diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-0.2.2-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-0.4.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-0.2.2-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-0.4.0.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-9999.ebuild
index fa4762df3e..ea863d371e 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/acbuild/acbuild-9999.ebuild
@@ -11,7 +11,7 @@ inherit coreos-go toolchain-funcs cros-workon
 if [[ "${PV}" == 9999 ]]; then
     KEYWORDS="~amd64 ~arm64"
 else
-    CROS_WORKON_COMMIT="e49e7de27443374a5356b7ccd9d9d7691fb5089f" # v0.2.2
+    CROS_WORKON_COMMIT="2d120a832bd4c3601ca307bf7dd1612a12b55d29" # v0.4.0
     KEYWORDS="amd64 arm64"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-0.5.1-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-0.8.11.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-0.5.1-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-0.8.11.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-9999.ebuild
index 4b11b10ef1..54f7e75dc1 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/actool/actool-9999.ebuild
@@ -11,7 +11,7 @@ inherit coreos-go cros-workon
 if [[ "${PV}" == 9999 ]]; then
     KEYWORDS="~amd64 ~arm64"
 else
-    CROS_WORKON_COMMIT="9a448f73b7fa765a60eade4bcca41e18bfe613aa" # v0.5.1
+    CROS_WORKON_COMMIT="cbe99b7160b1397bf89f9c8bb1418f69c9424049" # v0.8.11
     KEYWORDS="amd64 arm64"
 fi
 
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest
index 2647cc409e..bdfa2fee36 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest
@@ -1,3 +1,4 @@
 DIST gcc-4.7.3-r1-multilib-bootstrap.tar.bz2 8064097 SHA256 34aec5a59bb4d0ecf908c62fd418461d0f3793238296897687305fd7a1f27299 SHA512 40b93e194ad41a75d649d84d1c49070680f253a13f0617803243bc61c44fed1ca2d0a7572a97ebb79353f312b58b5f6360be916dd7435928cc53935082e15269 WHIRLPOOL bbce19e7fe5c30faa55ddd4e29070f0d1fdfca3a04e8d68e0772260fa9be89ccde63ec92badb490209008df5fee6e53dfdeec4ae51857b90ba298a79315a199f
-DIST glibc-2.25-patches-15.tar.bz2 78320 SHA256 63667d2c27d5aa540d5a9c4d8774b169933553a5cc57ff44d1c9ebbe099dc030 SHA512 7204218ea82b677e0f278c4752ddb90aa0c08ac2349d061de81ec91dac204b0f10fe223d7b1055b9e0c21dac97c835f913a90c0168a5000d3be00dd20027c185 WHIRLPOOL 21af5b2efb036d4f7290f75b23f6d2cb79f91178c3374a007fde888060c9c94306e4165cf07077cce9390c0d7b9980a2b5291a32f7b6b56895294df6975ba6d9
-DIST glibc-2.25.tar.xz 13873900 SHA256 067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0 SHA512 5b7a2418d5b8a1b6a907c6c7fb6477ee2a473151cb45e03d0d4cdd9a33497c90b1ee39e2e7e885e2b25743dcd3747336ef114b4a73eb001da1fd79f29e0f9a6e WHIRLPOOL dc2fafaa4a0e5581268338453838a03ed0c5e7a2af844e8fb7086ab8d3ae48efbdbe6f25db1d089ae669cd2f8b0412f690d965506753d86f8525da2df59b7953
+DIST gcc-multilib-bootstrap-20180511.tar.xz 2392908 BLAKE2B f3cf614399368acd8908f60d894c6344a2fa09383b30c1633a0682bc668367c8a2f8c6fec2d41b6e2178d709a2bd8db57e8b2ab56ba263c7d56f819c15acd061 SHA512 98c766e913693ab42ff790557acde2a36a8001e2648046a685b21964200df8d4d52d8452d499c0068c6648284d086ce062c2d36e2c6c2fd8aacd232d193f2853
+DIST glibc-2.26-patches-7.tar.bz2 413976 BLAKE2B 18263201cf33abf911eb7b802ed539b217391156f897a8db50f65a69627d8f8cceded78414168986ee98eba038364a6b2f3599b23f95e7b0ad2643481c399718 SHA512 0c812a343fcc68c10d92117cb2a0cf1c255470e81f0a7a04d6db2fe35445e410ef37f15162f145c2eb772b08ab55af246f5b52f5e57c2e91038181f6f027abc3
+DIST glibc-2.26.tar.xz 14682748 BLAKE2B c1c9dbec110dd4e25b2f463a96d8afc43b8e3ebfe3c958107032beaa879710252be3bc4122bb62166408725d43785f233544df6159d29cce0fc5b2c08f45adbe SHA512 6ed368523bc55f00976f96c5177f114e3f714b27273d7bffc252812c8b98fb81970403c1f5b5f0a61da678811532fb446530745492d2b49bfefc0d5bd71ce8c0
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/2.25/glibc-2.25-c-utf8-locale.patch b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/2.26/glibc-2.26-c-utf8-locale.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/2.25/glibc-2.25-c-utf8-locale.patch
rename to sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/2.26/glibc-2.26-c-utf8-locale.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.25-r11.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.25-r11.ebuild
deleted file mode 100644
index cad206842d..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.25-r11.ebuild
+++ /dev/null
@@ -1,191 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit toolchain-glibc
-
-DESCRIPTION="GNU libc6 (also called glibc2) C library"
-HOMEPAGE="https://www.gnu.org/software/libc/libc.html"
-
-LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
-KEYWORDS="alpha amd64 ~arm arm64 ~hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86"
-RESTRICT="strip" # strip ourself #46186
-EMULTILIB_PKG="true"
-
-# Configuration variables
-RELEASE_VER=""
-case ${PV} in
-9999*)
-	EGIT_REPO_URIS="git://sourceware.org/git/glibc.git"
-	EGIT_SOURCEDIRS="${S}"
-	inherit git-2
-	;;
-*)
-	RELEASE_VER=${PV}
-	;;
-esac
-GCC_BOOTSTRAP_VER="4.7.3-r1"
-# patches live at https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo/src/patchsets/glibc/
-PATCH_VER="15"                                 # Gentoo patchset
-: ${NPTL_KERN_VER:="2.6.32"}                   # min kernel version nptl requires
-
-GLIBC_PATCH_EXCLUDE+=" 0005_all_sys-types.h-drop-sys-sysmacros.h-include.patch"
-
-IUSE="audit caps debug gd hardened multilib nscd +rpc selinux systemtap profile suid vanilla headers-only"
-
-# Here's how the cross-compile logic breaks down ...
-#  CTARGET - machine that will target the binaries
-#  CHOST   - machine that will host the binaries
-#  CBUILD  - machine that will build the binaries
-# If CTARGET != CHOST, it means you want a libc for cross-compiling.
-# If CHOST != CBUILD, it means you want to cross-compile the libc.
-#  CBUILD = CHOST = CTARGET    - native build/install
-#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
-#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
-#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
-# For install paths:
-#  CHOST = CTARGET  - install into /
-#  CHOST != CTARGET - install into /usr/CTARGET/
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY} == cross-* ]] ; then
-		export CTARGET=${CATEGORY#cross-}
-	fi
-fi
-
-is_crosscompile() {
-	[[ ${CHOST} != ${CTARGET} ]]
-}
-
-# Why SLOT 2.2 you ask yourself while sippin your tea ?
-# Everyone knows 2.2 > 0, duh.
-SLOT="2.2"
-
-# General: We need a new-enough binutils/gcc to match upstream baseline.
-# arch: we need to make sure our binutils/gcc supports TLS.
-COMMON_DEPEND="
-	nscd? ( selinux? (
-		audit? ( sys-process/audit )
-		caps? ( sys-libs/libcap )
-	) )
-	suid? ( caps? ( sys-libs/libcap ) )
-	selinux? ( sys-libs/libselinux )
-	systemtap? ( dev-util/systemtap )
-"
-DEPEND="${COMMON_DEPEND}
-	>=app-misc/pax-utils-0.1.10
-	!<sys-apps/sandbox-1.6
-	!<sys-apps/portage-2.1.2"
-RDEPEND="${COMMON_DEPEND}
-	!sys-kernel/ps3-sources
-	sys-apps/gentoo-functions
-	!sys-libs/nss-db"
-
-if [[ ${CATEGORY} == cross-* ]] ; then
-	DEPEND+=" !headers-only? (
-		>=${CATEGORY}/binutils-2.24
-		>=${CATEGORY}/gcc-4.7
-	)"
-	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
-else
-	DEPEND+="
-		>=sys-devel/binutils-2.24
-		>=sys-devel/gcc-4.7
-		virtual/os-headers"
-	RDEPEND+=" vanilla? ( !sys-libs/timezone-data )"
-	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
-fi
-
-upstream_uris() {
-	echo mirror://gnu/glibc/$1 ftp://sourceware.org/pub/glibc/{releases,snapshots}/$1 mirror://gentoo/$1
-}
-gentoo_uris() {
-	local devspace="HTTP~vapier/dist/URI HTTP~dilfridge/distfiles/URI HTTP~tamiko/distfiles/URI HTTP~slyfox/distfiles/URI"
-	devspace=${devspace//HTTP/https://dev.gentoo.org/}
-	echo mirror://gentoo/$1 ${devspace//URI/$1}
-}
-SRC_URI=$(
-	[[ -z ${EGIT_REPO_URIS} ]] && upstream_uris ${P}.tar.xz
-	[[ -n ${PATCH_VER}      ]] && gentoo_uris ${P}-patches-${PATCH_VER}.tar.bz2
-)
-SRC_URI+=" ${GCC_BOOTSTRAP_VER:+multilib? ( $(gentoo_uris gcc-${GCC_BOOTSTRAP_VER}-multilib-bootstrap.tar.bz2) )}"
-
-src_unpack() {
-	[[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib && unpack gcc-${GCC_BOOTSTRAP_VER}-multilib-bootstrap.tar.bz2
-
-	toolchain-glibc_src_unpack
-}
-
-src_prepare() {
-	toolchain-glibc_src_prepare
-
-	cd "${S}"
-
-	epatch "${FILESDIR}"/2.19/${PN}-2.19-ia64-gcc-4.8-reloc-hack.patch #503838
-	## COREOS: Apply features and fixes missing from the Gentoo patch set.
-	epatch "${FILESDIR}"/${PV}/${P}-gshadow-handle-erange.patch
-	epatch "${FILESDIR}"/${PV}/${P}-c-utf8-locale.patch
-
-	if use hardened ; then
-		# We don't enable these for non-hardened as the output is very terse --
-		# it only states that a crash happened.  The default upstream behavior
-		# includes backtraces and symbols.
-		einfo "Installing Hardened Gentoo SSP and FORTIFY_SOURCE handler"
-		cp "${FILESDIR}"/2.20/glibc-2.20-gentoo-stack_chk_fail.c debug/stack_chk_fail.c || die
-		cp "${FILESDIR}"/2.25/glibc-2.25-gentoo-chk_fail.c debug/chk_fail.c || die
-
-		if use debug ; then
-			# Allow SIGABRT to dump core on non-hardened systems, or when debug is requested.
-			sed -i \
-				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-stack_chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
-				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
-				debug/Makefile || die
-		fi
-	fi
-
-	case $(gcc-fullversion) in
-	4.8.[0-3]|4.9.0)
-		eerror "You need to switch to a newer compiler; gcc-4.8.[0-3] and gcc-4.9.0 miscompile"
-		eerror "glibc.  See https://bugs.gentoo.org/547420 for details."
-		die "need to switch compilers #547420"
-		;;
-	esac
-}
-
-## COREOS: Redefine some eclass-provided functions for local changes.
-
-# For reference, this function has been modified to do:
-# - Config files are installed by baselayout, not glibc.
-# - Install nscd/systemd stuff in /usr.
-src_install() {
-	toolchain-glibc_src_install "$@"
-
-	# Work around #627378 on the boards.
-	if [[ ${ROOT:-/} =~ ^/build/ ]] ; then
-		local libm=("${ED}"/usr/lib*/libm-${PV}.so)
-		libm="${libm[0]:${#ED}}"
-		if [ -h "${ED}$libm" ] ; then
-			rm -f "${ED}$libm"
-			mv "${ED}${libm#/usr}" "${ED}$libm"
-		fi
-	fi
-
-	# Use tmpfiles to put nscd.conf in /etc and create directories.
-	insinto /usr/share/baselayout
-	if ! in_iuse nscd || use nscd ; then
-		doins "${S}"/nscd/nscd.conf || die
-		systemd_newtmpfilesd "${FILESDIR}"/nscd-conf.tmpfiles nscd-conf.conf || die
-	fi
-
-	# Clean out any default configs.
-	rm -rf "${ED}"/etc
-
-	# Restore this one for the SDK.
-	test ! -e "${T}"/00glibc || doenvd "${T}"/00glibc
-}
-
-# Ignore /dev/pts settings, since the chroot has no control over them.
-check_devpts() { : ; }
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.26-r7.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.26-r7.ebuild
new file mode 100644
index 0000000000..27da990442
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.26-r7.ebuild
@@ -0,0 +1,872 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit prefix toolchain-glibc
+
+DESCRIPTION="GNU libc C library"
+HOMEPAGE="https://www.gnu.org/software/libc/"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+RESTRICT="strip" # Strip ourself #46186
+EMULTILIB_PKG="true"
+
+# Configuration variables
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="git://sourceware.org/git/glibc.git"
+	inherit git-r3
+else
+	KEYWORDS="alpha amd64 arm arm64 ~hppa ia64 m68k ~mips ~ppc ~ppc64 s390 sh sparc x86"
+	SRC_URI="mirror://gnu/glibc/${P}.tar.xz"
+fi
+
+RELEASE_VER=${PV}
+
+GCC_BOOTSTRAP_VER=20180511
+
+# Gentoo patchset
+PATCH_VER=7
+
+SRC_URI+=" https://dev.gentoo.org/~dilfridge/distfiles/${P}-patches-${PATCH_VER}.tar.bz2"
+SRC_URI+=" multilib? ( https://dev.gentoo.org/~dilfridge/distfiles/gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz )"
+
+IUSE="audit caps debug doc gd hardened multilib nscd selinux systemtap profile suid vanilla headers-only"
+
+# Min kernel version glibc requires
+: ${NPTL_KERN_VER:="3.2.0"}
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+SLOT="2.2"
+
+# General: We need a new-enough binutils/gcc to match upstream baseline.
+# arch: we need to make sure our binutils/gcc supports TLS.
+COMMON_DEPEND="
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-util/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+	>=app-misc/pax-utils-0.1.10
+	!<sys-apps/sandbox-1.6
+	!<sys-apps/portage-2.1.2
+	doc? ( sys-apps/texinfo )
+"
+RDEPEND="${COMMON_DEPEND}
+	!sys-kernel/ps3-sources
+	sys-apps/gentoo-functions
+	!sys-libs/nss-db
+"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	DEPEND+=" !headers-only? (
+		>=${CATEGORY}/binutils-2.24
+		>=${CATEGORY}/gcc-4.9
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	DEPEND+="
+		>=sys-devel/binutils-2.24
+		>=sys-devel/gcc-4.9
+		virtual/os-headers
+	"
+	RDEPEND+=" vanilla? ( !sys-libs/timezone-data )"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+# COREOS: Ignore /dev/pts settings, since the chroot has no control over them.
+check_devpts() { : ; }
+
+#
+# the phases
+#
+
+pkg_pretend() {
+	# Make sure devpts is mounted correctly for use w/out setuid pt_chown
+	check_devpts
+
+	# Prevent native builds from downgrading
+	if [[ ${MERGE_TYPE} != "buildonly" ]] && \
+	   [[ ${ROOT} == "/" ]] && \
+	   [[ ${CBUILD} == ${CHOST} ]] && \
+	   [[ ${CHOST} == ${CTARGET} ]] ; then
+		# The high rev # is to allow people to downgrade between -r# versions.
+		# We want to block 2.20->2.19, but 2.20-r3->2.20-r2 should be fine.
+		# Hopefully we never actually use a r# this high.
+		if has_version ">${CATEGORY}/${P}-r10000" ; then
+			eerror "Sanity check to keep you from breaking your system:"
+			eerror " Downgrading glibc is not supported and a sure way to destruction"
+			die "Aborting to save your system"
+		fi
+
+		if ! glibc_run_test '#include <pwd.h>\nint main(){return getpwuid(0)==0;}\n'
+		then
+			eerror "Your patched vendor kernel is broken.  You need to get an"
+			eerror "update from whoever is providing the kernel to you."
+			eerror "https://sourceware.org/bugzilla/show_bug.cgi?id=5227"
+			eerror "https://bugs.gentoo.org/262698"
+			die "Keeping your system alive, say thank you"
+		fi
+
+		if ! glibc_run_test '#include <unistd.h>\n#include <sys/syscall.h>\nint main(){return syscall(1000)!=-1;}\n'
+		then
+			eerror "Your old kernel is broken.  You need to update it to"
+			eerror "a newer version as syscall(<bignum>) will break."
+			eerror "https://bugs.gentoo.org/279260"
+			die "Keeping your system alive, say thank you"
+		fi
+	fi
+
+	# Users have had a chance to phase themselves, time to give em the boot
+	if [[ -e ${EROOT}/etc/locale.gen ]] && [[ -e ${EROOT}/etc/locales.build ]] ; then
+		eerror "You still haven't deleted ${EROOT}/etc/locales.build."
+		eerror "Do so now after making sure ${EROOT}/etc/locale.gen is kosher."
+		die "Lazy upgrader detected"
+	fi
+
+	if [[ ${CTARGET} == i386-* ]] ; then
+		eerror "i386 CHOSTs are no longer supported."
+		eerror "Chances are you don't actually want/need i386."
+		eerror "Please read https://www.gentoo.org/doc/en/change-chost.xml"
+		die "Please fix your CHOST"
+	fi
+
+	if [[ -e /proc/xen ]] && [[ $(tc-arch) == "x86" ]] && ! is-flag -mno-tls-direct-seg-refs ; then
+		ewarn "You are using Xen but don't have -mno-tls-direct-seg-refs in your CFLAGS."
+		ewarn "This will result in a 50% performance penalty when running with a 32bit"
+		ewarn "hypervisor, which is probably not what you want."
+	fi
+
+	use hardened && ! tc-enables-pie && \
+		ewarn "PIE hardening not applied, as your compiler doesn't default to PIE"
+
+	# Make sure host system is up to date #394453
+	if has_version '<sys-libs/glibc-2.13' && \
+	   [[ -n $(scanelf -qys__guard -F'#s%F' "${EROOT}"/lib*/l*-*.so) ]]
+	then
+		ebegin "Scanning system for __guard to see if you need to rebuild first ..."
+		local files=$(
+			scanelf -qys__guard -F'#s%F' \
+				"${EROOT}"/*bin/ \
+				"${EROOT}"/lib* \
+				"${EROOT}"/usr/*bin/ \
+				"${EROOT}"/usr/lib* | \
+				egrep -v \
+					-e "^${EROOT}/lib.*/(libc|ld)-2.*.so$" \
+					-e "^${EROOT}/sbin/(ldconfig|sln)$"
+		)
+		[[ -z ${files} ]]
+		if ! eend $? ; then
+			eerror "Your system still has old SSP __guard symbols.  You need to"
+			eerror "rebuild all the packages that provide these files first:"
+			eerror "${files}"
+			die "old __guard detected"
+		fi
+	fi
+
+	# Check for sanity of /etc/nsswitch.conf
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] ; then
+		local entry
+		for entry in passwd group shadow; do
+			if ! egrep -q "^[ \t]*${entry}:.*files" "${EROOT}"/etc/nsswitch.conf; then
+				eerror "Your ${EROOT}/etc/nsswitch.conf is out of date."
+				eerror "Please make sure you have 'files' entries for"
+				eerror "'passwd:', 'group:' and 'shadow:' databases."
+				eerror "For more details see:"
+				eerror "  https://wiki.gentoo.org/wiki/Project:Toolchain/nsswitch.conf_in_glibc-2.26"
+				die "nsswitch.conf has no 'files' provider in '${entry}'."
+			fi
+		done
+	fi
+}
+
+src_unpack() {
+	use multilib && unpack gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}.tar.xz
+
+	setup_env
+
+	# Check NPTL support _before_ we unpack things to save some time
+	check_nptl_support
+
+	if [[ -n ${EGIT_REPO_URI} ]] ; then
+		git-r3_src_unpack
+	else
+		unpack ${P}.tar.xz
+	fi
+
+	cd "${S}"
+	touch locale/C-translit.h #185476 #218003
+
+	cd "${WORKDIR}"
+	unpack glibc-${RELEASE_VER}-patches-${PATCH_VER}.tar.bz2
+}
+
+src_prepare() {
+	if ! use vanilla ; then
+		elog "Applying Gentoo Glibc Patchset ${RELEASE_VER}-${PATCH_VER}"
+		eapply "${WORKDIR}"/patches
+		einfo "Done."
+	fi
+
+	if just_headers ; then
+		if [[ -e ports/sysdeps/mips/preconfigure ]] ; then
+			# mips peeps like to screw with us.  if building headers,
+			# we don't have a real compiler, so we can't let them
+			# insert -mabi on us.
+			sed -i '/CPPFLAGS=.*-mabi/s|.*|:|' ports/sysdeps/mips/preconfigure || die
+			find ports/sysdeps/mips/ -name Makefile -exec sed -i '/^CC.*-mabi=/s:-mabi=.*:-D_MIPS_SZPTR=32:' {} +
+		fi
+	fi
+
+	default
+
+	gnuconfig_update
+
+	cd "${WORKDIR}"
+	find . -name configure -exec touch {} +
+
+	eprefixify extra/locale/locale-gen
+
+	# Fix permissions on some of the scripts.
+	chmod u+x "${S}"/scripts/*.sh
+
+	cd "${S}"
+
+	## COREOS: Apply features and fixes missing from the Gentoo patch set.
+	epatch "${FILESDIR}"/${PV}/${P}-c-utf8-locale.patch
+	epatch "${FILESDIR}"/2.25/glibc-2.25-gshadow-handle-erange.patch
+
+	if use hardened ; then
+		# We don't enable these for non-hardened as the output is very terse --
+		# it only states that a crash happened.  The default upstream behavior
+		# includes backtraces and symbols.
+		einfo "Installing Hardened Gentoo SSP and FORTIFY_SOURCE handler"
+		cp "${FILESDIR}"/2.20/glibc-2.20-gentoo-stack_chk_fail.c debug/stack_chk_fail.c || die
+		cp "${FILESDIR}"/2.25/glibc-2.25-gentoo-chk_fail.c debug/chk_fail.c || die
+
+		if use debug ; then
+			# Allow SIGABRT to dump core on non-hardened systems, or when debug is requested.
+			sed -i \
+				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-stack_chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				debug/Makefile || die
+		fi
+	fi
+}
+
+glibc_do_configure() {
+	# Glibc does not work with gold (for various reasons) #269274.
+	tc-ld-disable-gold
+
+	# CXX isnt handled by the multilib system, so if we dont unset here
+	# we accumulate crap across abis
+	unset CXX
+
+	einfo "Configuring glibc for $1"
+
+	if use doc ; then
+		export MAKEINFO=makeinfo
+	else
+		export MAKEINFO=/dev/null
+	fi
+
+	local v
+	for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX LD {AS,C,CPP,CXX,LD}FLAGS MAKEINFO ; do
+		einfo " $(printf '%15s' ${v}:)   ${!v}"
+	done
+
+	# The glibc configure script doesn't properly use LDFLAGS all the time.
+	export CC="$(tc-getCC ${CTARGET}) ${LDFLAGS}"
+	einfo " $(printf '%15s' 'Manual CC:')   ${CC}"
+
+	# Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548
+	export CXX="$(tc-getCXX ${CTARGET}) $(get_abi_CFLAGS)"
+	einfo " $(printf '%15s' 'Manual CXX:')   ${CXX}"
+
+	echo
+
+	local myconf=()
+
+	# set addons
+	pushd "${S}" > /dev/null
+	local addons=$(echo */configure | sed \
+		-e 's:/configure::g' \
+		-e 's:\(linuxthreads\|nptl\|rtkaio\|glibc-compat\)\( \|$\)::g' \
+		-e 's: \+$::' \
+		-e 's! !,!g' \
+		-e 's!^!,!' \
+		-e '/^,\*$/d')
+	[[ -d ports ]] && addons+=",ports"
+	popd > /dev/null
+
+	case ${CTARGET} in
+		powerpc-*)
+			# Currently gcc on powerpc32 generates invalid code for
+			# __builtin_return_address(0) calls. Normally programs
+			# don't do that but malloc hooks in glibc do:
+			# https://gcc.gnu.org/PR81996
+			# https://bugs.gentoo.org/629054
+			myconf+=( --enable-stack-protector=no )
+			;;
+		*)
+			myconf+=( --enable-stack-protector=all )
+			;;
+	esac
+	myconf+=( --enable-stackguard-randomization )
+
+	# Keep a whitelist of targets supporing IFUNC. glibc's ./configure
+	# is not robust enough to detect proper support:
+	#    https://bugs.gentoo.org/641216
+	#    https://sourceware.org/PR22634#c0
+	case $(tc-arch ${CTARGET}) in
+		# Keep whitelist of targets where autodetection mostly works.
+		amd64|x86|sparc|ppc|ppc64|arm|arm64|s390) ;;
+		# Blacklist everywhere else
+		*) myconf+=( libc_cv_ld_gnu_indirect_function=no ) ;;
+	esac
+
+	[[ $(tc-is-softfloat) == "yes" ]] && myconf+=( --without-fp )
+
+	if [[ $1 == "nptl" ]] ; then
+		myconf+=( --enable-kernel=${NPTL_KERN_VER} )
+	else
+		die "invalid pthread option"
+	fi
+	myconf+=( --enable-add-ons="${addons#,}" )
+
+	# Since SELinux support is only required for nscd, only enable it if:
+	# 1. USE selinux
+	# 2. only for the primary ABI on multilib systems
+	# 3. Not a crosscompile
+	if ! is_crosscompile && use selinux ; then
+		if use multilib ; then
+			if is_final_abi ; then
+				myconf+=( --with-selinux )
+			else
+				myconf+=( --without-selinux )
+			fi
+		else
+			myconf+=( --with-selinux )
+		fi
+	else
+		myconf+=( --without-selinux )
+	fi
+
+	# Force a few tests where we always know the answer but
+	# configure is incapable of finding it.
+	if is_crosscompile ; then
+		export \
+			libc_cv_c_cleanup=yes \
+			libc_cv_forced_unwind=yes
+	fi
+
+	myconf+=(
+		--without-cvs
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		$(use_enable profile)
+		$(use_with gd)
+		--with-headers=$(alt_build_headers)
+		--prefix="${EPREFIX}/usr"
+		--sysconfdir="${EPREFIX}/etc"
+		--localstatedir="${EPREFIX}/var"
+		--libdir='$(prefix)'/$(get_libdir)
+		--mandir='$(prefix)'/share/man
+		--infodir='$(prefix)'/share/info
+		--libexecdir='$(libdir)'/misc/glibc
+		--with-bugurl=https://bugs.gentoo.org/
+		--with-pkgversion="$(glibc_banner)"
+		$(use_multiarch || echo --disable-multi-arch)
+		$(in_iuse systemtap && use_enable systemtap)
+		$(in_iuse nscd && use_enable nscd)
+		${EXTRA_ECONF}
+	)
+
+	# We rely on sys-libs/timezone-data for timezone tools normally.
+	myconf+=( $(use_enable vanilla timezone-tools) )
+
+	# These libs don't have configure flags.
+	ac_cv_lib_audit_audit_log_user_avc_message=$(in_iuse audit && usex audit || echo no)
+	ac_cv_lib_cap_cap_init=$(in_iuse caps && usex caps || echo no)
+
+	# There is no configure option for this and we need to export it
+	# since the glibc build will re-run configure on itself
+	export libc_cv_rootsbindir="${EPREFIX}/sbin"
+	export libc_cv_slibdir="${EPREFIX}/$(get_libdir)"
+
+	# We take care of patching our binutils to use both hash styles,
+	# and many people like to force gnu hash style only, so disable
+	# this overriding check.  #347761
+	export libc_cv_hashstyle=no
+
+	local builddir=$(builddir "$1")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+	set -- "${S}"/configure "${myconf[@]}"
+	echo "$@"
+	"$@" || die "failed to configure glibc"
+
+	# ia64 static cross-compilers are a pita in so much that they
+	# can't produce static ELFs (as the libgcc.a is broken).  so
+	# disable building of the programs for those targets if it
+	# doesn't work.
+	# XXX: We could turn this into a compiler test, but ia64 is
+	# the only one that matters, so this should be fine for now.
+	if is_crosscompile && [[ ${CTARGET} == ia64* ]] ; then
+		sed -i '1i+link-static = touch $@' config.make
+	fi
+
+	# If we're trying to migrate between ABI sets, we need
+	# to lie and use a local copy of gcc.  Like if the system
+	# is built with MULTILIB_ABIS="amd64 x86" but we want to
+	# add x32 to it, gcc/glibc don't yet support x32.
+	if [[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib ; then
+		echo 'main(){}' > "${T}"/test.c
+		if ! $(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS} "${T}"/test.c -Wl,-emain -lgcc 2>/dev/null ; then
+			sed -i -e '/^CC = /s:$: -B$(objdir)/../'"gcc-multilib-bootstrap-${GCC_BOOTSTRAP_VER}/${ABI}:" config.make || die
+		fi
+	fi
+}
+
+glibc_headers_configure() {
+	export ABI=default
+
+	local builddir=$(builddir "headers")
+	mkdir -p "${builddir}"
+	cd "${builddir}"
+
+	# if we don't have a compiler yet, we can't really test it now ...
+	# hopefully they don't affect header generation, so let's hope for
+	# the best here ...
+	local v vars=(
+		ac_cv_header_cpuid_h=yes
+		libc_cv_{386,390,alpha,arm,hppa,ia64,mips,{powerpc,sparc}{,32,64},sh,x86_64}_tls=yes
+		libc_cv_asm_cfi_directives=yes
+		libc_cv_broken_visibility_attribute=no
+		libc_cv_c_cleanup=yes
+		libc_cv_forced_unwind=yes
+		libc_cv_gcc___thread=yes
+		libc_cv_mlong_double_128=yes
+		libc_cv_mlong_double_128ibm=yes
+		libc_cv_ppc_machine=yes
+		libc_cv_ppc_rel16=yes
+		libc_cv_predef_fortify_source=no
+		libc_cv_visibility_attribute=yes
+		libc_cv_z_combreloc=yes
+		libc_cv_z_execstack=yes
+		libc_cv_z_initfirst=yes
+		libc_cv_z_nodelete=yes
+		libc_cv_z_nodlopen=yes
+		libc_cv_z_relro=yes
+		libc_mips_abi=${ABI}
+		libc_mips_float=$([[ $(tc-is-softfloat) == "yes" ]] && echo soft || echo hard)
+		# These libs don't have configure flags.
+		ac_cv_lib_audit_audit_log_user_avc_message=no
+		ac_cv_lib_cap_cap_init=no
+	)
+
+	einfo "Forcing cached settings:"
+	for v in "${vars[@]}" ; do
+		einfo " ${v}"
+		export ${v}
+	done
+
+	# Blow away some random CC settings that screw things up. #550192
+	if [[ -d ${S}/sysdeps/mips ]]; then
+		pushd "${S}"/sysdeps/mips >/dev/null
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=32:' mips32/Makefile mips64/n32/Makefile || die
+		sed -i -e '/^CC +=/s:=.*:= -D_MIPS_SZPTR=64:' mips64/n64/Makefile || die
+
+		# Force the mips ABI to the default.  This is OK because the set of
+		# installed headers in this phase is the same between the 3 ABIs.
+		# If this ever changes, this hack will break, but that's unlikely
+		# as glibc discourages that behavior.
+		# https://crbug.com/647033
+		sed -i -e 's:abiflag=.*:abiflag=_ABIO32:' preconfigure || die
+
+		popd >/dev/null
+	fi
+
+	local myconf=()
+	myconf+=(
+		--disable-sanity-checks
+		--enable-hacker-mode
+		--without-cvs
+		--disable-werror
+		--enable-bind-now
+		--build=${CBUILD_OPT:-${CBUILD}}
+		--host=${CTARGET_OPT:-${CTARGET}}
+		--with-headers=$(alt_build_headers)
+		--prefix="${EPREFIX}/usr"
+		${EXTRA_ECONF}
+	)
+
+	local addons
+	[[ -d ${S}/ports ]] && addons+=",ports"
+	myconf+=( --enable-add-ons="${addons#,}" )
+
+	# Nothing is compiled here which would affect the headers for the target.
+	# So forcing CC/CFLAGS is sane.
+	local headers_only_CC=$(tc-getBUILD_CC)
+	local headers_only_CFLAGS="-O1 -pipe"
+	local headers_only_CPPFLAGS="-U_FORTIFY_SOURCE"
+	local headers_only_LDFLAGS=""
+	set -- "${S}"/configure "${myconf[@]}"
+	echo \
+		"CC=${headers_only_CC}" \
+		"CFLAGS=${headers_only_CFLAGS}" \
+		"CPPFLAGS=${headers_only_CPPFLAGS}" \
+		"LDFLAGS=${headers_only_LDFLAGS}" \
+		"$@"
+	CC=${headers_only_CC} \
+	CFLAGS=${headers_only_CFLAGS} \
+	CPPFLAGS=${headers_only_CPPFLAGS} \
+	LDFLAGS="" \
+	"$@" || die "failed to configure glibc"
+}
+
+do_src_configure() {
+	if just_headers ; then
+		glibc_headers_configure
+	else
+		glibc_do_configure nptl
+	fi
+}
+
+src_configure() {
+	foreach_abi do_src_configure
+}
+
+do_src_compile() {
+	emake -C "$(builddir nptl)" || die "make nptl for ${ABI} failed"
+}
+
+src_compile() {
+	if just_headers ; then
+		return
+	fi
+
+	foreach_abi do_src_compile
+}
+
+glibc_src_test() {
+	cd "$(builddir $1)"
+	emake check
+}
+
+do_src_test() {
+	local ret=0
+
+	glibc_src_test nptl
+	: $(( ret |= $? ))
+
+	return ${ret}
+}
+
+src_test() {
+	if just_headers ; then
+		return
+	fi
+	# Give tests more time to complete.
+	export TIMEOUTFACTOR=5
+
+	foreach_abi do_src_test || die "tests failed"
+}
+
+glibc_do_src_install() {
+	local builddir=$(builddir nptl)
+	cd "${builddir}"
+
+	emake install_root="${D}$(alt_prefix)" install || die
+
+	# This version (2.26) provides some compatibility libraries for the NIS/NIS+ support
+	# which come without headers etc. Only needed for binary packages since the
+	# external net-libs/libnsl has increased soversion. Keep only versioned libraries.
+	find "${D}" -name "libnsl.a" -delete
+	find "${D}" -name "libnsl.so" -delete
+
+	# Normally upstream_pv is ${PV}. Live ebuilds are exception, there we need
+	# to infer upstream version:
+	# '#define VERSION "2.26.90"' -> '2.26.90'
+	local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h)
+
+	if [[ -e ${ED}$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then
+		# Move versioned .a file out of libdir to evade portage QA checks
+		# instead of using gen_usr_ldscript(). We fix ldscript as:
+		# "GROUP ( /usr/lib64/libm-<pv>.a ..." -> "GROUP ( /usr/lib64/glibc-<pv>/libm-<pv>.a ..."
+		sed -i "s@\(libm-${upstream_pv}.a\)@${P}/\1@" "${ED}"$(alt_usrlibdir)/libm.a || die
+		dodir $(alt_usrlibdir)/${P}
+		mv "${ED}"$(alt_usrlibdir)/libm-${upstream_pv}.a "${ED}"$(alt_usrlibdir)/${P}/libm-${upstream_pv}.a || die
+	fi
+
+	# We'll take care of the cache ourselves
+	rm -f "${ED}"/etc/ld.so.cache
+
+	# Everything past this point just needs to be done once ...
+	is_final_abi || return 0
+
+	# Make sure the non-native interp can be found on multilib systems even
+	# if the main library set isn't installed into the right place.  Maybe
+	# we should query the active gcc for info instead of hardcoding it ?
+	local i ldso_abi ldso_name
+	local ldso_abi_list=(
+		# x86
+		amd64   /lib64/ld-linux-x86-64.so.2
+		x32     /libx32/ld-linux-x32.so.2
+		x86     /lib/ld-linux.so.2
+		# mips
+		o32     /lib/ld.so.1
+		n32     /lib32/ld.so.1
+		n64     /lib64/ld.so.1
+		# powerpc
+		ppc     /lib/ld.so.1
+		ppc64   /lib64/ld64.so.1
+		# s390
+		s390    /lib/ld.so.1
+		s390x   /lib/ld64.so.1
+		# sparc
+		sparc32 /lib/ld-linux.so.2
+		sparc64 /lib64/ld-linux.so.2
+	)
+	case $(tc-endian) in
+	little)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64.so.1
+		)
+		;;
+	big)
+		ldso_abi_list+=(
+			# arm
+			arm64   /lib/ld-linux-aarch64_be.so.1
+		)
+		;;
+	esac
+	if [[ ${SYMLINK_LIB} == "yes" ]] && [[ ! -e ${ED}/$(alt_prefix)/lib ]] ; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) $(alt_prefix)/lib
+	fi
+	for (( i = 0; i < ${#ldso_abi_list[@]}; i += 2 )) ; do
+		ldso_abi=${ldso_abi_list[i]}
+		has ${ldso_abi} $(get_install_abis) || continue
+
+		ldso_name="$(alt_prefix)${ldso_abi_list[i+1]}"
+		if [[ ! -L ${ED}/${ldso_name} && ! -e ${ED}/${ldso_name} ]] ; then
+			dosym ../$(get_abi_LIBDIR ${ldso_abi})/${ldso_name##*/} ${ldso_name}
+		fi
+	done
+
+	# With devpts under Linux mounted properly, we do not need the pt_chown
+	# binary to be setuid.  This is because the default owners/perms will be
+	# exactly what we want.
+	if in_iuse suid && ! use suid ; then
+		find "${ED}" -name pt_chown -exec chmod -s {} +
+	fi
+
+	#################################################################
+	# EVERYTHING AFTER THIS POINT IS FOR NATIVE GLIBC INSTALLS ONLY #
+	# Make sure we install some symlink hacks so that when we build
+	# a 2nd stage cross-compiler, gcc finds the target system
+	# headers correctly.  See gcc/doc/gccinstall.info
+	if is_crosscompile ; then
+		# We need to make sure that /lib and /usr/lib always exists.
+		# gcc likes to use relative paths to get to its multilibs like
+		# /usr/lib/../lib64/.  So while we don't install any files into
+		# /usr/lib/, we do need it to exist.
+		cd "${ED}"$(alt_libdir)/..
+		[[ -e lib ]] || mkdir lib
+		cd "${ED}"$(alt_usrlibdir)/..
+		[[ -e lib ]] || mkdir lib
+
+		dosym usr/include $(alt_prefix)/sys-include
+		return 0
+	fi
+
+	# Files for Debian-style locale updating
+	dodir /usr/share/i18n
+	sed \
+		-e "/^#/d" \
+		-e "/SUPPORTED-LOCALES=/d" \
+		-e "s: \\\\::g" -e "s:/: :g" \
+		"${S}"/localedata/SUPPORTED > "${ED}"/usr/share/i18n/SUPPORTED \
+		|| die "generating /usr/share/i18n/SUPPORTED failed"
+	cd "${WORKDIR}"/extra/locale
+	dosbin locale-gen
+	doman *.[0-8]
+	insinto /etc
+	doins locale.gen
+
+	# Make sure all the ABI's can find the locales and so we only
+	# have to generate one set
+	local a
+	keepdir /usr/$(get_libdir)/locale
+	for a in $(get_install_abis) ; do
+		if [[ ! -e ${ED}/usr/$(get_abi_LIBDIR ${a})/locale ]] ; then
+			dosym ../$(get_libdir)/locale /usr/$(get_abi_LIBDIR ${a})/locale
+		fi
+	done
+
+	cd "${S}"
+
+	# Install misc network config files
+	insinto /etc
+	doins nscd/nscd.conf posix/gai.conf nss/nsswitch.conf
+	doins "${WORKDIR}"/extra/etc/*.conf
+
+	if use nscd ; then
+		doinitd "$(prefixify_ro "${WORKDIR}"/extra/etc/nscd)"
+
+		local nscd_args=(
+			-e "s:@PIDFILE@:$(strings "${ED}"/usr/sbin/nscd | grep nscd.pid):"
+		)
+
+		sed -i "${nscd_args[@]}" "${ED}"/etc/init.d/nscd
+
+		systemd_dounit nscd/nscd.service
+		systemd_newtmpfilesd nscd/nscd.tmpfiles nscd.conf
+	else
+		# Do this since extra/etc/*.conf above might have nscd.conf.
+		rm -f "${ED}"/etc/nscd.conf
+	fi
+
+	echo 'LDPATH="include ld.so.conf.d/*.conf"' > "${T}"/00glibc
+	doenvd "${T}"/00glibc
+
+	for d in BUGS ChangeLog* CONFORMANCE FAQ NEWS NOTES PROJECTS README* ; do
+		[[ -s ${d} ]] && dodoc ${d}
+	done
+
+	# Prevent overwriting of the /etc/localtime symlink.  We'll handle the
+	# creation of the "factory" symlink in pkg_postinst().
+	rm -f "${ED}"/etc/localtime
+
+	## COREOS: Add some local changes:
+	# - Config files are installed by baselayout, not glibc.
+	# - Install nscd/systemd stuff in /usr.
+
+	# Use tmpfiles to put nscd.conf in /etc and create directories.
+	insinto /usr/share/baselayout
+	if ! in_iuse nscd || use nscd ; then
+		doins "${S}"/nscd/nscd.conf || die
+		systemd_newtmpfilesd "${FILESDIR}"/nscd-conf.tmpfiles nscd-conf.conf || die
+	fi
+
+	# Clean out any default configs.
+	rm -rf "${ED}"/etc
+
+	# Restore this one for the SDK.
+	test ! -e "${T}"/00glibc || doenvd "${T}"/00glibc
+}
+
+glibc_headers_install() {
+	local builddir=$(builddir "headers")
+	cd "${builddir}"
+	emake install_root="${D}$(alt_prefix)" install-headers
+
+	insinto $(alt_headers)/gnu
+	doins "${S}"/include/gnu/stubs.h
+
+	# Make sure we install the sys-include symlink so that when
+	# we build a 2nd stage cross-compiler, gcc finds the target
+	# system headers correctly.  See gcc/doc/gccinstall.info
+	dosym usr/include $(alt_prefix)/sys-include
+}
+
+src_install() {
+	if just_headers ; then
+		export ABI=default
+		glibc_headers_install
+		return
+	fi
+
+	foreach_abi glibc_do_src_install
+	src_strip
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	# Default /etc/hosts.conf:multi to on for systems with small dbs.
+	if [[ $(wc -l < "${EROOT}"/etc/hosts) -lt 1000 ]] ; then
+		sed -i '/^multi off/s:off:on:' "${ED}"/etc/host.conf
+		einfo "Defaulting /etc/host.conf:multi to on"
+	fi
+
+	[[ ${ROOT} != "/" ]] && return 0
+	[[ -d ${ED}/$(get_libdir) ]] || return 0
+	[[ -z ${BOOTSTRAP_RAP} ]] && glibc_sanity_check
+}
+
+pkg_postinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	if ! tc-is-cross-compiler && [[ -x ${EROOT}/usr/sbin/iconvconfig ]] ; then
+		# Generate fastloading iconv module configuration file.
+		"${EROOT}"/usr/sbin/iconvconfig --prefix="${ROOT}"
+	fi
+
+	if ! is_crosscompile && [[ ${ROOT} == "/" ]] ; then
+		# Reload init ... if in a chroot or a diff init package, ignore
+		# errors from this step #253697
+		/sbin/telinit U 2>/dev/null
+
+		# if the host locales.gen contains no entries, we'll install everything
+		local locale_list="${EROOT}etc/locale.gen"
+		if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then
+			ewarn "Generating all locales; edit /etc/locale.gen to save time/space"
+			locale_list="${EROOT}usr/share/i18n/SUPPORTED"
+		fi
+		locale-gen -j $(makeopts_jobs) --config "${locale_list}"
+	fi
+
+	# Check for sanity of /etc/nsswitch.conf, take 2
+	if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then
+		local entry
+		for entry in passwd group shadow; do
+			if egrep -q "^[ \t]*${entry}:.*nis" "${EROOT}"/etc/nsswitch.conf; then
+				ewarn ""
+				ewarn "Your ${EROOT}/etc/nsswitch.conf uses NIS. Support for that has been"
+				ewarn "removed from glibc and is now provided by the package"
+				ewarn "  sys-auth/libnss-nis"
+				ewarn "Install it now to keep your NIS setup working."
+				ewarn ""
+			fi
+		done
+	fi
+}