diff --git a/build_library/catalyst_sdk.sh b/build_library/catalyst_sdk.sh
index 742b04f86c..753e60a941 100644
--- a/build_library/catalyst_sdk.sh
+++ b/build_library/catalyst_sdk.sh
@@ -4,6 +4,9 @@ set -e
 source /tmp/chroot-functions.sh
 source /tmp/toolchain_util.sh
 
+ln -vsfT "$(portageq get_repo_path / coreos-overlay)/coreos/user-patches" \
+    /etc/portage/patches
+
 echo "Double checking everything is fresh and happy."
 run_merge -uDN --with-bdeps=y world
 
diff --git a/build_library/toolchain_util.sh b/build_library/toolchain_util.sh
index 65848e9130..2d8a9e8980 100644
--- a/build_library/toolchain_util.sh
+++ b/build_library/toolchain_util.sh
@@ -423,7 +423,6 @@ install_cross_toolchain() {
     # Setup environment and wrappers for our shiny new toolchain
     binutils_set_latest_profile "${cross_chost}"
     gcc_set_latest_profile "${cross_chost}"
-    "${sudo[@]}" CC_QUIET=1 sysroot-config --install-links "${cross_chost}"
 }
 
 # Build/install toolchain dependencies into the cross sysroot for a
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/files/12.4.5-xmlsec1-pc.patch b/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/files/12.4.5-xmlsec1-pc.patch
new file mode 100644
index 0000000000..9dfaad5e20
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/files/12.4.5-xmlsec1-pc.patch
@@ -0,0 +1,57 @@
+https://github.com/vmware/open-vm-tools/pull/732
+
+From 9403500c9aac5be8c38b528e9cc0c711ba2f0151 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <chewi@gentoo.org>
+Date: Sun, 4 Aug 2024 14:53:16 +0100
+Subject: [PATCH 1/2] Also try using pkg-config to detect xmlsec
+
+The xmlsec1-config script does not help when cross-compiling. pkg-config is
+subsequently used for a version detection anyway.
+---
+ open-vm-tools/configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/open-vm-tools/configure.ac b/open-vm-tools/configure.ac
+index 26b2e950..d46a51e2 100644
+--- a/open-vm-tools/configure.ac
++++ b/open-vm-tools/configure.ac
+@@ -879,7 +879,7 @@ if test "$enable_vgauth" = "yes" ; then
+    AC_VMW_DEFAULT_FLAGS([XMLSEC1])
+    AC_VMW_CHECK_LIB([xmlsec1],
+                      [XMLSEC1],
+-                     [],
++                     [xmlsec1],
+                      [xmlsec1-config],
+                      [],
+                      [xmlsec/xmlsec.h],
+-- 
+2.45.2
+
+
+From b9f0bb3205039d2fa4e8d1f6d2e4d622f3ef97b1 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <chewi@gentoo.org>
+Date: Sun, 4 Aug 2024 14:54:34 +0100
+Subject: [PATCH 2/2] Respect the $PKG_CONFIG variable when checking the xmlsec
+ version
+
+This particularly helps when cross-compiling.
+---
+ open-vm-tools/configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/open-vm-tools/configure.ac b/open-vm-tools/configure.ac
+index d46a51e2..39b9fa9c 100644
+--- a/open-vm-tools/configure.ac
++++ b/open-vm-tools/configure.ac
+@@ -884,7 +884,7 @@ if test "$enable_vgauth" = "yes" ; then
+                      [],
+                      [xmlsec/xmlsec.h],
+                      [xmlSecCheckVersionExt],
+-                     [XMLSEC1_VER=`pkg-config --modversion xmlsec1`
++                     [XMLSEC1_VER=`$PKG_CONFIG --modversion xmlsec1`
+                       xmlsec1_major_version="`echo $XMLSEC1_VER | cut -f1 -d. | cut -f1 -d-`"
+                       xmlsec1_minor_version="`echo $XMLSEC1_VER | cut -f2 -d. | cut -f1 -d-`"
+                       xmlsec1_micro_version="`echo $XMLSEC1_VER | cut -f3 -d. | cut -f1 -d-`"
+-- 
+2.45.2
+
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/open-vm-tools-12.4.5.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/open-vm-tools-12.4.5.ebuild
index 47cf815f5f..1e9fc68019 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/open-vm-tools-12.4.5.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/open-vm-tools/open-vm-tools-12.4.5.ebuild
@@ -1,14 +1,16 @@
-# Copyright 2007-2023 Gentoo Authors
+# Copyright 2007-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 inherit autotools linux-info pam systemd udev
 
+MY_P="${P}-23787635"
+
 DESCRIPTION="Tools for VMware guests"
 HOMEPAGE="https://github.com/vmware/open-vm-tools"
-MY_P="${P}-23787635"
 SRC_URI="https://github.com/vmware/open-vm-tools/releases/download/stable-${PV}/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
@@ -31,57 +33,49 @@ RDEPEND="
 	fuse3? ( sys-fs/fuse:3 )
 	pam? ( sys-libs/pam )
 	!pam? ( virtual/libcrypt:= )
-	ssl? ( dev-libs/openssl:0= )
+	ssl? ( dev-libs/openssl:= )
 	vgauth? (
 		dev-libs/libxml2
 		dev-libs/xmlsec:=
 	)
 	X? (
-		x11-libs/libXext
-		multimon? ( x11-libs/libXinerama )
-		x11-libs/libXi
-		x11-libs/libXrender
-		x11-libs/libXrandr
-		x11-libs/libXtst
-		x11-libs/libSM
-		x11-libs/libXcomposite
 		x11-libs/gdk-pixbuf-xlib
 		x11-libs/gtk+:3
+		x11-libs/libSM
+		x11-libs/libXcomposite
+		x11-libs/libXext
+		x11-libs/libXi
+		x11-libs/libXrandr
+		x11-libs/libXrender
+		x11-libs/libXtst
 		gtkmm? (
 			dev-cpp/gtkmm:3.0
 			dev-libs/libsigc++:2
 		)
+		multimon? ( x11-libs/libXinerama )
 	)
 	dnet? ( dev-libs/libdnet )
 	icu? ( dev-libs/icu:= )
 	resolutionkms? (
 		x11-libs/libdrm[video_cards_vmware]
 		virtual/libudev
-	)
-"
-
+	)"
 DEPEND="${RDEPEND}
-	net-libs/rpcsvc-proto
-"
-
+	net-libs/rpcsvc-proto"
 BDEPEND="
 	dev-util/glib-utils
 	virtual/pkgconfig
-	doc? ( app-doc/doxygen )
-"
-
-S="${WORKDIR}/${MY_P}"
+	doc? ( app-text/doxygen )"
 
 PATCHES=(
-	"${FILESDIR}/10.1.0-Werror.patch"
-	"${FILESDIR}/11.3.5-icu.patch"
+	"${FILESDIR}"/10.1.0-Werror.patch
+	"${FILESDIR}"/11.3.5-icu.patch
+	"${FILESDIR}"/12.4.5-xmlsec1-pc.patch
 )
 
 pkg_setup() {
-	local CONFIG_CHECK="~VMWARE_BALLOON ~VMWARE_PVSCSI ~VMXNET3"
+	local CONFIG_CHECK="~VMWARE_BALLOON ~VMWARE_PVSCSI ~VMXNET3 ~VMWARE_VMCI ~VMWARE_VMCI_VSOCKETS ~FUSE_FS"
 	use X && CONFIG_CHECK+=" ~DRM_VMWGFX"
-	kernel_is -lt 3 9 || CONFIG_CHECK+=" ~VMWARE_VMCI ~VMWARE_VMCI_VSOCKETS"
-	kernel_is -lt 3 || CONFIG_CHECK+=" ~FUSE_FS"
 	kernel_is -lt 5 5 || CONFIG_CHECK+=" ~X86_IOPL_IOPERM"
 	linux-info_pkg_setup
 }
@@ -95,21 +89,20 @@ src_prepare() {
 src_configure() {
 	local myeconfargs=(
 		--disable-glibc-check
+		--disable-tests
 		--without-root-privileges
 		$(use_enable multimon)
 		$(use_with X x)
 		$(use_with X gtk3)
 		$(use_with gtkmm gtkmm3)
 		$(use_enable doc docs)
-		--disable-tests
 		$(use_enable resolutionkms)
-		--disable-static
 		$(use_enable deploypkg)
 		$(use_with pam)
 		$(use_enable vgauth)
 		$(use_with dnet)
 		$(use_with icu)
-		--with-udev-rules-dir="$(get_udevdir)/rules.d"
+		--with-udev-rules-dir="$(get_udevdir)"/rules.d
 		# Flatcar: TO UPSTREAM: explicitly specify fuse version
 		$(use_with fuse fuse 2)
 		$(use_with fuse3 fuse 3)
@@ -127,6 +120,10 @@ src_configure() {
 	# Avoid a bug in configure.ac
 	use ssl || myeconfargs+=( --without-ssl )
 
+	# Avoid relying on dnet-config script, which breaks cross-compiling. This
+	# library has no pkg-config file.
+	export CUSTOM_DNET_LIBS="-ldnet"
+
 	econf "${myeconfargs[@]}"
 }
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r209.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r210.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r209.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r210.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 64489799b2..e86c18075e 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -20,7 +20,6 @@ RDEPEND="${RDEPEND}
 	dev-embedded/u-boot-tools
 	!arm64? ( sys-boot/syslinux )
 	sys-devel/crossdev
-	sys-devel/sysroot-wrappers
 	sys-fs/dosfstools
 	"
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/scripts/config_wrapper b/sdk_container/src/third_party/coreos-overlay/coreos/scripts/config_wrapper
deleted file mode 100755
index 1444f8a91e..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/scripts/config_wrapper
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Wrap all the old style config scripts.
-
-# We'll be working with the env:
-#   argv[0]: armv7a-cros-linux-gnueabi-ncurses5-config
-#   CHOST:   armv7a-cros-linux-gnueabi
-#   SYSROOT: /build/arm-generic
-# See if there's a wrapper in the SYSROOT for us to execute, let's do
-# that, and then filter the output for any -I/-L paths that'd screw us up.
-
-wrap=${0##*/}
-
-if [[ -z ${CHOST} ]] ; then
-  # Let's figure out the answer from $0.  Do it piece by piece as
-  # we cannot assume the number of components in the target tuple
-  # or in the config script name.  Tuples can have 1, 2, 3, or 4
-  # components, and config scripts can have as many as they want
-  # (although most of the time, it's just 2).
-  parts=( ${wrap//-/ } )
-  i=$(( ${#parts[@]} - 1 ))
-  cfg=${parts[${i}]}
-  while [[ $(( --i )) -ge 0 ]] ; do
-    cfg="${parts[${i}]}-${cfg}"
-    if [[ -e ${SYSROOT}/usr/bin/${cfg} ]] ; then
-      CHOST=${wrap%-${cfg}}
-      type -P ${CHOST}-gcc >/dev/null && break
-      unset CHOST
-    fi
-  done
-else
-  cfg=${wrap#${CHOST}-}
-fi
-
-if [[ -z ${CHOST} ]] || [[ -z ${SYSROOT} ]] ; then
-  echo "${wrap}: please set CHOST/SYSROOT in the env" 1>&2
-  exit 1
-fi
-
-# Some wrappers will dynamically figure out where they're being run from,
-# and then output a full path -I/-L path based on that.  So we trim any
-# expanded sysroot paths that might be in the output already to avoid
-# having it be -L${SYSROOT}${SYSROOT}/usr/lib.
-set -o pipefail
-exec ${SYSROOT}/usr/bin/${cfg} "$@" | sed -r "s:(-[IL])(${SYSROOT})?:\1${SYSROOT}:g"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-aarch64-cros-linux-gnu/gcc b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-aarch64-cros-linux-gnu/gcc
new file mode 120000
index 0000000000..c59b0e7dcd
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-aarch64-cros-linux-gnu/gcc
@@ -0,0 +1 @@
+../sys-devel/gcc
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-x86_64-cros-linux-gnu/gcc b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-x86_64-cros-linux-gnu/gcc
new file mode 120000
index 0000000000..c59b0e7dcd
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/cross-x86_64-cros-linux-gnu/gcc
@@ -0,0 +1 @@
+../sys-devel/gcc
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/README.md
new file mode 100644
index 0000000000..a1eeecf70f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/README.md
@@ -0,0 +1,4 @@
+The ESYSROOT patch is pending inclusion into Gentoo's gcc patch set. Once
+merged, this will most likely be applied from 14.1 or 14.2 onwards. Check the
+[GitHub pull request](https://github.com/gentoo/gcc-patches/pull/3) for the
+current situation.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/gcc-esysroot.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/gcc-esysroot.patch
new file mode 100644
index 0000000000..46117f12e7
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/gcc/gcc-esysroot.patch
@@ -0,0 +1,20 @@
+diff -Naur a/gcc/gcc.cc b/gcc/gcc.cc
+--- a/gcc/gcc.cc	2024-08-01 23:34:33.525082176 +0100
++++ b/gcc/gcc.cc	2024-08-01 23:43:31.557156041 +0100
+@@ -5527,6 +5527,16 @@
+ 	      "BINUTILS", PREFIX_PRIORITY_LAST, 0, 1);
+   free (tooldir_prefix);
+
++  if (*cross_compile == '1' && !target_system_root_changed)
++    {
++      const char *esysroot = env.get("ESYSROOT");
++      if (esysroot && esysroot[0] != '\0' && strcmp(esysroot, "/") != 0 && (!target_system_root || strcmp(esysroot, target_system_root) != 0))
++	{
++	  target_system_root = esysroot;
++	  target_system_root_changed = 1;
++	}
++    }
++
+ #if defined(TARGET_SYSTEM_ROOT_RELOCATABLE) && !defined(VMS)
+   /* If the normal TARGET_SYSTEM_ROOT is inside of $exec_prefix,
+      then consider it to relocate with the rest of the GCC installation
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
index 7abb2c7af0..06def4ad28 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc
@@ -110,12 +110,6 @@ cros_post_src_install_set_up_var_lib_selinux() {
 # Source hooks for SLSA build provenance report generation
 source "${BASH_SOURCE[0]}.slsa-provenance"
 
-# Insert our sysroot wrappers into the path
-SYSROOT_WRAPPERS_BIN="/usr/lib64/sysroot-wrappers/bin"
-if [[ "$PATH" != *"$SYSROOT_WRAPPERS_BIN"* ]]; then
-    export PATH="$SYSROOT_WRAPPERS_BIN:$PATH"
-fi
-
 # Improve the chance that ccache is valid across versions by making all
 # paths under $S relative to $S, avoiding encoding the package version
 # contained in the path into __FILE__ expansions and debug info.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/profile.bashrc b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/profile.bashrc
deleted file mode 100644
index 99d382e571..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/profile.bashrc
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Locate all the old style config scripts this package installs.  Do it here
-# here so we can search the temp $D which has only this pkg rather than the
-# full ROOT which has everyone's files.
-cros_pre_pkg_preinst_wrap_old_config_scripts() {
-	# Only wrap when installing into a board sysroot.
-	[[ $(cros_target) != "board_sysroot" ]] && return 0
-
-	local wrappers=$(
-		find "${D}"/usr/bin -name '*-config' -printf '%P ' 2>/dev/null
-	)
-
-	local wdir="${CROS_BUILD_BOARD_TREE}/bin"
-	mkdir -p "${wdir}"
-
-	local c w
-	for w in ${wrappers} ; do
-		# $CHOST-$CHOST-foo-config isn't helpful
-		if [[ ${w} == ${CHOST}-* ]]; then
-			continue
-		fi
-		# Skip anything that isn't a script, e.g. pkg-config
-		if ! head -n1 "${D}/usr/bin/${w}" | egrep -q '^#!\s*/bin/(ba)?sh'; then
-			continue
-		fi
-		w="${wdir}/${CHOST}-${w}"
-		c="${CROS_ADDONS_TREE}/scripts/config_wrapper"
-		if [[ ! -e ${w} ]] ; then
-			ln -s "${c}" "${w}"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-auth/realmd/realmd-0.17.0-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-auth/realmd/realmd-0.17.0-r2.ebuild
index 753b4c36a1..f7bf88bf2a 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-auth/realmd/realmd-0.17.0-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-auth/realmd/realmd-0.17.0-r2.ebuild
@@ -54,6 +54,7 @@ src_configure() {
 		--with-distro=defaults
 		--disable-doc
 		--disable-nls
+		KRB5_CONFIG="${ESYSROOT}"/usr/bin/krb5-config
 	)
 	econf "${myconf[@]}"
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/Manifest
deleted file mode 100644
index 2cb182fa58..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/Manifest
+++ /dev/null
@@ -1 +0,0 @@
-DIST sysroot-wrappers-0.2.tar.gz 138063 BLAKE2B 04c5072fd48c0b931ea971aac4e242dc9a213429ebe03527cca5f4dd6c970eb15dee900c6e64d798a41fde48457c241e91ff8dcfbd678282bad390d5a7e07063 SHA512 bb27e2737ecde63bb877b75430c65b18e192b13671bb1a10d939694bff57412e59e51d4151aedf3ebf5f4d17e789a2f34ed1ab6506c20503c878b9c04efcfda6
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/metadata.xml b/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/metadata.xml
deleted file mode 100644
index 097975e3ad..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/metadata.xml
+++ /dev/null
@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-</pkgmetadata>
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-0.2.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-0.2.ebuild
deleted file mode 100644
index 57e66703b2..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-0.2.ebuild
+++ /dev/null
@@ -1,15 +0,0 @@
-# Copyright (c) 2013 CoreOS Inc. All rights reserved.
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Build tool wrappers for using custom SYSROOTs"
-HOMEPAGE="https://github.com/flatcar/sysroot-wrappers"
-SRC_URI="https://github.com/flatcar/${PN}/releases/download/v${PV}/${P}.tar.gz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="amd64 arm64"
-IUSE=""
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-9999.ebuild
deleted file mode 100644
index 2d6741f5a1..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-devel/sysroot-wrappers/sysroot-wrappers-9999.ebuild
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright (c) 2013 CoreOS Inc. All rights reserved.
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools git-r3
-
-DESCRIPTION="Build tool wrappers for using custom SYSROOTs"
-HOMEPAGE="https://github.com/coreos/sysroot-wrappers"
-EGIT_REPO_URI="https://github.com/coreos/sysroot-wrappers"
-SRC_URI=""
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="-*"
-IUSE=""
-
-src_prepare() {
-	default
-	eautoreconf
-}
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
index 7db34efb4e..3a63e50272 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
@@ -109,7 +109,7 @@ ECARGO_VENDOR="${ECARGO_HOME}/gentoo"
 #
 # If you enable CARGO_OPTIONAL, you have to set BDEPEND on virtual/rust
 # for your package and call at least cargo_gen_config manually before using
-# other src_functions of this eclass.
+# other src_functions or cargo_env of this eclass.
 # Note that cargo_gen_config is automatically called by cargo_src_unpack.
 
 # @ECLASS_VARIABLE: myfeatures
@@ -248,7 +248,7 @@ cargo_crate_uris() {
 
 # @FUNCTION: cargo_gen_config
 # @DESCRIPTION:
-# Generate the $CARGO_HOME/config necessary to use our local registry and settings.
+# Generate the $CARGO_HOME/config.toml necessary to use our local registry and settings.
 # Cargo can also be configured through environment variables in addition to the TOML syntax below.
 # For each configuration key below of the form foo.bar the environment variable CARGO_FOO_BAR
 # can also be used to define the value.
@@ -261,7 +261,7 @@ cargo_gen_config() {
 
 	mkdir -p "${ECARGO_HOME}" || die
 
-	cat > "${ECARGO_HOME}/config" <<- _EOF_ || die "Failed to create cargo config"
+	cat > "${ECARGO_HOME}/config.toml" <<- _EOF_ || die "Failed to create cargo config"
 	[source.gentoo]
 	directory = "${ECARGO_VENDOR}"
 
@@ -324,9 +324,7 @@ _cargo_gen_git_config() {
 # Return the directory within target that contains the build, e.g.
 # target/aarch64-unknown-linux-gnu/release.
 cargo_target_dir() {
-	local abi
-	tc-is-cross-compiler && abi=/$(rust_abi)
-	echo "${CARGO_TARGET_DIR:-target}${abi}/$(usex debug debug release)"
+	echo "${CARGO_TARGET_DIR:-target}/$(rust_abi)/$(usex debug debug release)"
 }
 
 # @FUNCTION: cargo_src_unpack
@@ -523,36 +521,92 @@ cargo_src_configure() {
 	[[ ${ECARGO_ARGS[@]} ]] && einfo "Configured with: ${ECARGO_ARGS[@]}"
 }
 
+# @FUNCTION: cargo_env
+# @USAGE: Command with its arguments
+# @DESCRIPTION:
+# Run the given command under an environment needed for performing tasks with
+# Cargo such as building. RUSTFLAGS are appended to additional flags set here.
+# Ensure these are set consistently between Cargo invocations, otherwise
+# rebuilds will occur. Project-specific rustflags set against [build] will not
+# take affect due to Cargo limitations, so add these to your ebuild's RUSTFLAGS
+# if they seem important.
+cargo_env() {
+	[[ ${_CARGO_GEN_CONFIG_HAS_RUN} ]] || \
+		die "FATAL: please call cargo_gen_config before using ${FUNCNAME}"
+
+	# Shadow flag variables so that filtering below remains local.
+	local flag
+	for flag in $(all-flag-vars); do
+		local -x "${flag}=${!flag}"
+	done
+
+	# Rust extensions are incompatible with C/C++ LTO compiler see e.g.
+	# https://bugs.gentoo.org/910220
+	filter-lto
+
+	tc-export AR CC CXX PKG_CONFIG
+
+	# Set vars for cc-rs crate.
+	local -x \
+		HOST_AR=$(tc-getBUILD_AR)
+		HOST_CC=$(tc-getBUILD_CC)
+		HOST_CXX=$(tc-getBUILD_CXX)
+		HOST_CFLAGS=${BUILD_CFLAGS}
+		HOST_CXXFLAGS=${BUILD_CXXFLAGS}
+
+	# Unfortunately, Cargo is *really* bad at handling flags. In short, it uses
+	# the first of the RUSTFLAGS env var, any target-specific config, and then
+	# any generic [build] config. It can merge within the latter two types from
+	# different sources, but it will not merge across these different types, so
+	# if a project sets flags under [target.'cfg(all())'], it will override any
+	# flags we set under [build] and vice-versa.
+	#
+	# It has been common for users and ebuilds to set RUSTFLAGS, which would
+	# have overridden whatever a project sets anyway, so the least-worst option
+	# is to include those RUSTFLAGS in target-specific config here, which will
+	# merge with any the project sets. Only flags in generic [build] config set
+	# by the project will be lost, and ebuilds will need to add those to
+	# RUSTFLAGS themselves if they are important.
+	#
+	# We could potentially inspect a project's generic [build] config and
+	# reapply those flags ourselves, but that would require a proper toml parser
+	# like tomlq, it might lead to confusion where projects also have
+	# target-specific config, and converting arrays to strings may not work
+	# well. Nightly features to inspect the config might help here in future.
+	#
+	# As of Rust 1.80, it is not possible to set separate flags for the build
+	# host and the target host when cross-compiling. The flags given are applied
+	# to the target host only with no flags being applied to the build host. The
+	# nightly host-config feature will improve this situation later.
+	#
+	# The default linker is "cc" so override by setting linker to CC in the
+	# RUSTFLAGS. The given linker cannot include any arguments, so split these
+	# into link-args along with LDFLAGS.
+	local -x CARGO_BUILD_TARGET=$(rust_abi)
+	local TRIPLE=${CARGO_BUILD_TARGET//-/_}
+	local TRIPLE=${TRIPLE^^} LD_A=( $(tc-getCC) ${LDFLAGS} )
+	local -x CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS="-C strip=none -C linker=${LD_A[0]}"
+	[[ ${#LD_A[@]} -gt 1 ]] && local CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS+="$(printf -- ' -C link-arg=%s' "${LD_A[@]:1}")"
+	local CARGO_TARGET_"${TRIPLE}"_RUSTFLAGS+=" ${RUSTFLAGS}"
+
+	(
+		# These variables will override the above, even if empty, so unset them
+		# locally. Do this in a subshell so that they remain set afterwards.
+		unset CARGO_BUILD_RUSTFLAGS CARGO_ENCODED_RUSTFLAGS RUSTFLAGS
+
+		"${@}"
+	)
+}
+
 # @FUNCTION: cargo_src_compile
 # @DESCRIPTION:
 # Build the package using cargo build.
 cargo_src_compile() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	[[ ${_CARGO_GEN_CONFIG_HAS_RUN} ]] || \
-		die "FATAL: please call cargo_gen_config before using ${FUNCNAME}"
-
-	filter-lto
-	tc-export AR CC CXX PKG_CONFIG
-
-	if tc-is-cross-compiler; then
-		export CARGO_BUILD_TARGET=$(rust_abi)
-		local TRIPLE=${CARGO_BUILD_TARGET//-/_}
-		export CARGO_TARGET_"${TRIPLE^^}"_LINKER=$(tc-getCC)
-
-		# Set vars for cc-rs crate.
-		tc-export_build_env
-		export \
-			HOST_AR=$(tc-getBUILD_AR)
-			HOST_CC=$(tc-getBUILD_CC)
-			HOST_CXX=$(tc-getBUILD_CXX)
-			HOST_CFLAGS=${BUILD_CFLAGS}
-			HOST_CXXFLAGS=${BUILD_CXXFLAGS}
-	fi
-
 	set -- cargo build $(usex debug "" --release) ${ECARGO_ARGS[@]} "$@"
 	einfo "${@}"
-	"${@}" || die "cargo build failed"
+	cargo_env "${@}" || die "cargo build failed"
 }
 
 # @FUNCTION: cargo_src_install
@@ -564,16 +618,13 @@ cargo_src_compile() {
 cargo_src_install() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	[[ ${_CARGO_GEN_CONFIG_HAS_RUN} ]] || \
-		die "FATAL: please call cargo_gen_config before using ${FUNCNAME}"
-
 	set -- cargo install $(has --path ${@} || echo --path ./) \
 		--root "${ED}/usr" \
 		${GIT_CRATES[@]:+--frozen} \
 		$(usex debug --debug "") \
 		${ECARGO_ARGS[@]} "$@"
 	einfo "${@}"
-	"${@}" || die "cargo install failed"
+	cargo_env "${@}" || die "cargo install failed"
 
 	rm -f "${ED}/usr/.crates.toml" || die
 	rm -f "${ED}/usr/.crates2.json" || die
@@ -585,12 +636,9 @@ cargo_src_install() {
 cargo_src_test() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	[[ ${_CARGO_GEN_CONFIG_HAS_RUN} ]] || \
-		die "FATAL: please call cargo_gen_config before using ${FUNCNAME}"
-
 	set -- cargo test $(usex debug "" --release) ${ECARGO_ARGS[@]} "$@"
 	einfo "${@}"
-	"${@}" || die "cargo test failed"
+	cargo_env "${@}" || die "cargo test failed"
 }
 
 fi
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index fa8edb5cdf..0f9dc8d14d 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -204,7 +204,7 @@ esac
 # This is an optimization that can avoid the overhead of calling into
 # the build system in pure Python packages and packages using the stable
 # Python ABI.
-DISTUTILS_ALLOW_WHEEL_REUSE=1
+: ${DISTUTILS_ALLOW_WHEEL_REUSE=1}
 
 # @ECLASS_VARIABLE: BUILD_DIR
 # @OUTPUT_VARIABLE
@@ -936,6 +936,7 @@ _distutils-r1_print_package_versions() {
 # distutils patches and/or quirks.
 distutils-r1_python_prepare_all() {
 	debug-print-function ${FUNCNAME} "${@}"
+	_python_sanity_checks
 	_distutils-r1_check_all_phase_mismatch
 
 	if [[ ! ${DISTUTILS_OPTIONAL} ]]; then
@@ -1251,7 +1252,9 @@ distutils_pep517_install() {
 		die "mydistutilsargs are banned in PEP517 mode (use DISTUTILS_ARGS)"
 	fi
 
-	local config_settings=
+	local cmd=() config_settings=
+	has cargo ${INHERITED} && cmd+=( cargo_env )
+
 	case ${DISTUTILS_USE_PEP517} in
 		maturin)
 			# `maturin pep517 build-wheel --help` for options
@@ -1388,9 +1391,14 @@ distutils_pep517_install() {
 			;;
 	esac
 
+	# https://pyo3.rs/latest/building-and-distribution.html#cross-compiling
+	if tc-is-cross-compiler; then
+		local -x PYO3_CROSS_LIB_DIR=${SYSROOT}/$(python_get_stdlib)
+	fi
+
 	local build_backend=$(_distutils-r1_get_backend)
 	einfo "  Building the wheel for ${PWD#${WORKDIR}/} via ${build_backend}"
-	local cmd=(
+	cmd+=(
 		"${EPYTHON}" -m gpep517 build-wheel
 			--prefix="${EPREFIX}/usr"
 			--backend "${build_backend}"
@@ -1792,16 +1800,6 @@ distutils-r1_run_phase() {
 		# bug fixes from Cython (this works only when setup.py is using
 		# cythonize() but it's better than nothing)
 		local -x CYTHON_FORCE_REGEN=1
-
-		# Rust extensions are incompatible with C/C++ LTO compiler
-		# see e.g. https://bugs.gentoo.org/910220
-		if has cargo ${INHERITED}; then
-			local x
-			for x in $(all-flag-vars); do
-				local -x "${x}=${!x}"
-			done
-			filter-lto
-		fi
 	fi
 
 	# silence warnings when pydevd is loaded on Python 3.11+
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index c47565fa1d..45d3da6bb9 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -332,6 +332,17 @@ _python_export() {
 				export PYTHON=${BROOT-${EPREFIX}}/usr/bin/${impl}
 				debug-print "${FUNCNAME}: PYTHON = ${PYTHON}"
 				;;
+			PYTHON_STDLIB)
+				[[ -n ${PYTHON} ]] || die "PYTHON needs to be set for ${var} to be exported, or requested before it"
+				PYTHON_STDLIB=$(
+					"${PYTHON}" - "${EPREFIX}/usr" <<-EOF || die
+						import sys, sysconfig
+						print(sysconfig.get_path("stdlib", vars={"installed_base": sys.argv[1]}))
+					EOF
+				)
+				export PYTHON_STDLIB
+				debug-print "${FUNCNAME}: PYTHON_STDLIB = ${PYTHON_STDLIB}"
+				;;
 			PYTHON_SITEDIR)
 				[[ -n ${PYTHON} ]] || die "PYTHON needs to be set for ${var} to be exported, or requested before it"
 				PYTHON_SITEDIR=$(
@@ -466,6 +477,18 @@ _python_export() {
 	done
 }
 
+# @FUNCTION: python_get_stdlib
+# @USAGE: [<impl>]
+# @DESCRIPTION:
+# Obtain and print the 'stdlib' path for the given implementation. If no
+# implementation is provided, ${EPYTHON} will be used.
+python_get_stdlib() {
+	debug-print-function ${FUNCNAME} "${@}"
+
+	_python_export "${@}" PYTHON_STDLIB
+	echo "${PYTHON_STDLIB}"
+}
+
 # @FUNCTION: python_get_sitedir
 # @USAGE: [<impl>]
 # @DESCRIPTION:
@@ -1544,4 +1567,38 @@ python_has_version() {
 	return 0
 }
 
+# @FUNCTION: _python_sanity_checks
+# @INTERNAL
+# @DESCRIPTION:
+# Perform additional environment sanity checks.
+_python_sanity_checks() {
+	debug-print-function ${FUNCNAME} "${@}"
+
+	[[ ${_PYTHON_SANITY_CHECKED} ]] && return
+
+	if [[ -v PYTHONPATH ]]; then
+		local x paths=()
+		mapfile -d ':' -t paths <<<${PYTHONPATH}
+
+		for x in "${paths[@]}"; do
+			if [[ ${x} != /* ]]; then
+				eerror "Relative path found in PYTHONPATH:"
+				eerror
+				eerror "  PYTHONPATH=${PYTHONPATH@Q}"
+				eerror
+				eerror "This is guaranteed to cause random breakage.  Please make sure that"
+				eerror "your PYTHONPATH contains absolute paths only (and only if necessary)."
+				eerror "Note that empty values (including ':' at either end and an empty"
+				eerror "PYTHONPATH) count as the current directory.  If no PYTHONPATH"
+				eerror "is intended, it needs to be unset instead."
+				die "Relative paths in PYTHONPATH are forbidden: ${x@Q}"
+			fi
+		done
+
+		elog "PYTHONPATH=${PYTHONPATH@Q}"
+	fi
+
+	_PYTHON_SANITY_CHECKED=1
+}
+
 fi
diff --git a/update_chroot b/update_chroot
index 2a9cbeb321..be8190d260 100755
--- a/update_chroot
+++ b/update_chroot
@@ -211,7 +211,6 @@ info "Updating basic system packages"
 sudo -E ${EMERGE_CMD} "${EMERGE_FLAGS[@]}" \
     sys-apps/portage \
     sys-devel/crossdev \
-    sys-devel/sysroot-wrappers \
     sys-libs/nss-usrfiles \
     "${TOOLCHAIN_PKGS[@]}"