfc5677203595e2
-DIST minicom-2.9.tar.gz 1044053 BLAKE2B 4c17f235d770ff9b4719c0ce9d3dfdb01603986d08cec245b1bfba5addbea597032bb06fc73c585886e035915dec990f37e9690b58d0a80a3e6faf8675485f96 SHA512 3bd41fa3b93b086c7b0fc851e9f46f241b13a037a4a325fc5e0ca6a4db7e9389443e8965891aa938a9c31ff848d50fd0cb88b98690a06737b5f3aca2520a60e2
diff --git a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/files/minicom-2.8-lockdir.patch b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/files/minicom-2.8-lockdir.patch
deleted file mode 100644
index 17fb635cd9..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/files/minicom-2.8-lockdir.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/configure.ac
-+++ b/configure.ac
-@@ -219,7 +219,10 @@
- 
- if test "x$UUCPLOCK" != x
- then
--	if test -d $UUCPLOCK
-+	dnl If a lock directory was manually specified, do not test it actually,
-+	dnl as that might not be true during a chroot build, and the
-+	dnl packager is responsible for making sure it exists at runtime.
-+	if true
- 	then
- 		AC_MSG_RESULT($UUCPLOCK)
- 		AC_DEFINE_UNQUOTED(UUCPLOCK, "$UUCPLOCK", [Lock directory])
diff --git a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.9.ebuild b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.9.ebuild
deleted file mode 100644
index e02357ffa3..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.9.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Serial Communication Program"
-HOMEPAGE="https://salsa.debian.org/minicom-team/minicom"
-SRC_URI="https://salsa.debian.org/${PN}-team/${PN}/-/archive/${PV}/${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="nls"
-
-DEPEND="sys-libs/ncurses:="
-
-RDEPEND="
-	${DEPEND}
-	net-dialup/lrzsz
-"
-
-BDEPEND="
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.8-gentoo-runscript.patch
-	"${FILESDIR}"/${PN}-2.8-lockdir.patch
-	"${FILESDIR}"/${PN}-2.9-update-gettext.patch
-)
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	# Lockdir must exist if not manually specified.
-	# '/var/lock' is created by OpenRC.
-	local myeconfargs=(
-		# See bug #788142
-		--sysconfdir="${EPREFIX}"/etc/${PN}
-
-		--disable-rpath
-		--enable-lock-dir="/var/lock"
-		$(use_enable nls)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	# Needs to match --sysconfdir above
-	insinto /etc/minicom
-	doins "${FILESDIR}"/minirc.dfl
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/libidn2/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/libidn2/Manifest
index 89f9618ca4..a390389b21 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/libidn2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/libidn2/Manifest
@@ -1,2 +1,4 @@
 DIST libidn2-2.3.7.tar.gz 2155214 BLAKE2B 40fde88e6be1e4665738855608a65c949834728463a3fb466192403f1076e99f7d399b9631308ff6776a28915251a0136ddfe6a67e8e010c7ccdb7fc64125d39 SHA512 eab5702bc0baed45492f8dde43a4d2ea3560ad80645e5f9e0cfa8d3b57bccd7fd782d04638e000ba07924a5d9f85e760095b55189188c4017b94705bef9b4a66
 DIST libidn2-2.3.7.tar.gz.sig 228 BLAKE2B 44f091a5a3ed7ad528ba404b4d1d1f60d1dae52e3c8173b633c30099e6e0405e51f46c954e4f5339b90d0fe883b5af34f8dbf704999e14aa4bd2f414a8473ad2 SHA512 00e5f8c3b6b1aef9ee341db99b339217080a57dbe65fba56798d60ad4be971a9535d8ae27e1f243b18b9fc9e900ada6c452b040a6c8094d5e05d8a76d1d79c03
+DIST libidn2-2.3.8.tar.gz 2234804 BLAKE2B 8b34975a5a469353ac960ade97d0b67080e811c0d0eb7b11dcb6a4b352753da59b17c812bab8c969877bfe027fc3de0a36b7c6b75942811f17938b676238fb3d SHA512 4d8427c0f115268132f7544e80a808c883ab1406338f6c529b1a586b016d57aedb0857f66166eb8d9f37d70efc9dccf907b673b43b17bcf258c8797db1e829ce
+DIST libidn2-2.3.8.tar.gz.sig 1223 BLAKE2B f77d1a8dc7400365d3a6f745d9ea59ea16c456cb79c938e27ba221b6c0513a103f589fd40212aeac66cc74f9145b82b50aa21d3c32c0e73541a575f8ad274704 SHA512 469dd344ef652d2914478f7332564a4a89138f709d4805634233a5211d8bd2b0ff759c8f31e0902da116c56d73afe2e9d57fb566b3a5c60f219c15ff7e91de62
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/libidn2/libidn2-2.3.8.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/libidn2/libidn2-2.3.8.ebuild
new file mode 100644
index 0000000000..13a009baf9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/libidn2/libidn2-2.3.8.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="An implementation of the IDNA2008 specifications (RFCs 5890, 5891, 5892, 5893)"
+HOMEPAGE="
+	https://www.gnu.org/software/libidn/#libidn2
+	https://gitlab.com/libidn/libidn2/
+"
+SRC_URI="
+	mirror://gnu/libidn/${P}.tar.gz
+	verify-sig? ( mirror://gnu/libidn/${P}.tar.gz.sig )
+"
+S="${WORKDIR}"/${P/a/}
+
+LICENSE="|| ( GPL-2+ LGPL-3+ ) GPL-3+ unicode"
+SLOT="0/2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="nls static-libs"
+
+RDEPEND="
+	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
+"
+DEPEND="
+	${RDEPEND}
+"
+BDEPEND="
+	dev-lang/perl
+	nls? ( sys-devel/gettext )
+	verify-sig? ( >=sec-keys/openpgp-keys-libidn-20250414 )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libidn.asc
+
+src_prepare() {
+	default
+	elibtoolize
+}
+
+multilib_src_configure() {
+	local myconf=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+		$(use_enable static-libs static)
+		$(multilib_native_use_enable nls)
+		--enable-doc
+		--disable-gcc-warnings
+		--disable-gtk-doc
+		--disable-valgrind-tests
+	)
+
+	local ECONF_SOURCE=${S}
+	econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	default
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
index be423c1f2c..bb56e7d708 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.9-r1.ebuild
@@ -17,7 +17,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # Subslot format:
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/Manifest
index fed90be311..93b31ec092 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/Manifest
@@ -1,5 +1,3 @@
-DIST libmicrohttpd-0.9.76.tar.gz 2199858 BLAKE2B 2c2de77d731ff130bb1491733b91e9e0b0c68bc30ea1a826f7f1d97aaf83fa7f6bec3c219f81c5293de72595b26d1e6eb66cdd4bfe3b16bd37a10e3acd3c6446 SHA512 9ff8a837892142376eaeaf50c0b0dba76697d0ff44b908434cba8db4324c57dfb8bbcc1a922b97d825891ac10f50693dee9388531856e0fa81fa2cfeac538581
-DIST libmicrohttpd-0.9.76.tar.gz.sig 566 BLAKE2B 84c9ecf45cdd24223374831a1a635db389119196312685d74d6324bbe133a075615026252e4317baf0496bb4ddb249d76560ade5a91cf5995bfc8cca4699957f SHA512 304421dbf2b0763113affa50dcdcefd6d44bcc33b8af521ac9a3002ba4befafe9b78d49a3ab63bd8972e95e65c7bac47592b7bb05a78de1e84d4690220dbceaa
 DIST libmicrohttpd-0.9.77.tar.gz 1896679 BLAKE2B 09a07c7da77d6072e5aa0fb121aedffb66b6cfdb2da30d1809583469282365832beb935417e779ddb31876949358d25c10bf79616079393503ca5860d88ac052 SHA512 001025c023dd94c4a0cf017ed575e65a577b5ce595e7e450346bfb75def77eaa8a4cfbeffb9f4b912e34165c2cfca147c02c895e067a4f6c5a321a12035758a5
 DIST libmicrohttpd-0.9.77.tar.gz.sig 581 BLAKE2B 99ea14c7a80b0ed542672752617b045bea9a16a906e43422a130e83de048ea4d989ab53978b25b77f2982da9599aea711357c05b5a48fb5be84583c04596686c SHA512 60489620bfb2388afb19dd91c105927e593c6a17ba0293b4814c746b66d4f0418edafe49837de333640c1479bacde3e46740b031c2d4ec5bd106493122c87b19
 DIST libmicrohttpd-1.0.1.tar.gz 2239593 BLAKE2B a29e49c719fc544ae72224d81cba7b7ef914f2641efe4b90d580d2212f2c3357a6d70499c43a6f50d14f4ec9d3102da8de899fe0420bf6660eb413080d89b7f7 SHA512 c99b8b93cae5feee8debcc5667ee3ff043412a84b30696fe852e6c138f3c890bb43c8fcd7199f1d2f809d522fef159e83b607c743d6cf3401a57050fbdf9b5c1
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/files/libmicrohttpd-0.9.76-fix-test_tricky-libcurl.patch b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/files/libmicrohttpd-0.9.76-fix-test_tricky-libcurl.patch
new file mode 100644
index 0000000000..8b44438c16
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/files/libmicrohttpd-0.9.76-fix-test_tricky-libcurl.patch
@@ -0,0 +1,62 @@
+From 036f8fdec2802e48e2555b2caf381bb1c565ab82 Mon Sep 17 00:00:00 2001
+From: "Evgeny Grin (Karlson2k)" <k2k@narod.ru>
+Date: Fri, 11 Apr 2025 20:13:48 +0300
+Subject: test_tricky.c: applied a minimal fix for the libcurl >= 8.13.0
+
+---
+ src/testcurl/test_tricky.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/src/testcurl/test_tricky.c b/src/testcurl/test_tricky.c
+index 8cb53a80..bcbcf1ce 100644
+--- a/src/testcurl/test_tricky.c
++++ b/src/testcurl/test_tricky.c
+@@ -452,6 +452,11 @@ struct curlQueryParams
+   CURLU *url;
+ #endif /* CURL_AT_LEAST_VERSION(7, 62, 0) */
+ 
++#if CURL_AT_LEAST_VERSION (7, 55, 0)
++  /* A string used as the request target directly, without modifications */
++  const char *queryTarget;
++#endif /* CURL_AT_LEAST_VERSION(7, 55, 0) */
++
+   /* Custom query method, NULL for default */
+   const char *method;
+ 
+@@ -520,6 +525,16 @@ curlEasyInitForTest (struct curlQueryParams *p,
+       libcurlErrorExitDesc ("curl_easy_setopt() failed");
+   }
+ #endif /* CURL_AT_LEAST_VERSION(7, 62, 0) */
++
++#if CURL_AT_LEAST_VERSION (7, 55, 0)
++  if (NULL != p->queryTarget)
++  {
++    if (CURLE_OK != curl_easy_setopt (c, CURLOPT_REQUEST_TARGET,
++                                      p->queryTarget))
++      libcurlErrorExitDesc ("curl_easy_setopt() failed");
++  }
++#endif /* CURL_AT_LEAST_VERSION(7, 55, 0) */
++
+   return c;
+ }
+ 
+@@ -738,6 +753,9 @@ performTestQueries (struct MHD_Daemon *d, uint16_t d_port,
+   qParam.queryPort = d_port;
+   qParam.method = NULL;  /* Use libcurl default: GET */
+   qParam.queryPath = URL_SCHEME_HOST EXPECTED_URI_BASE_PATH;
++#if CURL_AT_LEAST_VERSION (7, 55, 0)
++  qParam.queryTarget = NULL;
++#endif /* CURL_AT_LEAST_VERSION(7, 55, 0) */
+ #if CURL_AT_LEAST_VERSION (7, 62, 0)
+   qParam.url = NULL;
+ #endif /* CURL_AT_LEAST_VERSION(7, 62, 0) */
+@@ -781,6 +799,7 @@ performTestQueries (struct MHD_Daemon *d, uint16_t d_port,
+       libcurlErrorExit ();
+ 
+     qParam.queryPath = NULL;
++    qParam.queryTarget = EXPECTED_URI_BASE_PATH_TRICKY;
+     uri_cb_param->uri = EXPECTED_URI_BASE_PATH_TRICKY;
+     ahc_param->rq_url = EXPECTED_URI_BASE_PATH_TRICKY;
+ 
+-- 
+cgit v1.2.3
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76-r1.ebuild
deleted file mode 100644
index 58dd993e0c..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76-r1.ebuild
+++ /dev/null
@@ -1,104 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-inherit multilib-minimal verify-sig
-
-MY_P="${P/_/}"
-
-DESCRIPTION="Small C library to run an HTTP server as part of another application"
-HOMEPAGE="https://www.gnu.org/software/libmicrohttpd/"
-SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz
-	verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="|| ( LGPL-2.1+ !ssl? ( GPL-2+-with-eCos-exception-2 ) )"
-SLOT="0/12"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="+epoll ssl static-libs test +thread-names verify-sig"
-RESTRICT="!test? ( test )"
-
-KEYRING_VER=201906
-
-RDEPEND="ssl? ( >net-libs/gnutls-2.12.20:=[${MULTILIB_USEDEP}] )"
-# libcurl and the curl binary are used during tests on CHOST
-DEPEND="${RDEPEND}
-	test? ( net-misc/curl[ssl?] )"
-BDEPEND="ssl? ( virtual/pkgconfig )
-	verify-sig? ( ~sec-keys/openpgp-keys-libmicrohttpd-${KEYRING_VER} )"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libmicrohttpd-${KEYRING_VER}.asc
-
-DOCS=( AUTHORS NEWS COPYING README ChangeLog )
-
-PATCHES=( "${FILESDIR}"/${PN}-0.9.75-fix-testsuite-with-lto.patch )
-
-# All checks in libmicrohttpd's configure are correct
-# Gentoo Bug #898662
-# Gentoo Bug #923760
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'pthread_sigmask'
-	'CreateThread'
-	'pthread_attr_init'
-	'pthread_attr_setname_np'
-	'pthread_setname_np'
-	'__builtin_bswap32'
-	'__builtin_bswap64'
-	'WSAPoll'
-	'epoll_create1'
-	'eventfd'
-	'pipe'
-	'pipe2'
-	'socketpair'
-	'gmtime_s'
-	'host_get_clock_service'
-	'clock_get_time'
-	'mach_port_deallocate'
-	'gethrtime'
-	'timespec_get'
-	'gettimeofday'
-	'sendfile'
-	'gnutls_privkey_import_x509_raw'
-	'calloc'
-	'fork'
-	'waitpid'
-	'random'
-	'rand'
-	'getsockname'
-	'sysconf'
-	'sysctl'
-	'sysctlbyname'
-	'usleep'
-	'nanosleep'
-	'stpncpy'
-)
-
-multilib_src_configure() {
-	ECONF_SOURCE="${S}" \
-	econf \
-		--enable-shared \
-		$(use_enable static-libs static) \
-		--disable-nls \
-		--enable-bauth \
-		--enable-dauth \
-		--disable-examples \
-		--enable-messages \
-		--enable-postprocessor \
-		--enable-httpupgrade \
-		--disable-experimental \
-		--disable-heavy-tests \
-		$(use_enable thread-names) \
-		$(use_enable epoll) \
-		$(use_enable test curl) \
-		$(use_enable ssl https) \
-		$(use_with ssl gnutls)
-}
-
-multilib_src_install_all() {
-	default
-
-	if ! use static-libs; then
-		find "${ED}" -name '*.la' -delete || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76.ebuild
deleted file mode 100644
index 814c7a7fb3..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.76.ebuild
+++ /dev/null
@@ -1,98 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-inherit multilib-minimal
-
-MY_P="${P/_/}"
-
-DESCRIPTION="Small C library to run an HTTP server as part of another application"
-HOMEPAGE="https://www.gnu.org/software/libmicrohttpd/"
-SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="|| ( LGPL-2.1+ !ssl? ( GPL-2+-with-eCos-exception-2 ) )"
-SLOT="0/12"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="+epoll ssl static-libs test +thread-names"
-RESTRICT="!test? ( test )"
-
-RDEPEND="ssl? ( >net-libs/gnutls-2.12.20:=[${MULTILIB_USEDEP}] )"
-# libcurl and the curl binary are used during tests on CHOST
-DEPEND="${RDEPEND}
-	test? ( net-misc/curl[ssl?] )"
-BDEPEND="ssl? ( virtual/pkgconfig )"
-
-DOCS=( AUTHORS NEWS COPYING README ChangeLog )
-
-PATCHES=( "${FILESDIR}"/${PN}-0.9.75-fix-testsuite-with-lto.patch )
-
-# All checks in libmicrohttpd's configure are correct
-# Gentoo Bug #898662
-# Gentoo Bug #923760
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'pthread_sigmask'
-	'CreateThread'
-	'pthread_attr_init'
-	'pthread_attr_setname_np'
-	'pthread_setname_np'
-	'__builtin_bswap32'
-	'__builtin_bswap64'
-	'WSAPoll'
-	'epoll_create1'
-	'eventfd'
-	'pipe'
-	'pipe2'
-	'socketpair'
-	'gmtime_s'
-	'host_get_clock_service'
-	'clock_get_time'
-	'mach_port_deallocate'
-	'gethrtime'
-	'timespec_get'
-	'gettimeofday'
-	'sendfile'
-	'gnutls_privkey_import_x509_raw'
-	'calloc'
-	'fork'
-	'waitpid'
-	'random'
-	'rand'
-	'getsockname'
-	'sysconf'
-	'sysctl'
-	'sysctlbyname'
-	'usleep'
-	'nanosleep'
-	'stpncpy'
-)
-
-multilib_src_configure() {
-	ECONF_SOURCE="${S}" \
-	econf \
-		--enable-shared \
-		$(use_enable static-libs static) \
-		--disable-nls \
-		--enable-bauth \
-		--enable-dauth \
-		--disable-examples \
-		--enable-messages \
-		--enable-postprocessor \
-		--enable-httpupgrade \
-		--disable-experimental \
-		--disable-heavy-tests \
-		$(use_enable thread-names) \
-		$(use_enable epoll) \
-		$(use_enable test curl) \
-		$(use_enable ssl https) \
-		$(use_with ssl gnutls)
-}
-
-multilib_src_install_all() {
-	default
-
-	if ! use static-libs; then
-		find "${ED}" -name '*.la' -delete || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77-r1.ebuild
index b0d9af648e..4809b2606c 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -33,6 +33,10 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libmicrohttpd-${KEYRING_VER}
 
 DOCS=( AUTHORS NEWS COPYING README ChangeLog )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.9.76-fix-test_tricky-libcurl.patch # Gentoo Bug #953520
+)
+
 # All checks in libmicrohttpd's configure are correct
 # Gentoo Bug #923760
 QA_CONFIG_IMPL_DECL_SKIP=(
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77.ebuild
index 5b2d7ac477..e21c8449ed 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-0.9.77.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -27,6 +27,10 @@ BDEPEND="ssl? ( virtual/pkgconfig )"
 
 DOCS=( AUTHORS NEWS COPYING README ChangeLog )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.9.76-fix-test_tricky-libcurl.patch # Gentoo Bug #953520
+)
+
 # All checks in libmicrohttpd's configure are correct
 # Gentoo Bug #923760
 QA_CONFIG_IMPL_DECL_SKIP=(
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild
index 00b5a46c27..2ba8759910 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -33,6 +33,10 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libmicrohttpd-${KEYRING_VER}
 
 DOCS=( AUTHORS NEWS COPYING README ChangeLog )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.9.76-fix-test_tricky-libcurl.patch # Gentoo Bug #953520
+)
+
 # All checks in libmicrohttpd's configure are correct
 # Gentoo Bug #923760
 QA_CONFIG_IMPL_DECL_SKIP=(
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1.ebuild
index b196d442e8..5122d6e835 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libmicrohttpd/libmicrohttpd-1.0.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -27,6 +27,10 @@ BDEPEND="ssl? ( virtual/pkgconfig )"
 
 DOCS=( AUTHORS NEWS COPYING README ChangeLog )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.9.76-fix-test_tricky-libcurl.patch # Gentoo Bug #953520
+)
+
 # All checks in libmicrohttpd's configure are correct
 # Gentoo Bug #923760
 QA_CONFIG_IMPL_DECL_SKIP=(
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
index 09abf06970..84b8056e36 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/Manifest
@@ -1,3 +1,5 @@
+DIST openssh-10.0p1.tar.gz 1972675 BLAKE2B 4ce353adf75aade8f4b2a223ad13e2f92cd23d1e60b4ee52bad0eaf036571229438cd9760dfa99c0e10fa09a8ac47b2bfb04eb183fb7b9287ac564ec75316a75 SHA512 2daa1fcf95793b23810142077e68ddfabdf3732b207ef4f033a027f72d733d0e9bcdb6f757e7f3a5934b972de05bfaae3baae381cfc7a400cd8ab4d4e277a0ed
+DIST openssh-10.0p1.tar.gz.asc 833 BLAKE2B 105fd1238c9923719fb7fcbafa55806e2e5053095422b95193438d4c536d1f3bae04a1fc674fe1fee8bc14abaa5ea41c4d25134f4fe677cdf1d761c009246f0c SHA512 6ab9deb4233ff159e55a18c9fc07d5ff8a41723dad74aa3d803e1476b585f5662aba34f8a7a1f5fe1d248f3ff3cd663f2c2fb8e399c6a4723b6215b0eb423d13
 DIST openssh-9.8p1.tar.gz 1910393 BLAKE2B 3bf983c4ef5358054ed0104cd51d3e0069fbc2b80d8522d0df644d5508ec1d26a67bf061b1b5698d1cdf0d2cbba16b4cdca12a4ce30da24429094576a075e192 SHA512 95dec2f18e58eb47994f3de4430253e0665e185564b65088ca5f4108870e05feddef8cda8d3c0a4b75f18b98cc2c024df0e27de53b48c1a16da8da483cb8292a
 DIST openssh-9.8p1.tar.gz.asc 833 BLAKE2B 5291e8c03ab9a75acb44285cd7fc010f4a33551f142499624165dac708fc05a6d077df81555aa41037b45f6301e4e5db3161a7a23404473f8a233a877fc55cc3 SHA512 4df1f1be2c6ab7f3aebaedd0a773b0e8c8929abb30cd3415873ad55d012cfa113f792e888e5e772dd468c394aeb7e35d62893a514dbc0ab1a03acd79918657f7
 DIST openssh-9.9p2.tar.gz 1944499 BLAKE2B 1b5bc09482b3a807ccfee52c86c6be3c363acf0c8e774862e0ae64f76bfeb4ce7cf29b3ed2f99c04c89bb4977da0cf50a7a175b15bf1d9925de1e03c66f8306d SHA512 4c6d839aa3189cd5254c745f2bd51cd3f468b02f8e427b8d7a16b9ad017888a41178d2746dc51fb2d3fec5be00e54b9ab7c32c472ca7dec57a1dea4fc9840278
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild
new file mode 100644
index 0000000000..d53d606a53
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild
@@ -0,0 +1,438 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Remember to check the upstream release/stable branches for patches
+# to backport! See https://marc.info/?l=openssh-unix-dev&m=172723798122122&w=2.
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc
+inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="
+	mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+	verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc )
+"
+S="${WORKDIR}/${PARCH}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit debug kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test xmss"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	ldns? ( ssl )
+	pie? ( !static )
+	static? ( !kerberos !pam )
+	xmss? ( ssl  )
+	test? ( ssl )
+"
+
+# tests currently fail with XMSS
+REQUIRED_USE+="test? ( !xmss )"
+
+LIB_DEPEND="
+	audit? ( sys-process/audit[static-libs(+)] )
+	ldns? (
+		net-libs/ldns[static-libs(+)]
+		net-libs/ldns[ecdsa(+),ssl(+)]
+	)
+	libedit? ( dev-libs/libedit:=[static-libs(+)] )
+	security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] )
+	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+	ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] )
+	virtual/libcrypt:=[static-libs(+)]
+	>=sys-libs/zlib-1.2.3:=[static-libs(+)]
+"
+RDEPEND="
+	acct-group/sshd
+	acct-user/sshd
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	pam? ( sys-libs/pam )
+	kerberos? ( virtual/krb5 )
+"
+DEPEND="
+	${RDEPEND}
+	virtual/os-headers
+	kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) )
+	static? ( ${LIB_DEPEND} )
+"
+RDEPEND="
+	${RDEPEND}
+	!net-misc/openssh-contrib
+	pam? ( >=sys-auth/pambase-20081028 )
+	!prefix? ( sys-apps/shadow )
+"
+BDEPEND="
+	dev-build/autoconf
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-openssh )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
+	"${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
+	"${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
+	# Backports from upstream release branch
+	#"${FILESDIR}/${PV}"
+	# Our own backports
+)
+
+pkg_pretend() {
+	local i enabled_eol_flags disabled_eol_flags
+	for i in hpn sctp X509; do
+		if has_version "net-misc/openssh[${i}]"; then
+			enabled_eol_flags+="${i},"
+			disabled_eol_flags+="-${i},"
+		fi
+	done
+
+	if [[ -n ${enabled_eol_flags} && ${OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING} != yes ]]; then
+		# Skip for binary packages entirely because of environment saving, bug #907892
+		[[ ${MERGE_TYPE} == binary ]] && return
+
+		ewarn "net-misc/openssh does not support USE='${enabled_eol_flags%,}' anymore."
+		ewarn "The Base system team *STRONGLY* recommends you not rely on this functionality,"
+		ewarn "since these USE flags required third-party patches that often trigger bugs"
+		ewarn "and are of questionable provenance."
+		ewarn
+		ewarn "If you must continue relying on this functionality, switch to"
+		ewarn "net-misc/openssh-contrib. You will have to remove net-misc/openssh from your"
+		ewarn "world file first: 'emerge --deselect net-misc/openssh'"
+		ewarn
+		ewarn "In order to prevent loss of SSH remote login access, we will abort the build."
+		ewarn "Whether you proceed with disabling the USE flags or switch to the -contrib"
+		ewarn "variant, when re-emerging you will have to set"
+		ewarn
+		ewarn "  OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+
+		die "Building net-misc/openssh[${disabled_eol_flags%,}] without OPENSSH_EOL_USE_FLAGS_I_KNOW_WHAT_I_AM_DOING=yes"
+	fi
+
+	# Make sure people who are using tcp wrappers are notified of its removal. #531156
+	if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
+		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+		ewarn "you're trying to use it.  Update your ${EROOT}/etc/hosts.{allow,deny} please."
+	fi
+}
+
+src_prepare() {
+	# don't break .ssh/authorized_keys2 for fun
+	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+	[[ -d ${WORKDIR}/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+	default
+
+	# These tests are currently incompatible with PORTAGE_TMPDIR/sandbox
+	sed -e '/\t\tpercent \\/ d' \
+		-i regress/Makefile || die
+
+	tc-export PKG_CONFIG
+	local sed_args=(
+		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+		# Disable fortify flags ... our gcc does this for us
+		-e 's:-D_FORTIFY_SOURCE=2::'
+	)
+
+	# _XOPEN_SOURCE causes header conflicts on Solaris
+	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
+		-e 's/-D_XOPEN_SOURCE//'
+	)
+	sed -i "${sed_args[@]}" configure{.ac,} || die
+
+	eautoreconf
+}
+
+src_configure() {
+	addwrite /dev/ptmx
+
+	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+	use static && append-ldflags -static
+	use xmss && append-cflags -DWITH_XMSS
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# Solaris' glob.h doesn't have things like GLOB_TILDE, configure
+		# doesn't check for this, so force the replacement to be put in
+		# place
+		append-cppflags -DBROKEN_GLOB
+	fi
+
+	# use replacement, RPF_ECHO_ON doesn't exist here
+	[[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no
+
+	local myconf=(
+		--with-ldflags="${LDFLAGS}"
+		--disable-strip
+		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+		--sysconfdir="${EPREFIX}"/etc/ssh
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
+		--datadir="${EPREFIX}"/usr/share/openssh
+		--with-privsep-path="${EPREFIX}"/var/empty
+		--with-privsep-user=sshd
+		# optional at runtime; guarantee a known path
+		--with-xauth="${EPREFIX}"/usr/bin/xauth
+
+		# --with-hardening adds the following in addition to flags we
+		# already set in our toolchain:
+		# * -ftrapv (which is broken with GCC anyway),
+		# * -ftrivial-auto-var-init=zero (which is nice, but not the end of
+		#    the world to not have)
+		# * -fzero-call-used-regs=used (history of miscompilations with
+		#    Clang (bug #872548), ICEs on m68k (bug #920350, gcc PR113086,
+		#    gcc PR104820, gcc PR104817, gcc PR110934)).
+		#
+		# Furthermore, OSSH_CHECK_CFLAG_COMPILE does not use AC_CACHE_CHECK,
+		# so we cannot just disable -fzero-call-used-regs=used.
+		#
+		# Therefore, just pass --without-hardening, given it doesn't negate
+		# our already hardened toolchain defaults, and avoids adding flags
+		# which are known-broken in both Clang and GCC and haven't been
+		# proven reliable.
+		--without-hardening
+
+		# wtmpdb not yet packaged
+		--without-wtmpdb
+
+		$(use_with audit audit linux)
+		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
+		$(use_with ldns)
+		$(use_with libedit)
+		$(use_with pam)
+		$(use_with pie)
+		$(use_with selinux)
+		$(use_with security-key security-key-builtin)
+		$(use_with ssl openssl)
+		$(use_with ssl ssl-engine)
+	)
+
+	if use elibc_musl; then
+		# musl defines bogus values for UTMP_FILE and WTMP_FILE (bug #753230)
+		myconf+=( --disable-utmp --disable-wtmp )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+create_config_dropins() {
+	local locale_vars=(
+		# These are language variables that POSIX defines.
+		# http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+		LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+		# These are the GNU extensions.
+		# https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+		LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+	)
+
+	mkdir -p "${WORKDIR}"/etc/ssh/ssh{,d}_config.d || die
+
+	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die
+	# Send locale environment variables (bug #367017)
+	SendEnv ${locale_vars[*]}
+
+	# Send COLORTERM to match TERM (bug #658540)
+	SendEnv COLORTERM
+	EOF
+
+	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die
+	RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts"
+	EOF
+
+	cat <<-EOF > "${WORKDIR}"/etc/ssh/ssh_revoked_hosts || die
+	# https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/
+	ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+	EOF
+
+	cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
+	# Allow client to pass locale environment variables (bug #367017)
+	AcceptEnv ${locale_vars[*]}
+
+	# Allow client to pass COLORTERM to match TERM (bug #658540)
+	AcceptEnv COLORTERM
+	EOF
+
+	cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
+	# override default of no subsystems
+	Subsystem	sftp	${EPREFIX}/usr/$(get_libdir)/misc/sftp-server
+	EOF
+
+	if use pam ; then
+		cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
+		UsePAM yes
+		# This interferes with PAM.
+		PasswordAuthentication no
+		# PAM can do its own handling of MOTD.
+		PrintMotd no
+		PrintLastLog no
+		EOF
+	fi
+
+	if use livecd ; then
+		cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die
+		# Allow root login with password on livecds.
+		PermitRootLogin Yes
+		EOF
+	fi
+}
+
+src_compile() {
+	default
+	create_config_dropins
+}
+
+src_test() {
+	local tests=( compat-tests )
+	local shell=$(egetshell "${UID}")
+	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+		ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+		ewarn "user, so we will run a subset only."
+		tests+=( interop-tests )
+	else
+		tests+=( tests )
+	fi
+
+	local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1
+	mkdir -p "${HOME}"/.ssh || die
+	emake -j1 "${tests[@]}" </dev/null
+}
+
+src_install() {
+	emake install-nokeys DESTDIR="${D}"
+	fperms 600 /etc/ssh/sshd_config
+	dobin contrib/ssh-copy-id
+	newinitd "${FILESDIR}"/sshd-r1.initd sshd
+	newconfd "${FILESDIR}"/sshd-r1.confd sshd
+	exeinto /etc/user/init.d
+	newexe "${FILESDIR}"/ssh-agent.initd ssh-agent
+
+	if use pam; then
+		newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+	fi
+
+	doman contrib/ssh-copy-id.1
+	dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config
+
+	rmdir "${ED}"/var/empty || die
+
+	systemd_dounit "${FILESDIR}"/sshd.socket
+	systemd_newunit "${FILESDIR}"/sshd.service.2 sshd.service
+	systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service'
+
+	# Install dropins with explicit mode, bug 906638, 915840
+	diropts -m0755
+	insopts -m0644
+	insinto /etc/ssh
+	doins -r "${WORKDIR}"/etc/ssh/ssh_config.d
+	doins "${WORKDIR}"/etc/ssh/ssh_revoked_hosts
+	diropts -m0700
+	insopts -m0600
+	doins -r "${WORKDIR}"/etc/ssh/sshd_config.d
+}
+
+pkg_preinst() {
+	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then
+		show_ssl_warning=1
+	fi
+}
+
+pkg_postinst() {
+	# bug #139235
+	optfeature "x11 forwarding" x11-apps/xauth
+
+	if ver_replacing -lt "5.8_p1"; then
+		elog "Starting with openssh-5.8p1, the server will default to a newer key"
+		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
+		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
+	fi
+	if ver_replacing -lt "7.0_p1"; then
+		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+		elog "Make sure to update any configs that you might have.  Note that xinetd might"
+		elog "be an alternative for you as it supports USE=tcpd."
+	fi
+	if ver_replacing -lt "7.1_p1"; then #557388 #555518
+		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
+		elog "adding to your sshd_config or ~/.ssh/config files:"
+		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
+		elog "You should however generate new keys using rsa or ed25519."
+
+		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
+		elog "out of the box.  If you need this, please update your sshd_config explicitly."
+	fi
+	if ver_replacing -lt "7.6_p1"; then
+		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+	fi
+	if ver_replacing -lt "7.7_p1"; then
+		elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+		elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+		elog "if you need to authenticate against LDAP."
+		elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+	fi
+	if ver_replacing -lt "8.2_p1"; then
+		ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"
+		ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"
+		ewarn "connection is generally safe."
+	fi
+	if ver_replacing -lt "9.2_p1-r1" && systemd_is_booted; then
+		ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"
+		ewarn "'Restart=on-failure', which causes the service to automatically restart if it"
+		ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"
+		ewarn "but it can increase the vulnerability of the system in the event of a future exploit."
+		ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"
+		ewarn "set 'Restart=no' in your sshd unit file."
+	fi
+
+	if [[ -n ${show_ssl_warning} ]]; then
+		elog "Be aware that by disabling openssl support in openssh, the server and clients"
+		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
+		elog "and update all clients/servers that utilize them."
+	fi
+
+	openssh_maybe_restart
+}
+
+openssh_maybe_restart() {
+	local ver
+	declare -a versions
+	read -ra versions <<<"${REPLACING_VERSIONS}"
+	for ver in "${versions[@]}"; do
+		# Exclude 9.8_p1 because it didn't have the safety check
+		[[ ${ver} == 9.8_p1 ]] && break
+
+		if [[ ${ver%_*} == "${PV%_*}" ]]; then
+			# No major version change has occurred
+			return
+		fi
+	done
+
+	if [[ ${ROOT} ]]; then
+		return
+	elif [[ -d /run/systemd/system ]] && sshd -t >/dev/null 2>&1; then
+		ewarn "The ebuild will now attempt to restart OpenSSH to avoid"
+		ewarn "bricking the running instance. See bug #709748."
+		ebegin "Attempting to restart openssh via 'systemctl try-restart sshd'"
+		systemctl try-restart sshd
+		eend $?
+	elif [[ -d /run/openrc ]]; then
+		# We don't check for sshd -t here because the OpenRC init script
+		# has a stop_pre() which does checkconfig, i.e. we defer to it
+		# to give nicer output for a failed sanity check.
+		ewarn "The ebuild will now attempt to restart OpenSSH to avoid"
+		ewarn "bricking the running instance. See bug #709748."
+		ebegin "Attempting to restart openssh via 'rc-service -q --ifstarted --nodeps sshd restart'"
+		rc-service -q --ifstarted --nodeps sshd restart
+		eend $?
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
index 15d81449d5..0e50941404 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index c3a748c9c9..36d46e5762 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-04-09)
+# dev-db/tinycdb is not keyworded here
+mail-mta/sendmail tinycdb
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index 12d2fcf5cb..7d7aae672e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -189,6 +189,7 @@ dev-build/cmake -dap
 
 # Michał Górny <mgorny@gentoo.org> (2023-06-24)
 # dev-db/mongodb miraculously got keyworded here.
+dev-libs/mongo-c-driver -test-full
 dev-python/pymongo -test-full
 
 # Sam James <sam@gentoo.org> (2023-05-15)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 8b3fe6d7e5..d2af6e7804 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-04-09)
+# dev-db/tinycdb is not keyworded here
+mail-mta/sendmail tinycdb
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-04-02)
 # Needs kde-frameworks/breeze-icons which is not keyworded here.
 net-irc/quassel system-icons
@@ -63,7 +67,7 @@ games-emulation/rmg -dynarec
 # Abandoned upstream, does not take bug reports, unsupported in Gentoo.
 # Only remaining use is as a requirement for dev-lang/go on arm{,64}.
 # See #934149, #934151, #936022, #936021
-sys-devel/binutils -gold
+<sys-devel/binutils-2.44 -gold
 
 # Sam James <sam@gentoo.org> (2024-06-13)
 # Needs as-yet-unkeyworded KF6 (bug #934215)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index a9122ef4b8..f2f9a6e7e6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -83,7 +83,7 @@ sys-kernel/installkernel -ugrd
 # Abandoned upstream, does not take bug reports, unsupported in Gentoo.
 # Only remaining use is as a requirement for dev-lang/go on arm{,64}.
 # See #934149, #934151, #936022, #936021
-sys-devel/binutils -gold
+<sys-devel/binutils-2.44 -gold
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-06-23)
 # Pulls in kde-apps/kgpg which is keyworded here
@@ -157,6 +157,7 @@ dev-db/spatialite rttopo
 
 # Michał Górny <mgorny@gentoo.org> (2023-06-24)
 # dev-db/mongodb miraculously got keyworded here.
+dev-libs/mongo-c-driver -test-full
 dev-python/pymongo -test-full
 
 # Sam James <sam@gentoo.org> (2023-04-17)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 959b02c9e2..6f6350d357 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -164,6 +164,7 @@ dev-build/cmake dap
 
 # Michał Górny <mgorny@gentoo.org> (2023-06-24)
 # dev-db/mongodb builds practically only on the authors' computer.
+dev-libs/mongo-c-driver test-full
 dev-python/pymongo test-full
 
 # Sam James <sam@gentoo.org> (2023-05-15)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index ed4842a55a..fd362400da 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -68,10 +68,6 @@ media-libs/libass libunibreak
 # dev-util/bpftool and/or sys-devel/bpf-toolchain not keyworded here
 sys-apps/systemd bpf
 
-# Ulrich Müller <ulm@gentoo.org> (2024-08-03)
-# Needs dev-libs/openspecfun which is not yet keyworded
-sci-visualization/gnuplot amos
-
 # Leonardo Hernández Hernández <leohdz172@proton.me> (2024-07-07)
 # media-libs/quirc and media-sound/liblc3 are not keyworded here
 media-video/ffmpeg quirc liblc3
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index 66b9308579..f6a87459b0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -355,7 +355,7 @@ sys-libs/libxcrypt compat
 # limitations.
 
 # LoongArch has no gold
-sys-devel/binutils gold
+<sys-devel/binutils-2.44 gold
 
 # These aren't ported to LoongArch yet
 dev-libs/libpcre jit
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index e55fd975a9..e53f02a4d1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# PPN-SD <nicolas.parlant@parhuet.fr> (2025-04-08)
+# media-libs/libsidplayfp is not keyworded
+media-sound/mpd sid
+
 # Yongxiang Liang <tanekliang@gentoo.org> (2024-10-10)
 # app-i18n/fcitx:5 is not yet keyworded
 media-libs/libsdl2 fcitx
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 0a25bfe946..11ab2ec13a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -179,12 +179,6 @@ media-sound/easyeffects zamaudio
 # dev-python/django is not keyworded here
 dev-python/diskcache test
 
-# Sam James <sam@gentoo.org> (2021-03-11)
-# media-libs/libavif isn't keyworded here
-media-libs/gd avif
-www-client/links avif
-dev-lang/php avif
-
 # Sam James <sam@gentoo.org> (2021-02-28)
 # compiler-rt* has no support for ppc32 (yet?)
 # bug #708344
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
index df7a446261..b3053530cd 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
@@ -4,6 +4,13 @@
 # Unmask the flag which corresponds to ARCH.
 -ppc
 
+# Michał Górny <mgorny@gentoo.org> (2025-04-13)
+# Converted to global mask.
+#
+# Sam James <sam@gentoo.org> (2021-03-11)
+# media-libs/libavif isn't keyworded here
+avif
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-17)
 # media-libs/libheif is not keyworded here
 heif
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index 1790b4b950..6d3b1a0450 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Cristian Othón Martínez Vera (2025-04-09)
+# dev-db/tinycdb is not keyworded here
+mail-mta/sendmail tinycdb
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index 2c53f85273..b973d3b56c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-04-09)
+# dev-db/tinycdb is not keyworded here
+mail-mta/sendmail tinycdb
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libavif is not keyworded
 media-libs/imlib2 avif
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
index b47aa73348..1f31394563 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
@@ -1,9 +1,13 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -s390
 
+# Michał Górny <mgorny@gentoo.org> (2025-04-13)
+# media-libs/libavif is not keyworded here.
+avif
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-17)
 # media-libs/libheif is not keyworded here
 heif
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 2fb48cb35e..891c1c544e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,16 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2025-04-13)
+# Fails to build app-editors/emacs[jit] and has many test failures in the
+# libgccjit testsuite: bug #953775 (https://gcc.gnu.org/PR119767).
+app-editors/emacs jit
+sys-devel/gcc jit
+
+# Cristian Othón Martínez Vera <cfuga@cfuga.mx> (2025-04-09)
+# dev-db/tinycdb is not keyworded here
+mail-mta/sendmail tinycdb
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index e5f1d455a6..7c6c446414 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -4,7 +4,7 @@
 # Sebastian Pipping <sping@gentoo.org> (2025-03-27)
 # This blocks accidental use of bundled vulnerable dev-libs/expat
 # for now (bug #952113)
-dev-libs/xmlrpc-c libxml2
+<dev-libs/xmlrpc-c-1.59.03-r2 libxml2
 
 # Joonas Niilola <juippis@gentoo.org> (2025-03-05)
 # 136.0 can't be compiled with "-rust-extensions".
@@ -35,8 +35,8 @@ llvm-runtimes/libcxxabi clang
 #    echo "dev-lang/rust:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 #    echo "dev-lang/rust-bin:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 # done
-dev-lang/rust:1.86 llvm_slot_19
-dev-lang/rust-bin:1.86 llvm_slot_19
+dev-lang/rust:1.86.0 llvm_slot_19
+dev-lang/rust-bin:1.86.0 llvm_slot_19
 dev-lang/rust:1.85.1 llvm_slot_19
 dev-lang/rust-bin:1.85.1 llvm_slot_19
 dev-lang/rust:1.85.0 llvm_slot_19
@@ -288,6 +288,12 @@ gnome-base/gnome-desktop seccomp
 app-misc/tracker-miners seccomp
 net-libs/webkit-gtk seccomp
 
+# Lukas Schmelting <lschmelting@posteo.com> after consulting
+# Mart Raudsepp <leio@gentoo.org> (2025-19-02)
+# GNOME without Xwayland is not mainstream yet. Current priority is that
+# users have working apps, advanced users can still override this
+x11-wm/mutter xwayland
+
 # Luke Dashjr <luke-jr+gentoobugs@utopios.org> (2018-11-19)
 # iasl is not keyworded on many platforms yet
 sys-firmware/seabios binary
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 3dba5a0521..d209ecd92a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,25 +33,22 @@
 
 #--- END OF EXAMPLES ---
 
-# Sam James <sam@gentoo.org> (2025-04-05)
-# New abseil/protobuf breaks too much:
-# * net-libs/grpc (bug #953141)
-# * media-libs/opencv (bug #953138)
-# * dev-libs/protobuf (bug #953140)
-=dev-cpp/abseil-cpp-20250127.0*
-=dev-cpp/abseil-cpp-20240722.1*
-=dev-cpp/abseil-cpp-20240116.3*
-=dev-cpp/abseil-cpp-20230802.3*
-=dev-libs/protobuf-30*
-=dev-ruby/google-protobuf-4.30*
-=dev-java/protobuf-java-4.30*
-=dev-python/protobuf-6.30*
+# Hans de Graaff <graaff@gentoo.org> (2025-04-14)
+# Obsolete slot that fails tests, bug 933189. EAPI 7.  Use the newer
+# slot instead. Masked for removal on 2025-05-14.
+dev-ruby/childprocess:2
 
-# Arthur Zamarin <arthurzam@gentoo.org> (2025-04-04)
-# Temporary mask until handled the usage of shorter SLOT.
-# Bugs #953127, #953103.
-dev-lang/rust:1.86
-dev-lang/rust-bin:1.86
+# Ionen Wolkens <ionen@gentoo.org> (2025-04-12)
+# >=31 breaks www-client/qutebrowser's tests
+# https://github.com/cucumber/gherkin/issues/373
+# https://github.com/qutebrowser/qutebrowser/commit/12e683826783
+>=dev-python/gherkin-official-31
+
+# Michał Górny <mgorny@gentoo.org> (2025-04-09)
+# Still uses legacy distutils-r1 mode, and lacks Python 3.13 target.
+# No reply from the maintainer for a year now.
+# Removal on 2025-05-09.  Bug #909900.
+app-text/nfoview
 
 # Matt Turner <mattst88@gentoo.org> (2025-04-04)
 # Package is dead (last release in 1999).
@@ -83,6 +80,8 @@ app-text/kchmviewer
 # to catch up on support if needed. May or may keep masked until 6.9.1
 # depending on issues. If wanted, feel free to add `dev-qt/*:6/6.9.0`
 # to package.unmask and report issues.
+=dev-python/pyqt6-6.9*
+=dev-python/pyqt6-webengine-6.9*
 =dev-python/pyside-6.9.0*
 =dev-qt/qt-docs-6.9.0*
 =dev-qt/qt3d-6.9.0*
@@ -384,34 +383,6 @@ dev-vcs/notify-webhook
 # Removal on 2025-04-15.
 sci-biology/clustalx
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-02-27)
-# We have collected a lot of barely used Perl virtuals over time
-# (they effectively only make sense with version dependencies).
-# Time to clean up. In ebuilds, just depend on dev-lang/perl.
-# The following are masked for removal on 2025-03-31:
-virtual/perl-Attribute-Handlers
-virtual/perl-AutoLoader
-virtual/perl-CPAN-Meta-YAML
-virtual/perl-Dumpvalue
-virtual/perl-ExtUtils-Constant
-virtual/perl-ExtUtils-Install
-virtual/perl-ExtUtils-Manifest
-virtual/perl-Filter-Simple
-virtual/perl-I18N-LangTags
-virtual/perl-IPC-Cmd
-virtual/perl-Locale-Maketext-Simple
-virtual/perl-Memoize
-virtual/perl-Module-Loaded
-virtual/perl-Net-Ping
-virtual/perl-Perl-OSType
-virtual/perl-Pod-Escapes
-virtual/perl-Safe
-virtual/perl-Thread-Queue
-virtual/perl-Thread-Semaphore
-virtual/perl-threads-shared
-virtual/perl-Tie-RefHash
-virtual/perl-Time-Piece
-
 # Eray Aslan <eras@gentoo.org> (2025-02-24)
 # Mask experimental software
 =mail-mta/postfix-3.11*
@@ -489,12 +460,6 @@ dev-qt/qtserialbus:5
 dev-qt/qtvirtualkeyboard:5
 dev-qt/qtwebview:5
 
-# Conrad Kostecki <conikost@gentoo.org> (2025-01-09)
-# New version, which dropps support for legacy devices.
-# Will be unmasked, when split to legacy-branch is done.
->=dev-libs/intel-compute-runtime-24.52.32224.5
->=dev-util/intel-graphics-compiler-2.5.7
-
 # Michał Górny <mgorny@gentoo.org> (2024-12-05)
 # 6.12.2 does not boot for me.
 =sys-kernel/gentoo-kernel-6.12.2
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025 b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025
index 8cd13e2d86..cfa859579b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025
@@ -1 +1,3 @@
 move kde-apps/spectacle kde-plasma/spectacle
+slotmove <=dev-util/intel-graphics-compiler-1.0.17791.18 0 legacy
+slotmove <=dev-libs/intel-compute-runtime-24.35.30872.32 0 legacy
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/acl/Manifest
index c2761e2fcd..8eafcfa344 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/Manifest
@@ -1,2 +1 @@
-DIST acl-2.3.1.tar.xz 355676 BLAKE2B 15e81e8159ddb21ef0c262bef3101c0b6fa546738a2ab74c01ccc21fd1c3dc8ab6aaf84a06dee6da22291f3ca4feeffa60c7d11bfac1ab770a6ec28e1f1655e0 SHA512 7d02f05d17305f8587ab485395b00c7fdb8e44c1906d0d04b70a43a3020803e8b2b8c707abb6147f794867dfa87bd51769c2d3e11a3db55ecbd2006a6e6231dc
 DIST acl-2.3.2.tar.xz 371680 BLAKE2B 9f2abfddcd403df2c716c05f02a1b52453613d10948dc58a65b9ef41b44e37db6de99fb22dcfc4f6f0fb5d0319c939da61bd4e0fba2cdb5643e8087ecd34eeac SHA512 c2d061dbfd28c00cecbc1ae614d67f3138202bf4d39b383f2df4c6a8b10b830f33acec620fb211f268478737dde4037d338a5823af445253cb088c48a135099b
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
deleted file mode 100644
index 9136b3b1f6..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
+++ /dev/null
@@ -1,81 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic libtool multilib-minimal toolchain-funcs usr-ldscript
-
-DESCRIPTION="Access control list utilities, libraries, and headers"
-HOMEPAGE="https://savannah.nongnu.org/projects/acl"
-SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
-
-LICENSE="LGPL-2.1"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="nls static-libs"
-
-RDEPEND="
-	>=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}]
-"
-DEPEND="${RDEPEND}"
-BDEPEND="nls? ( sys-devel/gettext )"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-2.3.1-musl-1.2.4-lfs64-fix.patch"
-)
-
-src_prepare() {
-	default
-
-	# bug #580792
-	elibtoolize
-}
-
-multilib_src_configure() {
-	# Filter out -flto flags as they break getfacl/setfacl binaries
-	# bug #667372
-	filter-lto
-
-	# Broken with FORTIFY_SOURCE=3
-	# Our toolchain sets F_S=2 by default w/ >= -O2, so we need
-	# to unset F_S first, then explicitly set 2, to negate any default
-	# and anything set by the user if they're choosing 3 (or if they've
-	# modified GCC to set 3).
-	#
-	# Refs:
-	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964
-	# https://savannah.nongnu.org/bugs/index.php?62519
-	# bug #847280
-	if tc-enables-fortify-source ; then
-		filter-flags -D_FORTIFY_SOURCE=3
-		append-cppflags -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
-	fi
-
-	local myeconfargs=(
-		--bindir="${EPREFIX}"/bin
-		$(use_enable static-libs static)
-		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
-		$(use_enable nls)
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_test() {
-	# Tests call native binaries with an LD_PRELOAD wrapper
-	# bug #772356
-	multilib_is_native_abi && default
-}
-
-multilib_src_install() {
-	default
-
-	# Move shared libs to /
-	gen_usr_ldscript -a acl
-}
-
-multilib_src_install_all() {
-	if ! use static-libs ; then
-		find "${ED}" -type f -name "*.la" -delete || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
index 846518eebf..f60fa774ff 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1+ GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="nls static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch b/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch
deleted file mode 100644
index 3b5d2c6bab..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-Bug: https://bugs.gentoo.org/905910
-Upstream Bug: https://savannah.nongnu.org/bugs/index.php?64162
-
-From a9100afd77fea00b311f114a5a04108283aa681a Mon Sep 17 00:00:00 2001
-From: Violet Purcell <vimproved@inventati.org>
-Date: Mon, 8 May 2023 04:17:07 +0000
-Subject: [PATCH] musl 1.2.4 LFS64 removal fixes
-
----
- tools/chacl.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/chacl.c b/tools/chacl.c
-index 525a7ff..8fff875 100644
---- a/tools/chacl.c
-+++ b/tools/chacl.c
-@@ -320,7 +320,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- {
- 	int failed = 0;
- 	DIR *dir;
--	struct dirent64 *d;
-+	struct dirent *d;
- 	char *name;
- 
- 	if ((dir = opendir(fname)) == NULL) {
-@@ -332,7 +332,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- 		return(0);	/* got a file, not an error */
- 	}
- 
--	while ((d = readdir64(dir)) != NULL) {
-+	while ((d = readdir(dir)) != NULL) {
- 		/* skip "." and ".." entries */
- 		if (strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0)
- 			continue;
--- 
-2.40.1
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
index 87c9ffc987..9ddd2afea1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
@@ -7,5 +7,5 @@ DIST coreutils-9.5.tar.xz.sig 833 BLAKE2B 37c29984bceee0ff3bffde76712f71dbb118c2
 DIST coreutils-9.6-patches.tar.xz 5904 BLAKE2B 1abe214914007804362b9d7c1a7c39f07d74c51857e84484179f11bb8fa512356ee97c811ef62469aaa52db5cc90f2f7587c2dc57ed130ebbfdacc59755dcb90 SHA512 5a609b21da7c78e41184e5d7bca87da4f868975635b6e8aa4bd8f4d18c98a2fabd5b7e8ad6bf7780ca77f6d532bfa5cb1ed618e4bc32617ba2977d4b8a885b9f
 DIST coreutils-9.6.tar.xz 6134764 BLAKE2B 4070d3d272851d3e9c326df9c05ce67797d86852e7f5c26e545f987f444295f2cfca24e8569514d7b5edf8fd50318d07cb20dea4a4ce8c65b34bea0c5a9177be SHA512 398391d7f9d77e6117b750abb8711eebdd9cd2549e7846cab26884fb2dd522b6bcfb8bf7fef35a12683e213ada7f89b817bf615628628d42aee3fa3102647b28
 DIST coreutils-9.6.tar.xz.sig 833 BLAKE2B a9ea9773746d21b526e69ca2ff7637f3dcef4a921da943f281c4d16fed2d8f9eff92353e1ceafbbc8cfe4b9b23bf123bf64dcd79ff598759373c50739a5046c6 SHA512 a8e578b5e1d053b49e3e2c5dc94431d17c6a14662f459b2174cea23865ccca32e5ae5c13fedb0a8345d25269a9b98cb7f463a897c9663f9f9bcaf61e5c781378
-DIST coreutils-9.6_p20250406.tar.xz 6153440 BLAKE2B 39a7008ce18f88a67188b7d687cb5a7e6ec973c6894c55b8968a1ba48660354f754ff0a8a1887cfc991ac1bd7bc74ad4a2ed457420ca427baabea6686599c66f SHA512 833ed305150c80469d9e8d8c21841d6ff08571b42b067a6f3e3f2c23395051389a62632dd16f752508fb8ca9c095f0c783cf87d6e12c1fc63093d4f5aade5984
-DIST coreutils-9.6_p20250406.tar.xz.sig 833 BLAKE2B 87a3626126ec4e34d874630fccf5785cb38a60457100f0ebade9a5a07163d77788425814c683a61d6661e67f7ce0e3f1e5309342c7d5280fdcc66cdb82c5f224 SHA512 fa39eeb7bf0cbe140346ef9280ee43aea7ac6c2f9e440c27d9f27f04e35dbcea8648ce03d9a29589aa10af08ea55e6821b8b1870cd9260dc20a73a8b3af4dddf
+DIST coreutils-9.7.tar.xz 6158960 BLAKE2B e5e5f7ec26c3952eb6a25988f78d3a1f8a70cf97a2fbc7b433dfcd1721cd38e6e0a8b9cb83f854a22df325bcb5ea8c4534c5a217273762cd5d575b381db69ee8 SHA512 fe81e6ba4fb492095153d5baac1eca8f07ece0957849de746a2a858cf007893cc2ded595a31a5e5d43d13216cc44b9d74a3245d9f23221ecc8cd00f428f27414
+DIST coreutils-9.7.tar.xz.sig 833 BLAKE2B 18dee5a1b5dc1811b277748fe6ee079dc6320bc6d67e01f108415c6afe21ad0367ece46f8c6dfb0976b1e5f62ae15c2d61fba916ea232c71a1b2f66c81b983bf SHA512 48d86a19cee3c153f01f7478847f4621685c02e59942540bb20b30e314df05230817b87d0e73acd953e79fab35718e5bea57f25fe511a2c275a85ced4b317bae
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6.ebuild
index 1354868018..1453609a69 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6.ebuild
@@ -33,7 +33,7 @@ else
 		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
 	"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
 fi
 
 SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6_p20250406.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6_p20250406.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.7.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
index f36947282a..42aab71d21 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
@@ -1,6 +1,6 @@
 DIST diffutils-3.10.tar.xz 1624240 BLAKE2B 24a90162b3d876e6378243f19a85a1f1bb4cdfe98d130dee684740a902f2987509d5830dd32df4e26678b468b96960f6f9785ffb922e828cb8b4acce0d8587f6 SHA512 219d2c815a120690c6589846271e43aee5c96c61a7ee4abbef97dfcdb3d6416652ed494b417de0ab6688c4322540d48be63b5e617beb6d20530b5d55d723ccbb
 DIST diffutils-3.10.tar.xz.sig 833 BLAKE2B 06650838d6a3327fda6b2ab09693170ec18b730b1f5981c8f3e2180b2c8a553307ae93199e4be0532a534a8a3f95e4a7b4fccbbd9e5f8d1b1cedd0816b0aac90 SHA512 91aa1fcfca224454e292540ea7813f4a0eb348f06a4374017326d524949775359fc833de597cc201c97f357eb6c675800828a6e3332572376f3554f1f2e1aca1
-DIST diffutils-3.11.11-7e53.tar.xz 1937668 BLAKE2B 16ac12d27c68efeb2b01e35e7ff8a98d081f1d67f72688c20d65067730eca6f8d3759bff3dd5fde04c8994ac9e93e685ffb4da4419b7a29f03c778fcb0cb607f SHA512 a99b6105e8d856626cb7f03847a5340b5cccfa951bc332af39f470f1cf75ed73b6bd8da035905f83add0c054a6d8232c1098673a8087974e6aa4acfc1cf669a1
-DIST diffutils-3.11.11-7e53.tar.xz.sig 833 BLAKE2B 9bbc84b91cd89335891bd522a036820f602a43bb268944c899944ecb67288c84938f71598d0b2ffb43cab3fce11c96f70b72bfab0617845f367b01c608e24152 SHA512 6a4ac048828e5bd2ca58d251b2fa8c502540aa08fb04dce2b77f3a4b99388312816c9925e976118cd5bd5d6d3cac12a92c89dd17d709d48a39c30aefe84e824d
 DIST diffutils-3.11.tar.xz 1926052 BLAKE2B e3d78548d1fbee060a9e0a7ee93f4aebaa80a9ff15867f13e2f1d09672e2b1e8dcf01f264d5184c441bc81b0b1a797210cbf4a1f9b8ba061994066e710e79fc1 SHA512 a381ee6bcbbead155ab6ea1aecc167ab1077c6d95133a876e26284b60bcaae26f01c62eaee400c86302b74fa8ab0c5239b7860ea86478b739ddc304367a35960
 DIST diffutils-3.11.tar.xz.sig 833 BLAKE2B 5b7f8d8b0ec2f1443270f9291acfd6ec7833268c5287d98225fb997efcfbbbec2e27f565226ae7d350576765689d7efd352b83c5a3ffca113963d9ec86b6a467 SHA512 81ac0cff6b9015758182e41688df70244f1ceac77835e0b06cb2c6c8ca89d93d1567010fed9b216bd65ebde8fcb89f162cc3112aa01f05b5b05f4a26f6fe69d7
+DIST diffutils-3.12.tar.xz 1938800 BLAKE2B 5b4593b39da71578d7f975603abe9359be215b9ac76548a6ab0d6e3838bb103c7ffcddf7fa01abcd5c6289db9a2f16b43aa3d5e846a9aa4b8db866763c2660de SHA512 10b17cf1dcdfa9ca0e5db91d62c4a079ebe9fd7eafa3aaebd4eb7e6206e4d753f348496622aa281e1bd7f7fcde65ce4a886dcc4acbb59332ef980f224197b4e4
+DIST diffutils-3.12.tar.xz.sig 833 BLAKE2B 611b56a88b950e8dcd803dac082b42c3a516c90e62ff979b73b1e6d078e55328e9861ff630c98755426e9b7793d9ada7eee3ede1ab23ebaecd3f861ce879ccf5 SHA512 8eb59b40156741fbfcac947f29f76aa0eefb9c8f819206cab9474da0ffe0154c6aa8b38435eccdd82ceb8c3565a6c548e8d2a0f771f1e8e1af15635854ec9c62
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.11_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.11_p20250405.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.12.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
index 7ba806bc61..c7ad266e6b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
@@ -1,6 +1,4 @@
-DIST grep-3.11.68-05f8.tar.xz 1917200 BLAKE2B 9e2f71c716410afa66d94e90dd2efc0a0666495b0bd4c0e0e29f7ef13aaf815e24901d74d9608b8fae3cba8487121946d2aec36a37513e65dc66080951a2855f SHA512 c449cd9ecf2fd35ede9521d707bfb9be13bad8368244c277dde9ae1ad39205eb4445e726b0775d60d9c56ad3d0af2d3136869d6199a71aec7486c40df34f30e6
-DIST grep-3.11.68-05f8.tar.xz.sig 833 BLAKE2B 75ac09556bfbf3d102c648331f2b2ec9854df6ffc4dbb677856d2b915db2357039ee13bc9fdd5e330183148695e4a3f20ef92c1712308861af189d281268be64 SHA512 fa6773f4088c6523fd697fdfa001c47e0b8d3b4d3f1ba23a8213cf15b9aa9aa928c09755aa6269bc8121c567f57fe9f6d823714f479b99882c0e7075b479ef18
-DIST grep-3.11.69-a4628.tar.xz 1917544 BLAKE2B 575ea74c3a84f75c17b5dd39e0ada56cd559ca09f566c3d5163aec31d5b70720569b739251c8b7ce5b813819893b4bfb170dc70a93b7abab7a4c5648e179cff9 SHA512 280804275b4aacf72a6d50894d0024d1455375d2bb0550ce20211f9d66da6b0e942ea6186447e38b27fc5861e177b86f657c24477fce4a4a797e2b0dcf34e9f9
-DIST grep-3.11.69-a4628.tar.xz.sig 833 BLAKE2B f9fe9425ea8d5e304678618d3d9668ee21f5ef159714e4b35b486d2420b33480b55bdae779504bd3103f27957ffceaa0e8f109f5c779608ab59da57c68a8f6dd SHA512 45db55b8f172d672513d8703ad5ff777818ba71e216ce018aa86aa4059aaf2450cb26ae8144039c39e3fa41563d7b0707a77a3344feadf369d648f244c048ca2
 DIST grep-3.11.tar.xz 1703776 BLAKE2B e21785bca20b5a090d32bb5dc525fb298af30165106ed4c289b1518ea3d2acdcacfd6309b12f13be29a4b958f19588546119c695deb2b7500d49dcff86357bdc SHA512 f254a1905a08c8173e12fbdd4fd8baed9a200217fba9d7641f0d78e4e002c1f2a621152d67027d9b25f0bb2430898f5233dc70909d8464fd13d7dd9298e65c42
 DIST grep-3.11.tar.xz.sig 833 BLAKE2B 5edfba20e3a9f54d25ae63cf04985382bf6afb0ca643979561321090614e68b5d234767b07e48211888722c52c441233093735e183ff69432d5ee2e6a4f53aea SHA512 487aba063373ca0594c519991f19b2a6a33b3da0d74735c890f3828fd0880e7e6f64495d2c8f9efa5da53d1eb2d446609bab2399a4b89dcb4510a632e31ffb54
+DIST grep-3.12.tar.xz 1918448 BLAKE2B 93d06bce04793f4b4c94d92febc6092f669e50e1bfc1bef3c911a2ca322560bdab8619e88a05a4d6ea4908b2d01da1926a99a22eecc513bd48b8957984bdfa12 SHA512 c54b4db5a8b9afe098c088decd94977746305284d716666a60bac82b4edc0fae4acf828970b5b6fc7d58ecd549f638e17e6958f33a71fedcc7d7415b9228b161
+DIST grep-3.12.tar.xz.sig 833 BLAKE2B f9b3b4f89e15b8b66f91d89fc25322bd9f4a9207fbff5e5e35dd7a0edf84c48a555ed3d1f8f53dd996c347e784b4fe9366bdc47e74cf445cbe7e4430b2bd2524 SHA512 333755fd9e5879436789a19e9593667d6fb96c2d1b876a1c391eb9cd75d10bb7fbc10215db9838280e6006790c818ef4583b1ae22318a833a5b69264ca15dbf1
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild
deleted file mode 100644
index 27efce25ff..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild
+++ /dev/null
@@ -1,118 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/grep.asc
-inherit flag-o-matic verify-sig
-
-DESCRIPTION="GNU regular expression matcher"
-HOMEPAGE="https://www.gnu.org/software/grep/"
-
-if [[ ${PV} == *_p* ]] ; then
-	# Subscribe to the 'platform-testers' ML to find these.
-	# Useful to test on our especially more niche arches and report issues upstream.
-	MY_COMMIT="68-05f8"
-	MY_P=${PN}-$(ver_cut 1-2).${MY_COMMIT}
-	SRC_URI="https://meyering.net/${PN}/${MY_P}.tar.xz"
-	SRC_URI+=" verify-sig? ( https://meyering.net/${PN}/${MY_P}.tar.xz.sig )"
-	S="${WORKDIR}"/${MY_P}
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-3+"
-SLOT="0"
-IUSE="+egrep-fgrep nls pcre static"
-
-# We lack dev-libs/libsigsegv[static-libs] for now
-REQUIRED_USE="static? ( !sparc )"
-
-LIB_DEPEND="
-	pcre? ( >=dev-libs/libpcre2-10.42-r1[static-libs(+)] )
-	sparc? ( dev-libs/libsigsegv )
-"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	nls? ( virtual/libintl )
-	virtual/libiconv
-"
-DEPEND="
-	${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-"
-BDEPEND="
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-grep )
-"
-
-DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
-
-QA_CONFIG_IMPL_DECL_SKIP=(
-	# Either gnulib FPs or fixed in newer autoconf, not worth autoreconf here for now?
-	MIN
-	alignof
-	static_assert
-)
-
-src_prepare() {
-	default
-
-	# bug #523898
-	sed -i \
-		-e "s:@SHELL@:${EPREFIX}/bin/sh:g" \
-		-e "s:@grep@:${EPREFIX}/bin/grep:" \
-		src/egrep.sh || die
-
-	# Drop when grep-3.11-100k-files-dir.patch is gone
-	#touch aclocal.m4 config.hin configure {,doc/,gnulib-tests/,lib/,src/,tests/}Makefile.in || die
-}
-
-src_configure() {
-	use static && append-ldflags -static
-
-	# We used to turn this off unconditionally (bug #673524) but we now
-	# allow it for cases where libsigsegv is better for userspace handling
-	# of stack overflows.
-	# In particular, it's necessary for sparc: bug #768135
-	export ac_cv_libsigsegv=$(usex sparc)
-
-	local myeconfargs=(
-		--bindir="${EPREFIX}"/bin
-		$(use_enable nls)
-		$(use_enable pcre perl-regexp)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	if use egrep-fgrep ; then
-		# Delete the upstream wrapper variants which warn on egrep+fgrep use
-		rm "${ED}"/bin/{egrep,fgrep} || die
-
-		into /
-		# Install egrep, fgrep which don't warn.
-		#
-		# We do this by default to avoid breakage in old scripts
-		# and such which don't expect unexpected output on stderr,
-		# we've had examples of builds failing because foo-config
-		# starts returning a warning.
-		#
-		# https://lists.gnu.org/archive/html/bug-grep/2022-10/msg00000.html
-		newbin - egrep <<-EOF
-		#!/usr/bin/env sh
-		exec "${EPREFIX}/bin/grep" -E "\$@"
-		EOF
-
-		newbin - fgrep <<-EOF
-		#!/usr/bin/env sh
-		exec "${EPREFIX}/bin/grep" -F "\$@"
-		EOF
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250407.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250407.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.12.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild
index 286b0dd423..80f84453bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 DESCRIPTION="kernel routing and traffic control utilities"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
index b45cb339c1..30d064ebe9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
@@ -1,3 +1,4 @@
 DIST portage-3.0.65.tar.bz2 1193321 BLAKE2B 4734b0a2b17cf0cdbd0bedac9efa6cecb5799460e1faa8b8ab137fa017e17d47d6d5da6382e75322f21d4be77a31acffbacd753c70b43b011613cc5a6332bc96 SHA512 c864bcb3bef11916128852a5f50b161d82529d7316ec970703a9ec948c46a51148419ef1dfde2906f72347dd41d0eebd49f5a1769a228d97145f5517c34dbff8
 DIST portage-3.0.66.1.tar.bz2 1198196 BLAKE2B 8dbd1bc17c1a9a3530425efa31a27efba39e1ef5f5457b4084875c64f7128453139aea447c25a642c124438e88ef484a43b1838cbd8c03748017571dd18f9921 SHA512 fcd3d4d3dcfdb67cbcdb0f4854860f073b4a9d41dadc97a3e6f890e3c75091aceec5622e97495741622b5c390309f05dec35b9e951d7ee7a78e28a9b3ed2939d
 DIST portage-3.0.67.tar.bz2 1196776 BLAKE2B 4a9056d388b012a0fa343d6fc50c9c3b455cb3a4d356210accf86c4ff4434a2d8cb4d23c3f58f3e23ab8bb4a4e9ee244bd1ec1203d5f72fa6f0e0a2caa92e757 SHA512 e725a471dcadaac771aa7f910524232e237efbb944d3e175825ad659b5190d631a91d4c188089c278a79b4709d4a8d6a6e53c55524c4b1c8d1c43580506e0d1c
+DIST portage-3.0.68.tar.bz2 1198758 BLAKE2B fbe3a14babbe5687d075c7e691027d04e7a34a35c3199c981e176bae365242e1dc7d4122f2d7a385444798b9413c415ca40801825a9dd9c99c3590efca8087e6 SHA512 4ed6d0945ad94ee19260996dd2ba9fa5e013560a50de887eb7e8df87a3649552316cbc62ee8ef9b4a025d9d98fb74e85ee7734b7a8fe7416450b8d6818fdcfab
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.68.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.68.ebuild
new file mode 100644
index 0000000000..544100bf1b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.68.ebuild
@@ -0,0 +1,231 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit meson linux-info python-r1 tmpfiles
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/portage.git
+		https://github.com/gentoo/portage.git
+	"
+	inherit git-r3
+else
+	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.27
+	>=dev-build/meson-1.3.0-r1
+	>=sys-apps/sed-4.0.5
+	sys-devel/patch
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+	doc? (
+		~app-text/docbook-xml-dtd-4.4
+		app-text/xmlto
+	)
+	test? (
+		dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+RDEPEND="
+	${PYTHON_DEPS}
+	acct-user/portage
+	>=app-arch/tar-1.27
+	app-arch/zstd
+	>=app-misc/pax-utils-0.1.17
+	dev-lang/python-exec:2
+	>=sys-apps/baselayout-2.9
+	>=sys-apps/findutils-4.9
+	!build? (
+		>=app-admin/eselect-1.2
+		app-portage/getuto
+		>=app-shells/bash-5.0:0
+		>=sec-keys/openpgp-keys-gentoo-release-20240703
+		>=sys-apps/sed-4.0.5
+		rsync-verify? (
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		>=sys-apps/coreutils-6.4
+		>=sys-apps/file-5.44-r3
+	)
+"
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	check_extra_config
+}
+
+src_prepare() {
+	default
+
+	if use prefix-guest; then
+		sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+			-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+			-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+}
+
+src_configure() {
+	local code_only=false
+	python_foreach_impl my_src_configure
+}
+
+my_src_configure() {
+	local emesonargs=(
+		-Dcode-only=${code_only}
+		-Deprefix="${EPREFIX}"
+		-Dportage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}"
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		$(meson_use doc)
+		$(meson_use apidoc)
+		$(meson_use gentoo-dev)
+		$(meson_use ipc)
+		$(meson_use xattr)
+	)
+
+	if use native-extensions && [[ "${EPYTHON}" != pypy3* ]] ; then
+		emesonargs+=( -Dnative-extensions=true )
+	else
+		emesonargs+=( -Dnative-extensions=false )
+	fi
+
+	if use build; then
+		emesonargs+=( -Drsync-verify=false )
+	else
+		emesonargs+=( $(meson_use rsync-verify) )
+	fi
+
+	meson_src_configure
+	code_only=true
+}
+
+src_compile() {
+	python_foreach_impl meson_src_compile
+}
+
+src_test() {
+	local EPYTEST_XDIST=1
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	python_foreach_impl epytest
+}
+
+src_install() {
+	python_foreach_impl my_src_install
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	local scripts
+	mapfile -t scripts < <(awk '/^#!.*python/ {print FILENAME} {nextfile}' "${ED}"/usr/{bin,sbin}/* || die)
+	python_replicate_script "${scripts[@]}"
+}
+
+my_src_install() {
+	local pydirs=(
+		"${D}$(python_get_sitedir)"
+		"${ED}/usr/lib/portage/${EPYTHON}"
+	)
+
+	meson_src_install
+	python_fix_shebang "${pydirs[@]}"
+	python_optimize "${pydirs[@]}"
+}
+
+pkg_preinst() {
+	if ! use build && [[ -z ${ROOT} ]]; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			ED="${ED}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			ED="${ED}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			ED="${ED}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+
+		env -u BINPKG_FORMAT \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			ED="${ED}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_format || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
index 947cf2d6c1..d52445c85f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-9999.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 LICENSE="GPL-2"
@@ -124,7 +124,7 @@ my_src_configure() {
 		$(meson_use xattr)
 	)
 
-	if use native-extensions && [[ "${EPYTHON}" != "pypy3" ]] ; then
+	if use native-extensions && [[ "${EPYTHON}" != pypy3* ]] ; then
 		emesonargs+=( -Dnative-extensions=true )
 	else
 		emesonargs+=( -Dnative-extensions=false )
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.31.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.31.ebuild
index 9bc35e6c9a..b0670b0fc0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.31.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.9.31.ebuild
@@ -18,7 +18,7 @@ else
 		verify-sig? ( https://www.ivarch.com/programs/sources/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
 	"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
index 359fd20db6..0959455cd0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
@@ -2,3 +2,4 @@ DIST crossdev-20240921.tar.xz 31008 BLAKE2B 9daeabcbeefa32624d71b86c5ddeb1f6bf6c
 DIST crossdev-20241202.tar.xz 33032 BLAKE2B 74ec859e1ae5f816397349c18f8bd98d8fae2f4de471112d70621767733a6c91dfffaabb33afc4bdabf5bed31b83a0cdf8afaffaba3e0df95f70d43cf249fb94 SHA512 c6a8c534135aa15b2005546d3f006953570de1e54ae3d3170c71bed62f044c2db79412ecde3b91fd85fca92e7c996762ba086db29c6132f6f1d9e9a48f1e79ea
 DIST crossdev-20241215.tar.xz 33028 BLAKE2B 3b33284f55fe41a45bfeea1dbc273a828eeceada38d4274f9fcaab06a1d9b342efaa0fcad407bb5a5d921515acc18dac0e4923240e2610a425f7c508b6274ecd SHA512 84960b518767aacc7400cfa32d36b15492dd5e3908c36c0f513470fdfbaedde04d24aecaf0f5020bf69cd7c2095da1cc2961ae090e90340a176292299bbfaf25
 DIST crossdev-20250106.tar.xz 33124 BLAKE2B 45992cd29a6dd48f97d871ba5f4b09b18797c76389a5839c7b02e23b765556561f9b442d594a6bed58ff670e69d4efc27f37cdb1f6bb1722fd1d18e0bc50cc5f SHA512 8d9cdb194f3477dcbe605c4f8126be013e9193acb716e2b12e8f51f826087bbac3f50b44268c150d4e9f86b78182a0b4b323634b0040f0a815dc4a075c662c75
+DIST crossdev-20250410.tar.xz 33292 BLAKE2B b4c41757ff705866fb3c7420e10d1325977937c50801600002639984dd39b90ebf4fadbde5a09bae02eba2ca17261db32f5275b1599858b2b7c961e3eb85d82f SHA512 aa6c1657d23c96b6109e49ac517dd9550d731f0af508359be55fa8c641675bd4205223eb492e7c94fd69dd86999124d7d0f4766cf1bc17a3dd953f457bf85c9b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
new file mode 100644
index 0000000000..7c9eb35f4b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20250410.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+if [[ ${PV} == "99999999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/crossdev.git
+		https://github.com/gentoo/crossdev
+	"
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Gentoo Cross-toolchain generator"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Crossdev"
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=sys-apps/portage-2.1
+	app-shells/bash
+	sys-apps/gentoo-functions
+	sys-apps/config-site
+"
+BDEPEND="app-arch/xz-utils"
+
+src_install() {
+	default
+
+	if [[ ${PV} == "99999999" ]] ; then
+		sed -i "s:@CDEVPV@:${EGIT_VERSION}:" "${ED}"/usr/bin/crossdev || die
+	else
+		sed -i "s:@CDEVPV@:${PV}:" "${ED}"/usr/bin/crossdev || die
+	fi
+
+	dodir /usr/share/config.site.d
+	mv "${ED}"/usr/share/config.site{,.d/80crossdev.conf} || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
index e90b93fce0..7c9eb35f4b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-99999999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
@@ -33,6 +33,8 @@ src_install() {
 
 	if [[ ${PV} == "99999999" ]] ; then
 		sed -i "s:@CDEVPV@:${EGIT_VERSION}:" "${ED}"/usr/bin/crossdev || die
+	else
+		sed -i "s:@CDEVPV@:${PV}:" "${ED}"/usr/bin/crossdev || die
 	fi
 
 	dodir /usr/share/config.site.d
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 5dc9b00c73..2be4ecfdcb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -9,6 +9,7 @@ DIST gcc-12-20250227.tar.xz 79915940 BLAKE2B 0adb19847cb3f317316549f657434654b99
 DIST gcc-12-20250320.tar.xz 79921688 BLAKE2B cafdd710d1bf04083f8db4cce873667caded67961b701760f95e95f76ad98924582b51752061fe404e2e7f6dbab4215e0fe5c4436826ac320d9bd224ae7a061c SHA512 1dc331f1a942c4a10ae56fc234bcc37c72dd720df1cb9e1aa1802092307378abffd83b887b718a8f8d11c16296c0a7aa53011a7358aea86c8e60522d8f50e76d
 DIST gcc-12-20250327.tar.xz 79923680 BLAKE2B 7bbe5a736f42ad9e04740b6c8adcb06ae8bd405e32b4f45897c76c15eb24428a55827f2ba715456c48a906d02693b42b280f8b73e61926d05c4c99316de4a4b3 SHA512 8cf3aced94a42635b68f7a0f57e831d09718d1674272ee9134c1419a81a2b6f7d056f156ff3b0c5565c098eb62334d318a1320a268e6713a3c64ac59c5ad910a
 DIST gcc-12-20250403.tar.xz 79905284 BLAKE2B 768f10e1dd000f0f409552ad73198df6eb9c8f7f5950b9e0995700e76a71dfc7732d2ae176807f1410d48191bc457bca895bc3142ba8166c3225b264e204c2bc SHA512 c2df1232658a7a58def2ebdb991f09487b5badf8ab1fbd265308fabf54e329acd7307971861ac143271fef5a6ce93791ea4278faad7e960419072abe5f4a9984
+DIST gcc-12-20250410.tar.xz 79914700 BLAKE2B 06dab76008cdebc974ba8e72fb99ffc5f4a875a77b2b0c487e1a9e9fc877f29b86ccb859f1e421297312b4f0831ce4b5ef686da31985fd94b8f0356547498cdb SHA512 ae55bf088a02819e5e116ee0afead1fdcd1aab8b6301a08a14df278eb733f9745e7d91cd121177302b4d61d5a62d3efde08cc49a05d00203dcd42387fc4ba154
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0-patches-2.tar.xz 14876 BLAKE2B 6bf5abbb2abba4b9fe9fa153ac4112fe5f563e97cd4e1b885ccd0d88abf1124fa91f20d6be972e2242410447be73bca60014785f8551b8087ed0d4cc3e868225 SHA512 dfd5f02d4c1076fad4ee998b2f620171dd3eb65a1160312def9dae89b18327a06db853f569e0e3c049e5ab06c61488bb6faecec52bafe737fddeb43628c54a1f
@@ -19,6 +20,7 @@ DIST gcc-13-20250301.tar.xz 84525780 BLAKE2B c366f4de63b7956abb1bf2d1039acdf90c7
 DIST gcc-13-20250321.tar.xz 84515248 BLAKE2B b07d6f518bf2d32ad17b3c169ddb782dfe4de5efb157e2d4b8b2eb00f68f50b9250ba9e873b4dee269506740330176d98b1160d754ca6c714e1d6c76358c6493 SHA512 16a2acce5b2900749b7100a445ae387b03504a6e2319f76cd0a8a1d67eae8c04493f845f63e4e040d8fecba9123105d8b9fed433220e1fa6abc87448180dccd8
 DIST gcc-13-20250328.tar.xz 84532580 BLAKE2B e518053fd44461632560334c536ca29a3510493147bffba3906c3a9f2f08f4a124bd50132a0f2b82eb8a783fa3de58c5a41507c4558fd701d0cb9e2667526ad5 SHA512 277348fff14e1c44d32ffa717c9b2496fbf2975b95a237256a2c8585bbdba6b833b7212b0d9c59c3b430ebc98fe2866fe07e6acc429b09c0087e72da631f5ad3
 DIST gcc-13-20250404.tar.xz 84527280 BLAKE2B 1cd4592ccd2f0e6a712f74f5e7aa57f4b7cece92eb02cbb6049a11567a345589ee7993b81d2d9dc7b5cc1af8fe1d4350e3969377f4f389878d19eca7bf9520bc SHA512 7511736852972cae3578973ad11941cb9f758aea10e0b49cf4d67302bf0e4ad2c7b7ed4663e3d4c17ad6e350742b182652f8bfeb502134bf2e2b0d758037f0a9
+DIST gcc-13-20250411.tar.xz 84527868 BLAKE2B 1a3ea6a3ff4cf8cb0185e51fc9f8745a5216505e757bf80d4f6fff6edb25399f4fc3cfa60697ec71b27b27526753f897757c4d149dd2ff096dd5559b32b787d9 SHA512 fb452eabc0308e90dbbdac67b7f7a46e6d43932060926a81b05384cec0cf138ccda996b7b90ab6d89174e7b046cf0c8596efe6c66dbda42dd5c1c6d830eab2c7
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
@@ -28,12 +30,15 @@ DIST gcc-14-20250301.tar.xz 88230928 BLAKE2B 2b65e7cccbf431a74df73adac53995873e7
 DIST gcc-14-20250322.tar.xz 88221060 BLAKE2B c8ec3dcbaaed1ee9a8d35f866a21879192a10707600a9ffa10c9a958de84e0fec3f8bd93950a5cdd53f2e4d9fcc74b45c4416a357eb271e70b314bd339da4818 SHA512 860049792547bfc21c4f61f1648056510495f16e97ea47444d02a740e60bfea1870d3ff437548854681e94fb2e7099a186526a6acecb02df7753e0f5661f6d30
 DIST gcc-14-20250329.tar.xz 88223376 BLAKE2B 024343e0307d8cc18efe326a137f599c25304346e23ba2a501e7a414c7c96891cd339ac5f82c9b6b1f8bfa0101734aafc3580d8577405d8f18d0c809f5d1b2d2 SHA512 ae86076dee09826ef3bed6ae927c757205ea48c9fcef59c61a74a3ca31117797a958ba2307cdee785f2c2bbccd87dd93316a0e3415f0e81bf2712d6abebcdef3
 DIST gcc-14-20250405.tar.xz 88235744 BLAKE2B 8de5bb1e182391c20b887b84da2ef04aab01bfd8f50d0a0fdca107fde89059f492d2920604ce7680be66f0aca319ed3fbb79f671e3d89b8fda0d33f447074210 SHA512 ba12a47dd3c2f3af4def7d582241b450e1e6ca9e8585839089401bf00dedfb93020bfd8a05ecb1a120491d664208c319f7ae2f763fb49c764492efe6a109cf92
+DIST gcc-14-20250412.tar.xz 88240916 BLAKE2B 775e364f4709858507cb8ef6a365a9ebc05dc523a261b70141e53931eb84a2f260b2b91d5fe85b73ae5403687959bd6fd83b3351af1a8f76cffeb5518069bec1 SHA512 193476123bd6a635a1cc1c19b85520f796138ebf85d61632606bfb8cfe4eb32945524932c35e2e13b510a874286febf2772f5f850cf1834be1e239c8c3335afb
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-7.tar.xz 14244 BLAKE2B 11236e91e1fe83fec8ffaa40ec0cdd4b52a00a951e9aa9a7a0a932b234b8f1a9603333a7ccf55859f4ef53dd4d8ad1fd5c1d2514b6e45fce5b86bb58622a0ecc SHA512 5a4d86d943e31fa068b5a784c0132bd83c23243dcb3cf972557a42e004469a415e1b3185f31b1bb36f916594d475f266a2fda031a414e4a15e0bbfe471269eee
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
 DIST gcc-15-20250406.tar.xz 91871244 BLAKE2B d9b4f8b382c5755f62e5f8b89deac74fdbe177e3961c205bba1d887c2157486908b85e80e0171e4d1ed6233d0cd8704af89850a3d2f6dcf0c6e703aa27b23fd9 SHA512 3a4b135833660107b6d3129570a24b3977e7da0f85296d663cfa8949eb8b2bd97237086535b1ff3eaf6423afcf799d18f21aaadc4fcc35835dca2f10cc154c7c
+DIST gcc-15-20250413.tar.xz 91915660 BLAKE2B 80b2ad128d4bdbf3abf2295abfe452c1a1b1d831d73715e8d99d625dd0ec8e1293198fb0cbe7a04920eeb4ec88ce147d1120d297430cd6321e72b2c7948bcb08 SHA512 6b9b5bd62dd9624d8b49fe001f057cfa87a59c01064de108f4f24224849f19bb3fbfe4d7f70ee57cc7db88c41741cb5f49100402f88bbbe5fa1d07f50d4dc7aa
 DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
 DIST gcc-15.0.0-patches-53.tar.xz 27892 BLAKE2B 0c1455cae4aee49051fb5a8c31b8f82765da8ad9509ef17cb8c9f96d2c53a73fe1c8cfc0a2708e3bce0f8deb6f5e16807d8739bfd06cc6c08788331a719ded73 SHA512 c8f375f4de882ba99872f649f2cbbcc1b9f89d3dc9b355c1d11abfb6daf3ae7e89b82e002497215b641175d42d9f9a94749add2af2a5b6bcc1f3f5b41320df5b
+DIST gcc-15.0.0-patches-54.tar.xz 20764 BLAKE2B fdd746b5243858d940e67f3dc11e085f370244c890e35b3f0b1b4af4f978ec98b5204b9874e9defd422f508262060e0b489ef85f5ba9b2296af371a7ed879bd5 SHA512 ecf38b4637c30ee7a0f74c73c55a3ba2d193d39e82e4bfe058494a5d125596bef547ea70ce52bf109cdec4aa31c3ed8c2b32ae52a9d9827be2b10e8fe0875e82
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-compare-debug.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-compare-debug.patch
new file mode 100644
index 0000000000..5fd89cd8e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-compare-debug.patch
@@ -0,0 +1,88 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=088887de7717a22b1503760e9b79dfbe22a0f428
+
+From 088887de7717a22b1503760e9b79dfbe22a0f428 Mon Sep 17 00:00:00 2001
+From: Richard Biener <rguenther@suse.de>
+Date: Wed, 9 Apr 2025 14:36:19 +0200
+Subject: [PATCH] rtl-optimization/119689 - compare-debug failure with LRA
+
+The previous change to fix LRA rematerialization broke compare-debug
+for i586 bootstrap.  Fixed by using prev_nonnote_nondebug_insn
+instead of prev_nonnote_insn.
+
+	PR rtl-optimization/119689
+	PR rtl-optimization/115568
+	* lra-remat.cc (create_cands): Use prev_nonnote_nondebug_insn
+	to check whether insn2 is directly before insn.
+
+	* g++.target/i386/pr119689.C: New testcase.
+---
+ gcc/lra-remat.cc                         |  2 +-
+ gcc/testsuite/g++.target/i386/pr119689.C | 44 ++++++++++++++++++++++++
+ 2 files changed, 45 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/g++.target/i386/pr119689.C
+
+diff --git a/gcc/lra-remat.cc b/gcc/lra-remat.cc
+index 2f3afffcf5be..5f823193aa73 100644
+--- a/gcc/lra-remat.cc
++++ b/gcc/lra-remat.cc
+@@ -460,7 +460,7 @@ create_cands (void)
+ 		&& dst_regno >= FIRST_PSEUDO_REGISTER
+ 		&& reg_renumber[dst_regno] < 0
+ 		&& BLOCK_FOR_INSN (insn2) == BLOCK_FOR_INSN (insn)
+-		&& insn2 == prev_nonnote_insn (insn))
++		&& insn2 == prev_nonnote_nondebug_insn (insn))
+ 	      {
+ 		create_cand (insn2, regno_potential_cand[src_regno].nop,
+ 			     dst_regno, insn);
+diff --git a/gcc/testsuite/g++.target/i386/pr119689.C b/gcc/testsuite/g++.target/i386/pr119689.C
+new file mode 100644
+index 000000000000..cdc6d2dade53
+--- /dev/null
++++ b/gcc/testsuite/g++.target/i386/pr119689.C
+@@ -0,0 +1,44 @@
++// { dg-do compile }
++// { dg-options "-O2 -fcompare-debug" }
++// { dg-additional-options "-march=i586 -mtune=generic" { target ia32 } }
++// { dg-additional-options "-fPIC" { target { fpic } } }
++
++enum gimple_code { GIMPLE_ASSIGN, GIMPLE_RETURN };
++bool is_gimple_call();
++int m_sig, m_exp, sreal_new_exp;
++struct sreal {
++  sreal(long long sig) {
++    long long __trans_tmp_6 = sig >= 0 ? sig : -(unsigned long long)sig;
++    sig = __trans_tmp_6 <<= sreal_new_exp -= m_exp = __trans_tmp_6;
++    m_sig = sig;
++  }
++  void operator/(sreal);
++};
++struct ipa_predicate {
++  ipa_predicate(bool = true);
++  void operator&=(ipa_predicate);
++  void operator&(ipa_predicate);
++};
++void add_condition();
++gimple_code eliminated_by_inlining_prob_code;
++static int eliminated_by_inlining_prob() {
++  switch (eliminated_by_inlining_prob_code) {
++  case GIMPLE_RETURN:
++    return 2;
++  case GIMPLE_ASSIGN:
++    return 1;
++  }
++  return 0;
++}
++void fp_expression_p() {
++  ipa_predicate bb_predicate;
++  for (;;) {
++    int prob = eliminated_by_inlining_prob();
++    ipa_predicate sra_predicate;
++    sra_predicate &= add_condition;
++    if (is_gimple_call())
++      sreal(prob) / 2;
++    if (prob != 2)
++      bb_predicate & sra_predicate;
++  }
++}
+-- 
+2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-de-locale.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-de-locale.patch
new file mode 100644
index 0000000000..e0ccde38b9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-de-locale.patch
@@ -0,0 +1,216 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=1f32b87117b0e2ecc33b844d929d723de3fe8085
+
+From 1f32b87117b0e2ecc33b844d929d723de3fe8085 Mon Sep 17 00:00:00 2001
+From: Jakub Jelinek <jakub@redhat.com>
+Date: Thu, 10 Apr 2025 18:39:52 +0200
+Subject: [PATCH] c++: Use G_ instead of _ around cp/errors.cc
+ gcc-internal-format strings [PR119684]
+
+These pp_printf/pp_verbatim format strings should be gcc-internal-format,
+they use the pretty-print.cc format specifier handling rather than libc
+*printf, but pp_printf/pp_verbatim are intentionally not handled through
+exgettext because not everything done through them should be translated
+(e.g. its use for dump files shouldn't be).
+In addition, composing translatable messages from
+"in requirements " and later on "with " might make it harder to be
+translated.
+
+I've verified these strings (at least those which don't use format
+specifiers added post GCC 4.3 which gettext doesn't handle) are properly
+marked as gcc-internal-format in gcc.pot.  The lack of that caused
+ICEs on German translation of the "%s%s%sIn instantiation of %q#D:\n"
+message because it contained too many %s.
+
+2025-04-10  Jakub Jelinek  <jakub@redhat.com>
+
+	PR translation/119684
+	* error.cc (cp_print_error_function): Use G_ instead of _ for
+	pp_printf arguments.
+	(function_category): Use G_ instead of _.
+	(print_instantiation_full_context): Use G_ instead of _ in pp_verbatim
+	arguments.
+	(print_location): Likewise.
+	(print_instantiation_partial_context): Likewise.
+	(maybe_print_constexpr_context): Likewise.
+	(print_constrained_decl_info): Use G_() around pp_verbatim argument.
+	(print_concept_check_info): Likewise.
+	(print_constraint_context_head): Likewise.
+	(print_requires_expression_info): Likewise.  Merge separate pp_verbatim
+	"in requirements " and "with " into one with conditional messages.
+---
+ gcc/cp/error.cc | 59 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 29 insertions(+), 30 deletions(-)
+
+diff --git a/gcc/cp/error.cc b/gcc/cp/error.cc
+index ec7527e96d18..499eb1b15a85 100644
+--- a/gcc/cp/error.cc
++++ b/gcc/cp/error.cc
+@@ -3788,18 +3788,18 @@ cp_print_error_function (diagnostic_text_output_format &text_output,
+ 		    {
+ 		      if (text_output.show_column_p () && s.column != 0)
+ 			pp_printf (pp,
+-				   _("    inlined from %qD at %r%s:%d:%d%R"),
++				   G_("    inlined from %qD at %r%s:%d:%d%R"),
+ 				   fndecl,
+ 				   "locus", s.file, s.line, s.column);
+ 		      else
+ 			pp_printf (pp,
+-				   _("    inlined from %qD at %r%s:%d%R"),
++				   G_("    inlined from %qD at %r%s:%d%R"),
+ 				   fndecl,
+ 				   "locus", s.file, s.line);
+ 
+ 		    }
+ 		  else
+-		    pp_printf (pp, _("    inlined from %qD"),
++		    pp_printf (pp, G_("    inlined from %qD"),
+ 			       fndecl);
+ 		}
+ 	    }
+@@ -3825,22 +3825,22 @@ function_category (tree fn)
+       && DECL_FUNCTION_MEMBER_P (fn))
+     {
+       if (DECL_STATIC_FUNCTION_P (fn))
+-	return _("In static member function %qD");
++	return G_("In static member function %qD");
+       else if (DECL_COPY_CONSTRUCTOR_P (fn))
+-	return _("In copy constructor %qD");
++	return G_("In copy constructor %qD");
+       else if (DECL_CONSTRUCTOR_P (fn))
+-	return _("In constructor %qD");
++	return G_("In constructor %qD");
+       else if (DECL_DESTRUCTOR_P (fn))
+-	return _("In destructor %qD");
++	return G_("In destructor %qD");
+       else if (LAMBDA_FUNCTION_P (fn))
+-	return _("In lambda function");
++	return G_("In lambda function");
+       else if (DECL_XOBJ_MEMBER_FUNCTION_P (fn))
+-	return _("In explicit object member function %qD");
++	return G_("In explicit object member function %qD");
+       else
+-	return _("In member function %qD");
++	return G_("In member function %qD");
+     }
+   else
+-    return _("In function %qD");
++    return G_("In function %qD");
+ }
+ 
+ /* Disable warnings about missing quoting in GCC diagnostics for
+@@ -3867,8 +3867,8 @@ print_instantiation_full_context (diagnostic_text_output_format &text_output)
+       char *indent = text_output.build_indent_prefix (true);
+       pp_verbatim (text_output.get_printer (),
+ 		   p->list_p ()
+-		   ? _("%s%s%sIn substitution of %qS:\n")
+-		   : _("%s%s%sIn instantiation of %q#D:\n"),
++		   ? G_("%s%s%sIn substitution of %qS:\n")
++		   : G_("%s%s%sIn instantiation of %q#D:\n"),
+ 		   indent,
+ 		   show_file ? LOCATION_FILE (location) : "",
+ 		   show_file ? ": " : "",
+@@ -3888,10 +3888,10 @@ print_location (diagnostic_text_output_format &text_output,
+   expanded_location xloc = expand_location (loc);
+   pretty_printer *const pp = text_output.get_printer ();
+   if (text_output.show_column_p ())
+-    pp_verbatim (pp, _("%r%s:%d:%d:%R   "),
++    pp_verbatim (pp, G_("%r%s:%d:%d:%R   "),
+ 		 "locus", xloc.file, xloc.line, xloc.column);
+   else
+-    pp_verbatim (pp, _("%r%s:%d:%R   "),
++    pp_verbatim (pp, G_("%r%s:%d:%R   "),
+ 		 "locus", xloc.file, xloc.line);
+ }
+ 
+@@ -3984,22 +3984,22 @@ print_instantiation_partial_context_line (diagnostic_text_output_format &text_ou
+       if (t->list_p ())
+ 	pp_verbatim (pp,
+ 		     recursive_p
+-		     ? _("recursively required by substitution of %qS\n")
+-		     : _("required by substitution of %qS\n"),
++		     ? G_("recursively required by substitution of %qS\n")
++		     : G_("required by substitution of %qS\n"),
+ 		     t->get_node ());
+       else
+ 	pp_verbatim (pp,
+ 		     recursive_p
+-		     ? _("recursively required from %q#D\n")
+-		     : _("required from %q#D\n"),
++		     ? G_("recursively required from %q#D\n")
++		     : G_("required from %q#D\n"),
+ 		     t->get_node ());
+     }
+   else
+     {
+       pp_verbatim (pp,
+ 		   recursive_p
+-		   ? _("recursively required from here\n")
+-		   : _("required from here\n"));
++		   ? G_("recursively required from here\n")
++		   : G_("required from here\n"));
+     }
+ }
+ 
+@@ -4049,8 +4049,8 @@ print_instantiation_partial_context (diagnostic_text_output_format &text_output,
+ 	{
+ 	  auto_context_line sentinel (text_output, loc);
+ 	  pp_verbatim (text_output.get_printer (),
+-		       _("[ skipping %d instantiation contexts,"
+-			 " use -ftemplate-backtrace-limit=0 to disable ]\n"),
++		       G_("[ skipping %d instantiation contexts,"
++			  " use -ftemplate-backtrace-limit=0 to disable ]\n"),
+ 		       skip);
+ 	  do {
+ 	    loc = t->locus;
+@@ -4101,7 +4101,7 @@ maybe_print_constexpr_context (diagnostic_text_output_format &text_output)
+       pretty_printer *const pp = text_output.get_printer ();
+       auto_context_line sentinel (text_output, EXPR_LOCATION (t));
+       pp_verbatim (pp,
+-		   _("in %<constexpr%> expansion of %qs"),
++		   G_("in %<constexpr%> expansion of %qs"),
+ 		   s);
+       pp_newline (pp);
+     }
+@@ -4114,7 +4114,7 @@ print_constrained_decl_info (diagnostic_text_output_format &text_output,
+ {
+   auto_context_line sentinel (text_output, DECL_SOURCE_LOCATION (decl));
+   pretty_printer *const pp = text_output.get_printer ();
+-  pp_verbatim (pp, "required by the constraints of %q#D\n", decl);
++  pp_verbatim (pp, G_("required by the constraints of %q#D\n"), decl);
+ }
+ 
+ static void
+@@ -4129,7 +4129,7 @@ print_concept_check_info (diagnostic_text_output_format &text_output,
+ 
+   cxx_pretty_printer *const pp
+     = (cxx_pretty_printer *)text_output.get_printer ();
+-  pp_verbatim (pp, "required for the satisfaction of %qE", expr);
++  pp_verbatim (pp, G_("required for the satisfaction of %qE"), expr);
+   if (map && map != error_mark_node)
+     {
+       tree subst_map = tsubst_parameter_mapping (map, args, tf_none, NULL_TREE);
+@@ -4151,7 +4151,7 @@ print_constraint_context_head (diagnostic_text_output_format &text_output,
+     {
+       auto_context_line sentinel (text_output, input_location);
+       pretty_printer *const pp = text_output.get_printer ();
+-      pp_verbatim (pp, "required for constraint satisfaction\n");
++      pp_verbatim (pp, G_("required for constraint satisfaction\n"));
+       return NULL_TREE;
+     }
+   if (DECL_P (src))
+@@ -4180,11 +4180,10 @@ print_requires_expression_info (diagnostic_text_output_format &text_output,
+   auto_context_line sentinel (text_output, cp_expr_loc_or_input_loc (expr));
+   cxx_pretty_printer *const pp
+     = static_cast <cxx_pretty_printer *> (text_output.get_printer ());
+-  pp_verbatim (pp, "in requirements ");
+ 
+   tree parms = TREE_OPERAND (expr, 0);
+-  if (parms)
+-    pp_verbatim (pp, "with ");
++  pp_verbatim (pp, parms ? G_("in requirements with ")
++			 : G_("in requirements "));
+   while (parms)
+     {
+       pp_verbatim (pp, "%q#D", parms);
+-- 
+2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-qt.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-qt.patch
new file mode 100644
index 0000000000..86874faf6f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-qt.patch
@@ -0,0 +1,77 @@
+https://inbox.sourceware.org/gcc-patches/20250409151104.2600656-1-ppalka@redhat.com/
+
+From 660e4bf9391692acb0bb18ba5eb38e689ae0a8a6 Mon Sep 17 00:00:00 2001
+Message-ID: <660e4bf9391692acb0bb18ba5eb38e689ae0a8a6.1744212391.git.sam@gentoo.org>
+From: Patrick Palka <ppalka@redhat.com>
+Date: Wed, 9 Apr 2025 11:11:04 -0400
+Subject: [PATCH] c++: alias_ctad_tweaks ICE w/ inherited CTAD [PR119687]
+
+With inherited CTAD the set of guides may be a two-dimensional overload
+set (i.e. OVERLOADs containing OVERLOADs) so alias_ctad_tweaks (which
+also handles the inherited CTAD transformation) needs to use the 2D-aware
+lkp_iterator instead of ovl_iterator.  Actually, we might as well use
+the more idiomatic lkp_range here.
+
+	PR c++/119687
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (alias_ctad_tweaks): Use lkp_range / lkp_iterator
+	instead of ovl_iterator.
+
+gcc/testsuite/ChangeLog:
+
+* g++.dg/cpp23/class-deduction-inherited8.C: New test.
+---
+ gcc/cp/pt.cc                                  |  3 +--
+ .../g++.dg/cpp23/class-deduction-inherited8.C | 21 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 2 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp23/class-deduction-inherited8.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index 0e120c4040ed..352a7f4ed316 100644
+--- a/gcc/cp/pt.cc
++++ b/gcc/cp/pt.cc
+@@ -30937,9 +30937,8 @@ alias_ctad_tweaks (tree tmpl, tree uguides)
+   tree aguides = NULL_TREE;
+   tree atparms = INNERMOST_TEMPLATE_PARMS (fullatparms);
+   unsigned natparms = TREE_VEC_LENGTH (atparms);
+-  for (ovl_iterator iter (uguides); iter; ++iter)
++  for (tree f : lkp_range (uguides))
+     {
+-      tree f = *iter;
+       tree in_decl = f;
+       location_t loc = DECL_SOURCE_LOCATION (f);
+       tree ret = TREE_TYPE (TREE_TYPE (f));
+diff --git a/gcc/testsuite/g++.dg/cpp23/class-deduction-inherited8.C b/gcc/testsuite/g++.dg/cpp23/class-deduction-inherited8.C
+new file mode 100644
+index 000000000000..79fceadd9e1c
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp23/class-deduction-inherited8.C
+@@ -0,0 +1,21 @@
++// PR c++/119687
++// { dg-do compile { target c++20 } }
++
++template <typename> class QFlagsStorage{};
++
++template <typename Enum> struct QFlagsStorageHelper : QFlagsStorage<Enum>  {
++  using QFlagsStorage<Enum>::QFlagsStorage;
++
++public:
++  QFlagsStorageHelper(Enum);
++};
++
++template <typename Enum> struct QFlags : public QFlagsStorageHelper<Enum> {
++  using Base = QFlagsStorageHelper<Enum>;
++  using Base::Base;
++  QFlags(Enum);
++};
++
++void f(int flag) {
++  QFlags{int{}};
++}
+
+base-commit: 334545194d9023fb9b2f72ee0dcde8af94930f25
+-- 
+2.49.0
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-simplify-oops.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-simplify-oops.patch
new file mode 100644
index 0000000000..abc7b6966c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250406-simplify-oops.patch
@@ -0,0 +1,81 @@
+https://gcc.gnu.org/PR119672
+https://gcc.gnu.org/PR119713
+https://bugs.gentoo.org/953420
+https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=04918a2d3f20b02ac3efad1096c33894d57789a0
+
+From 04918a2d3f20b02ac3efad1096c33894d57789a0 Mon Sep 17 00:00:00 2001
+From: Jakub Jelinek <jakub@redhat.com>
+Date: Tue, 8 Apr 2025 15:14:58 +0200
+Subject: [PATCH] simplify-rtx: Fix up POPCOUNT optimization [PR119672]
+
+The gcc.dg/vect/pr113281-1.c test and many others ICE on riscv since
+presumably the r15-9238 change which allowed more cases of vector modes
+in simplify_const_relational_operation.
+In the testcase it is EQ of
+(popcount:SI (unspec:RVVMF32BI [
+            (and:RVVMF32BI (const_vector:RVVMF32BI repeat [
+                        (const_int 1 [0x1])
+                    ])
+                (reg:RVVMF32BI 147 [ mask__6.8_35 ]))
+            (reg:SI 143 [ _41 ])
+            (const_int 0 [0])
+            (reg:SI 66 vl)
+            (reg:SI 67 vtype)
+        ] UNSPEC_VPREDICATE))
+and
+(const_int 0 [0])
+which it tries to fold as EQ comparison of
+(unspec:RVVMF32BI [
+        (and:RVVMF32BI (const_vector:RVVMF32BI repeat [
+                    (const_int 1 [0x1])
+                ])
+            (reg:RVVMF32BI 147 [ mask__6.8_35 ]))
+        (reg:SI 143 [ _41 ])
+        (const_int 0 [0])
+        (reg:SI 66 vl)
+        (reg:SI 67 vtype)
+    ] UNSPEC_VPREDICATE)
+with
+(const_int 0 [0])
+which ICEs because const0_rtx isn't a vector.
+Fixed by using CONST0_RTX, so that we pass
+(const_vector:RVVMF32BI repeat [
+        (const_int 0 [0])
+    ])
+instead.
+
+2025-04-08  Jakub Jelinek  <jakub@redhat.com>
+
+	PR rtl-optimization/119672
+	* simplify-rtx.cc (simplify_context::simplify_relational_operation_1):
+	For POPCOUNT == 0 or != 0 optimizations use
+	CONST0_RTX (GET_MODE (XEXP (op0, 0))) rather than const0_rtx.
+---
+ gcc/simplify-rtx.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/gcc/simplify-rtx.cc b/gcc/simplify-rtx.cc
+index 6f969effdf99..88d31a71c05a 100644
+--- a/gcc/simplify-rtx.cc
++++ b/gcc/simplify-rtx.cc
+@@ -6465,14 +6465,16 @@ simplify_context::simplify_relational_operation_1 (rtx_code code,
+       case LEU:
+ 	/* (eq (popcount x) (const_int 0)) -> (eq x (const_int 0)).  */
+ 	return simplify_gen_relational (EQ, mode, GET_MODE (XEXP (op0, 0)),
+-					XEXP (op0, 0), const0_rtx);
++					XEXP (op0, 0),
++					CONST0_RTX (GET_MODE (XEXP (op0, 0))));
+ 
+       case NE:
+       case GT:
+       case GTU:
+ 	/* (ne (popcount x) (const_int 0)) -> (ne x (const_int 0)).  */
+ 	return simplify_gen_relational (NE, mode, GET_MODE (XEXP (op0, 0)),
+-					XEXP (op0, 0), const0_rtx);
++					XEXP (op0, 0),
++					CONST0_RTX (GET_MODE (XEXP (op0, 0))));
+ 
+       default:
+ 	break;
+-- 
+2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250410.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250410.ebuild
new file mode 100644
index 0000000000..fb61817994
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250410.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="3"
+MUSL_VER="1"
+MUSL_GCC_VER="12.4.0"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250411.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250411.ebuild
new file mode 100644
index 0000000000..bdc9b8c2e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250411.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
+MUSL_GCC_VER="13.2.0"
+PATCH_VER="2"
+MUSL_VER="2"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250412.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250412.ebuild
new file mode 100644
index 0000000000..d405a1386b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250412.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="8"
+MUSL_VER="1"
+MUSL_GCC_VER="14.1.0"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# m68k doesnt build (ICE, bug 932733)
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406-r2.ebuild
new file mode 100644
index 0000000000..db6335cc30
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406-r2.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.0.0"
+PATCH_VER="53"
+MUSL_VER="2"
+MUSL_GCC_VER="15.0.0"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply "${FILESDIR}"/${P}-simplify-oops.patch
+	eapply "${FILESDIR}"/${P}-compare-debug.patch
+	eapply "${FILESDIR}"/${P}-de-locale.patch
+	eapply "${FILESDIR}"/${P}-qt.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250413.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250413.ebuild
new file mode 100644
index 0000000000..ecf92065f2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250413.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="15.0.0"
+PATCH_VER="54"
+MUSL_VER="2"
+MUSL_GCC_VER="15.0.0"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
index 90afb460c0..ebe573f1b1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/m4/Manifest
@@ -1,3 +1,5 @@
 DIST m4-1.4.19-test-198-sysval-r1.patch.gz 6292 BLAKE2B 62f52c8bb75e7b8f11e487906f1ce47069ea6d3095fd6532aa6b47bcd8109b7cd733fde26915d449a1cfc326f27f5ed83ba29a5a80687b8b9bdb73c8d87e96b8 SHA512 c3e7d4c1631e401c6b5477c22fd5de837188acf9d72551b116c665a927d1799b1fb249e90c9fb4f6f2f328ee84b2e4dd0bf54f684139997c19ee5b69a3e9284d
+DIST m4-1.4.19.60-6ebfc.tar.xz 2031984 BLAKE2B d6001b14a4f4bb5bb163463331b9e24469b6b48f690c88796b4d2ca57dc3c31046eb7ece0c2593941aa1b5a0e90e2aa0d85b000e135742286bf90cc7f5d09b57 SHA512 bcb801404ff8f4146e59e8baadae02f5dfac1ce3f860118122430e4facae098628e915d8ee9386abb3c133a0cc2b7c98170a57687c9d85aaa6f130b061b7810f
+DIST m4-1.4.19.60-6ebfc.tar.xz.sig 488 BLAKE2B 71f9c4aec3e981816eda83032474b4d9acccc628c79a5dd9a5e2a077e4f3f30fa6f59fb29ed7e0c1ae7148a4605584b65653eacaee7d06ba006fa2dcb7e425c1 SHA512 5e89d23c7879eb4970f05a6e8fb37eb1b17ece4204bb86cc16bcbb4f4705263725ac70b286c2454249a8a33728784a2434e498deccbbd367424ceef91a36b164
 DIST m4-1.4.19.tar.xz 1654908 BLAKE2B 08694485a49c542761fa9a7db4d7609f4dfb08a5c6b785b57f2e14cf1f696c2a1c788bb5eb934e8159a632b63ff071dfe42511d0109d7b1828f46d33c8bf416a SHA512 47f595845c89709727bda0b3fc78e3188ef78ec818965b395532e7041cabe9e49677ee4aca3d042930095a7f8df81de3da1026b23b6897be471f6cf13ddd512b
 DIST m4-1.4.19.tar.xz.sig 488 BLAKE2B 99e89b1ed0bf158d29a652392fb122e23227e895c75a8c63057ebe33f11b433ab205ae99a991578a89df8c3e723fc00669d8cdb290fbc86eaa6c704b112e4370 SHA512 d6ac9c6a54c57e9b53fb3e34a60d49df2f46a6e494da0a0c9ae8246b984e68a853b5d8c42677c1a0485c3f36b0bce10a481d3775c0edc1dbdfb27b43545bc31e
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
new file mode 100644
index 0000000000..6fb2e2de7e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/m4/m4-1.4.19_p20250413.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/m4.asc
+inherit verify-sig
+
+DESCRIPTION="GNU macro processor"
+HOMEPAGE="https://www.gnu.org/software/m4/m4.html"
+if [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-3).60-6ebfc"
+	SRC_URI="
+		https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
+		https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz
+		verify-sig? (
+			https://alpha.gnu.org/gnu/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
+			https://people.redhat.com/eblake/${PN}/${PN}-${MY_SNAPSHOT}.tar.xz.sig
+		)
+	"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="examples nls"
+
+RDEPEND="
+	virtual/libiconv
+	nls? (
+		sys-devel/gettext
+		virtual/libintl
+	)
+"
+DEPEND="${RDEPEND}"
+# Remember: cannot dep on autoconf since it needs us
+BDEPEND="
+	app-arch/xz-utils
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-m4 )
+"
+
+src_prepare() {
+	default
+
+	# touch generated files after patching m4, to avoid activating maintainer
+	# mode
+	# remove when loong-fix-build.patch is no longer necessary
+	#touch ./aclocal.m4 ./lib/config.hin ./configure ./doc/stamp-vti || die
+	#find . -name Makefile.in -exec touch {} + || die
+}
+
+src_configure() {
+	local -a myeconfargs=(
+		--enable-changeword
+
+		--with-packager="Gentoo Linux"
+		--with-packager-version="${PVR}"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+
+		$(usex nls '' '--disable-nls')
+
+		# Disable automagic dependency over libsigsegv; see bug #278026
+		ac_cv_libsigsegv=no
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	[[ -d /none ]] && die "m4 tests will fail with /none/" # bug #244396
+	emake check
+}
+
+src_install() {
+	default
+
+	# autoconf-2.60 for instance, first checks gm4, then m4.  If we don't have
+	# gm4, it might find gm4 from outside the prefix on for instance Darwin
+	use prefix && dosym m4 /usr/bin/gm4
+
+	if use examples ; then
+		dodoc -r examples
+		rm -f "${ED}"/usr/share/doc/${PF}/examples/Makefile*
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild
index 42dec07a68..5086678d26 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild
@@ -15,7 +15,7 @@ else
 	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/patch/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild
index 010d7b023e..7a19a40d50 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/${P/_/-}
 LICENSE="GPL-2+"
 SLOT="0/12" # libcryptsetup.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.12.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.12.0.ebuild
index 1f70ea3e72..43643fc812 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.12.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.12.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/utils/fs/xfs/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="icu libedit nls selinux static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/Manifest
index 98269d8cf8..2e819ca680 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/Manifest
@@ -1,3 +1,2 @@
 DIST cracklib-2.10.2.tar.xz 465152 BLAKE2B 87ea88085fee30cbd6e59485f157b7c6213e21619ff8af20ed33c118fd4be78cc9fc5b8ac5d583391df7a3bd527671044410d0e5cfe1cf864c0608cd24a8ca0b SHA512 b58f513bb3094821a69e45c092483d7445ecd1ea2d4d70b6cc422c58e478146f4656fc1ddc0b276f1da31a858d2baea4cca233c9232e2acd05085d55873f3273
 DIST cracklib-2.10.3.tar.xz 466704 BLAKE2B 714b904a4f890f399fc2acd3c8ed91173cbce19d04f386cd594388e1d35197b135d760616998979051de9154f9e94c587d21f80979fe4e00ada66010006c7216 SHA512 5a86116b888dd324d17495c3ccefb061bfc6b31a7dcebc394324d87878dec5dec268591f9d7ef30cf60f70df9ff3bbf3d891c60efc198dba80f83cc43a08273c
-DIST cracklib-2.9.11.tar.xz 461116 BLAKE2B 46b499e465c1c268b772781a9c8ce573a5167ae2e0ac919b403acdb9a14c35140dfb53909eef6e41600e26c2f87d905b3d6d05380c66f053d091765b58a264f4 SHA512 c32e509f757344a1f0b7032ad3b6dc47a8759852a94e511c92073d85bce55f45d48c389d9eb34c993e1d61ad5c1542150672f3e8bc147148ebbb04d3319a2409
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.3.ebuild
index 9708b38db1..b0423997a3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.10.3.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
 IUSE="nls python static-libs zlib"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.9.11.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.9.11.ebuild
deleted file mode 100644
index 6e08105b0d..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/cracklib-2.9.11.ebuild
+++ /dev/null
@@ -1,134 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: ideally bump with sys-apps/cracklib-words
-DISTUTILS_EXT=1
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} )
-inherit distutils-r1 libtool multilib-minimal usr-ldscript
-
-MY_P=${P/_}
-DESCRIPTION="Password Checking Library"
-HOMEPAGE="https://github.com/cracklib/cracklib/"
-SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="LGPL-2.1"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"
-IUSE="nls python static-libs zlib"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-RDEPEND="
-	python? ( ${PYTHON_DEPS} )
-	zlib? ( >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
-"
-DEPEND="
-	${RDEPEND}
-	nls? ( virtual/libintl )
-"
-BDEPEND="
-	nls? ( sys-devel/gettext )
-	python? ( ${DISTUTILS_DEPS} )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-py3.12-tests.patch
-)
-
-distutils_enable_tests unittest
-
-pkg_setup() {
-	# Workaround bug #195017
-	if has unmerge-orphans ${FEATURES} && has_version "<${CATEGORY}/${PN}-2.8.10" ; then
-		eerror "Upgrade path is broken with FEATURES=unmerge-orphans"
-		eerror "Please run: FEATURES=-unmerge-orphans emerge cracklib"
-		die "Please run: FEATURES=-unmerge-orphans emerge cracklib"
-	fi
-}
-
-src_prepare() {
-	default
-
-	# bug #269003
-	elibtoolize
-
-	if use python ; then
-		distutils-r1_src_prepare
-	fi
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		# use /usr/lib so that the dictionary is shared between ABIs
-		--with-default-dict="/usr/lib/cracklib_dict"
-		--without-python
-		$(use_enable nls)
-		$(use_enable static-libs static)
-	)
-
-	export ac_cv_header_zlib_h=$(usex zlib)
-	export ac_cv_search_gzopen=$(usex zlib -lz no)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		local -x CFLAGS="${CFLAGS} -DLOCALEDIR='\"${EPREFIX}/usr/share/locale\"' -DDEFAULT_CRACKLIB_DICT=\'${EPREFIX}/usr/lib/cracklib_dict\'"
-		cd python || die
-		distutils-r1_src_compile
-	fi
-}
-
-multilib_src_test() {
-	default
-
-	if multilib_is_native_abi && use python ; then
-		distutils-r1_src_test
-	fi
-}
-
-python_test() {
-	cd "${S}"/python || die
-
-	# Make sure we load the freshly built library
-	local -x LD_LIBRARY_PATH="${BUILD_DIR/-${EPYTHON/./_}}/lib/.libs:${BUILD_DIR}/lib:${LD_LIBRARY_PATH}"
-
-	eunittest
-}
-
-multilib_src_install() {
-	default
-
-	# Move shared libs to /
-	gen_usr_ldscript -a crack
-
-	if multilib_is_native_abi && use python ; then
-		cd python || die
-		distutils-r1_src_install
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	find "${ED}" -type f -name "*.la" -delete || die
-	rm -r "${ED}"/usr/share/cracklib || die
-
-	insinto /usr/share/dict
-	doins dicts/cracklib-small
-}
-
-pkg_postinst() {
-	if [[ -z ${ROOT} ]] ; then
-		ebegin "Regenerating cracklib dictionary"
-		create-cracklib-dict "${EPREFIX}"/usr/share/dict/* > /dev/null
-		eend $?
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/files/cracklib-2.9.11-py3.12-tests.patch b/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/files/cracklib-2.9.11-py3.12-tests.patch
deleted file mode 100644
index f0e1cd29a0..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/cracklib/files/cracklib-2.9.11-py3.12-tests.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-https://github.com/cracklib/cracklib/commit/a77a392272df3677f71c68e81fcdad1bc722732e
-
-From a77a392272df3677f71c68e81fcdad1bc722732e Mon Sep 17 00:00:00 2001
-From: Olivier Gayot <olivier.gayot@canonical.com>
-Date: Thu, 30 Nov 2023 18:36:17 +0100
-Subject: [PATCH] Fix test-suite so it can run with Python 3.12
-
-The test suite still used the obsolete assertEquals() function which was
-a deprecated alias for assertEqual() (without the s) and got dropped
-from Python 3.12.
-
-Use the replacement instead so the test-suite can run with Python 3.12.
-
-Signed-off-by: Olivier Gayot <olivier.gayot@canonical.com>
---- a/python/test_cracklib.py
-+++ b/python/test_cracklib.py
-@@ -69,52 +69,52 @@ def test_simple(self):
-     def test_simple_lower(self):
-         for passwd in ['t' * i for i in range(
-             cracklib.MIN_LENGTH - cracklib.LOW_CREDIT)]:
--            self.assertEquals(
-+            self.assertEqual(
-                 1, cracklib.simple(passwd),
-                 'password {0} should be detected as too simple'.format(
-                     passwd))
--        self.assertEquals(0, cracklib.simple(
-+        self.assertEqual(0, cracklib.simple(
-             't' * (cracklib.MIN_LENGTH - cracklib.LOW_CREDIT)))
- 
-     def test_simple_upper(self):
-         for passwd in ['T' * i for i in range(
-             cracklib.MIN_LENGTH - cracklib.UP_CREDIT)]:
--            self.assertEquals(
-+            self.assertEqual(
-                 1, cracklib.simple(passwd),
-                 'password {0} should be detected as too simple'.format(
-                     passwd))
--        self.assertEquals(0, cracklib.simple(
-+        self.assertEqual(0, cracklib.simple(
-             'T' * (cracklib.MIN_LENGTH - cracklib.UP_CREDIT)))
- 
-     def test_simple_digit(self):
-         for passwd in ['1' * i for i in range(
-             cracklib.MIN_LENGTH - cracklib.DIG_CREDIT)]:
--            self.assertEquals(
-+            self.assertEqual(
-                 1, cracklib.simple(passwd),
-                 'password {0} should be detected as too simple'.format(
-                     passwd))
--        self.assertEquals(0, cracklib.simple(
-+        self.assertEqual(0, cracklib.simple(
-             '1' * (cracklib.MIN_LENGTH - cracklib.DIG_CREDIT)))
- 
-     def test_simple_other(self):
-         for passwd in ['#' * i for i in range(
-             cracklib.MIN_LENGTH - cracklib.OTH_CREDIT)]:
--            self.assertEquals(
-+            self.assertEqual(
-                 1, cracklib.simple(passwd),
-                 'password {0} should be detected as too simple'.format(
-                     passwd))
--        self.assertEquals(0, cracklib.simple(
-+        self.assertEqual(0, cracklib.simple(
-             '#' * (cracklib.MIN_LENGTH - cracklib.OTH_CREDIT)))
- 
-     def test_simple_combinations(self):
-         testset = '#a' * (cracklib.MIN_LENGTH // 2)
-         for passwd in [testset[:i] for i in range(
-             cracklib.MIN_LENGTH - cracklib.LOW_CREDIT - cracklib.OTH_CREDIT)]:
--            self.assertEquals(
-+            self.assertEqual(
-                 1, cracklib.simple(passwd),
-                 'password {0} should be detected as too simple'.format(
-                     passwd))
--        self.assertEquals(0, cracklib.simple(
-+        self.assertEqual(0, cracklib.simple(
-             testset[:(cracklib.MIN_LENGTH - cracklib.LOW_CREDIT -
-                 cracklib.OTH_CREDIT)]))
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
index c6c2c99e85..90a7c81652 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
@@ -3,10 +3,8 @@ DIST readline-8.1.tar.gz 2993288 BLAKE2B f0feca1ea3517b2b613adacac8c997cce0e86aa
 DIST readline-8.1.tar.gz.sig 95 BLAKE2B 8a297ef2ebf815ac53f02d6395aa2ff9f24234aef6b9793bfcd5a610cd3a5024182ad8ec8beb75eadd5cf876c57cd56d4226075578a86e0e2421d2e9b1677aa5 SHA512 42a6052d5882f16e5b6f8cd16433d793a9cbb43cf1886b2d858dc65ce067a4c39c8dda7331e52f76426c43de02c358f9ffdaf5c8fd7b089479008c1e5aa19112
 DIST readline-8.2.tar.gz 3043952 BLAKE2B 7974322b9c092a756a79e537df08e8532f8e0fcb598f77732e28287c33ebec9e9837ed88b43334c310892d56a871b423903f0f564def2fbe700a1004f2ae7b18 SHA512 0a451d459146bfdeecc9cdd94bda6a6416d3e93abd80885a40b334312f16eb890f8618a27ca26868cebbddf1224983e631b1cbc002c1a4d1cd0d65fba9fea49a
 DIST readline-8.2.tar.gz.sig 95 BLAKE2B dc510459c0c47782ca87364a6677b4d8f0b68a984143122c08bd15aef08a71bff59ac92d3c3ada518dad09f189c144748e840175041eb619f679e2d8b95dc2aa SHA512 0effd273689e5f7fe7e049c8f2c5f3c97149f198a90d053231ee4de34901560a465ab0d4fd71fd07c7d7e233caed7f42e5b668bffaf1e23a7eb373c8f9e150fe
-DIST readline-8.3-beta.tar.gz 3412518 BLAKE2B 196812d49ad5a56d4163a50e603269e9d7a3e4b28acf0d09103bd64a12845c107ef03fd09812f93a3854cdf0dae201e780b9e71d51ed752233f1b38fef1d87dd SHA512 5a8727420917016ef1be2ec3dff1bff433a62b9e0732707f203a6ffbbaaff6134b3ab67d22a51ee86ed2c4d94b75e0fb2d41bca8018ce52cccb44d27320dfa1d
-DIST readline-8.3-beta.tar.gz.sig 95 BLAKE2B af715b9a5e4bcad38aec353c2501b82648544429acd0db6afc19c66c0f19d6b8215e1198b3d54e09a54edb94c8a5438fc07ba80df17fa2dab789ba2201355ac5 SHA512 1906eaf283f558a5401bdfe401081ed92c77bf36c5bee19c4460cf907e9578bff6ce29423577e58d9e920760dd3822424426637dce1346569bc3668c7fead104
-DIST readline-8.3_beta_p20250128-5bcabd92f35444fa87ed49bd180a2994fd9449ba.tar.gz 3475352 BLAKE2B 7ea7ee7706a4d815e7a60acf96fdb344ef2baeb362d13cd7f5b8e6021e117c18f801ad1788689745739f9c69de2b0da1a1d04078fc2610bbdf212e42583980a3 SHA512 7267f9b1a08479f13f721afe03c8a1453ec95404ce9bdcdb3a7d150faf96522542ae26ebbcd54d648855779b60b84fe2e8d14bf78afdb6d391ce9db5642cb90c
-DIST readline-8.3_beta_p20250404-10a0a06a6b51db5d6125ecd8f79c1c844dcfc845.tar.gz 3476495 BLAKE2B abb696284e77a596a7a7557de37cb76945ae0b83cf03484a9a26e1b3ad10e1950879e20cd61e6d67db890a09dcd517fd1f2401054fa6df571b01590be9c130df SHA512 988b4fbf2d99c14b59f42ba08720d154850065ff5760e9e204026a3634e91a4d134a3568203974b7e842dbe8767e97abba6d1be568a95dad710c3cc9482c92b5
+DIST readline-8.3-rc1.tar.gz 3415130 BLAKE2B 08dd19a92b7561ab55bd8b8d6a939bf6c31f5545484133de060555e0fb6fbf17b49b2151918d91e537c9fe4d55a17959967684126fedfb26fececd7ff265c207 SHA512 dbaa0eeb2d8bbe8dc89b5ab6d3e47162fd9bad5cf950e33f8f1d3d9baaa9faa014c77ced46b9249c0e56e70b94665f1433ae2e4093dc20f937b19e07bb9fcc74
+DIST readline-8.3-rc1.tar.gz.sig 95 BLAKE2B 1c2b88ff2b2755e121bbe53b22bee75ce435c365ed513afdd7d9053be5860fab7ba15d51b9a2b9621b3b77674b4f46b60f5591b3ccb057e60f4fd9aa4c59872f SHA512 d8e4bfb03f903d696cf6982066ee2c513f5a8e5fd3426d39a39eed4c661a53cb315f156e7c00b3cdfe6dcb6728f5f849f1eea33e766641e971fc11d0b8e6d50c
 DIST readline81-001 2454 BLAKE2B 7ec4e5c39a224a70643b44b88bcfef5198e199c76f2a34f0b0ce24f1747dd46be49ddf93871c474cda64322b4358127fec4c2401d19422f84934546bbe1f3bf2 SHA512 cfbef10bdeb562a302ccf214878d02ebadf799343b3d2d7996a282f81bcfde83997ba6dcc9a8477af4dd7c73bca74105ca00a81e42ed13321672bd2930550e54
 DIST readline81-001.sig 95 BLAKE2B 7d523d0fc21772cb03aa4b5d66ea58c1a99a6c0e4a8625e89cad015cbff63cd68e08207ca5150819225300ac864806032888104bbbea64ca38ebf89e28c24b7e SHA512 7fa3747e388aecb26f2d4f8346b89b367710ea99a14618c625066b820901dc467bd156ec37340fde1f86f0fe0d6b33044c1ed5768cf8ed1a25386d32dc6419a6
 DIST readline81-002 1242 BLAKE2B 4ef0404561bd8fc5559e8e5f675ae3f12c467178a8954f54f3204c2d09b88ccec960e807c7af0ec3514b489b676e3be51f98351e377fb18e3d7a14d33d4da69d SHA512 e47c029b82cf3a4d44e85c4348f7e059c56726694c190d84186822e1c893e1c006e7ec75f33c36791112f81abd792a2e2fdae9a65cd128f3c89ff4ffd9a9a1ff
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta.ebuild
deleted file mode 100644
index 9fd907b9b7..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta.ebuild
+++ /dev/null
@@ -1,265 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# There's no standard way of versioning the point releases upstream
-# make anyway, so while this was added for RC versions, it's fine
-# in general.
-QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
-
-# Official patches
-# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
-PLEVEL="${PV##*_p}"
-MY_PV="${PV/_p*}"
-MY_PV="${MY_PV/_/-}"
-MY_P="${PN}-${MY_PV}"
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-DESCRIPTION="Another cute console display library"
-HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	READLINE_COMMIT="a6b963cd20db6d75914cdfeb99c62c4b4c8d9b42"
-	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
-else
-	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PLEVEL} -gt 0 ]] ; then
-		# bash-5.1 -> bash51
-		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
-
-		patch_url=
-		my_patch_index=
-
-		upstream_url_base="mirror://gnu/readline"
-		mirror_url_base="ftp://ftp.cwru.edu/pub/readline"
-
-		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
-			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
-			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
-
-			SRC_URI+=" ${patch_url}"
-			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
-
-			# Add in the mirror URL too.
-			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
-			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}}.sig )"
-
-			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
-		done
-
-		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
-	fi
-fi
-
-LICENSE="GPL-3+"
-SLOT="0/8"  # subslot matches SONAME major
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="static-libs +unicode utils"
-
-RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
-	"${FILESDIR}"/${PN}-7.0-headers.patch
-	"${FILESDIR}"/${PN}-8.0-headers.patch
-
-	# TODO: rebase
-	#"${FILESDIR}"/${PN}-8.0-darwin-shlib-versioning.patch
-)
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	default
-
-	#(( PLEVEL < 0 )) && eautoreconf
-
-	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
-		# If we're bootstrapping, make a guess. We don't have pkg-config
-		# around yet. bug #818103.
-		# Incorrectly populating this leads to underlinked libreadline.
-		local ncurses_libs
-		local ncurses_libs_suffix=$(usex unicode w '')
-
-		ncurses_libs="-lncurses${ncurses_libs_suffix}"
-
-		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
-			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
-		fi
-	else
-		# Force ncurses linking, bug #71420.
-		# Use pkg-config to get the right values, bug #457558.
-		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
-	fi
-
-	sed -i \
-		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
-		support/shobj-conf || die
-	sed -i \
-		-e "/^[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
-		examples/rlfe/configure || die
-
-	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
-	# objformat for years, so we don't want to rely on that.
-	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
-
-	# For local readline headers
-	ln -s ../.. examples/rlfe/readline || die
-}
-
-src_configure() {
-	# Fix implicit decls with widechar funcs
-	append-cppflags -D_GNU_SOURCE
-	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
-	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
-
-	# Make sure configure picks a better ar than `ar`, bug #484866
-	export ac_cv_prog_AR="$(tc-getAR)"
-
-	# Force the test since we used sed above to force it.
-	export bash_cv_termcap_lib=ncurses
-
-	# Control cross-compiling cases when we know the right answer.
-	# In cases where the C library doesn't support wide characters, readline
-	# itself won't work correctly, so forcing the answer below should be OK.
-	if tc-is-cross-compiler ; then
-		export bash_cv_func_sigsetjmp="present"
-		export bash_cv_func_ctype_nonascii="yes"
-		# bug #503312
-		export bash_cv_wcwidth_broken="no"
-	fi
-
-	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
-	# so we can re-use the config cache file between the two.
-	append-ldflags -L.
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		--cache-file="${BUILD_DIR}"/config.cache
-		--with-curses
-		$(use_enable static-libs static)
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
-	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
-		# Code is full of AC_TRY_RUN()
-		mkdir -p examples/rlfe || die
-		cd examples/rlfe || die
-
-		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
-	fi
-}
-
-multilib_src_compile() {
-	emake
-
-	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
-		# Code is full of AC_TRY_RUN()
-		cd examples/rlfe || die
-		local l
-		for l in readline history ; do
-			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
-			ln -s ../../lib${l}.a lib${l}.a || die
-		done
-		emake
-	fi
-}
-
-multilib_src_install() {
-	default
-
-	if multilib_is_native_abi ; then
-		if use utils && ! tc-is-cross-compiler; then
-			dobin examples/rlfe/rlfe
-		fi
-	fi
-}
-
-multilib_src_install_all() {
-	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
-
-	dodoc USAGE
-	docinto ps
-	dodoc doc/*.ps
-}
-pkg_preinst() {
-	# bug #29865
-	# Reappeared in bug #595324 with paludis so keeping this for now...
-	preserve_old_lib \
-		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 7)
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify \
-		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 7)
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250128.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250128.ebuild
deleted file mode 100644
index d3e7f154e8..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250128.ebuild
+++ /dev/null
@@ -1,265 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# There's no standard way of versioning the point releases upstream
-# make anyway, so while this was added for RC versions, it's fine
-# in general.
-QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
-inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
-
-# Official patches
-# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
-PLEVEL="${PV##*_p}"
-MY_PV="${PV/_p*}"
-MY_PV="${MY_PV/_/-}"
-MY_P="${PN}-${MY_PV}"
-MY_PATCHES=()
-
-# Determine the patchlevel.
-case ${PV} in
-	9999|*_alpha*|*_beta*|*_rc*)
-		# Set a negative patchlevel to indicate that it's a pre-release.
-		PLEVEL=-1
-		;;
-	*_p*)
-		PLEVEL=${PV##*_p}
-		;;
-	*)
-		PLEVEL=0
-esac
-
-DESCRIPTION="Another cute console display library"
-HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
-	EGIT_BRANCH=devel
-	inherit git-r3
-elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-	# It can be useful to have snapshots in the pre-release period once
-	# the first alpha is out, as various bugs get reported and fixed from
-	# the alpha, and the next pre-release is usually quite far away.
-	#
-	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	READLINE_COMMIT="5bcabd92f35444fa87ed49bd180a2994fd9449ba"
-	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
-	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
-else
-	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
-	S="${WORKDIR}/${MY_P}"
-
-	if [[ ${PLEVEL} -gt 0 ]] ; then
-		# bash-5.1 -> bash51
-		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
-
-		patch_url=
-		my_patch_index=
-
-		upstream_url_base="mirror://gnu/readline"
-		mirror_url_base="ftp://ftp.cwru.edu/pub/readline"
-
-		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
-			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
-			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
-
-			SRC_URI+=" ${patch_url}"
-			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
-
-			# Add in the mirror URL too.
-			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
-			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}}.sig )"
-
-			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
-		done
-
-		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
-	fi
-fi
-
-LICENSE="GPL-3+"
-SLOT="0/8"  # subslot matches SONAME major
-if (( PLEVEL >= 0 )); then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-IUSE="static-libs +unicode utils"
-
-RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-chetramey )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
-	"${FILESDIR}"/${PN}-7.0-headers.patch
-	"${FILESDIR}"/${PN}-8.0-headers.patch
-
-	# TODO: rebase
-	#"${FILESDIR}"/${PN}-8.0-darwin-shlib-versioning.patch
-)
-
-src_unpack() {
-	local patch
-
-	if [[ ${PV} == 9999 ]]; then
-		git-r3_src_unpack
-	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
-		default
-	else
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
-
-			for patch in "${MY_PATCHES[@]}"; do
-				verify-sig_verify_detached "${patch}"{,.sig}
-			done
-		fi
-
-		unpack "${MY_P}.tar.gz"
-
-		if [[ ${GENTOO_PATCH_VER} ]]; then
-			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
-		fi
-	fi
-}
-
-src_prepare() {
-	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
-
-	default
-
-	#(( PLEVEL < 0 )) && eautoreconf
-
-	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
-		# If we're bootstrapping, make a guess. We don't have pkg-config
-		# around yet. bug #818103.
-		# Incorrectly populating this leads to underlinked libreadline.
-		local ncurses_libs
-		local ncurses_libs_suffix=$(usex unicode w '')
-
-		ncurses_libs="-lncurses${ncurses_libs_suffix}"
-
-		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
-			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
-		fi
-	else
-		# Force ncurses linking, bug #71420.
-		# Use pkg-config to get the right values, bug #457558.
-		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
-	fi
-
-	sed -i \
-		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
-		support/shobj-conf || die
-	sed -i \
-		-e "/^[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
-		examples/rlfe/configure || die
-
-	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
-	# objformat for years, so we don't want to rely on that.
-	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
-
-	# For local readline headers
-	ln -s ../.. examples/rlfe/readline || die
-}
-
-src_configure() {
-	# Fix implicit decls with widechar funcs
-	append-cppflags -D_GNU_SOURCE
-	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
-	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
-
-	# Make sure configure picks a better ar than `ar`, bug #484866
-	export ac_cv_prog_AR="$(tc-getAR)"
-
-	# Force the test since we used sed above to force it.
-	export bash_cv_termcap_lib=ncurses
-
-	# Control cross-compiling cases when we know the right answer.
-	# In cases where the C library doesn't support wide characters, readline
-	# itself won't work correctly, so forcing the answer below should be OK.
-	if tc-is-cross-compiler ; then
-		export bash_cv_func_sigsetjmp="present"
-		export bash_cv_func_ctype_nonascii="yes"
-		# bug #503312
-		export bash_cv_wcwidth_broken="no"
-	fi
-
-	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
-	# so we can re-use the config cache file between the two.
-	append-ldflags -L.
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		--cache-file="${BUILD_DIR}"/config.cache
-		--with-curses
-		$(use_enable static-libs static)
-	)
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-
-	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
-		# Code is full of AC_TRY_RUN()
-		mkdir -p examples/rlfe || die
-		cd examples/rlfe || die
-
-		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
-	fi
-}
-
-multilib_src_compile() {
-	emake
-
-	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
-		# Code is full of AC_TRY_RUN()
-		cd examples/rlfe || die
-		local l
-		for l in readline history ; do
-			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
-			ln -s ../../lib${l}.a lib${l}.a || die
-		done
-		emake
-	fi
-}
-
-multilib_src_install() {
-	default
-
-	if multilib_is_native_abi ; then
-		if use utils && ! tc-is-cross-compiler; then
-			dobin examples/rlfe/rlfe
-		fi
-	fi
-}
-
-multilib_src_install_all() {
-	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
-
-	dodoc USAGE
-	docinto ps
-	dodoc doc/*.ps
-}
-pkg_preinst() {
-	# bug #29865
-	# Reappeared in bug #595324 with paludis so keeping this for now...
-	preserve_old_lib \
-		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 7)
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify \
-		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
-		/$(get_libdir)/lib{history,readline}$(get_libname 7)
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250404.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_rc1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250404.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_rc1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
index 5a3da1defe..131a1abdd2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
@@ -1,3 +1,4 @@
 DIST talloc-2.4.0.tar.gz 676054 BLAKE2B 71b3f21fa7cd114579e1dc064aadda447c0d196beaa27a5919acebdce668f6b768dd7c293c056ae4c096f31d8e931255ee2b71728c4b7b0bbb7818169380e9ca SHA512 810d92a614d0b9e0ac6fe403c1643c4dda435f79c4627d3c3be228f94b4b2ee8e528efbbed07f7d1a16043d6e55bdf4f10826f31fb8ca1c649c4126ea09a3aff
 DIST talloc-2.4.1.tar.gz 679160 BLAKE2B a7913b25930c77da53c17c2e0d71386402b1059f93c751084037c5068a035bd543c2d7e24a2d8dc989bb4eea13fa1a3c7a362e4d6c14af0b2030fbfb2f513801 SHA512 4de3b66d7cd1ff3f53e28e86bf9e89528635465c67868e1262aab6946106c228b2c184e988561361c3194fb260d83e016477254c9dbea7abff40c4dc0d31c76c
 DIST talloc-2.4.2.tar.gz 679750 BLAKE2B 1f836d6b11e096e399ad7b99ad4abd3c140e75ee307695659c35b89eca600de247e5432bce523a299334f20ca2dad4c726b783a94c546b67fe25b2b7199b2915 SHA512 fb91665ffbe0cce96b1359940ff3ed21330c81c5331140788a26aa94f82b50492176e6000ff54b31d1a434bb1cb53a6a2c7894153545252a1fd91bda7c05a213
+DIST talloc-2.4.3.tar.gz 684092 BLAKE2B 5299ea4f19afd6b623f0c98514bdf4ae80121af3f4b38963cf2d39a8a9fdac3bd4a3119a606bc04f2a48a991bb98e7a66643e26e4f68427c64d3675b838ccc2d SHA512 7174a069dd3d4ebf8c04fee3434fd50269015bb8f039839e7e7723f431d089b66fb0167e8893bff2d1c392de1ac33665e5b278168246da30d528d522b0e1d5bd
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.3.ebuild
new file mode 100644
index 0000000000..1870821ee9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.3.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils python-single-r1 multilib-minimal
+
+DESCRIPTION="Samba talloc library"
+HOMEPAGE="https://talloc.samba.org/"
+SRC_URI="https://www.samba.org/ftp/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3 LGPL-3+ LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+IUSE="compat +python test valgrind"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!elibc_SunOS? (
+		!elibc_Darwin? (
+			dev-libs/libbsd[${MULTILIB_USEDEP}]
+		)
+	)
+	python? ( ${PYTHON_DEPS} )
+"
+# Valgrind is automagic here but it's a build-only dep so it's not so bad.
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-debug/valgrind )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-libs/libxslt
+	sys-devel/gettext
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# python goes only for native
+	/usr/include/pytalloc.h
+)
+
+pkg_setup() {
+	# Try to turn off distcc and ccache for people that have a problem with it
+	export DISTCC_DISABLE=1
+	export CCACHE_DISABLE=1
+
+	python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Drop irritating ABI names (e.g. cpython-37m)
+		# We're only installing one implementation anyway
+		sed -i "s/+ conf.all_envs\['default'\]\['PYTHON_SO_ABI_FLAG'\]//" wscript || die
+		sed -i "s/name = bld.pyembed_libname('pytalloc-util')/name = 'pytalloc-util'/" wscript || die
+	fi
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 test_pytalloc.py || die
+	fi
+
+	# WAF
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local extra_opts=(
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+
+		$(usev compat --enable-talloc-compat1)
+		$(multilib_native_usex python '' --disable-python)
+		$([[ ${CHOST} == *-solaris* ]] && echo '--disable-symbol-versions')
+	)
+
+	waf-utils_src_configure "${extra_opts[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	# waf is stupid, and no, we can't fix the build-system, since it's provided
+	# as a brilliant binary blob thats decompressed on the fly
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		install_name_tool \
+			-id "${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+			"${ED}"/usr/$(get_libdir)/libtalloc.${PV}.dylib || die
+
+		if use python ; then
+			install_name_tool \
+				-id "${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.${PV}.dylib || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.${PV}.dylib || die
+
+			install_name_tool \
+				-id "${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.dylib || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${ED}"/usr/$(get_libdir)/libpytalloc-util.dylib || die
+
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libpytalloc-util.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libpytalloc-util.dylib \
+				"${D}"$(python_get_sitedir)/talloc*.bundle || die
+			install_name_tool \
+				-change "${BUILD_DIR}/bin/default/libtalloc.dylib" \
+				"${EPREFIX}"/usr/$(get_libdir)/libtalloc.2.dylib \
+				"${D}"$(python_get_sitedir)/talloc*.bundle || die
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
index f75ddc6818..e1cb9136c3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
@@ -1,4 +1,5 @@
 DIST tdb-1.4.10.tar.gz 747139 BLAKE2B e271f824acc8c691a6e88f5e5f73d0673a132134d025e84461520108b94cd7a5db587a0012ad1172270d29042f29336aab6ca59a735d611d6529f81ec3c195e9 SHA512 b5147d811617d90a025d1070abf16c42744b3fc3cac1042fbff03b1e635af2eaf9c957a7bffdb3f56b4a0c775b44f8027def9f23deb1b3ede817b95bbece2ce9
 DIST tdb-1.4.12.tar.gz 748827 BLAKE2B a21d4d6335306ed43d099629960856b1f4e94be046d43b4c3d1cb7a1d929dcb7146f385d4a1c2e8ef3a22af73f7e4db9d2a6f032a7501946dd7fdcbead377661 SHA512 f41644ae29da7fed26959e4f2e3664e58ec65681b0b7115fbb296a7a8c5642c8190dac6e16e5704b322469466dd5aa15c1f7f72df8226ac9c695b5b10ac85b66
+DIST tdb-1.4.13.tar.gz 751677 BLAKE2B 25b8b3246dd0f19c8522a14b70df32b08f6cff9c61dc643e84f3c3d65be55acae5963b19bb271cff96f226c494f790c6763bcacd8513fe64c5e4f8c89e2d4754 SHA512 23cbabaf272947d65ab6ba22481ecbf2b86889f860b223ae650101fbf3c6a19acd179d8da15013502076172876acbf3ee3695e9cdeeaa721ed30920b1bd4937d
 DIST tdb-1.4.8.tar.gz 742791 BLAKE2B dc2705cb16ee59f4d5bf25602032b25fd5338caa890db19939996a40cd19c4c999f9a74786d5754dbbd1de54d818541cf56844beeb33008aaee507d5dfcdba85 SHA512 763beebe923aa04303cbb91ce5970e6bbd13546888cff75ea9ab025afff3ef88fee539ae173fc2fb7ec661b6c337b0c2da361ce3d318f51ef6627bdb3fe6ca63
 DIST tdb-1.4.9.tar.gz 746608 BLAKE2B 2cdcf636b9ef5445d48ca2aab79d4ffd137a8409b6d7b1fcdbcd28797d4bbe617f768a5ef92a14c4ae6dddfc37576f5d411cf4d67edeb4319f46a1a15ffd94ee SHA512 6b0109075826b8630f6b5a7e7ade2fcff95c5d05338340af78219422610947c520707b3e484ff13fbd40bbfffe13977976e8ddcb1be7b13e13ac78b4e3ec06c2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.13.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.13.ebuild
new file mode 100644
index 0000000000..cb95a311aa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.13.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils multilib-minimal python-single-r1
+
+DESCRIPTION="Simple database API"
+HOMEPAGE="https://tdb.samba.org/"
+SRC_URI="https://samba.org/ftp/tdb/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="python test"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	python? ( ${PYTHON_DEPS} )
+"
+DEPEND="
+	${RDEPEND}
+	virtual/libcrypt
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-text/docbook-xml-dtd:4.2
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+src_prepare() {
+	default
+
+	python_fix_shebang .
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 python/tests/simple.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	#MAKEOPTS+=" -j1"
+
+	local extra_opts=(
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+	)
+
+	if ! multilib_is_native_abi || ! use python ; then
+		extra_opts+=( --disable-python )
+	fi
+
+	waf-utils_src_configure "${extra_opts[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_test() {
+	# the default src_test runs 'make test' and 'make check', letting
+	# the tests fail occasionally (reason: unknown)
+	emake check WAF_BIN="${WAF_BINARY}"
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+	use python && python_optimize
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
index a31847945a..ba53905ff2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
@@ -1,3 +1,4 @@
 DIST tevent-0.14.1.tar.gz 881979 BLAKE2B 272b7d0029061dfd172a39135d806b937ee6f5bb9eb4c9c8d68a6e5cb3d9eca01582f7ddf5a15d7f033d3322c7fd4d6e87d697f76e4d44565c8e757398a5f0f8 SHA512 0bcc87c10f84e947edad8f8c31f3923253c599b7a69a1db1c21ab292e02937ccb8bad9f0f70e27420ead687aaed1a9b3830b6daa903b8a9bd48cc035a6e5f4ec
 DIST tevent-0.15.0.tar.gz 884634 BLAKE2B 071906dc0cc199a9b550e74ca7fcd3555e54a1c48a9be2c107c498ccf2157521336c3ec63fd776e3551064e9baf1ebcf9c7ff5eb0f04375b7d714056331476aa SHA512 470cc4489255a4f122ba1d680669589ba375d4081ff46631dd56f5104202d175bfb13356820eb9108a6b768b3837b2f5d26cc7b0acc3071c4787fb070df3cbab
 DIST tevent-0.16.1.tar.gz 890010 BLAKE2B 34639cf0e63193eebdb9c3f845390685d66916c6a687f22fbe25dbe175d3279752dfea1e3567fdb2eed3bea17108b9b226039cb1218c0536fc1eb7f4e0a025ab SHA512 cda001d91728b2f28dd081e9c5f6d8ede345dcd9ce1dca04394860cd83090c15aa8dfef1c53b73e120bd17f0d95551fa9301eb4927963314556d016fe5420a39
+DIST tevent-0.16.2.tar.gz 897447 BLAKE2B d23d60f5e5478899daab248c6a2b8d9b67d19a881bf1cfec2803e4fa538f2f59333b3e28c729a1072b3ec3b528961faf63ccd60fdc92f229a73e358fdcdb080e SHA512 c644771227fd1ee9f221e8cac1be9db97043953670a29415a20f3f8933d4fa93c7421b991a4ecaac0b9b29e922d1ec2f436160f2d2eaf77c6d392f1dec212417
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.2.ebuild
new file mode 100644
index 0000000000..3c3ec74695
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.2.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils multilib-minimal python-single-r1
+
+DESCRIPTION="Samba tevent library"
+HOMEPAGE="https://tevent.samba.org/"
+SRC_URI="https://samba.org/ftp/tevent/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+IUSE="python test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.3"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	python? (
+		${PYTHON_DEPS}
+		>=sys-libs/talloc-${TALLOC_VERSION}[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	elibc_glibc? (
+		net-libs/libtirpc[${MULTILIB_USEDEP}]
+		net-libs/rpcsvc-proto
+	)
+	test? ( >=dev-util/cmocka-1.1.3 )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		# (depsite the name. bindings.py is just for Python tests.)
+		truncate -s0 bindings.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test ; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	waf-utils_src_configure \
+		--libdir="${EPREFIX}/usr/$(get_libdir)" \
+		--disable-dependency-tracking \
+		--disable-warnings-as-errors \
+		--bundled-libraries="${bundled_libs}" \
+		--builtin-libraries=NONE \
+		$(multilib_native_usex python '' '--disable-python')
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	multilib_is_native_abi && use python && python_domodule tevent.py
+}
+
+multilib_src_install_all() {
+	insinto /usr/include
+	doins tevent_internal.h
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.2-r1.ebuild
index 8ea3c8dae3..ccaff3704f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.2-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -17,7 +17,7 @@ SRC_URI="https://people.redhat.com/sgrubb/audit/${P}.tar.gz"
 
 LICENSE="GPL-2+ LGPL-2.1+"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="gssapi io-uring ldap python static-libs test"
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"