diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/Manifest
new file mode 100644
index 0000000000..6bb7ddd4b6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/Manifest
@@ -0,0 +1,5 @@
+DIST ngtcp2-1.12.0.tar.xz 656116 BLAKE2B 8559b5ca68bfcb0a290e3dc81311f8d3a8e15d49ce8ea423262b5c40d3ecd3e496f1b37bfc98da3cacbf76cd863c57fe050663fa8356a9d09923762d1c896938 SHA512 9d387df7d80665a346b170cf2adc0cc1163ae8d1d921355c1c07ec4e788feb76b9fd681dd606b139b3a2c27f3f0cf3e0a61014b9a3623c4bc06e86d32da0a90b
+DIST ngtcp2-1.20.0.tar.xz 684060 BLAKE2B 1666c711688674eca1aba86dfca68f421557bf0c49f14ef915b9103b30a5c26b977d74a8cbdfa1466fe80148fdcb6d6f4061c402c5bca8201c071e57684d4132 SHA512 2366b6ae29664617776c901b05976a5cbd5443da8051854ce6c6e7b7779f5630bc2638a97144f4090a0e140a1a7607460b0b738cf55128d9e3bf31f872db26a8
+DIST ngtcp2-1.20.0.tar.xz.asc 833 BLAKE2B 62adeb882ce0023934534f5bad8f13395d66e0a54505ea654e6930c45eeba1fe5e21b964e1d8d2893732a6b8e742d1781c38034ebc69f4c87da5261ec1c7491e SHA512 1a57a1f9969f62a852390193de76685984e87ef5deec53a5a2937198deb01f7b2980989406f23ad58441baec9f881094028bd65c6cf309a73575a41d2ad1b01a
+DIST ngtcp2-1.21.0.tar.xz 687504 BLAKE2B 1ce024c811b0e084478607a48d5ebc1e5840b9067178d5328fe9c32336243af3860923905a35043b9e431b518df6c7ff687e66955fe96bb344b7a980c8b42d31 SHA512 8f1fab5f71364da2b42a3a2726089520b7b2bf751bd7ba3b8de153091cb36c6e983ab71cf2bb8cd62b29b665331dc08c5e40d106066f79474059a77e4f7f9361
+DIST ngtcp2-1.21.0.tar.xz.asc 833 BLAKE2B 097b3328acd32c8a3fd77b9494b56d41fd93d511e2d709a607f5865b4408e8c6c5ba6c0ce99904b378845f7dad856ebefeea334e0b325ea416a3295a21b97a03 SHA512 267ab883b912ae9cb294d441d2937446db1bb46e0ca7df1fe78a4108caf94f403af75ec01448a9ad01e9b5f6045db2929d22eeb8feebcf35c0ed1e83100eef63
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/metadata.xml b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/metadata.xml
new file mode 100644
index 0000000000..4b6987e8ad
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>candrews@gentoo.org</email>
+		<name>Craig Andrews</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">ngtcp2/ngtcp2</remote-id>
+	</upstream>
+	<use>
+		<flag name="openssl">Provide SSL support using OpenSSL (requires <pkg>dev-libs/openssl</pkg>)</flag>
+	</use>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.12.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.12.0.ebuild
new file mode 100644
index 0000000000..366d9b923a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.12.0.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Built with autotools rather than cmake to avoid circular dep (bug #951524
+
+inherit multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/ngtcp2/ngtcp2.git"
+	inherit autotools git-r3
+else
+	SRC_URI="https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz"
+
+	KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+fi
+
+DESCRIPTION="Implementation of the IETF QUIC Protocol"
+HOMEPAGE="https://github.com/ngtcp2/ngtcp2"
+
+LICENSE="MIT"
+SLOT="0/0"
+IUSE="+gnutls openssl +ssl"
+REQUIRED_USE="ssl? ( || ( gnutls openssl ) )"
+
+RDEPEND="
+	ssl? (
+		gnutls? ( >=net-libs/gnutls-3.7.2:=[${MULTILIB_USEDEP}] )
+		openssl? ( >=dev-libs/openssl-1.1.1:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+src_prepare() {
+	default
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--disable-werror
+		--enable-lib-only
+		$(use_with openssl)
+		$(use_with gnutls)
+		--without-boringssl
+		--without-picotls
+		--without-wolfssl
+		--without-libev
+		--without-libnghttp3
+		--without-jemalloc
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}"/usr -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0-r1.ebuild
new file mode 100644
index 0000000000..81f58ee6eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0-r1.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Built with autotools rather than cmake to avoid circular dep (bug #951524
+
+inherit multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/ngtcp2/ngtcp2.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/ngtcp2.asc
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-ngtcp2 )"
+fi
+
+DESCRIPTION="Implementation of the IETF QUIC Protocol"
+HOMEPAGE="https://nghttp2.org/ngtcp2/ https://github.com/ngtcp2/ngtcp2"
+
+LICENSE="MIT"
+SLOT="0/0"
+IUSE="gnutls +openssl +ssl"
+REQUIRED_USE="ssl? ( || ( gnutls openssl ) )"
+
+# Uses SSL_set_quic_tls_cbs to detect OpenSSL. The function was introduced in
+# OpenSSL 3.5:
+# https://docs.openssl.org/master/man3/SSL_set_quic_tls_cbs/#history.
+RDEPEND="
+	ssl? (
+		gnutls? ( >=net-libs/gnutls-3.7.2:=[${MULTILIB_USEDEP}] )
+		openssl? ( >=dev-libs/openssl-3.5:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+=" virtual/pkgconfig"
+
+# QuicTLS function, the OpenSSL support is checked via SSL_set_quic_tls_cbs.
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'SSL_provide_quic_data'
+)
+
+src_prepare() {
+	default
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--disable-werror
+		--enable-lib-only
+		$(use_with openssl)
+		$(use_with gnutls)
+		--without-boringssl
+		--without-picotls
+		--without-wolfssl
+		--without-libev
+		--without-libnghttp3
+		--without-jemalloc
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}"/usr -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0.ebuild
new file mode 100644
index 0000000000..42d4a5a65c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.20.0.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Built with autotools rather than cmake to avoid circular dep (bug #951524
+
+inherit multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/ngtcp2/ngtcp2.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/ngtcp2.asc
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-ngtcp2 )"
+fi
+
+DESCRIPTION="Implementation of the IETF QUIC Protocol"
+HOMEPAGE="https://nghttp2.org/ngtcp2/ https://github.com/ngtcp2/ngtcp2"
+
+LICENSE="MIT"
+SLOT="0/0"
+IUSE="+gnutls openssl +ssl"
+REQUIRED_USE="ssl? ( || ( gnutls openssl ) )"
+
+RDEPEND="
+	ssl? (
+		gnutls? ( >=net-libs/gnutls-3.7.2:=[${MULTILIB_USEDEP}] )
+		openssl? ( >=dev-libs/openssl-1.1.1:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+=" virtual/pkgconfig"
+
+src_prepare() {
+	default
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--disable-werror
+		--enable-lib-only
+		$(use_with openssl)
+		$(use_with gnutls)
+		--without-boringssl
+		--without-picotls
+		--without-wolfssl
+		--without-libev
+		--without-libnghttp3
+		--without-jemalloc
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}"/usr -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.21.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.21.0.ebuild
new file mode 100644
index 0000000000..a910ee17d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-1.21.0.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Built with autotools rather than cmake to avoid circular dep (bug #951524
+
+inherit multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/ngtcp2/ngtcp2.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/ngtcp2.asc
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~arm64-macos ~x64-macos"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-ngtcp2 )"
+fi
+
+DESCRIPTION="Implementation of the IETF QUIC Protocol"
+HOMEPAGE="https://nghttp2.org/ngtcp2/ https://github.com/ngtcp2/ngtcp2"
+
+LICENSE="MIT"
+SLOT="0/0"
+IUSE="gnutls +openssl +ssl"
+REQUIRED_USE="ssl? ( || ( gnutls openssl ) )"
+
+# Uses SSL_set_quic_tls_cbs to detect OpenSSL. The function was introduced in
+# OpenSSL 3.5:
+# https://docs.openssl.org/master/man3/SSL_set_quic_tls_cbs/#history.
+RDEPEND="
+	ssl? (
+		gnutls? ( >=net-libs/gnutls-3.7.2:=[${MULTILIB_USEDEP}] )
+		openssl? ( >=dev-libs/openssl-3.5:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+=" virtual/pkgconfig"
+
+# QuicTLS function, the OpenSSL support is checked via SSL_set_quic_tls_cbs.
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'SSL_provide_quic_data'
+)
+
+src_prepare() {
+	default
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--disable-werror
+		--enable-lib-only
+		$(use_with openssl)
+		$(use_with gnutls)
+		--without-boringssl
+		--without-picotls
+		--without-wolfssl
+		--without-libev
+		--without-libnghttp3
+		--without-jemalloc
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}"/usr -type f -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-9999.ebuild
new file mode 100644
index 0000000000..81f58ee6eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/ngtcp2/ngtcp2-9999.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Built with autotools rather than cmake to avoid circular dep (bug #951524
+
+inherit multilib-minimal
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/ngtcp2/ngtcp2.git"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/ngtcp2.asc
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz
+		verify-sig? ( https://github.com/ngtcp2/ngtcp2/releases/download/v${PV}/${P}.tar.xz.asc )
+	"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-ngtcp2 )"
+fi
+
+DESCRIPTION="Implementation of the IETF QUIC Protocol"
+HOMEPAGE="https://nghttp2.org/ngtcp2/ https://github.com/ngtcp2/ngtcp2"
+
+LICENSE="MIT"
+SLOT="0/0"
+IUSE="gnutls +openssl +ssl"
+REQUIRED_USE="ssl? ( || ( gnutls openssl ) )"
+
+# Uses SSL_set_quic_tls_cbs to detect OpenSSL. The function was introduced in
+# OpenSSL 3.5:
+# https://docs.openssl.org/master/man3/SSL_set_quic_tls_cbs/#history.
+RDEPEND="
+	ssl? (
+		gnutls? ( >=net-libs/gnutls-3.7.2:=[${MULTILIB_USEDEP}] )
+		openssl? ( >=dev-libs/openssl-3.5:=[${MULTILIB_USEDEP}] )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+=" virtual/pkgconfig"
+
+# QuicTLS function, the OpenSSL support is checked via SSL_set_quic_tls_cbs.
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'SSL_provide_quic_data'
+)
+
+src_prepare() {
+	default
+	[[ ${PV} == 9999 ]] && eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--disable-werror
+		--enable-lib-only
+		$(use_with openssl)
+		$(use_with gnutls)
+		--without-boringssl
+		--without-picotls
+		--without-wolfssl
+		--without-libev
+		--without-libnghttp3
+		--without-jemalloc
+	)
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}"/usr -type f -name '*.la' -delete || die
+}