diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index d687dd5546..a7a41d87f6 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -563,6 +563,7 @@ sys-firmware/ipxe
 sys-firmware/seabios-bin
 sys-firmware/sgabios
 
+sys-fs/btrfs-progs
 sys-fs/cryptsetup
 sys-fs/dosfstools
 sys-fs/e2fsprogs
diff --git a/changelog/security/2024-07-29-weekly-updates.md b/changelog/security/2024-07-29-weekly-updates.md
new file mode 100644
index 0000000000..d5cb374552
--- /dev/null
+++ b/changelog/security/2024-07-29-weekly-updates.md
@@ -0,0 +1,2 @@
+- curl ([CVE-2024-6197](https://nvd.nist.gov/vuln/detail/CVE-2024-6197), [CVE-2024-6874](https://nvd.nist.gov/vuln/detail/CVE-2024-6874))
+- podman ([CVE-2024-3727](https://nvd.nist.gov/vuln/detail/CVE-2024-3727))
diff --git a/changelog/updates/2024-07-29-weekly-updates.md b/changelog/updates/2024-07-29-weekly-updates.md
new file mode 100644
index 0000000000..39d57bc408
--- /dev/null
+++ b/changelog/updates/2024-07-29-weekly-updates.md
@@ -0,0 +1,19 @@
+- btrfs-progs ([6.9.2](https://github.com/kdave/btrfs-progs/blob/v6.9.2/CHANGES))
+- c-ares ([1.29.0](https://github.com/c-ares/c-ares/releases/tag/cares-1_29_0))
+- cryptsetup ([2.7.2](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.2/docs/v2.7.2-ReleaseNotes) (includes [2.7.1](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.1/docs/v2.7.1-ReleaseNotes) and [2.7.0](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.7.0/docs/v2.7.0-ReleaseNotes)))
+- curl ([8.9.0](https://curl.se/ch/8.9.0.html))
+- e2fsprogs ([1.47.1](https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.1))
+- ethtool ([6.9](https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/tree/NEWS?h=v6.9))
+- findutils ([4.10.0](https://git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v4.10.0))
+- gcc ([13.3.1_p20240614](https://gcc.gnu.org/gcc-13/changes.html))
+- hwdata ([0.383](https://github.com/vcrhonek/hwdata/compare/v0.382...v0.383))
+- libksba ([1.6.7](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=blob;f=NEWS;h=3d2d5a47688bb6214efaf02f5ab29f6e64433a97;hb=b14e68b97df754b2bb7a90bb904d143d8e896afb))
+- pciutils ([3.13.0](https://github.com/pciutils/pciutils/blob/v3.13.0/ChangeLog))
+- sysext-podman: podman ([5.0.3](https://github.com/containers/podman/releases/tag/v5.0.3))
+- sysext-python: setuptools ([70.3.0](https://github.com/pypa/setuptools/blob/v70.3.0/NEWS.rst))
+- strace ([6.9](https://github.com/strace/strace/releases/tag/v6.9))
+- tpm2-tools ([5.7](https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7))
+- tpm2-tss ([4.1.3](https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.3))
+- util-linux ([2.39.4](https://github.com/util-linux/util-linux/blob/v2.39.4/Documentation/releases/v2.39.4-ReleaseNotes))
+- xfsprogs ([6.8.0](https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/tree/doc/CHANGES?h=v6.8.0))
+- xz-utils ([5.6.2](https://github.com/tukaani-project/xz/releases/tag/v5.6.2))
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 943371daef..4e72306548 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -7,20 +7,19 @@
 # Gentoo upstream package stabilisation
 # (the following packages are "unstable" upstream; we're stabilising these)
 
-# Catalyst 4 is not stable yet, but earlier versions are masked now.
-dev-util/catalyst ~amd64 ~arm64
-
 # Handled by automation
 =app-containers/containerd-1.7.20 ~amd64 ~arm64 # DO NOT EDIT THIS LINE. Added by containerd-apply-patch.sh on 2024-07-19 08:17:43
 
-# Handled by automation?
-=app-containers/cri-tools-1.27.0 ~amd64 ~arm64
+# Keep versions on both arches in sync.
+=app-containers/cri-tools-1.27.0 ~arm64
+
+# Needed to address CVE-2024-3727
+=app-containers/podman-5.0.3 ~amd64 ~arm64
 
 # These seem to be the versions we initially got, but the
 # modifications made to the ebuilds were clobbered, so these are here
 # to keep using the same version. Can be dropped when these or newer
 # get stabilized in Gentoo.
-=app-containers/podman-5.0.2 ~amd64 ~arm64
 =app-containers/runc-1.1.13 ~amd64 ~arm64
 
 # Seems to be the only available ebuild in portage-stable right now.
@@ -43,7 +42,7 @@ dev-util/catalyst ~amd64 ~arm64
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
-=dev-cpp/abseil-cpp-20230125.3-r3 ~arm64
+=dev-cpp/abseil-cpp-20230125.3-r4 ~arm64
 
 # Needed by arm64-native SDK.
 =dev-embedded/u-boot-tools-2021.04_rc2 ~arm64
@@ -67,7 +66,6 @@ dev-util/catalyst ~amd64 ~arm64
 =dev-libs/luksmeta-9-r1 **
 
 # Keep versions on both arches in sync.
-=dev-libs/libp11-0.4.12-r6 ~arm64
 =dev-libs/protobuf-23.3-r4 ~arm64
 
 # These seem to be the versions we initially got, but the
@@ -76,9 +74,8 @@ dev-util/catalyst ~amd64 ~arm64
 # get stabilized in Gentoo.
 =dev-libs/yajl-2.1.0-r5 ~amd64 ~arm64
 
-# Keep versions on both arches in sync.
-=dev-python/lxml-5.2.1 ~arm64
-=dev-util/pahole-1.26 ~arm64
+# Catalyst 4 is not stable yet, but earlier versions are masked now.
+dev-util/catalyst ~amd64 ~arm64
 
 # Needed for the MIT License
 =net-analyzer/netperf-2.7.0_p20210121 ~amd64 ~arm64
@@ -94,10 +91,12 @@ dev-util/catalyst ~amd64 ~arm64
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
+# Needed to address CVE-2024-6197 and CVE-2024-6874.
+=net-misc/curl-8.9.0 ~amd64 ~arm64
+
 # Keep versions on both arches in sync.
 =sys-apps/kexec-tools-2.0.28 ~arm64
-
-sys-apps/zram-generator ~amd64 ~arm64
+=sys-apps/zram-generator-1.1.2 ~arm64
 
 # Upgrade to latest version for secureboot
 =sys-boot/mokutil-0.6.0 ~amd64
@@ -105,9 +104,6 @@ sys-apps/zram-generator ~amd64 ~arm64
 # Enable ipvsadm for arm64.
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
-# Keep versions on both arches in sync.
-=sys-firmware/edk2-aarch64-18.02 **
-
 # Accept unstable host Rust compilers.
 =virtual/rust-1.80.0 ~amd64 ~arm64
 
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 281718f3fc..6ffd638f14 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -73,9 +73,6 @@ sys-apps/portage -xattr -rsync-verify
 # Enable -M and -Z flags; -M is used by mayday
 sys-process/lsof rpc selinux
 
-# Disable zstd to avoid adding it to prod images until something needs it
-sys-fs/btrfs-progs -zstd
-
 # Enable SELinux for all targets
 coreos-base/coreos          selinux
 sys-apps/dbus               selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
deleted file mode 100644
index 7ad8a320e1..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/Manifest
+++ /dev/null
@@ -1 +0,0 @@
-DIST btrfs-progs-v6.0.2.tar.xz 2321220 BLAKE2B 391bd9dcc7ae2d40c339eb9b7fb466624c3f122149af640bc0ca73abfc85ca7bd076976d47ce2d4eab64fb3b9b1309e3446acdd78ba77e5cb583b939710f8b6c SHA512 8e01fa6e3373d95a8e8577003ceb94722e4dfdf24110bfea79191a9862daf5e6580d72e898fdea134b5e86beeda32948eed572072f7906226189c6f1ac8615e3
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md b/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
deleted file mode 100644
index 16f62cc8c0..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-We forked this package for the following reasons:
-
-- We override the udev rules directory. The configure script does not
-  provide a way to override it, so we need to hack it, otherwise the
-  configure script will figure out the wrong path in our builds. We do
-  it by overriding it in Makefile.inc.in. Ideal solution here would be
-  to patch btrfs-progs to allow overriding the udev path and then
-  override it in the ebuild properly, without the sed hacks.
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/lz4/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/lz4/Manifest
index dfd1e824e6..91e1cb9c3f 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/lz4/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/lz4/Manifest
@@ -1 +1,2 @@
+DIST lz4-1.10.0.tar.gz 387114 BLAKE2B c87a939b748b0449e4f1869579ebc109704aa89e8699b6029217f6786c351d1b0329580dd3a955fe509efb113f29aecbafc83084d65d153f5d43610f4840a819 SHA512 8c4ceb217e6dc8e7e0beba99adc736aca8963867bcf9f970d621978ba11ce92855912f8b66138037a1d2ae171e8e17beb7be99281fea840106aa60373c455b28
 DIST lz4-1.9.4.tar.gz 354063 BLAKE2B 2289cdce36acd35283bf2f02ef4d6d8f4805563be6d5a3492f3d6ea7975fb6bd14e1ac2e505df9747776edf8bcf0da7ba4ae7084b150e3ec08a52a9885f92ad5 SHA512 043a9acb2417624019d73db140d83b80f1d7c43a6fd5be839193d68df8fd0b3f610d7ed4d628c2a9184f7cde9a0fd1ba9d075d8251298e3eb4b3a77f52736684
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/lz4/files/1.10.0-fix-freestanding-test.patch b/sdk_container/src/third_party/portage-stable/app-arch/lz4/files/1.10.0-fix-freestanding-test.patch
new file mode 100644
index 0000000000..f8dfe2a41c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/lz4/files/1.10.0-fix-freestanding-test.patch
@@ -0,0 +1,42 @@
+
+From: https://github.com/lz4/lz4/pull/1468
+
+commit 63267a77d863f63826d8b13ddb8c190d3a4c01c5
+Author: Holger Hoffstätte <holger@applied-asynchrony.com>
+Date:   Mon Jul 22 22:11:19 2024 +0200
+
+    Fix stack alignment of _start() in freestanding test
+    
+    When the freestanding test is built with any kind of optimization
+    that enables vectorized loops, special care must be taken to align
+    the stack for _start() at a 16-byte boundary.
+
+diff --git a/tests/freestanding.c b/tests/freestanding.c
+index 6109aa7..96de9d3 100644
+--- a/tests/freestanding.c
++++ b/tests/freestanding.c
+@@ -225,7 +225,7 @@ EXTERN_C int memcmp(const void *s1, const void *s2, size_t n) {
+ 
+ 
+ //
+-EXTERN_C void _start(void) {
++EXTERN_C void __attribute__((force_align_arg_pointer)) _start(void) {
+     test();
+     MY_exit(0);
+ }
+
+Disable the stack protector to allow building with clang.
+See https://bugs.gentoo.org/936480
+
+diff -up lz4-1.10.0/build/meson/meson/tests/meson.build lz4-1.10.0/build/meson/meson/tests/meson.build
+--- lz4-1.10.0/build/meson/meson/tests/meson.build	2024-07-21 19:29:49.000000000 +0200
++++ lz4-1.10.0/build/meson/meson/tests/meson.build	2024-07-23 01:26:40.561113031 +0200
+@@ -47,7 +47,7 @@ test_exes = {
+   },
+   'freestanding': {
+     'sources': files(lz4_source_root / 'tests/freestanding.c'),
+-    'c_args': ['-ffreestanding', '-Wno-unused-parameter', '-Wno-declaration-after-statement'],
++    'c_args': ['-ffreestanding', '-fno-stack-protector', '-Wno-unused-parameter', '-Wno-declaration-after-statement'],
+     'link_args': ['-nostdlib'],
+     'build': cc.get_id() in ['gcc', 'clang'] and
+       host_machine.system() == 'linux' and host_machine.cpu_family() == 'x86_64',
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild
new file mode 100644
index 0000000000..7cbc02aadc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0-r1.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson-multilib
+
+DESCRIPTION="Extremely Fast Compression algorithm"
+HOMEPAGE="https://github.com/lz4/lz4"
+SRC_URI="https://github.com/lz4/lz4/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/1.10.0-meson"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="static-libs test"
+RESTRICT="!test? ( test )"
+
+EMESON_SOURCE=${S}/build/meson
+
+PATCHES=(
+	"${FILESDIR}/${PV}-fix-freestanding-test.patch"
+)
+
+multilib_src_configure() {
+	local emesonargs=(
+		-Dtests=$(usex test true false)
+		-Ddefault_library=$(usex static-libs both shared)
+	)
+	# with -Dprograms=false, the test suite is only rudimentary,
+	# so build them for testing non-native ABI as well
+	if multilib_is_native_abi || use test; then
+		emesonargs+=(
+			-Dprograms=true
+		)
+	fi
+
+	meson_src_configure
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0.ebuild
new file mode 100644
index 0000000000..325d4225f6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/lz4/lz4-1.10.0.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib
+
+DESCRIPTION="Extremely Fast Compression algorithm"
+HOMEPAGE="https://github.com/lz4/lz4"
+SRC_URI="https://github.com/lz4/lz4/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD-2 GPL-2"
+SLOT="0/1.10.0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="static-libs"
+
+CMAKE_USE_DIR=${S}/build/cmake
+
+multilib_src_configure() {
+	local mycmakeargs=(
+		-DBUILD_STATIC_LIBS=$(usex static-libs)
+	)
+
+	cmake_src_configure
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p27-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p27-r1.ebuild
index 5b6fb1d1ab..982d367d9e 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p27-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p27-r1.ebuild
@@ -65,7 +65,7 @@ src_configure() {
 		i?86*-*linux*)       TARGET="linux_asm" ;;
 		*linux*)             TARGET="linux_noasm" ;;
 		*-darwin*)           TARGET="macosx" ;;
-		*-solaris*)          TARGET="generic" ;;
+		*-solaris*)          TARGET="linux_noasm" ;;
 		*) die "Unknown target; please update the ebuild to handle ${CHOST}" ;;
 	esac
 
@@ -73,6 +73,7 @@ src_configure() {
 	append-flags -std=gnu89
 
 	[[ ${CHOST} == *linux* ]] && append-cppflags -DNO_LCHMOD
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -DNO_LCHMOD -DBSD4_4
 	use bzip2 && append-cppflags -DUSE_BZIP2
 	use unicode && append-cppflags -DUNICODE_SUPPORT -DUNICODE_WCHAR -DUTF8_MAYBE_NATIVE -DUSE_ICONV_MAPPING
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild
index 2b5beefd93..43ea1f62f4 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.2-r1.ebuild
index 81f4675867..ae07648550 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.2-r1.ebuild
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
index 4639692423..241b60c0ce 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest
@@ -1 +1,2 @@
+DIST runc-1.1.12.tar.gz 2522196 BLAKE2B 14fe8d5f82d5b4d7f6b4bb9111c5d258e74f6a44aeb51fc87c69104e95b9bf24a3d503f4cc5dedb40d542fbd4b6e27273f456bda4fcf3bc298eb93ae292d9663 SHA512 92e8ac54a77d7ebcc76b5a9cc08d9a064211f12e9d26f064070cc203a5afb11c3af28d8f556f297513f797a2933d50bf10a8f22e307724041d66aa8c5ca1d9d3
 DIST runc-1.1.13.tar.gz 2532849 BLAKE2B f3d3171ffce2bb833bfb5cc21d0dc034fd7e38c47ee098cc1fc75c06fd4dfae21dfe25c2e69a1ca93b29d36e8799727ea41725eee8aca3a059c14dab6c8a435f SHA512 644bf9e6359bf49bbdec667c0f7c69ded78c7eacfc2d1b730d52fdcf7348571c6406b8e5790811fe3662a458c878e4225c3559885f0d95f8905273e7e40e55ad
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.13.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.13.ebuild
index 07fc00259a..821b7ad84d 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.1.13.ebuild
@@ -10,13 +10,14 @@ RUNC_COMMIT=58aa9203c123022138b22cf96540c284876a7910
 CONFIG_CHECK="~USER_NS"
 
 DESCRIPTION="runc container cli tools"
-HOMEPAGE="http://github.com/opencontainers/runc/"
+HOMEPAGE="https://github.com/opencontainers/runc/"
 MY_PV="${PV/_/-}"
 SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="Apache-2.0 BSD-2 BSD MIT"
 SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
 IUSE="apparmor hardened +kmem +seccomp selinux test"
 
 DEPEND="seccomp? ( sys-libs/libseccomp )"
@@ -38,8 +39,6 @@ BDEPEND="
 # majority of tests pass
 RESTRICT+=" test"
 
-S="${WORKDIR}/${PN}-${MY_PV}"
-
 src_compile() {
 	# Taken from app-containers/docker-1.7.0-r1
 	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/libb2/libb2-0.98.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/libb2/libb2-0.98.1-r3.ebuild
index f810cc600e..0137d18d8f 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/libb2/libb2-0.98.1-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/libb2/libb2-0.98.1-r3.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-inherit autotools multilib-minimal toolchain-funcs
+inherit autotools multilib-minimal toolchain-funcs flag-o-matic
 
 DESCRIPTION="C library providing BLAKE2b, BLAKE2s, BLAKE2bp, BLAKE2sp"
 HOMEPAGE="https://github.com/BLAKE2/libb2"
@@ -40,6 +40,8 @@ src_prepare() {
 	sed -i -e 's/ == / = /' configure.ac || die
 	# https://github.com/BLAKE2/libb2/pull/28
 	echo 'libb2_la_LDFLAGS = -no-undefined' >> src/Makefile.am || die
+	# make memset_s available
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -D__STDC_WANT_LIB_EXT1__=1
 	eautoreconf  # upstream doesn't make releases
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.0-r3.ebuild
index 7eb27b6304..93734b1fa1 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.3.0-r3.ebuild
@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="caps efl emacs gtk keyring ncurses qt5 qt6 wayland X"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
index f0c382e989..99c2a66f1a 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.7.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/tpm2-software/tpm2-tools/releases/download/${PV}/${P
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
+KEYWORDS="amd64 arm arm64 ppc64 x86"
 IUSE="+fapi test"
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.1.3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.1.3.ebuild
index 79327c4521..0f0b23883e 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.1.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tss/tpm2-tss-4.1.3.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar
 
 LICENSE="BSD-2"
 SLOT="0/4"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ppc64 ~riscv x86"
 IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 3d10636c06..9d9e18f33a 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -4,7 +4,7 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.11.tar.xz 121877020 BLAKE2B c546773b9ac7809b39a3afa51da5b1c06c3765fadb4df9d8529f8af65c26098676adf8e516620ca1b39201fa859878780edb56a445778e105cbe7db0f52b9f6a SHA512 c77ff1505128c05fe39eaa95cc11e4d2279bff06093acd613e54f71d4a13144f905551eec1d044c3a3fb751d3369c01d131d68c18b15d9a04bcc77370d93c217
 DIST qemu-7.2.12.tar.xz 124399872 BLAKE2B df0afc8de23f3df7b0ada301584f1d96c7add69ec16755c5b75eced88827ec2719ba79c9191da5c77f00872bf2c492b24b08f310954e5ca97249debd5e520cda SHA512 239623f6f3c15b85ce8da27adb8123886a2b56971742d2a11cde58b0dfac40de1592e1e33591306b830c5cee051d11b00d1bdccf414cc7b111dab79b65b1cf92
-DIST qemu-7.2.4.tar.xz 121849100 BLAKE2B a9c5ffce9ff0fac4e2d1fa4be1a1dcee2f5d7f793ddf726871c5ae9a68c22f7ba03692a8a5096de3051030d3c2f34e46697d5af2d66c34984b8161ae3bb07b42 SHA512 fa765673833a1f2cbecdb9d47dc7dc29d7613be5a5c8fc63925ae70e1f5aafb4f9f02e45b212a329f17b689351b8a9cdf5f5235ab6adb71bb40e41868898d95b
+DIST qemu-7.2.13.tar.xz 124399088 BLAKE2B 7d0b86862e663b20e918a211f661aff0bf8eeb480cffef9eba51c819d817368db33989bcc4f1673dd278d1f0f91f7991e22a24fca828559d8da225fdb8a1836b SHA512 be6a1d2efb111c09456be97a431a8881667b0a1d356a9901e6582b9720143826d4719778c228eb342ec865b5a3dc21444ebe296be56e1edafd16ab1b3aef3ae2
 DIST qemu-8.0.0-docs.tar.xz 3218024 BLAKE2B b764a625024e78a39470048355471e12cfb57ab3c34e764dc4200fdf5c1aea635d26095ec961979bf46f177101c5bd38618bacf7e98e04bd64688ab5e29591aa SHA512 d9dfe191372e105fe16fe8f66f41ed793ade4c89b5ab1d84b39459f3419a1ca61bd49422a83981965cc257c05eca7fd49054703f58f179f5c7b656e9473a1054
 DIST qemu-8.0.5.tar.xz 126175064 BLAKE2B 1d1f78c185ab64b4ca946a44ad04d0bbb6ea48de058037e4ba18176abeb0f0528754c6e832f742f93227182bbce145544eca5b908a366006e7ee58876aca0bda SHA512 ec9679473dda84a2f56ae8ee0039ec4dafb056414bfc5a3a147b2b6bb45ae3b130dd80f6385e8567b5d18f4be94f3536bc8acc45c61eddf40c9678b46cb8bddc
 DIST qemu-8.1.0-docs.tar.xz 2129912 BLAKE2B 8aaf7b748538afdb5bcb6da15dbd96572d086824377c4b0e93f1ddc695f9a4775471e360a9616d2d481dbf8113e91d2601c69d92cef565fb90b65ffacfdb304e SHA512 905515742bb56a439fc8117ec48ea668e7b2bf0244587673e4352d9e8e49911eb84ff093596ff566e44787197cf9789ec8950e3d75fb7a670c5546394a322ac9
@@ -12,6 +12,7 @@ DIST qemu-8.1.5.tar.xz 124007248 BLAKE2B 0d5db3e18c4dc1035fed442116be98b7e7bbfae
 DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
 DIST qemu-8.2.3.tar.xz 130106716 BLAKE2B 2ec91b5111952434686064bd603880d87c4f56774d2478ee953eb0454e2b14235b1d1cca484e015b96bceae3182f90b856d222ca590059032b4989babf1dffe8 SHA512 28c789d84754b26cd86ded9db8464ec82f07cdc3b1025a988e74b8c5b05df8839a3e9990ff96cfba50e032dd967e9dc18cf75f3525baeadd0fa019cb69108d0a
 DIST qemu-8.2.5.tar.xz 132743988 BLAKE2B 24da4350cfe5a46771ea257b7baba48f02465c87e819ad3cc0557c06814f24f442ba3b97661af74d5235e31e7883b7c62d108e3180f7ce9e4be524ec966d07d0 SHA512 b95de309d790033452687b488ba869940bc40862ebbc9d91edbeee840e4ffc0b4cae43e1bfcd00f5534da126c62072b7b5309da6d74d30ba537e4c7b430f4255
+DIST qemu-8.2.6.tar.xz 132750000 BLAKE2B da5fdb03fcb44cf764d2ccaf9011b726e5c152d8659ca91550cd04b3e578e7f9bf2cc050b38a64055103775e64303ae949cf7e2cde5508f8a4b976d1311631c5 SHA512 ba702306df0c2a6744fff6fdca5f251ebc572230ee4674113433c74f74187ba33457ea9716d9023aa48cc1e6887af132a2877c30ea098da9ed23e95d4691b88b
 DIST qemu-9.0.0-docs.tar.xz 2290196 BLAKE2B 82d22637ff2629bee372550e86651f12051ea6b4a57e314ef83f290425d4973ef01827eaf28a85b635788f22cb7cc1c747438b7525c92c99b90b234fb8f7655c SHA512 7c0ba1f3e7bbaa4e3feebc33a1946a5c190f2c14b9ed78b15c1f642668c8124960f8c85bcf36fe54a10d4edef47d2256e500f06d9173b92b03c599811a15a073
-DIST qemu-9.0.0.tar.xz 129789856 BLAKE2B d92acb859d9ce5097fee27a4689c71869aa38f65eb0308547956d54bd8caf29efe5389d9009f334f109ad228e0ef1f1fd1444d26360f03fac4320b204b657081 SHA512 1603517cd4c93632ba60ad7261eb67374f12a744bf58f10b0e8686e46d3a02d8b6bf58a0c617f23a1868084aaba6386c24341894f75539e0b816091718721427
 DIST qemu-9.0.1.tar.xz 132368412 BLAKE2B e96ae5cc3ee935dd31232d38d46bbdc74fd3a2a0dd8517c0e035757f3ded92712dfa68d0068cd8c37f314a92d237e2b4a725b509ba402b7a1ce92df63207a08d SHA512 6c120aaf52f15e79c32d883cc83df8fc83222d538ea6be9c19aaddfba0aef91479b5826bbc03e58688fba639cb24bc6f54e525ccc2404ed5d820766d11735210
+DIST qemu-9.0.2.tar.xz 132387528 BLAKE2B 6b5301f985919ae53e056410be7486b8150a65016127568bd4d58f596e94960d08eb3fc57cff7ff6a3435d71274adee516f57375d856d61b4fc7a3f24cbf75c4 SHA512 58ed84f6fe6263d279356bc9193f96edf62cf3663fb151daa3f047d52329fe49cb91c2d45e09697e0469f4f5409be96403aec9572d4871ffa40848a786c21599
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.4.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.13.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.4.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.13.ebuild
index ecb35f2798..ac517632fb 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.13.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -315,7 +315,6 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
-	"${FILESDIR}"/${PN}-7.2.0-linux-headers-6.2-glibc-2.36.patch
 )
 
 QA_PREBUILT="
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.6.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.6.ebuild
new file mode 100644
index 0000000000..b622077598
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.6.ebuild
@@ -0,0 +1,992 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.0.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2.ebuild
index 179ca305b4..6d9b868ae6 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.0.2.ebuild
@@ -8,7 +8,7 @@ EAPI=8
 # (the construct below is to allow overriding from env for script)
 QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
 QEMU_DOCS_PREBUILT_DEV=sam
-QEMU_DOCS_VERSION=$(ver_cut 1-3)
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # bug #830088
 QEMU_DOC_USEFLAG="+doc"
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
index 9846c5d07d..9fef1bcd1c 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
@@ -1,3 +1,4 @@
 DIST elt-patches-20240315.tar.xz 45416 BLAKE2B 4a1e33bba89c43cb91d75641d35837aa482e2e119079321b4e1824ee5bd4b0f5c465c4709082daf987dedf423fef5adb9ba8d8d1b9d6dc814c663dda86ac0ee0 SHA512 7c2034713630f8ad40fed5be34f397749e8e1f63d5933656fe3618e97cf59240aaa64468fcb1a46bac111b96603e538b857513ca80d327c0be865868020457ea
 DIST elt-patches-20240324.tar.xz 45712 BLAKE2B 29a94ad3132ba10f4fc90cde685732b1cb679d693e1b1a1fbdb7fd99fbfc70aa7df9e6753ef6374cd606195829bd9d6a8b9b19126780ffa8f28542fb59d99fb0 SHA512 3878d5d303b372c873859510d6a0f3911657f4b66af8a91833657a13902474d011e30b4d245e5f82df791a9231f0253bb0ddef42bba66acb4241600265fb7925
 DIST elt-patches-20240512.tar.xz 46176 BLAKE2B 8ca496aae63dd49e7148b7c06e687b3644a58211ec5cf7b82d8ccb7603df6390c7f9ba6f71b4b9b9db7263bf0c7005f9c6098091227c6b34729032f6a6101cd7 SHA512 c33321668b9191d2f8221fb4a1ea365ccce6d0b61bf8bb1b95fc6c2c67ada8b36c44d7423d994678e60e3197bf2721aca9e062e882d2cea05b465ad0d4e8a93c
+DIST elt-patches-20240721.tar.xz 46392 BLAKE2B 87d2cefebcacbfa447e8981bf16eda3d21bcf4190e91c478280cd81089ab43440a86ff84a5c6b2cda7d772707dad645d4f481d9ec2543f9c14059fe084c2f54d SHA512 a8a8f55e5e1b0a2ea67895e86307a6fd5116593c25a2e3cc6fb2361f21eddc125a91c46ef84c0fd036c1bb25a682a4ff07c581c041a9b853d713d5c8f73d8d5b
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240721.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240721.ebuild
new file mode 100644
index 0000000000..29410c13f9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240721.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Collection of patches for libtool.eclass"
+HOMEPAGE="https://gitweb.gentoo.org/proj/elt-patches.git/"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/elt-patches.git
+		https://github.com/gentoo/elt-patches
+	"
+	inherit git-r3
+else
+	SRC_URI="
+		https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz
+		https://dev.gentoo.org/~vapier/dist/${P}.tar.xz
+		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+# The 'check' target currently wants network access to fetch libtool tarballs.
+RESTRICT="test"
+
+RDEPEND="sys-apps/gentoo-functions"
+BDEPEND="app-arch/xz-utils"
+
+src_compile() {
+	emake rootprefix="${EPREFIX}" libdirname="$(get_libdir)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" rootprefix="${EPREFIX}" install
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 1e19b9b1bc..5517d1ff31 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -28,6 +28,8 @@ DIST bash-5.3-alpha.tar.gz.sig 95 BLAKE2B 69c8b33fe2a40498662ef084967701cff19260
 DIST bash-5.3_alpha_p20240628-5e28a1813ce7d08628c8df584ea36515091c6d9b.tar.xz 8528432 BLAKE2B d920640b0ba0ae38dbb98b48a9e4dd6635a05d7f86fcf26a4f2c79f6a4338e4f25ff20119f9a1df451d23d9cc381862963dcf9c135050102e8159eccbe5f7314 SHA512 cc60f94083b378ac51fda973f834f10477ac6ebcfc682f934426db3fd6ca4506e5ed1c64311c67d5d9d70b62ab2bf9900ee66f1aa96a7bce7198d69edf9131ca
 DIST bash-5.3_alpha_p20240706-a91b8b077300b0a2a7daefe02f0363f9116e00d5.tar.xz 8525768 BLAKE2B 07b1b92b15bbd1c4bd01e3c2fbdf65d7dab14976442a2c4ea751c0d6e729d937886495af5402cd4669e84f68e952f3e79a375c649bbda1b4cc948172e3ea2948 SHA512 dfd19e6a4786ff066cb7e13ae328fbc909847fd7f987b59d9c646ab0bbf5abdc8c570bbc75810fe9eb6c9171acb3256b4e3278f565a1f526d9ce030fd423c0f8
 DIST bash-5.3_alpha_p20240711-d3e86e66ce857a8dc02e3116fd98b6e5b34d6364.tar.xz 8532476 BLAKE2B bae60589e733f29f4dab827c1c68899f4770c4cb2ca58af19e10bb833820644d336ada480be60b4dabb82441ae68f64494074387057d8b56efe8d5b9befd2a13 SHA512 ef677d2641607b75a000bef4b6eb9b359553ae6c3f930285989b97c036bfd1f7ecfa9240af1873af11dda42d1eca68da9c4b7567876e0bca878e8469dde0d0af
+DIST bash-5.3_alpha_p20240718-6c703092759ace29263ea96374e18412c59acc7f.tar.xz 8535120 BLAKE2B 7dd47829ca71689c138af9acd2657cee732f43abc82506ad76e65eb038e39acd31e208e985714460d76fbfb354517c3597fd85d459969541af950382ae7796c9 SHA512 41e07ed4fa90f8b645faf6c26766048fa51a3e3bd420dc875898fc9a1d674c05fe35f12b1c4d6ac6e6374736e6052e17e235a94c205c4bda80183f8065035182
+DIST bash-5.3_alpha_p20240726-d5ef283cbdd08217efdc55974a6a8a2c52a7562f.tar.xz 8534860 BLAKE2B 93ced89c621522554bb3f8c2e23ab2a6d8500beedb023064006cbd5777719195c2dbaabe6a04d737cb33d940c8a40ad2b3cdbce43b18e2b074d0d050dac77559 SHA512 d651cf0da9ed62d2e54ac526ef55a2a8eba274b430b627fc9e146bbc1d936363cf248388439dac485b653f6bfedcb21269c4b5f4662646080ecfe07390572450
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240718.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240718.ebuild
new file mode 100644
index 0000000000..52be02ada0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240718.ebuild
@@ -0,0 +1,411 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3_alpha"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="6c703092759ace29263ea96374e18412c59acc7f"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases. The
+	# touch utility is invoked for the benefit of config.status.
+	if (( PLEVEL >= 0 )); then
+		rm -rf lib/{readline,termcap}/* \
+		&& touch lib/{readline,termcap}/Makefile.in \
+		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
+		|| die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
+	# upstream to Chet by email.
+	filter-lto
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240726.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240726.ebuild
new file mode 100644
index 0000000000..25fcce4c5a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_alpha_p20240726.ebuild
@@ -0,0 +1,411 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset.
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
+READLINE_VER="8.3_alpha"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	BASH_COMMIT="d5ef283cbdd08217efdc55974a6a8a2c52a7562f"
+	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.xz -> ${P}-${BASH_COMMIT}.tar.xz"
+	S=${WORKDIR}/${PN}-${BASH_COMMIT}
+else
+	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
+
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
+
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
+
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
+	S=${WORKDIR}/${MY_P}
+
+	unset -v my_urls my_p my_patch_idx my_patch_ver
+fi
+
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if (( PLEVEL >= 0 )); then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+# EAPI 8 tries to append it but it doesn't exist here.
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases. The
+	# touch utility is invoked for the benefit of config.status.
+	if (( PLEVEL >= 0 )); then
+		rm -rf lib/{readline,termcap}/* \
+		&& touch lib/{readline,termcap}/Makefile.in \
+		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
+		|| die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local -a myconf
+
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset -v YACC
+
+	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
+	# upstream to Chet by email.
+	filter-lto
+
+	myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h.
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	use nls || myconf+=( --disable-nls )
+
+	if (( PLEVEL >= 0 )); then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
+	else
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if (( ${#pgo_generate_flags[@]} )); then
+		# Used in test suite.
+		unset -v A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset -v A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
+	dodir /bin
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
+
+	insinto /etc/bash/bashrc.d
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
+	newins "${FILESDIR}"/bashrc.d/10-gentoo-title-r1.bash 10-gentoo-title.bash
+	if [[ ! ${EPREFIX} ]]; then
+		doins "${FILESDIR}"/bashrc.d/15-gentoo-bashrc-check.bash
+	fi
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
+	done
+
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
+				else
+					dodoc "${f}"
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1.
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]]; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r8"; then
+		return
+	fi
+
+	while read -r; do ewarn "${REPLY}"; done <<'EOF'
+Files under /etc/bash/bashrc.d must now have a suffix of .sh or .bash.
+
+Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the
+characteristics of the operating environment, it may contain a command to set
+the terminal's window title. Those who were already choosing to customise the
+PROMPT_COMMAND variable are now advised to append their commands like so:
+
+PROMPT_COMMAND+=('custom command goes here')
+
+Gentoo no longer defaults to having bash set the window title in the case
+that the terminal is controlled by sshd(8), unless screen is launched on the
+remote side or the terminal reliably supports saving and restoring the title
+(as alacritty, foot and tmux do). Those wanting for the title to be set
+regardless may adjust ~/.bashrc - or create a custom /etc/bash/bashrc.d
+drop-in - to set PROMPT_COMMMAND like so:
+
+PROMPT_COMMAND=(genfun_set_win_title)
+
+Those who would prefer for bash never to interfere with the window title may
+now opt out of the default title setting behaviour, either with the "unset -v
+PROMPT_COMMAND" command or by re-defining PROMPT_COMMAND as desired.
+EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20240607.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20240607.ebuild
index 0573bd599f..9c1e181d17 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20240607.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/automake-wrapper/automake-wrapper-20240607.ebuild
@@ -20,7 +20,7 @@ else
 	SRC_URI="https://gitweb.gentoo.org/proj/autotools-wrappers.git/snapshot/${MY_P}.tar.gz"
 	S="${WORKDIR}"/${MY_P}
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index b3d94d5fd9..219ca184c9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -12,7 +12,13 @@ DIST cmake-3.29.3.tar.gz 11247199 BLAKE2B 8d18aca8871a615a4dca8eeb380ad79fdf41a2
 DIST cmake-3.29.6-SHA-256.txt 1646 BLAKE2B 8d2e11fe0e7ba89e394e51920657deb793e5f45026ebb86c39748410f110568c68021099286901f05fea47bf641d583b4f3715fe315e795cc8041a1fb66d5107 SHA512 1df0e791c3f42e5f96a967b385155b1f2e5214d78df639c81d2632455748f68423ab5de580f7f3e64c06387fd25247660da4b4bda0c9881f7ca25a317b62556f
 DIST cmake-3.29.6-SHA-256.txt.asc 833 BLAKE2B 25e2588375d353cc3d56480dae7aa3d2376c11cb1d830167f57544429fb0b455aeaceb121ac0fdd3f6f2b235c418bc4f52eafacc436472d9a2f3e80b97b08b18 SHA512 f01fff8b188ddd5aa7501acba3d68f3ba2a6b94d402af1afd716be66fa8f76c2d373cd6851a7fe308761171e2206c60f4f785209c86170037afcf3f416f080de
 DIST cmake-3.29.6.tar.gz 11248411 BLAKE2B cfd639ce975a4a13221d1fffea97c3bf0599c9af1c8de28e340013ea918bd0fc1eff1d97ca07b2cdd9c34f790950246530ebf1282d400f658fb2d1f4f89a089c SHA512 ecb7b62d2ed133da5c03932d78cc218deddd3c5d7d1116a5ded80b07f6e5f8145928fc15a5c22265995a2b451b1e20aa4dcaa1918060d025485fe8fa7730f3ec
+DIST cmake-3.29.7-SHA-256.txt 1646 BLAKE2B 8de09802b055a05fe3cddae74f3952173a63dcbfdd2aef36f31c2c362bbd942a37cd2b7dae4cb56e46501be5c0963c21f2273eba55da026887ab0d2b37039958 SHA512 21c6c186a20ec986d6e4df528f68b9946d051e63feb7f94cfe80c9a7b686b933b4bd26242c391475bf3cb52ed2a7bb02fff06fda42688fe4129f05e54945fc0d
+DIST cmake-3.29.7-SHA-256.txt.asc 833 BLAKE2B 73cb2182d7b10d1e36e08494a2c97607550ddab0048f62362ecc0ec37e08967d0968982d2beb606fc099cea99dec9f1c57f0e84128cbea4b09dcf62b87156bea SHA512 783ea23764ac41a487fd58075eec529ae2b1e1ea5057d61c933245474b84e3a866715c81255ac353578bd272d2a17e54f925aa2238c516f6a4c00ba58336174b
+DIST cmake-3.29.7.tar.gz 11249246 BLAKE2B ffc1c67e310632d58353c361b0f7a7c3624ab54662829e982adb1ebf3c4ab0479b6ae96d10c3d2273ea460a9836b2f0a43cd769154e2f1a30b77eb3a9f96dad3 SHA512 96e963cd2b5bccd34ed8ec3d2a7f19bd798611cd946adce8ebe142015562b20cb3bae0aa832e8ccb60bb3dc290e41218b4f3ca0361f3e11afecbccf7a182f7d2
 DIST cmake-3.30.0-SHA-256.txt 1646 BLAKE2B 9ef563e1b7a49a34bd08547483e628de469edf64889e4a82975441eba6ec77f1ae3cafec4bfcc641699f9c5a60a9998960a6a3e0fd2b955678dc3c40729248ed SHA512 7236dba187dcd5c92b5221116fe31931324ffd09f3371eb3d06b10cdcdb45c6822d95646cf4f8a44926210485f68f34c09f78cc4e3939b5f176f84aa818e82cd
 DIST cmake-3.30.0-SHA-256.txt.asc 833 BLAKE2B 2c2657afba4b9d2b176d82789d634505e1eb9a1f46969a0993aadf52da34a242dc104988bc2d5d24cecbab7f32266aa22ac57c09986e20871321bbab11d2aa92 SHA512 de86b2b88c78bc5db905f0d8cbbb7f3ce736c1905375de93d68a2eea3927a02bc4d93d2f3a49c6cb5b0afbc61f6520c9cb1e8b4a33897670d16caff60aa4cdb3
 DIST cmake-3.30.0-docs.tar.xz 572276 BLAKE2B 0c258f8dd0a518bb7bf97d35a778d8e406c986e123fc8acafb174a750ad0883d346254d12e8134dd9d030faefddc13b8260e7b43e405272157ada742c75b5fc2 SHA512 9d534b0efc30829f1144fb32c4f10ba25749e238c8ceeb4399b6d1eb8421b9fb1363972a497757ef84689bb987840619cbb4333ae95fd2397eea07eebed112c1
 DIST cmake-3.30.0.tar.gz 11500060 BLAKE2B 62b3f3d5ed92f7f118991f36ba7098ff20c202dd924ecd1e7af3fedc54345c5db26ce6fa782fe1acb490857b478067c17383f0453dece579482c2e962bd9de12 SHA512 1dd872a3f93cfadb7ac0f93177e7d4d7ded67cf09c71b1b776dc3bc8b7d4e44dd81533a8a4bf2c9eaaed56443060aa27a11250a5e47de316c89db7e146929782
+DIST cmake-3.30.1-SHA-256.txt 1646 BLAKE2B 39c8a32acb873f3b2b35af543006ef4ebc976f1939f4a857e55048654c60c23ee79cde0f1c625a7388f612d5ad594fa4ddfc89e4bb6e13764ffc78ce2e70f0e4 SHA512 bf3ba7218d504c75474b048b7c8b5db3928994fa269ea3762e68a751905403f87946c3dfdfbf63836d87f5180c905ed57b0d287bec97b04ee0e81f1f420a8c5f
+DIST cmake-3.30.1-SHA-256.txt.asc 833 BLAKE2B 5232626cc85bbcf0f44a9df4904ede8935c4d028b9604c9749a04b6eb2d51f648c817412b7870ae7f3e635dd88a44143568985d4ed2322d5239c5935e073a92b SHA512 b2a7b344a2d6350e55721860e7579a70c767b94b04a88b73a9fb1e9830658689561f9467d09eed87b2dce00106917543cf69ede5c7ed66a529359a1f6427dbc5
+DIST cmake-3.30.1.tar.gz 11500521 BLAKE2B 0e604ecc6b7da1c1c1baa81488a033aef6fa39cbddaaf43364193dda3e30d02a072f58a75573723e71653a2d1b34d09a7e1d0cc98280d76801d262bf54ffe77d SHA512 e3b38d309554a4239b8048434d770d3ac4533280a82c1bec65c37c9b0996cdf1753185e38deb4fb5da890ddc3d39c1d5c075e2ab0f7e0c52d61f5d556851fd20
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.7.ebuild
new file mode 100644
index 0000000000..dc2e2378fa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.7.ebuild
@@ -0,0 +1,284 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=3.28.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
+	)
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.0.ebuild
index c119ad22dc..7957c7bb58 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.0.ebuild
@@ -152,6 +152,14 @@ src_prepare() {
 		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
 			-e '/cmGlobalXCodeGenerator.h/d' \
 			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
 
 		# Disable isysroot usage with GCC, we've properly instructed
 		# where things are via GCC configuration and ldwrapper
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.1.ebuild
new file mode 100644
index 0000000000..7957c7bb58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.30.1.ebuild
@@ -0,0 +1,291 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+CMAKE_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
+	)
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	## in theory we could handle these flags in src_configure, as we do in many other packages. But we *must*
+	## handle them as part of bootstrapping, sadly.
+
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	unset CLICOLOR CLICOLOR_FORCE CMAKE_COMPILER_COLOR_DIAGNOSTICS CMAKE_COLOR_DIAGNOSTICS
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	local -x QT_QPA_PLATFORM=offscreen
+
+	cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
index 199bff8efd..f6f904da21 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-9999.ebuild
@@ -153,6 +153,14 @@ src_prepare() {
 		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
 			-e '/cmGlobalXCodeGenerator.h/d' \
 			Source/cmake.cxx || die
+		# Disable system integration, bug #933744
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			Source/cmFindProgramCommand.cxx \
+			Source/CPack/cmCPackGeneratorFactory.cxx || die
+		sed -i -e 's/__MAC_OS_X_VERSION_MIN_REQUIRED/__DISABLED__/' \
+			Source/cmMachO.cxx || die
+		sed -i -e 's:CPack/cmCPack\(Bundle\|DragNDrop\|PKG\|ProductBuild\)Generator.cxx::' \
+			Source/CMakeLists.txt || die
 
 		# Disable isysroot usage with GCC, we've properly instructed
 		# where things are via GCC configuration and ldwrapper
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array.py
similarity index 61%
rename from sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array
rename to sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array.py
index d2bf49ba8e..84a490cf29 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/files/meson-format-array.py
@@ -6,10 +6,22 @@ import itertools
 import shlex
 import sys
 
+
 def quote(s):
+    """ Surround a value with quotes, escape embedded quotes.
+    >>> quote("foo'bar")
+    "'foo\\\\'bar'"
+    """
+
     return "'" + s.replace("\\", "\\\\").replace("'", "\\'") + "'"
 
-def main(args):
+
+def format_array(args):
+    """ Format shell-compatible expressions as a meson array.
+    >>> format_array(['-O2 -pipe -DFOO="bar baz"'])
+    "['-O2', '-pipe', '-DFOO=bar baz']"
+    """
+
     # Split each argument according to shell rules
     args = (shlex.split(x) for x in args)
 
@@ -20,7 +32,12 @@ def main(args):
     args = (quote(x) for x in args)
 
     # Format the result
-    print("[" + ", ".join(args) + "]")
+    return "[" + ", ".join(args) + "]"
+
+
+def main(args):
+    print(format_array(args))
+
 
 if __name__ == "__main__":
     main(sys.argv[1:])
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
index d9e12ab903..d278f439af 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson-format-array/meson-format-array-0.ebuild
@@ -4,10 +4,11 @@
 EAPI=8
 PYTHON_COMPAT=( python3_{10..13} )
 
-inherit python-r1
+inherit edo python-r1
 
 DESCRIPTION="Format shell expressions into a meson array"
 HOMEPAGE="https://wiki.gentoo.org/wiki/No_homepage"
+S="${WORKDIR}"
 
 LICENSE="GPL-2"
 SLOT="0"
@@ -15,8 +16,14 @@ KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 RDEPEND="${PYTHON_DEPS}"
-S="${WORKDIR}"
+
+src_test() {
+	run_doctest() {
+		edo ${EPYTHON} -B -m doctest "${FILESDIR}/meson-format-array.py"
+	}
+	python_foreach_impl run_doctest
+}
 
 src_install() {
-	python_foreach_impl python_doscript "${FILESDIR}"/meson-format-array
+	python_foreach_impl python_newscript "${FILESDIR}"/meson-format-array.py meson-format-array
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index 24e33d0e26..536d224b89 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -10,6 +10,9 @@ DIST meson-1.4.2.tar.gz 2227701 BLAKE2B 11d98d8c84545390bd35b393ae02db7876a38dad
 DIST meson-1.4.2.tar.gz.asc 833 BLAKE2B 64ce1fc0fecdd6aa76bb89d88ff7497548d82afc00805c083a0bca7ce4cee41dc50be50368e333649ae7e863c03ea780fe24a48c525281fbbcab679b540f4254 SHA512 51d3245f9443cb398e2e8f225f00a853848bde1bfba02bae6334d47115e36ad96c8ec03244f6169c89d73162b86a73158a7f8d08d5bd6b3d28e8369ce7b55093
 DIST meson-1.5.0.tar.gz 2257170 BLAKE2B 5103622831a3581b428f9cdd96950b8544ddfdcbd384ec2ccd344d6b9ffb2cdd7da069963d57b09a22f26938f6a3b34823abe678fb50a0fe8d79c8abc7899605 SHA512 f0a25cf134949739c698eddaea602bf7852866b3fee3d2c11c1e6b6e48c944cf92abc3d171a2e42e21077edc01f1e7079d451f5624e2b6131382e114e814db3e
 DIST meson-1.5.0.tar.gz.asc 833 BLAKE2B 43c1e0f197520d3151ea4a41e3723666034fbfba0d794a18783ed765e5844776337f8119aed5897f5320922ac8978992f3900756300b54970bf1066f6fcde629 SHA512 35537ebc8c430eb3c011ff75529442e0ab364aa4fbec8176c340b5f466cd7f2217ab7ed6a03c7bdb577b86bb3472faa054e5ce0472edbb690fe76f39845c2dd6
+DIST meson-1.5.1.tar.gz 2257106 BLAKE2B 3368b209444d0873217bafee2339b395dca9fa43df68adce19029a41ad5c0eca59426ef681d174ef8b6b89d4a6c5b4f189c1ae219deed78334028d44bdb23a95 SHA512 3239d6f3d64dcedddd456dc451278a37aa6c4460708b0efdff1b04b6e8844c20f5f882060de311c59a678bebd51ee09e1906c9384d4b0c85b28015fd1713ab0a
+DIST meson-1.5.1.tar.gz.asc 833 BLAKE2B c099720b102b8fff581f2043000454f5cb3593352a8b69c681cda73dae7172fb7d892dc0500e29fffe4ba7828cdcba418acea230563dc26a7a89139ab526b231 SHA512 f8210dd309a104b4169bc2eae9ff370f3ced6fe2c5dfc8f3477c9fbbed983dd6636ea05822d9345d7570e88bfe7789c6cc075e5a91d578a8376666d16ad550a3
 DIST meson-reference-1.4.1.3 339324 BLAKE2B a0ea6a1dd599c0a559dae64772f730ac7cad7df3ea63acc8355ff933152873567803efff012e6ea0a4c75ef9c8be023a8d927411a49e43de20bbfc69b1263488 SHA512 fc94aa95df3cd04af49ab2f27050c3ef206407a2ccb3b61d9c8660deba55eae3fb627d83713de62f3e1216a1a33a88e989bf5b557b7e17adbb73a57d5f2ad11a
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.0.3 341110 BLAKE2B c81d1014f93ca3848e03e6a8948190a31e1823b04134ab6861db94d5b9517252bf66fcbbc987ba2051430c54282256d729d3575db83e1e8d09fa344c6ff06dbf SHA512 b45c7b40cbe1abf7416d50c1c7658726d4feda4a30627a6dc70c7b9aab61f72c9c7c1fa915e47f4b50e9d82987e4179db8ab3d5158ec5ef3d7856335b604f603
+DIST meson-reference-1.5.1.3 341110 BLAKE2B 5267c2eea1b1281f87e63eb08aa928257dd98088b4d5c27c2785d2d8066c2c28536f7f56bf804ffe37d2f51552c91f31ff7e2729f3b2485d594a9e44a0df9ab1 SHA512 2d36e87e9bc2de0b958f4b20544b0bd9f2b0ffb646768e68fefcd5dfb8f09c24db40f27208b5f2d1f6ba02e7465f68a538ea72be118670c76e0959e090a42cf3
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.1.ebuild
index d30bc90b11..db20019291 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.1.ebuild
@@ -82,12 +82,22 @@ python_prepare_all() {
 		# ASAN is unsupported on some targets
 		# https://bugs.gentoo.org/692822
 		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
 	)
 
 	sed -i "${disable_unittests[@]}" unittests/*.py || die
 
 	# Broken due to python2 script created by python_wrapper_setup
 	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
 
 	distutils-r1_python_prepare_all
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.2.ebuild
index 4b7ba1a363..c1202d979e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.4.2.ebuild
@@ -94,6 +94,10 @@ python_prepare_all() {
 
 	# Broken due to python2 script created by python_wrapper_setup
 	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
 
 	# The 1.4.2 tarball accidentally contains some untracked files from git master:
 	# - subprojects/bar-0.1/Cargo.toml
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.0.ebuild
index 762876dc5e..9cddc1a7a3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.0.ebuild
@@ -94,6 +94,10 @@ python_prepare_all() {
 
 	# Broken due to python2 script created by python_wrapper_setup
 	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
 
 	distutils-r1_python_prepare_all
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.1.ebuild
new file mode 100644
index 0000000000..9cddc1a7a3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.5.1.ebuild
@@ -0,0 +1,190 @@
+# Copyright 2016-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
index 762876dc5e..9cddc1a7a3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@@ -94,6 +94,10 @@ python_prepare_all() {
 
 	# Broken due to python2 script created by python_wrapper_setup
 	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
 
 	distutils-r1_python_prepare_all
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230125.3-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230125.3-r4.ebuild
index 87f1b86c76..f1cf1e2063 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230125.3-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/abseil-cpp/abseil-cpp-20230125.3-r4.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/abseil/abseil-cpp/archive/${PV}.tar.gz -> ${P}.tar.g
 
 LICENSE="Apache-2.0"
 SLOT="0/${PV%%.*}.0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv x86"
 IUSE="test"
 
 RDEPEND=">=dev-cpp/gtest-1.13.0[${MULTILIB_USEDEP}]"
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-14.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-14.2-r1.ebuild
index b8698002fd..bedaa3a44c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-14.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-14.2-r1.ebuild
@@ -74,7 +74,7 @@ LICENSE="GPL-3+ LGPL-2.1+"
 SLOT="0"
 IUSE="cet debuginfod guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash zstd"
 if [[ -n ${REGULAR_RELEASE} ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 fi
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1.ebuild
index 541bf7f891..89469e9787 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/gdb/gdb-15.1.ebuild
@@ -131,14 +131,6 @@ src_prepare() {
 	# Avoid using ancient termcap from host on Prefix systems
 	sed -i -e 's/termcap tinfow/tinfow/g' \
 		gdb/configure{.ac,} || die
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		# code relies on C++11, so make sure we get that selected
-		# due to Python 3.11 pymacro.h doing stuff to work around
-		# versioning mess based on the C version, while we're compiling
-		# C++ here, so we need to make it clear we're doing C++11/C11
-		# because Solaris system headers act on these
-		sed -i -e 's/-x c++/-std=c++11/' gdb/Makefile.in || die
-	fi
 }
 
 gdb_branding() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
index b7477dfde2..2ba8f3e59a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 414c984f20..34c6cfd66a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -14,6 +14,8 @@ DIST Python-3.13.0b2.tar.xz 21089692 BLAKE2B 3cc77e9b7abcd8c9797a40b2a1f5ff6562a
 DIST Python-3.13.0b2.tar.xz.asc 963 BLAKE2B 2acab01cd8b2b5072e87f0c697767e9cec6a73cd6afae38f066a3bfa14798d10e01c03e806a1a90d1db3e5d91dea090d9dd37d1884bef3291783e6163e3d8906 SHA512 17091aba45ebd8c8feb3e9c54854e20dcd44fec4a1c08c9c0c4593166c407c4ad2b245a0e0893afc83a43e8b461a557fa1d6691c87a6a5ebc97ea448a9201c87
 DIST Python-3.13.0b3.tar.xz 20841504 BLAKE2B 92760124355483da082ac9fdc7a72eb6739e99acd97521a8c9a60bb73a25e26bcb8bdc9e911ee91667244320b742a9572c1e12229eb1c0d97ef5794493abac0f SHA512 1f0ef2d6f5d450664ad4104b92193b5a2dbe9c79add0a79c35ad9508f9fc7f1a5561efd5e4367defddf45457291524d353705d9a60b3550065920e204c77357d
 DIST Python-3.13.0b3.tar.xz.asc 963 BLAKE2B 784df664961ea36cb570d685c0cf6e8fe7159161c38103f217303bc0264c73a9904021cca297a180c7dd712d4e7fcee161d741919bee49eff962a25d14568d41 SHA512 3d8bdc8c26441a12518940d264e93a8897042e297ccf9cd2ddec725716a58486475be9462582ee489bd189a4d028b43504f979298174c1b008d521b7ab5fbf1b
+DIST Python-3.13.0b4.tar.xz 20876136 BLAKE2B b3a7b42b03320df618af18844a8b0f1c4b88b9bcd581cacd2d40d3ecec7d0f11aac36e54913f64541a2287d7a5052aa69f8e8d0379d6bbb4fba78600bf484f75 SHA512 e556f7a4e54b688d0424b0bd84f9849b52f4f7e04c68d4d5b877d86b4f9ded92c9efaa2b7ab33f345235f35e8d544833542f7a4cb100d0ff15b7d98b8367b935
+DIST Python-3.13.0b4.tar.xz.asc 963 BLAKE2B 0d9c7baa1eedce684e73359682f63c2aa6e7abc7cc77ee7fcf6d9658e93221c02412aa55f22d16337b72a680f10c70520742292da1138228f9257f81bc57d328 SHA512 243637efff94965aa4d997fe26c91a7c1aa7dcfdf7f78d35d6f4fc408b654dfa9d075d1c73bc5a90d145f6e5029ee395a86faf7e027c24a55fabfea6ca20fbd4
 DIST Python-3.8.19.tar.xz 18975156 BLAKE2B 57b241aeb8f99a8c30590dcb9402abbcf573f00d06e807846bc9135c0a8a4af896c4d772d34abc3c292339953f4974a203bff61a78641d91b1826770226cd7e9 SHA512 1d2a57fa15ccdaec8cdca508ba2ffb01e1ae053a3446ac709bc334480f8e913070899f01ed680cce6dc7ddfddcb27ef402fe206562249fa4c4e87be21ece0625
 DIST Python-3.8.19.tar.xz.asc 833 BLAKE2B a11705011e9ea2bd6cbabc2b4c896ba94675341188eb483b881c2cb25c932e9ff25f9f589f930605b0442ff93a1f54532608b111c8ace715a406ce10809af671 SHA512 efdaae5462badcf4b98625ce8ab0e34756acea9539416e6ec428725b04539f8c38c1978de346510d669e93bbeef3ae20b1534e4c6582f89c7dc56a04c7cae140
 DIST Python-3.9.19.tar.xz 19682840 BLAKE2B a12256663f0ff3b799c2193c5877aa89a434340dfa01e655f790abea70af0709b54577e1c2590add241308a8581fd6f45a22aed450bd5db2bf9fa35c4a9d619b SHA512 5577830c734e63a70bbc62cd33d263b9aa87c4381b49cb694c3559067c4c682a55506b65ec5514a8e0a5abf6294dc728e909385d449ae1c388e62f83cea9bb89
@@ -28,5 +30,6 @@ DIST python-gentoo-patches-3.13.0b1_p3.tar.xz 11056 BLAKE2B ef932bac59d2316ee8fe
 DIST python-gentoo-patches-3.13.0b2_p9.tar.xz 11288 BLAKE2B e46bac845ce54e32446316b8a5e055905f023e88ad7fb9cfed101f0fccf6c0fef2fb9fd5b7dc4b15ec1e6c075ceaa9f07777c3cfede0f88412871beac0a54e47 SHA512 4148342d649acd98cce1f3d3c7bdbf4adad069ba555624882ddb69f00ee0e64641014086b5e60d97eac809ccb1e3e782a112eb58d7bb83bcfa3222811cbb8682
 DIST python-gentoo-patches-3.13.0b3.tar.xz 5704 BLAKE2B 665f60d0a440c63ca6bbc1615333e01e0b9d3c5cd8c871157866dd70146a9afb71aecdb6f72f75de2fd8c163d011c8df538c8b278ad6a91079f3300bd05fead3 SHA512 959826aaf467235c8a144a2b94137113b273f79febd30fee0556b718132bb89b5ba97bc01a3718771cade099777f131b322682f336dfaabe18cd5838a75318fa
 DIST python-gentoo-patches-3.13.0b3_p1.tar.xz 8716 BLAKE2B 25b2d9f059c6f31a354b19833a3dfaab446a43ca00bbaa415e38c3ede6c4a738046469ca4ef6e184a5d7df33a8a1c5209271a1eb0728c3791e6630953bcd798f SHA512 57bbe0470e3356cef3b1880cedd18d4e84d6f64d1f398ce3e3e729744ac5f7a4dc4144333e2355f9ecf41c58382ab5708e7dbf7d480dbf797caa460862aee3bd
+DIST python-gentoo-patches-3.13.0b4.tar.xz 5700 BLAKE2B cc3e6d899dc51dc4a0f4b57fb5a891a61e5ba5a943edd31b55b6540f1d52a61f2a80f8ac1cdbc36ce155a83ab3942b8991fad0e83baab4c0a1080e62b30e16df SHA512 bf236ed221512a032a057f8b89b29a28e84cfaba56f58c2eaacee846db636089b2ae4534dc55ff3389cfbf1a4485e1cc2049a5cdb98ec1cd31eef71de60596c1
 DIST python-gentoo-patches-3.8.19_p2.tar.xz 35524 BLAKE2B a6b81e6ae907b60eea676cb65a9c693e62453dc44616baaadb294c5782a195c20eff6c2869b38ea110fe06e9e511468f4ab0c3d1811b16e0ab2833f9dc09b25b SHA512 9944c330b6062c2ac6e13fcfbc1c8835dfd078f6744cdfbc03ba787ae97c08bdae559cefadafe9dfe9be9c31f8c15ee895599b266d870f73c06a2f4b15c78dc3
 DIST python-gentoo-patches-3.9.19_p3.tar.xz 28240 BLAKE2B 35c70b1f9a590abe9a74795f478ab788cd72c96e9d84f2756685e61324dc4203148e71b00a236bb4af8fb8315e3582ecec255b39749a653e0511d4a9f9fef725 SHA512 6b8f4dab4aa7d4d646ee4091b5cf76bbc8896d4299a3623660a2c5fec06c0cf56c0a50ac87604885cd155141bc85e0e80acdbedb7b34a813901aad021b9b8ab2
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p2.ebuild
index bec993fb2e..a2461c6b39 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.4_p2.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_beta4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_beta4.ebuild
new file mode 100644
index 0000000000..20a8761fa6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_beta4.ebuild
@@ -0,0 +1,658 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 18 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
+inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_beta/b}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build +debug +ensurepip examples gdbm +gil jit
+	libedit +ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-libs/mpdecimal:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			sys-devel/clang:${LLVM_SLOT}
+			sys-devel/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+
+	if ! use gil || use jit; then
+		ewarn "USE=-gil and USE=jit flags are considered experimental upstream.  Using"
+		ewarn "them could lead to unexpected breakage, including race conditions"
+		ewarn "and crashes, respectively.  Please do not file Gentoo bugs, unless"
+		ewarn "you can reproduce the problem with dev-lang/python[gil,-jit].  Instead,"
+		ewarn "please consider reporting freethreading / JIT problems upstream."
+	fi
+}
+
+pkg_setup() {
+	use jit && llvm-r1_pkg_setup
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	# breaks tests when using --with-wheel-pkg-dir
+	rm -r Lib/test/wheeldata || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	# Set baseline test skip flags.
+	COMMON_TEST_SKIPS=(
+		# failures
+		-x test_concurrent_futures
+		-x test_gdb
+		# flaky: https://github.com/python/cpython/issues/121973
+		-x test_pyrepl
+	)
+
+	# Arch-specific skips.  See #931888 for a collection of these.
+	case ${CHOST} in
+		alpha*)
+			COMMON_TEST_SKIPS+=(
+				-x test_builtin
+				-x test_capi
+				-x test_cmath
+				-x test_float
+				# timeout
+				-x test_free_threading
+				-x test_math
+				-x test_numeric_tower
+				-x test_random
+				-x test_statistics
+				# bug 653850
+				-x test_resource
+				-x test_strtod
+			)
+			;;
+		ia64*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+			)
+			;;
+		mips*)
+			COMMON_TEST_SKIPS+=(
+				-x test_ctypes
+				-x test_external_inspection
+				-x test_statistics
+			)
+			;;
+		powerpc64-*) # big endian
+			COMMON_TEST_SKIPS+=(
+				-x test_descr
+			)
+			;;
+		riscv*)
+			COMMON_TEST_SKIPS+=(
+				-x test_urllib2
+			)
+			;;
+		sparc*)
+			COMMON_TEST_SKIPS+=(
+				# bug 788022
+				-x test_multiprocessing_fork
+				-x test_multiprocessing_forkserver
+
+				-x test_ctypes
+				-x test_descr
+				# bug 931908
+				-x test_exceptions
+			)
+			;;
+	esac
+
+	# musl-specific skips
+	use elibc_musl && COMMON_TEST_SKIPS+=(
+		# various musl locale deficiencies
+		-x test__locale
+		-x test_c_locale_coercion
+		-x test_locale
+		-x test_re
+
+		# known issues with find_library on musl
+		# https://bugs.python.org/issue21622
+		-x test_ctypes
+
+		# fpathconf, ttyname errno values
+		-x test_os
+	)
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			--verbose3
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			"${COMMON_TEST_SKIPS[@]}"
+
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+
+			# Fails in profiling run, passes in src_test().
+			-x test_capi
+		)
+
+		# Arch-specific skips.  See #931888 for a collection of these.
+		case ${CHOST} in
+			alpha*)
+				profile_task_flags+=(
+					-x test_os
+				)
+				;;
+			hppa*)
+				profile_task_flags+=(
+					-x test_descr
+					# bug 931908
+					-x test_exceptions
+					-x test_os
+				)
+				;;
+			ia64*)
+				profile_task_flags+=(
+					-x test_signal
+				)
+				;;
+			powerpc64-*) # big endian
+				profile_task_flags+=(
+					# bug 931908
+					-x test_exceptions
+				)
+				;;
+			riscv*)
+				profile_task_flags+=(
+					-x test_statistics
+				)
+				;;
+		esac
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-libmpdec
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable gil)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	# Gentoo hack to disable accessing system site-packages
+	export GENTOO_CPYTHON_BUILD=1
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		--verbose3
+		-u-network
+		-j "$(makeopts_jobs)"
+		"${COMMON_TEST_SKIPS[@]}"
+	)
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.13.0_beta2; then
+			ewarn "Python 3.13.0b2 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.13 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.13/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/Manifest
index e6f246ba29..8114a68ae9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/Manifest
@@ -1,2 +1,2 @@
-DIST cyrus-sasl-2.1.28-r3-patches.tar.xz 4244 BLAKE2B 113da9bb58cce3643269fca88ea8d700aa20226d9536427c9068ef7b43499c2b78cbcb233d8db2418d84136c7edd629cc05f52b31cdfddfcb529f9a9fcb4effb SHA512 0cccbb27646dc118fbeea64b0cb688f312df97b31fced8c18d5230764cd5e2f0d48806bd2f5524aeddd02e8933cd835fb6f67dd3fbc1b0abfd1a3e1f0f53cf8a
+DIST cyrus-sasl-2.1.28-r4-patches.tar.xz 4452 BLAKE2B e75f89f0e4ce829b9b27ce0cf86d04e18e30cd851335a9be22235063b19731e312ab390be7b57f024b40074dc4d9373b520e4e9a22121dab9a5c4297378d8486 SHA512 33850bd3ac80721f2765414b19d1a3adaf92e973293910c0b19ef6fcdc3981a8abb3f4d6f487da71d1a7454375e77e3fafb892eace5aa37335841718fcc4c541
 DIST cyrus-sasl-2.1.28.tar.gz 4034803 BLAKE2B 6cca8c26cebb9c2ee5d539c43797d30b6309a476ec4233225789978e1d7315c4ea5d2abbc7f5464be0f3c0de5fd9212706b43fbc92f40b76cd0b1013cc00f823 SHA512 db15af9079758a9f385457a79390c8a7cd7ea666573dace8bf4fb01bb4b49037538d67285727d6a70ad799d2e2318f265c9372e2427de9371d626a1959dd6f78
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
index f5eba5bfaf..395775bc63 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
@@ -6,12 +6,12 @@ EAPI=8
 inherit autotools edos2unix flag-o-matic multilib multilib-minimal pam db-use systemd toolchain-funcs tmpfiles
 
 SASLAUTHD_CONF_VER="2.1.26"
-MY_PATCH_VER="${PN}-2.1.28-r3-patches"
+MY_PATCH_VER="${PN}-2.1.28-r4-patches"
 DESCRIPTION="The Cyrus SASL (Simple Authentication and Security Layer)"
 HOMEPAGE="https://www.cyrusimap.org/sasl/"
 #SRC_URI="ftp://ftp.cyrusimap.org/cyrus-sasl/${P}.tar.gz"
 SRC_URI="https://github.com/cyrusimap/${PN}/releases/download/${P}/${P}.tar.gz"
-SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH_VER}.tar.xz"
+SRC_URI+=" https://dev.gentoo.org/~grobian/distfiles/${MY_PATCH_VER}.tar.xz"
 
 LICENSE="BSD-with-attribution"
 SLOT="2"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
index b2f6ab3007..1e6a82d027 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.bz
 
 LICENSE="MIT"
 SLOT="0/4"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
 IUSE="doc static-libs"
 
 BDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
index e4a7ca4da1..f936805969 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.0.ebuild
@@ -10,7 +10,7 @@ EAPI=8
 # any subsequent ones linked within so you're covered for a while.)
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-inherit libtool verify-sig
+inherit verify-sig
 
 DESCRIPTION="IPC library used by GnuPG and GPGME"
 HOMEPAGE="https://www.gnupg.org/related_software/libassuan/index.en.html"
@@ -26,21 +26,6 @@ RDEPEND=">=dev-libs/libgpg-error-1.33"
 DEPEND="${RDEPEND}"
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-gnupg )"
 
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		elibtoolize
-
-		# fix standards conflict
-		sed -i \
-			-e '/_XOPEN_SOURCE/s/500/600/' \
-			-e 's/_XOPEN_SOURCE_EXTENDED/_NO&/' \
-			-e 's/__EXTENSIONS__/_NO&/' \
-			configure || die
-	fi
-}
-
 src_configure() {
 	local myeconfargs=(
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1.ebuild
index e4a7ca4da1..f936805969 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libassuan/libassuan-3.0.1.ebuild
@@ -10,7 +10,7 @@ EAPI=8
 # any subsequent ones linked within so you're covered for a while.)
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
-inherit libtool verify-sig
+inherit verify-sig
 
 DESCRIPTION="IPC library used by GnuPG and GPGME"
 HOMEPAGE="https://www.gnupg.org/related_software/libassuan/index.en.html"
@@ -26,21 +26,6 @@ RDEPEND=">=dev-libs/libgpg-error-1.33"
 DEPEND="${RDEPEND}"
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-gnupg )"
 
-src_prepare() {
-	default
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		elibtoolize
-
-		# fix standards conflict
-		sed -i \
-			-e '/_XOPEN_SOURCE/s/500/600/' \
-			-e 's/_XOPEN_SOURCE_EXTENDED/_NO&/' \
-			-e 's/__EXTENSIONS__/_NO&/' \
-			configure || die
-	fi
-}
-
 src_configure() {
 	local myeconfargs=(
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
index 9747d039fe..6d72a68b85 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
@@ -142,9 +142,6 @@ multilib_src_configure() {
 		# after libgcrypt drops them (bug #468616)
 		--without-capabilities
 
-		# http://trac.videolan.org/vlc/ticket/620
-		$([[ ${CHOST} == *86*-darwin* ]] && echo "--disable-asm")
-
 		$(use asm || echo "--disable-asm")
 
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.3-r1.ebuild
index e2225f4238..ae0b050199 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.3-r1.ebuild
@@ -140,9 +140,6 @@ multilib_src_configure() {
 		# after libgcrypt drops them (bug #468616)
 		--without-capabilities
 
-		# http://trac.videolan.org/vlc/ticket/620
-		$([[ ${CHOST} == *86*-darwin* ]] && echo "--disable-asm")
-
 		$(use asm || echo "--disable-asm")
 
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0.ebuild
index f3520b916d..3eb2898506 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.11.0.ebuild
@@ -94,13 +94,6 @@ src_configure() {
 }
 
 multilib_src_configure() {
-	if [[ ${CHOST} == *86*-solaris* ]] ; then
-		# ASM code uses GNU ELF syntax, divide in particular, we need to
-		# allow this via ASFLAGS, since we don't have a flag-o-matic
-		# function for that, we'll have to abuse cflags for this
-		append-cflags -Wa,--divide
-	fi
-
 	if [[ ${CHOST} == powerpc* ]] ; then
 		# ./configure does a lot of automagic, prevent that
 		# generic ppc32+ppc64 altivec
@@ -146,9 +139,6 @@ multilib_src_configure() {
 		# after libgcrypt drops them (bug #468616)
 		--without-capabilities
 
-		# http://trac.videolan.org/vlc/ticket/620
-		$([[ ${CHOST} == *86*-darwin* ]] && echo "--disable-asm")
-
 		$(use asm || echo "--disable-asm")
 
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.7.ebuild
index 6e94bee349..b02777ead9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.7.ebuild
@@ -20,7 +20,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="LGPL-3+ GPL-2+ GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs"
 
 RDEPEND=">=dev-libs/libgpg-error-1.33"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
index c3489a869e..b5d2df84aa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/Manifest
@@ -1,3 +1,4 @@
+DIST libnl-3.10.0.tar.gz 1116186 BLAKE2B 13383c4ef49be3bcf89122b24d1d5dc9834353aa7128f04f50993203add14aa7f97a4500164982ddcb82f481f7324a26efc2375036d5a23bfa62b15c4fe07473 SHA512 c95e79fba69308c63a08d0c576503b4398710ea9cd1d0097851500a7fbc5fbe87fb32ac281cf42bbfe57eab07b110055e6bc9b95d82244bba3df8a31fe562962
 DIST libnl-3.7.0.tar.gz 1000913 BLAKE2B 22c418ea520416d79ee4552ab6bc5ba99239b29e074c840d31b0ec4171a0403ea9d2c1afcbf1b3428564dd371cadd99bc062ae7540e7496f970c4fb98f967e84 SHA512 80fbbc079299c90afd2a5eda62e4d4f98bf4ef23958c3ce5101f4ed4d81d783af733213bb3bab15f218555d8460bc2394898f909f4ac024fc27281faec86a041
 DIST libnl-3.8.0.tar.gz 1071113 BLAKE2B ff90d52e9b617ad8a53e4d42f43bee065b331ed919a3effc4a0f38c8e15b46f86c1eb153816499ed77dd99063500b1dc52951891034475a5bb81da1ad8004594 SHA512 a8da7e8464c5cab2807cd86f83fca53bc77f7c3bdefe43880db7be9caf5ba6bfca1b7e778b906c12fda1cf7e6f413f88cc7ad1dcc42fe8c050a8d28a6e656c02
 DIST libnl-3.9.0.tar.gz 1074117 BLAKE2B 56a39aad9aa15992ff02fe35732abbc5ed5d107b814587e02b914631489877899989d49c7aeee1ecb461ad5f525c7cd7c045c9770864d83b0a58490293441193 SHA512 b6f3633d1920e61645c97f4c4c4419444e7fd66aa3b67b0a73bc29df24cf27065542a62a9c2581f90d0c153247922ce5c649b7da51c0fead6afceaf4d0361dce
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild
new file mode 100644
index 0000000000..1c7d4454ac
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.10.0.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Make sure to test USE=utils on bumps and update MULTILIB_WRAPPED_HEADERS if needed
+
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..12} )
+inherit autotools distutils-r1 multilib-minimal
+
+LIBNL_P=${P/_/-}
+LIBNL_DIR=${PV/_/}
+LIBNL_DIR=${LIBNL_DIR//./_}
+
+DESCRIPTION="Libraries providing APIs to netlink protocol based Linux kernel interfaces"
+HOMEPAGE="https://www.infradead.org/~tgr/libnl/ https://github.com/thom311/libnl"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/thom311/libnl"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/thom311/${PN}/releases/download/${PN}${LIBNL_DIR}/${P/_rc/-rc}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+	S="${WORKDIR}/${LIBNL_P}"
+fi
+
+LICENSE="LGPL-2.1 utils? ( GPL-2 )"
+SLOT="3"
+IUSE="+debug python test utils"
+# Tests fail w/ sandboxes
+# https://github.com/thom311/libnl/issues/361
+RESTRICT="!test? ( test ) test"
+
+RDEPEND="python? ( ${PYTHON_DEPS} )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${RDEPEND}
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+	python? (
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+	)
+	test? ( dev-libs/check )
+"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# We do not install CLI stuff for non-native
+	/usr/include/libnl3/netlink/cli/addr.h
+	/usr/include/libnl3/netlink/cli/class.h
+	/usr/include/libnl3/netlink/cli/cls.h
+	/usr/include/libnl3/netlink/cli/ct.h
+	/usr/include/libnl3/netlink/cli/exp.h
+	/usr/include/libnl3/netlink/cli/link.h
+	/usr/include/libnl3/netlink/cli/mdb.h
+	/usr/include/libnl3/netlink/cli/nh.h
+	/usr/include/libnl3/netlink/cli/neigh.h
+	/usr/include/libnl3/netlink/cli/qdisc.h
+	/usr/include/libnl3/netlink/cli/route.h
+	/usr/include/libnl3/netlink/cli/rule.h
+	/usr/include/libnl3/netlink/cli/tc.h
+	/usr/include/libnl3/netlink/cli/utils.h
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	if use python; then
+		pushd "${S}"/python > /dev/null || die
+		distutils-r1_src_prepare
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_configure() {
+	# bug #884277
+	export YACC=yacc.bison
+
+	ECONF_SOURCE="${S}" econf \
+		$(multilib_native_use_enable utils cli) \
+		$(use_enable debug)
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		pushd python > /dev/null || die
+		distutils-r1_src_compile
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	CK_VERBOSITY=verbose emake check VERBOSE=1
+
+	if multilib_is_native_abi && use python ; then
+		pushd python > /dev/null || die
+		# TODO: run python/tests/test-create-bridge.py
+		distutils-r1_src_test
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		# Unset DOCS= since distutils-r1.eclass interferes
+		local DOCS=()
+
+		pushd python > /dev/null || die
+
+		distutils-r1_src_install
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_install_all() {
+	DOCS=( ChangeLog )
+
+	einstalldocs
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild
index dc16175b64..c4bd282100 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.7.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -27,7 +27,9 @@ fi
 LICENSE="LGPL-2.1 utils? ( GPL-2 )"
 SLOT="3"
 IUSE="+debug python test utils"
-RESTRICT="!test? ( test )"
+# Tests fail w/ sandboxes
+# https://github.com/thom311/libnl/issues/361
+RESTRICT="!test? ( test ) test"
 
 RDEPEND="python? ( ${PYTHON_DEPS} )"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.8.0.ebuild
index c72e4b01c3..c258b57d08 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.8.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -22,7 +22,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/thom311/${PN}/releases/download/${PN}${LIBNL_DIR}/${P/_rc/-rc}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 
 	S="${WORKDIR}/${LIBNL_P}"
 fi
@@ -30,7 +30,9 @@ fi
 LICENSE="LGPL-2.1 utils? ( GPL-2 )"
 SLOT="3"
 IUSE="+debug python test utils"
-RESTRICT="!test? ( test )"
+# Tests fail w/ sandboxes
+# https://github.com/thom311/libnl/issues/361
+RESTRICT="!test? ( test ) test"
 
 RDEPEND="python? ( ${PYTHON_DEPS} )"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.9.0.ebuild
index cd91ab04a0..157fe4e901 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.9.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-3.9.0.ebuild
@@ -30,7 +30,9 @@ fi
 LICENSE="LGPL-2.1 utils? ( GPL-2 )"
 SLOT="3"
 IUSE="+debug python test utils"
-RESTRICT="!test? ( test )"
+# Tests fail w/ sandboxes
+# https://github.com/thom311/libnl/issues/361
+RESTRICT="!test? ( test ) test"
 
 RDEPEND="python? ( ${PYTHON_DEPS} )"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
index 65afdf1df7..1c7d4454ac 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libnl/libnl-9999.ebuild
@@ -30,7 +30,9 @@ fi
 LICENSE="LGPL-2.1 utils? ( GPL-2 )"
 SLOT="3"
 IUSE="+debug python test utils"
-RESTRICT="!test? ( test )"
+# Tests fail w/ sandboxes
+# https://github.com/thom311/libnl/issues/361
+RESTRICT="!test? ( test ) test"
 
 RDEPEND="python? ( ${PYTHON_DEPS} )"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
index 9525dd0504..31f46b9f96 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/metadata.xml
@@ -1,10 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person" proxied="yes">
-		<email>arfrever.fta@gmail.com</email>
-		<name>Arfrever Frehtes Taifersar Arahesis</name>
-	</maintainer>
 	<maintainer type="project">
 		<email>cjk@gentoo.org</email>
 		<name>Cjk</name>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/backports-tarfile/backports-tarfile-1.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/backports-tarfile/backports-tarfile-1.2.0.ebuild
index 1f0459fd0c..f5f19e4439 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/backports-tarfile/backports-tarfile-1.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/backports-tarfile/backports-tarfile-1.2.0.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
index 998be6c39d..7fe03ded49 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/Manifest
@@ -2,3 +2,4 @@ DIST pip-24.0-py3-none-any.whl 2110226 BLAKE2B 6a0c8c9796cd574ef1d709de40a8530a1
 DIST pip-24.1-py3-none-any.whl 1823006 BLAKE2B ca5282b1100243cc4e391ce30d5ae7d4978987e46323b7e151c87457c4ab762f909c88ae3cb72015d09bf7c1243ddb6ad791e991093713431961962fc6fdde83 SHA512 84e8318896294e5750f30a3fa55833e5e5c802066091802e05ff94fe139c825f3fe0fb5014b899f0afd844ad1129e8d04b9fedd74a7f46a1c248dac546ab16f8
 DIST pip-24.1.1-py3-none-any.whl 1824282 BLAKE2B dc8b4938002bc8ededf5f3fb5f47492b529cb846f145308d5392c04778417f7e85527064e791c4dec4bfe6fc407bcc4d7ad26ff84e0f4c436dce5db8d9ec1f25 SHA512 591c0862ca7469a00a4a0220ca9acbd4834394abb0abcd44bd071a1b392b46029d618c2219e327cd43bacdd5d62f0f47d88454d60d4028f0ba7cd02ce3e648bf
 DIST pip-24.1.2-py3-none-any.whl 1824406 BLAKE2B b3e951f444bc93cf64a35acbef5363f7e44607f567f73eff886f5a14bd97fe5b18aa5a8de01b899601847bccee24318843b41c35cd484e758ffb4c11460b458f SHA512 bc8ed36bc9e618b7e299d412d07472b46968ba6485dd1d7eee4e8583996aa29cb268ff5d3114a6e5efeae9f6407c9f9066a0e4f5c2a0be76e6cd234b85cc2bec
+DIST pip-24.2-py3-none-any.whl 1815170 BLAKE2B 8d93bdfb2f3ae4fafd5433df1f9871ca549029457dd4395cf7c53fff93d235768f042cb2f7b6d5b5af068df1867add1a0aca83d329a6d66ecd64fa51e01f0939 SHA512 5c8c6531a477aa4deb9e880f079c6971318b3b0eae007a45c7d73aff1da050824bb6c44e8b71487c9b937732bca93c29b07ed2272fff118cc11fd27bad3022f5
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.2.ebuild
index 85e9351f85..03358c3201 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.1.2.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	!<dev-python/ensurepip-wheels-100
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.2.ebuild
new file mode 100644
index 0000000000..85e9351f85
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-pip/ensurepip-pip-24.2.ebuild
@@ -0,0 +1,24 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit pypi
+
+DESCRIPTION="Shared pip wheel for ensurepip Python module"
+HOMEPAGE="https://pypi.org/project/pip/"
+SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
+S=${DISTDIR}
+
+LICENSE="Apache-2.0 BSD BSD-2 ISC LGPL-2.1+ MIT MPL-2.0 PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	!<dev-python/ensurepip-wheels-100
+"
+
+src_install() {
+	insinto /usr/lib/python/ensurepip
+	doins "${A}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
index deba7be87a..757be9a9cf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/Manifest
@@ -1,3 +1,4 @@
-DIST setuptools-70.1.1-py3-none-any.whl 883347 BLAKE2B f0e9c3b3ee278942b72ebf470279841f648e7852d355841dab27d28551ee09fa1ed6a77e02c5c808a820810a134dffdc28038938c0e2003011f966e6d5799428 SHA512 81ebaa3c39d599ae3975ec5848ca03491188de10c62d0a01923ded1cb4d08dbbbb3be9ecee501cfe16d88726ec0899ad8f36f7c7b289f1f90c5bec403b5049c1
-DIST setuptools-70.2.0-py3-none-any.whl 930834 BLAKE2B 7ef99e6c7c47fd306c4a136504a1d3285faa046da6a4b0be15ec66a2a2eccbe34f203bed794f0a9114ae6970aea163207d22bd4bf5aedf44a92cc2abcac3d881 SHA512 ed6b5199a795c776d653f02e665e560da27e515cf334a2afbbf7f7cb7eb9cd738ca685a2b52d43d68ce6f63486d8da5baa216e58af95e5fad03c6dd95d3d901a
 DIST setuptools-70.3.0-py3-none-any.whl 931070 BLAKE2B 92c424f7efc52f42bb4e04f3ddcc57eb079e2db3cb2af1a142520f656c05895ed5bde816e37f05d96d4c431fb888bf09d576956313667a029b6f8de9afc867b4 SHA512 085d39ef4426aa5f097fbc484595becc16e61ca23fc7da4d2a8bba540a3b82e789e390b176c7151bdc67d01735cce22b1562cdb2e31273225a2d3e275851a4ad
+DIST setuptools-71.0.4-py3-none-any.whl 2341127 BLAKE2B 6312511c9981ff41e0f8a7eb3da511c9bf35b52af9fb7cbd826d3fecf342008911d8b13a6a0747a1f3d0a8189fcf701d82b03b7b62c73774845d35dc38fb8743 SHA512 a5909a1bbc46924ac8ee89322ed35fbf5562397fc46f5d20d12f6d63dbd94355c4c9718c07597b6d50c7fe46a771b96c2c25f1f2f53d6ff17c4d7cbd9e6bcb09
+DIST setuptools-71.1.0-py3-none-any.whl 2341722 BLAKE2B 5d2aa4205b91f619a5c6e9596d9ac77aaef4759a98d4a2ee1cd706b01febadf2b94cc891f92640da185ac565d315b141c66f628a213fa199a3ab282250250d34 SHA512 3c2a49f5a3953b525885635bbd93a503e6bc378914da2a2ff658b5800b27848e91ee268d652176c7034f55b8937db10d7e68f3d4d315ca03124ee3054f58e36c
+DIST setuptools-72.0.0-py3-none-any.whl 2337262 BLAKE2B 10a0ebe1238248e207f3c6a92b671f23be2590ba1574778b97fb2b169eaee9e3274c466083a401db48076524d006b2ff90084e4645852eec4b4ecfc8b70e5cc8 SHA512 ef89ac76684f646850d59438c9cbe2a3eaf393bee0dc0577ab8dd12514ad7b2945ca027be1fb361d4f81f0b3722bc2fa006dcc321616d2d64f8f76c465f0f18f
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.3.0.ebuild
index 97aca4a618..6e384d8b8a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.3.0.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	!<dev-python/ensurepip-wheels-100
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-71.0.4.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.2.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-71.0.4.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-71.1.0.ebuild
similarity index 71%
rename from sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.1.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-71.1.0.ebuild
index 6e384d8b8a..97aca4a618 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-70.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-71.1.0.ebuild
@@ -12,7 +12,7 @@ S=${DISTDIR}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	!<dev-python/ensurepip-wheels-100
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-72.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-72.0.0.ebuild
new file mode 100644
index 0000000000..97aca4a618
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/ensurepip-setuptools/ensurepip-setuptools-72.0.0.ebuild
@@ -0,0 +1,24 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit pypi
+
+DESCRIPTION="Shared setuptools wheel for ensurepip Python module"
+HOMEPAGE="https://pypi.org/project/setuptools/"
+SRC_URI="$(pypi_wheel_url "${PN#ensurepip-}")"
+S=${DISTDIR}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	!<dev-python/ensurepip-wheels-100
+"
+
+src_install() {
+	insinto /usr/lib/python/ensurepip
+	doins "${A}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
index 6a2d88cc99..8cb625122f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	$(python_gen_cond_dep '
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/Manifest
index 22da7a46ee..17c88fa3de 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/Manifest
@@ -1,2 +1,3 @@
 DIST jaraco_text-3.12.1.tar.gz 16580 BLAKE2B 89f11877052e6b7cacbee4ae53ea140ce337a3a8f25657c558e3634378d20ac70206fd188f8492bdc725ebfec94c7f553ec61a9a3be97738918746fab79a9414 SHA512 4a459e497259de8dc37fbe92eec19973f5d1425f23212221885339a9c7b0f432301978c3c918f4cdd4e1cb3e50b465aad07634ab8cf40f86151d08b150d097e4
 DIST jaraco_text-3.14.0.tar.gz 16824 BLAKE2B 62a4db8fc6e7148d81dacaab08a3dd3478a74e9cb0377a3b9cbce538575542cd99b42f599af04fdfa62be06d3edb7a7f7f4b27883e91608e8d1033c655ee8304 SHA512 3557876c0ab2e1a54c8ce85663b45c9c143a88bb64a5d9c3e2354b2af229b25983b7977c576f83add1b5bae79cceebb01206c756a354eca24681a57a0ee14fb4
+DIST jaraco_text-4.0.0.tar.gz 17009 BLAKE2B 4aa4381de0988383f4442a1caaab48eae79f2cbe564438b540adfed12d9cfb3680de1e5579029be204024256ba9f3327af225db73f2bd68fed7b2bdd4859a799 SHA512 240c4f6f3df6916e9015479147474a43ea9e858e22821f53263c1ef42c61336c36a34baa9c7384b9d345cf42e10b7499e2efa3c85178a0c2abc47fcd82b63fb3
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
new file mode 100644
index 0000000000..09e788276e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-4.0.0.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYPI_PN=${PN/-/.}
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Text utilities used by other projects by developer jaraco"
+HOMEPAGE="
+	https://github.com/jaraco/jaraco.text/
+	https://pypi.org/project/jaraco.text/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/jaraco-context-4.1.1-r1[${PYTHON_USEDEP}]
+	>=dev-python/jaraco-functools-3.5.0-r1[${PYTHON_USEDEP}]
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "jaraco.text"
+		version = "${PV}"
+		description = "Module for text manipulation"
+	EOF
+
+	# remove CLI tools, they have annoying deps, no entry points
+	# and since there are dashes in their names, they can't be imported
+	# anyway
+	rm jaraco/text/*-*.py || die
+}
+
+python_install() {
+	distutils-r1_python_install
+	# rename to workaround a bug in pkg_resources
+	# https://bugs.gentoo.org/834522
+	mv "${D}$(python_get_sitedir)"/jaraco{_,.}text-${PV}.dist-info || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-10.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-10.4.0.ebuild
index 325ccf8122..f775161172 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-10.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-10.4.0.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="HPND"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
 IUSE="examples imagequant +jpeg jpeg2k lcms test tiff tk truetype webp xcb zlib"
 REQUIRED_USE="test? ( jpeg jpeg2k lcms tiff truetype )"
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 67175342c4..afb99d9e64 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,3 +1,4 @@
-DIST setuptools-70.1.1.tar.gz 2292324 BLAKE2B 9d489117a80ef9cefab6b730680a614d990f338aa54579928bafbe3c87dbb5e4db8527b8a0b6c1090bcd3504be97cc69a9ce979e593d0634d9b66b66bccb25e5 SHA512 63452aa1e1d1dea6ad622a21fcc9334bc3603e45de9a1485f79776e02a0fb3b0a0a8b3e886af73845c3c373348c7021f2e06a5665676e9015ee9855441512136
-DIST setuptools-70.2.0.tar.gz 2332711 BLAKE2B d552e3c7fb8bad3829b6c210827af2a3993afa7c534502d08cb7f87df846f9939b75ce181217c673be7a0c71e81ede437b5f44cf9a42ff13133a9f922e426c1d SHA512 a2b0aaf57d012326475ee7637e65ebbc3b1a09b338850e8b0c6a0f169c49651f934c813d6d347ba1ff04894a4d8341bb5fedbea35d45dbc19f317587bbb35094
 DIST setuptools-70.3.0.tar.gz 2333112 BLAKE2B cffe583c1440e2c6ed049fc0c3da70d6b3f43710cec8eeba9b96906d7d3113c0156ac0398f12355e2c0eeeb73dc351e56eea117361c83a4819e255f2b44d01da SHA512 9f330bd9867631da69ee0886551033a6e8ef3cf52cfe38aad9fcd359cbfc2e0d7ee8c85382b29f8d52568c674893dc07f2b2a896afe5154e6140bb3209ee50a0
+DIST setuptools-71.0.4.tar.gz 2421868 BLAKE2B 29c63bedd87dd4c79ef86d20b6ab4297ae434a59d412813d0ef136c6239b8c77c7ec81b8384319a0e18617d0f8417da3c28d9f8ece40f4509949611c575c35a2 SHA512 efd1996e2720244b8bb385682258be4b2cd67d18b0910aa3f32c23907fad998144ff47455fb8866298e2b879b714624d09efefdcf1bf1d55047ecd3d1e36548e
+DIST setuptools-71.1.0.tar.gz 2422233 BLAKE2B b98bc2155cdf5acabd52c942a8b7908dbb48b39a3abbf065e42b089e22c3bba27aeee3492c5ecfc1de8b4bdba3c97259cfc609a31cdc11cdaf23f9a2dbab8685 SHA512 2cb817d3dee790ab1e71739b3980361c6dface44fa9c027a92aa3f96e758c034b0330de5eae48365dfa17933fe050f8418cff23fea192b3c616789215e411c1a
+DIST setuptools-72.0.0.tar.gz 2419061 BLAKE2B 70c401d2314f246131e730b700fa0de2351d1bb92c8fe3403ee3db8f3a65bfec958b78b91e47b116cf1c0dac2ec81bb79194835f2be2fc8f1a18638393b7b2e0 SHA512 4ccb06eded99bc5b8f7cc932bc77fe46c17826639e2a8646eef96466cfb1f4c5e5d46c0518831b2f361bfb06956df94aa1d1a682fd45d5dfb553db4db8fe3aaf
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.3.0.ebuild
index 9e5836dda1..4888f82ee6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.3.0.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.2.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.0.4.ebuild
similarity index 75%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.2.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.0.4.ebuild
index ee5ce0b32c..d4a49d9456 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.2.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.0.4.ebuild
@@ -21,11 +21,10 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
-# check */_vendor/vendored.txt
 RDEPEND="
 	!!<dev-python/setuptools-rust-1.8.0
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -87,10 +86,7 @@ src_prepare() {
 	# remove bundled dependencies
 	rm -r */_vendor setuptools/_distutils/_vendor || die
 
-	# remove the ugly */extern hack that breaks on unvendored deps
-	rm -r */extern || die
 	find -name '*.py' -exec sed \
-		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
 		-e 's:from [.]_vendor[.]:from :' \
 		-i {} + || die
 }
@@ -102,20 +98,14 @@ python_test() {
 
 	local EPYTEST_DESELECT=(
 		# network
-		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
-		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
-		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
 		setuptools/tests/test_build_meta.py::test_legacy_editable_install
 		setuptools/tests/test_distutils_adoption.py
 		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
-		setuptools/tests/test_virtualenv.py::test_clean_env_install
 		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
 		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
 		# TODO
 		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
 		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		setuptools/tests/test_extern.py::test_distribution_picklable
 		# expects bundled deps in virtualenv
 		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
 		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
@@ -123,22 +113,12 @@ python_test() {
 		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
 		# TODO, probably some random package
 		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# Internet, sigh
-		setuptools/tests/test_integration.py
-		# flaky
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_transitive_extra_dependency
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_distutils_command_dep
+		# broken by unbundling
+		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
 	)
 
-	case ${EPYTHON} in
-		python3.12)
-			EPYTEST_DESELECT+=(
-				# TODO
-				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_distutils_command_dep
-				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_transitive_extra_dependency
-			)
-	esac
-
 	local EPYTEST_XDIST=1
-	epytest -o tmp_path_retention_policy=all setuptools
+	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
+	epytest -o tmp_path_retention_policy=all \
+		-m "not uses_network" setuptools
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.1.0.ebuild
similarity index 73%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.1.1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.1.0.ebuild
index 8805e6bdc1..d4a49d9456 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-70.1.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-71.1.0.ebuild
@@ -21,11 +21,10 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
-# check */_vendor/vendored.txt
 RDEPEND="
 	!!<dev-python/setuptools-rust-1.8.0
 	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
@@ -67,6 +66,7 @@ BDEPEND="
 # trove-classifiers are optionally used in validation, if they are
 # installed.  Since we really oughtn't block them, let's always enforce
 # the newest version for the time being to avoid errors.
+# https://github.com/pypa/setuptools/issues/4459
 PDEPEND="
 	dev-python/setuptools-scm[${PYTHON_USEDEP}]
 	>=dev-python/trove-classifiers-2024.7.2[${PYTHON_USEDEP}]
@@ -84,12 +84,10 @@ src_prepare() {
 	sed -i -e '/--import-mode/d' pytest.ini || die
 
 	# remove bundled dependencies
-	rm -r */_vendor || die
+	rm -r */_vendor setuptools/_distutils/_vendor || die
 
-	# remove the ugly */extern hack that breaks on unvendored deps
-	rm -r */extern || die
 	find -name '*.py' -exec sed \
-		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
+		-e 's:from [.]_vendor[.]:from :' \
 		-i {} + || die
 }
 
@@ -100,20 +98,14 @@ python_test() {
 
 	local EPYTEST_DESELECT=(
 		# network
-		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
-		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
-		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
 		setuptools/tests/test_build_meta.py::test_legacy_editable_install
 		setuptools/tests/test_distutils_adoption.py
 		setuptools/tests/test_editable_install.py
-		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
-		setuptools/tests/test_virtualenv.py::test_clean_env_install
 		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
 		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
 		# TODO
 		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
 		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
-		setuptools/tests/test_extern.py::test_distribution_picklable
 		# expects bundled deps in virtualenv
 		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
 		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
@@ -121,22 +113,12 @@ python_test() {
 		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
 		# TODO, probably some random package
 		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
-		# Internet, sigh
-		setuptools/tests/test_integration.py
-		# flaky
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_transitive_extra_dependency
-		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_distutils_command_dep
+		# broken by unbundling
+		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
 	)
 
-	case ${EPYTHON} in
-		python3.12)
-			EPYTEST_DESELECT+=(
-				# TODO
-				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_distutils_command_dep
-				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_transitive_extra_dependency
-			)
-	esac
-
 	local EPYTEST_XDIST=1
-	epytest -o tmp_path_retention_policy=all setuptools
+	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
+	epytest -o tmp_path_retention_policy=all \
+		-m "not uses_network" setuptools
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-72.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-72.0.0.ebuild
new file mode 100644
index 0000000000..d4a49d9456
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-72.0.0.ebuild
@@ -0,0 +1,124 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..13} pypy3 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!!<dev-python/setuptools-rust-1.8.0
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/ordered-set-4.0.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-24[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	' 3.10)
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			>=dev-python/build-1.0.3[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.14[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
+			dev-python/jaraco-test[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pyproject-hooks[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
+			dev-python/pytest-subprocess[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+# setuptools-scm is here because installing plugins apparently breaks stuff at
+# runtime, so let's pull it early. See bug #663324.
+#
+# trove-classifiers are optionally used in validation, if they are
+# installed.  Since we really oughtn't block them, let's always enforce
+# the newest version for the time being to avoid errors.
+# https://github.com/pypa/setuptools/issues/4459
+PDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	>=dev-python/trove-classifiers-2024.7.2[${PYTHON_USEDEP}]
+"
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}/setuptools-62.4.0-py-compile.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	# breaks tests
+	sed -i -e '/--import-mode/d' pytest.ini || die
+
+	# remove bundled dependencies
+	rm -r */_vendor setuptools/_distutils/_vendor || die
+
+	find -name '*.py' -exec sed \
+		-e 's:from [.]_vendor[.]:from :' \
+		-i {} + || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
+		# broken by unbundling
+		setuptools/tests/test_setuptools.py::test_wheel_includes_vendored_metadata
+	)
+
+	local EPYTEST_XDIST=1
+	local -x PRE_BUILT_SETUPTOOLS_WHEEL=${DISTUTILS_WHEEL_PATH}
+	epytest -o tmp_path_retention_policy=all \
+		-m "not uses_network" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
index 5251daabfb..5f1c428547 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
@@ -1,4 +1,6 @@
+DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84a20015239cf157e3f4f51c7ac5efedc8a51132b2d7482f9276ac418de6624831c8a3b806130d9c2d2124c539b SHA512 baa2487954044f991d2ae254d77d14a1f0185dd62c9f0fcaff69f586c9f906823017b8db1c4588f27b076dfa3ebb606929fec859f60ea419e7974330b9289cc2
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
 DIST linux-6.9.tar.xz 144034416 BLAKE2B 4cf86c3cfe6e6534745d42dfaeca59b17ea1168c4e8b615c80e6d8aac735f11283cd85fa992b440b5d4452917e94b9f08397a64af0be5894e3df23c68892377e SHA512 fed3b4cd1fbfb4d94618587c1934273d2ecc8b6e42a3d586ff8a5f24980be930f2ef803aa2923ca3bfa5e4e619f967f3af315368f24fa76f610b10443624a579
+DIST patch-6.10.xz 6489436 BLAKE2B 96ab8c23a804ae0d3dc5834efa19f9f9d8b4cd1e84d7519670e3e5213af0ef016079d4c0624f45d4163af7b250cb5ab30aec28bb62433d7480ab3d3a11e681b6 SHA512 adbc39835028aa67aa949310c9d44d83c6fddf6a12fbc305960d935bd7e2009e1ff813f2388cd59e59bf64efb2e1df51a6d266594fa12e75074d7346c78bb2eb
 DIST patch-6.8.2.xz 247244 BLAKE2B a85078230548543c38550a5546689d0b44a54208cdad591ab34e10dec9348ce2f74e45bf85f373b14977d40556067e2e2c17ac4b6791fbb8aaba98feccd3cdac SHA512 a8e32b89f7680670c69c62f356846bb65b57614f979114627a9a2f945d7dc97c921d30197dffa993e5b18e499ba8c7196046ffdf0e721528a5378d1ee65a9ba5
 DIST patch-6.9.2.xz 16184 BLAKE2B 8a37e96c253b55b57c86f1654f2ea8bf65af96b1b38213e90032cb918bb8eea992d6ddbfa6a6774a229ab2e2288ab57bdb6cbad6e7e393c123f24850e06847c9 SHA512 a27af24f0caaa5de3811b6db5acc2d72b96df9ebb5c44bad99a949d871fb06c6ffd2be10cfc35b246d430c7be2291701f802aed47eaa8818ad12b8818a60f3ec
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild
new file mode 100644
index 0000000000..9a93a41059
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-7.5.0.ebuild
@@ -0,0 +1,124 @@
+# Copyright 2021-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+
+inherit estack linux-info optfeature python-any-r1 bash-completion-r1 toolchain-funcs
+
+DESCRIPTION="Tool for inspection and simple manipulation of eBPF programs and maps"
+HOMEPAGE="https://kernel.org/"
+
+# Use PV to indicate the full kernel version
+MY_PV=6.10
+LINUX_V="${MY_PV:0:1}.x"
+LINUX_VER=$(ver_cut 1-2 ${MY_PV})
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+LINUX_PATCH=patch-${MY_PV}.xz
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/bpf/bpftool"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+IUSE="caps +llvm"
+
+RDEPEND="
+	sys-libs/binutils-libs:=
+	sys-libs/zlib:=
+	virtual/libelf:=
+	caps? ( sys-libs/libcap:= )
+	llvm? ( sys-devel/llvm:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.8
+"
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	app-arch/tar
+	dev-python/docutils
+"
+
+CONFIG_CHECK="~DEBUG_INFO_BTF"
+
+# src_unpack and src_prepare are copied from dev-util/perf since
+# it's building from the same tarball, please keep it in sync with perf
+src_unpack() {
+	local paths=(
+		kernel/bpf tools/{arch,bpf,build,include,lib,perf,scripts}
+		scripts include lib "arch/*/include" "arch/*/lib" "arch/*/tools"
+	)
+
+	# We expect the tar implementation to support the -j and --wildcards option
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		filterdiff -p1 ${paths[@]/#/-i } -z "${DISTDIR}"/${LINUX_PATCH} \
+			> ${P}.patch
+		eend $? || die "filterdiff failed"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	# Use rst2man or rst2man.py depending on which one exists (#930076)
+	type -P rst2man >/dev/null || sed -i -e 's/rst2man/rst2man.py/g' Documentation/Makefile || die
+
+	# remove -Werror (bug 887981)
+	sed -i -e 's/\-Werror//g' ../../lib/bpf/Makefile || die
+}
+
+bpftool_make() {
+	local arch=$(tc-arch-kernel)
+	tc-export AR CC LD
+
+	emake V=1 VF=1 \
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)" \
+		EXTRA_CFLAGS="${CFLAGS}" ARCH="${arch}" \
+		prefix="${EPREFIX}"/usr \
+		bash_compdir="$(get_bashcompdir)" \
+		feature-libcap="$(usex caps 1 0)" \
+		feature-llvm="$(usex llvm 1 0)" \
+		"$@"
+}
+
+src_compile() {
+	bpftool_make
+	bpftool_make -C Documentation
+}
+
+src_install() {
+	bpftool_make DESTDIR="${D}" install
+	bpftool_make mandir="${ED}"/usr/share/man -C Documentation install
+}
+
+pkg_postinst() {
+	optfeature "clang-bpf-co-re support" sys-devel/clang[llvm_targets_BPF]
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/metadata.xml
index 84c0375fb1..ddb15174a5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/metadata.xml
@@ -1,7 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<!-- maintainer-needed -->
+	<maintainer type="person" proxied="yes">
+		<email>holger@applied-asynchrony.com</email>
+		<name>Holger Hoffstätte</name>
+	</maintainer>
+	<maintainer type="project" proxied="proxy">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
 	<use>
 		<flag name="caps">Use <pkg>sys-libs/libcap</pkg> to enable unprivileged run support</flag>
 		<flag name="llvm">Use <pkg>sys-devel/llvm</pkg></flag>
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/files/pahole-1.27-r1-fix-clang-btf-generation-bug.patch b/sdk_container/src/third_party/portage-stable/dev-util/pahole/files/pahole-1.27-r1-fix-clang-btf-generation-bug.patch
new file mode 100644
index 0000000000..ab740729ac
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/files/pahole-1.27-r1-fix-clang-btf-generation-bug.patch
@@ -0,0 +1,83 @@
+From 6a2b27c0f512619b0e7a769a18a0fb05bb3789a5 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Tue, 18 Jun 2024 10:37:30 -0300
+Subject: [PATCH] core: Initialize cu->node with INIT_LIST_HEAD()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In cu__new() zalloc() is used defensively, and that helped catch this
+problem where we assume that a cu us in the cus list of cu instances,
+but that is not the case when we use cus__merge_and_process_cu(), for
+instance when loading files created by clang with LTO, as reported by
+Peter Jung and narrowed down by Nathan Chancellor.
+
+If we use INIT_LIST_HEAD() in cu__new() to initialize cu->node, which is
+what we do with other lists and nodes there, then the unconditional
+removal using list_del_init() will be a no-op and removing something not
+on the cus list of cu instances will not cause problems, just keep an
+unconsistent cus->nr_entries field.
+
+So lets just have this fix in first, keeping Nathan's Tested-by and then
+do the a bit more involved fix of either adding that cu to the cus list
+or checking at removal time if it is there.
+
+  Program received signal SIGSEGV, Segmentation fault.
+  0x00007ffff7f1e13e in __list_del (prev=0x0, next=0x0) at /home/acme/git/pahole/list.h:106
+  106		next->prev = prev;
+  (gdb) bt
+  #0  0x00007ffff7f1e13e in __list_del (prev=0x0, next=0x0) at /home/acme/git/pahole/list.h:106
+  #1  0x00007ffff7f1e176 in list_del_init (entry=0x417980) at /home/acme/git/pahole/list.h:165
+  #2  0x00007ffff7f1f8f9 in __cus__remove (cus=0x4142a0, cu=0x417980) at /home/acme/git/pahole/dwarves.c:527
+  #3  0x00007ffff7f1f92b in cus__remove (cus=0x4142a0, cu=0x417980) at /home/acme/git/pahole/dwarves.c:533
+  #4  0x00007ffff7f3d01c in cus__finalize (cus=0x4142a0, cu=0x417980, conf=0x4133c0 <conf_load>, thr_data=0x0)
+      at /home/acme/git/pahole/dwarf_loader.c:3040
+  #5  0x00007ffff7f3e05c in cus__merge_and_process_cu (cus=0x4142a0, conf=0x4133c0 <conf_load>, mod=0x415cf0, dw=0x416110, elf=0x414380,
+      filename=0x7fffffffe3f7 "cast_common.ko", build_id=0x416680 "\265D\371U\213\373u|\037\250\242\032\271\365⒜]y\023", build_id_len=20,
+      type_dcu=0x0) at /home/acme/git/pahole/dwarf_loader.c:3482
+  #6  0x00007ffff7f3e218 in cus__load_module (cus=0x4142a0, conf=0x4133c0 <conf_load>, mod=0x415cf0, dw=0x416110, elf=0x414380,
+      filename=0x7fffffffe3f7 "cast_common.ko") at /home/acme/git/pahole/dwarf_loader.c:3521
+  #7  0x00007ffff7f3e396 in cus__process_dwflmod (dwflmod=0x415cf0, userdata=0x415d00, name=0x415ea0 "cast_common.ko", base=65536,
+      arg=0x7fffffffde40) at /home/acme/git/pahole/dwarf_loader.c:3581
+  #8  0x00007ffff7eb4609 in dwfl_getmodules (dwfl=0x414300, callback=0x7ffff7f3e2ec <cus__process_dwflmod>, arg=0x7fffffffde40, offset=0)
+      at ../libdwfl/dwfl_getmodules.c:86
+  #9  0x00007ffff7f3e4c5 in cus__process_file (cus=0x4142a0, conf=0x4133c0 <conf_load>, fd=3, filename=0x7fffffffe3f7 "cast_common.ko")
+      at /home/acme/git/pahole/dwarf_loader.c:3647
+  #10 0x00007ffff7f3e5cd in dwarf__load_file (cus=0x4142a0, conf=0x4133c0 <conf_load>, filename=0x7fffffffe3f7 "cast_common.ko")
+      at /home/acme/git/pahole/dwarf_loader.c:3684
+  #11 0x00007ffff7f232df in cus__load_file (cus=0x4142a0, conf=0x4133c0 <conf_load>, filename=0x7fffffffe3f7 "cast_common.ko")
+      at /home/acme/git/pahole/dwarves.c:2134
+  #12 0x00007ffff7f23e8b in cus__load_files (cus=0x4142a0, conf=0x4133c0 <conf_load>, filenames=0x7fffffffe0f0)
+      at /home/acme/git/pahole/dwarves.c:2637
+  #13 0x000000000040aec0 in main (argc=2, argv=0x7fffffffe0e8) at /home/acme/git/pahole/pahole.c:3805
+  (gdb) fr 1
+  #1  0x00007ffff7f1e176 in list_del_init (entry=0x417980) at /home/acme/git/pahole/list.h:165
+  165		__list_del(entry->prev, entry->next);
+  (gdb) p entry
+  $1 = (struct list_head *) 0x417980
+  (gdb) p entry->next
+  $2 = (struct list_head *) 0x0
+  (gdb) p entry->prev
+  $3 = (struct list_head *) 0x0
+
+Closes: https://github.com/acmel/dwarves/issues/53
+Closes: https://gitlab.archlinux.org/archlinux/packaging/packages/pahole/-/issues/1
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/all/20240617210810.GA1877676@thelio-3990X
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+---
+ dwarves.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dwarves.c b/dwarves.c
+index 1ec259f5..823a0152 100644
+--- a/dwarves.c
++++ b/dwarves.c
+@@ -739,6 +739,7 @@ struct cu *cu__new(const char *name, uint8_t addr_size,
+ 		cu->dfops	= NULL;
+ 		INIT_LIST_HEAD(&cu->tags);
+ 		INIT_LIST_HEAD(&cu->tool_list);
++		INIT_LIST_HEAD(&cu->node);
+ 
+ 		cu->addr_size = addr_size;
+ 		cu->extra_dbg_info = 0;
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild
new file mode 100644
index 0000000000..97e2e021ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pahole/pahole-1.27-r1.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{9..12} )
+inherit cmake python-single-r1
+
+MY_PN=dwarves
+MY_P=${MY_PN}-${PV%%_p*}
+
+DESCRIPTION="pahole (Poke-a-Hole) and other DWARF utilities"
+HOMEPAGE="https://git.kernel.org/cgit/devel/pahole/pahole.git/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/devel/pahole/pahole.git"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/arnaldocarvalhodemelo.asc
+	inherit verify-sig
+	SRC_URI="http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.xz
+		verify-sig? ( http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.sign )"
+	if [[ ${PV} == *_p* ]] ; then
+		# Patch rollups from git format-patch. Sometimes there are important
+		# fixes in git which haven't been released (and no release in sight).
+		# Patch rollups are a bit better for understanding where changes have
+		# come from for users.
+		SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-patches.tar.xz"
+	fi
+	S="${WORKDIR}"/${MY_P}
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-arnaldocarvalhodemelo )"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="GPL-2" # only
+SLOT="0"
+IUSE="debug"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-libs/elfutils-0.178
+	sys-libs/zlib"
+DEPEND="${RDEPEND}"
+
+DOCS=( README README.ctracer NEWS )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.10-python-import.patch"
+	"${FILESDIR}/${PN}-1.27-r1-fix-clang-btf-generation-bug.patch"
+)
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	# Upstream sign the decompressed .tar
+	if use verify-sig; then
+		einfo "Unpacking ${MY_P}.tar.xz ..."
+		verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+			< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+		assert "Unpack failed"
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	[[ -d "${WORKDIR}"/${P}-patches ]] && PATCHES+=( "${WORKDIR}"/${P}-patches )
+
+	cmake_src_prepare
+	python_fix_shebang ostra/ostra-cg ostra/python/ostra.py
+}
+
+src_configure() {
+	local mycmakeargs=( "-D__LIB=$(get_libdir)" )
+	cmake_src_configure
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index 38c4e09db5..eaf7134c3f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,3 +1,4 @@
+DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84a20015239cf157e3f4f51c7ac5efedc8a51132b2d7482f9276ac418de6624831c8a3b806130d9c2d2124c539b SHA512 baa2487954044f991d2ae254d77d14a1f0185dd62c9f0fcaff69f586c9f906823017b8db1c4588f27b076dfa3ebb606929fec859f60ea419e7974330b9289cc2
 DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.10-expr.patch b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.10-expr.patch
new file mode 100644
index 0000000000..b4220a062f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.10-expr.patch
@@ -0,0 +1,22 @@
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index bc980fd..a7f1e1e 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -1184,7 +1184,7 @@ ifneq ($(NO_LIBTRACEEVENT),1)
+     CFLAGS += -DHAVE_LIBTRACEEVENT $(LIBTRACEEVENT_CFLAGS)
+     LDFLAGS += $(LIBTRACEEVENT_LDFLAGS)
+     EXTLIBS += ${TRACEEVENTLIBS}
+-    LIBTRACEEVENT_VERSION := $(shell PKG_CONFIG_PATH=$(LIBTRACEEVENT_DIR) $(PKG_CONFIG) --modversion libtraceevent)
++    LIBTRACEEVENT_VERSION := $(shell PKG_CONFIG_PATH=$(LIBTRACEEVENT_DIR) $(PKG_CONFIG) --modversion libtraceevent).0
+     LIBTRACEEVENT_VERSION_1 := $(word 1, $(subst ., ,$(LIBTRACEEVENT_VERSION)))
+     LIBTRACEEVENT_VERSION_2 := $(word 2, $(subst ., ,$(LIBTRACEEVENT_VERSION)))
+     LIBTRACEEVENT_VERSION_3 := $(word 3, $(subst ., ,$(LIBTRACEEVENT_VERSION)))
+@@ -1198,7 +1198,7 @@ ifneq ($(NO_LIBTRACEEVENT),1)
+   $(call feature_check,libtracefs)
+   ifeq ($(feature-libtracefs), 1)
+     EXTLIBS += -ltracefs
+-    LIBTRACEFS_VERSION := $(shell $(PKG_CONFIG) --modversion libtracefs)
++    LIBTRACEFS_VERSION := $(shell $(PKG_CONFIG) --modversion libtracefs).0
+     LIBTRACEFS_VERSION_1 := $(word 1, $(subst ., ,$(LIBTRACEFS_VERSION)))
+     LIBTRACEFS_VERSION_2 := $(word 2, $(subst ., ,$(LIBTRACEFS_VERSION)))
+     LIBTRACEFS_VERSION_3 := $(word 3, $(subst ., ,$(LIBTRACEFS_VERSION)))
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.10.ebuild
new file mode 100644
index 0000000000..3a49940473
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.10.ebuild
@@ -0,0 +1,340 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm toolchain-funcs python-r1
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perf.wiki.kernel.org/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 audit babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl python slang systemtap tcmalloc unwind zstd"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.34-r2
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="
+	audit? ( sys-process/audit )
+	babeltrace? ( dev-util/babeltrace:0/1 )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+		sys-devel/clang:=
+		sys-devel/llvm:=
+	)
+	caps? ( sys-libs/libcap )
+	capstone? ( dev-libs/capstone )
+	crypt? ( dev-libs/openssl:= )
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-debug/systemtap )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	zstd? ( app-arch/zstd:= )
+	dev-libs/elfutils
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+	virtual/libcrypt
+"
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	local CONFIG_CHECK="
+		~DEBUG_INFO
+		~FTRACE
+		~FTRACE_SYSCALLS
+		~FUNCTION_TRACER
+		~KALLSYMS
+		~KALLSYMS_ALL
+		~KPROBES
+		~KPROBE_EVENTS
+		~PERF_EVENTS
+		~UPROBES
+		~UPROBE_EVENTS
+	"
+
+	use bpf && llvm_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT"
+	fi
+
+	linux-info_pkg_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		kernel/bpf tools/{arch,bpf,build,include,lib,perf,scripts}
+		scripts include lib "arch/*/include" "arch/*/lib" "arch/*/tools"
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		filterdiff -p1 ${paths[@]/#/-i } -z "${DISTDIR}"/${LINUX_PATCH} \
+			> ${P}.patch
+		eend $? || die "filterdiff failed"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	eapply "${FILESDIR}"/perf-6.4-libtracefs.patch
+	eapply "${FILESDIR}"/perf-6.10-expr.patch
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" 1; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+
+	# sync this with the whitelist in tools/perf/Makefile.config
+	local disable_libdw
+	if ! use amd64 && ! use x86 && \
+	   ! use arm && \
+	   ! use arm64 && \
+	   ! use ppc && ! use ppc64 \
+	   ! use s390 && \
+	   ! use riscv && \
+	   ! use loong
+	then
+		disable_libdw=1
+	fi
+
+	# perf directly invokes LD for linking without going through CC, on mips
+	# it is required to specify the emulation.  port of below buildroot patch
+	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
+	local linker="$(tc-getLD)"
+	if use mips
+	then
+		if use big-endian
+		then
+			use abi_mips_n64 && linker+=" -m elf64btsmip"
+			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32btsmip"
+		else
+			use abi_mips_n64 && linker+=" -m elf64ltsmip"
+			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32ltsmip"
+		fi
+	fi
+
+	# FIXME: NO_CORESIGHT
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_CAPSTONE=$(puse capstone)
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=$(puse audit)
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
+		NO_LIBELF=
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_LIBZSTD=$(puse zstd)
+		NO_SDT=$(puse systemtap)
+		NO_SHELLCHECK=1
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		DEBUG=$(usex debug 1 "")
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
+		"$@"
+	)
+	emake "${emakeargs[@]}"
+}
+
+src_compile() {
+	filter-lto
+
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 61c0a80323..fa8edb5cdf 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -195,7 +195,6 @@ esac
 # @CODE
 
 # @ECLASS_VARIABLE: DISTUTILS_ALLOW_WHEEL_REUSE
-# @DEFAULT_UNSET
 # @USER_VARIABLE
 # @DESCRIPTION:
 # If set to a non-empty value, the eclass is allowed to reuse a wheel
@@ -205,6 +204,7 @@ esac
 # This is an optimization that can avoid the overhead of calling into
 # the build system in pure Python packages and packages using the stable
 # Python ABI.
+DISTUTILS_ALLOW_WHEEL_REUSE=1
 
 # @ECLASS_VARIABLE: BUILD_DIR
 # @OUTPUT_VARIABLE
@@ -572,6 +572,9 @@ distutils_enable_sphinx() {
 # with the specified test runner.  Also copies the current value
 # of RDEPEND to test?-BDEPEND.  The test-runner argument must be one of:
 #
+# - import-check: `pytest --import-check` fallback (for use when there are
+#   no tests to run)
+#
 # - pytest: dev-python/pytest
 #
 # - setup.py: setup.py test (no deps included)
@@ -597,9 +600,13 @@ distutils_enable_tests() {
 	[[ ${#} -eq 1 ]] || die "${FUNCNAME} takes exactly one argument: test-runner"
 
 	local test_deps=${RDEPEND}
+	local test_pkgs=
 	case ${1} in
+		import-check)
+			test_pkgs+=' dev-python/pytest-import-check[${PYTHON_USEDEP}]'
+			;&
 		pytest)
-			local test_pkgs='>=dev-python/pytest-7.4.4[${PYTHON_USEDEP}]'
+			test_pkgs+=' >=dev-python/pytest-7.4.4[${PYTHON_USEDEP}]'
 			if [[ -n ${EPYTEST_TIMEOUT} ]]; then
 				test_pkgs+=' dev-python/pytest-timeout[${PYTHON_USEDEP}]'
 			fi
@@ -1560,6 +1567,9 @@ distutils-r1_python_test() {
 	_python_check_EPYTHON
 
 	case ${_DISTUTILS_TEST_RUNNER} in
+		import-check)
+			epytest --import-check "${BUILD_DIR}/install$(python_get_sitedir)"
+			;;
 		pytest)
 			epytest
 			;;
@@ -1933,7 +1943,7 @@ _distutils-r1_compare_installed_files() {
 	# Perform the check only if at least one potentially reusable wheel
 	# has been produced.  Nonpure packages (e.g. NumPy) may install
 	# interpreter configuration details into sitedir.
-	if [[ ${!DISTUTILS_WHEELS[*]} != *-none-any.whl* &&
+	if [[ ${!DISTUTILS_WHEELS[*]} != *py3-none-any.whl* &&
 			${!DISTUTILS_WHEELS[*]} != *-abi3-*.whl ]]; then
 		return
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
index 91f8fba879..559342068c 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
@@ -1838,7 +1838,7 @@ ejunit_() {
 	local junit=${1}
 	shift 1
 
-	local cp=$(java-pkg_getjars --with-dependencies ${junit}${pkgs})
+	local cp=$(java-pkg_getjars --build-only --with-dependencies ${junit}${pkgs})
 	if [[ ${1} = -cp || ${1} = -classpath ]]; then
 		cp="${2}:${cp}"
 		shift 2
@@ -2723,7 +2723,13 @@ java-pkg_build-vm-from-handle() {
 	fi
 
 	for vm in ${JAVA_PKG_WANT_BUILD_VM}; do
-		if java-config-2 --select-vm=${vm} 2>/dev/null; then
+		local java_config
+		for java_config in java-config{,-2}; do
+			type -p ${java_config} >/dev/null && break
+		done
+		[[ -z ${java_config} ]] && die "No java-config binary in PATH"
+
+		if ${java_config} --select-vm=${vm} 2>/dev/null; then
 			echo ${vm}
 			return 0
 		fi
diff --git a/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass b/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
index e297fe992c..bb5ff5d782 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/llvm.eclass
@@ -9,6 +9,7 @@
 # @SUPPORTED_EAPIS: 7 8
 # @PROVIDES: llvm-utils
 # @BLURB: Utility functions to build against slotted LLVM
+# @DEPRECATED: llvm-r1.eclass
 # @DESCRIPTION:
 # The llvm.eclass provides utility functions that can be used to build
 # against specific version of slotted LLVM (with fallback to :0 for old
diff --git a/sdk_container/src/third_party/portage-stable/eclass/savedconfig.eclass b/sdk_container/src/third_party/portage-stable/eclass/savedconfig.eclass
index cc57485430..65a1f3bfd8 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/savedconfig.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/savedconfig.eclass
@@ -1,10 +1,10 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: savedconfig.eclass
 # @MAINTAINER:
 # base-system@gentoo.org
-# @SUPPORTED_EAPIS: 6 7 8
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: common API for saving/restoring complex configuration files
 # @DESCRIPTION:
 # It is not uncommon to come across a package which has a very fine
@@ -31,7 +31,7 @@
 # build.
 
 case ${EAPI} in
-	6|7|8) ;;
+	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
@@ -60,12 +60,12 @@ save_config() {
 	if [[ $# -eq 1 && -f $1 ]] ; then
 		# Just one file, so have the ${configfile} be that config file
 		dodir "${configfile%/*}"
-		cp "$@" "${ED%/}/${configfile}" || die "failed to save $*"
+		cp "$@" "${ED}/${configfile}" || die "failed to save $*"
 	else
 		# A dir, or multiple files, so have the ${configfile} be a dir
 		# with all the saved stuff below it
 		dodir "${configfile}"
-		treecopy "$@" "${ED%/}/${configfile}" || die "failed to save $*"
+		treecopy "$@" "${ED}/${configfile}" || die "failed to save $*"
 	fi
 
 	elog "Your configuration for ${CATEGORY}/${PF} has been saved in "
@@ -150,7 +150,7 @@ savedconfig_pkg_postinst() {
 	# are worse :/.
 
 	if use savedconfig ; then
-		find "${EROOT%/}/etc/portage/savedconfig/${CATEGORY}/${PF}" \
+		find "${EROOT}/etc/portage/savedconfig/${CATEGORY}/${PF}" \
 			-exec touch {} + 2>/dev/null
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/eclass/unpacker.eclass b/sdk_container/src/third_party/portage-stable/eclass/unpacker.eclass
index 2957ca02d3..91520a36d1 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/unpacker.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/unpacker.eclass
@@ -4,7 +4,7 @@
 # @ECLASS: unpacker.eclass
 # @MAINTAINER:
 # base-system@gentoo.org
-# @SUPPORTED_EAPIS: 6 7 8
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: helpers for extraneous file formats and consistent behavior across EAPIs
 # @DESCRIPTION:
 # Some extraneous file formats are not part of PMS, or are only in certain
@@ -16,7 +16,7 @@
 #  - support partial unpacks?
 
 case ${EAPI} in
-	6|7|8) ;;
+	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
@@ -430,10 +430,7 @@ _unpacker_get_decompressor() {
 		echo "xz -T$(makeopts_jobs) -dc" ;;
 	*.lz)
 		find_lz_unpacker() {
-			local has_version_arg="-b"
-
-			[[ ${EAPI} == 6 ]] && has_version_arg="--host-root"
-			if has_version "${has_version_arg}" ">=app-arch/xz-utils-5.4.0" ; then
+			if has_version -b ">=app-arch/xz-utils-5.4.0" ; then
 				echo xz
 				return
 			fi
@@ -537,7 +534,7 @@ _unpacker() {
 	esac
 
 	# 7z, rar and lha/lzh are handled by package manager in EAPI < 8
-	if [[ ${EAPI} != [67] ]]; then
+	if [[ ${EAPI} != 7 ]]; then
 		case ${m} in
 		*.7z)
 			arch="unpack_7z" ;;
diff --git a/sdk_container/src/third_party/portage-stable/licenses/BL b/sdk_container/src/third_party/portage-stable/licenses/BL
deleted file mode 100644
index 606d3ef6ce..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/BL
+++ /dev/null
@@ -1,48 +0,0 @@
-Blender License 1.0 (the "BL", see http://www.blender.org/BL/ ).
-
-Copyright (C) 2002 Blender Foundation. All Rights Reserved.
-
-For teams that don't want to operate under the GPL, we're also offering
-this "non-GPL" Blender License option. This means that you can download
-the latest sources and tools via FTP or CVS from our site and sign an
-additional agreement with the Blender Foundation, so you can keep your
-source modifications confidential. Contact the Blender Foundation via
-email at license@blender.org so we can discuss how we handle the
-practical matters.
-
-A signed agreement allows you to do business with proprietary code, make
-special derived versions, sell executables, projects or services,
-provided that:
-
-1. The BL-ed code remains copyrighted by the original owners, and cannot
-be transferred to other parties
-
-2. The BL-ed code cannot be published or re-distributed in any way, and
-only be available for the internal staff that works directly on the
-software itself. Employees of partners with which you co-develop on the
-projects that include BL-ed code are considered 'internal staff' also.
-
-3. The BL-ed code can be used (sold, distributed) in parts or in its
-whole only as an executable or as a compiled library/module and its
-header files.
-
-4. The usage of the name Blender or the Blender logo is not included in
-this license. Instead 'including Blender Foundation release X' (or
-similar) can be used, with 'X' the version number of the initial Blender
-Foundation release which you started with.
-
-5. Note that this BL has no authority over some of the external
-libraries licenses which Blender links with.
-
-Additionally you get :
-
-1. The right to use Blender Foundation source updates for a 1 year
-period.
-
-2. Support. Details to be determined by the additional agreement.
-
-You are invited to donate your proprietary changes back to the open
-source community after a reasonable time period. You are of course free
-to choose not to do this.
-
-End of BL terms and conditions.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/MAJESTY-DEMO b/sdk_container/src/third_party/portage-stable/licenses/MAJESTY-DEMO
deleted file mode 100644
index 7f82374fb9..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/MAJESTY-DEMO
+++ /dev/null
@@ -1,140 +0,0 @@
-End User License Agreement
-YOU SHOULD CAREFULLY READ THE FOLLOWING END USER LICENSE AGREEMENT
-BEFORE INSTALLING THIS SOFTWARE PROGRAM. BY INSTALLING OR OTHERWISE
-USING THE SOFTWARE PROGRAM, YOU AGREE TO BE BOUND BY THE TERMS OF THIS
-AGREEMENT.
-
-This software program (the "Program"), any printed materials, any
-on-line or electronic documentation (the "Manuals"), and any and all
-copies and derivative works of such software program are the
-copyrighted work of Linux Game Publishing LTD and its licensors. All
-rights reserved, except as expressly stated herein. All use of the
-Program is governed by the terms of this End User License Agreement
-("License Agreement"). The Program is solely for use by end users
-according to the terms of the Licence Agreement. Any use, reproduction
-or redistribution of the Program not in accordance with the terms of
-the Licence Agreement is expressly prohibited.
-
-1. Limited Use License. Linux Game Publishing ("LGP") hereby grants,
-and by installing the Program you thereby accept, a limited,
-non-exclusive license and right to install and use one (1) copy of the
-Program for your use on either a home, business, or portable
-computer. The Program is licensed not sold. Your license confers no
-title or ownership in the Program.
-
-2. Ownership. All title, ownership rights and intellectual property
-rights in and to the Program and any and all copies thereof (including
-but not limited to any titles, computer code, themes, objects,
-characters, character names, stories, dialog, catch phrases,
-locations, concepts, artwork, animations, sounds, musical
-compositions, audio-visual effects, methods of operation, moral
-rights, and any related documentation, and "applets" incorporated into
-the Program) are owned by LGP and its licensors. The Program is
-protected by the copyright laws of the United Kingdom, international
-copyright treaties and conventions and other laws. All rights are
-reserved. The Program contains certain licensed materials and LGP's
-licensors may protect their rights in the event of any violation of
-this Agreement.
-
-3. Responsibilities of End User.
-A. Subject to the Grant of License hereinabove, you may not, in whole
-or in part, copy, photocopy, reproduce, translate, reverse engineer,
-derive source code, modify, disassemble, decompile, create derivative
-works based on the Program, or remove any proprietary notices or
-labels on the Program without the prior written consent of LGP.
-B. The Program is licensed to you as a single product. Its component
-parts may not be separated for use on more than one computer.
-C. You are entitled to use the Program for your own use, but you are
-not entitled to: (i) sell, grant a security interest in or transfer
-reproductions of the Program to other parties in any way, nor to rent,
-lease or license the Program to others without the prior written
-consent of LGP; or (ii) exploit the Program or any of its parts for
-any commercial purpose including, but not limited to, use at a cyber
-cafe, computer gaming center or any other location-based site. LGP may
-offer a separate Site License Agreement to permit you to make the
-Program available for commercial use. Contact LGP for details.
-
-4. Program Transfer. You may transfer all of your rights
-under this License Agreement, provided the recipient agrees to the
-terms of this License Agreement.
-
-5. Termination. The License Agreement is effective until
-terminated. You may terminate the License Agreement at any time by
-destroying the Program. LGP may, at its discretion, terminate this
-License Agreement in the event that you fail to comply with the terms
-and conditions contained herein. In such event, you must immediately
-destroy the Program.
-
-6. Export Controls. The program may not be re-exported, downloaded,
-otherwise exported into (or to a national or resident of) any country
-to whom it would be illegal to export the Program under UK law.
-
-7. Limited Warranty. Except as expressly and unambiguously set forth
-in this paragraph 7, LGP and its licensors disclaim any warranty for
-the Program, Editor and Manual(s). The Program, Editor and Manual(s)
-are provided "as is" without any warranty of any kind, either express
-or implied, including, without limitation, the implied warranties of
-merchantability, fitness for a particular purpose, or
-noninfringement. The entire risk arising out of use or performance of
-the Program, Editor, and Manual(s) remains with the User, however LGP
-warrants up to and including 90 days from the date of your purchase of
-the Program that the media containing the Program shall be free from
-defects in material and workmanship. In the event that the media
-proves to be defective during that time period, and upon presentation
-to LGP of proof of purchase of the defective Program, LGP will at its
-option: (i) correct any defect; (ii) provide a replacement copy of the
-same product; or (iii) refund your money.
-
-8. Limitation of Liability. NEITHER LGP, ITS LICENSORS NOR ANY PARENT,
-SUBSIDIARY OR AFFILIATE OF THE FOREGOING SHALL BE LIABLE IN ANY WAY
-FOR LOSS OR DAMAGE OF ANY KIND RESULTING FROM THE USE OF THE PROGRAM,
-EDITOR, AND MANUAL(S) INCLUDING, WITHOUT LIMITATION, LOSS OF GOODWILL,
-WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER
-COMMERCIAL DAMAGES OR LOSSES.
-
-9. Equitable Remedies. You hereby agree that LGP would be irreparably
-damaged if the terms of this License Agreement were not specifically
-enforced, and therefore you agree that LGP shall be entitled, without
-bond, other security, or proof of damages, to appropriate equitable
-remedies with respect to breaches of this License Agreement, in
-addition to such other remedies as LGP may otherwise have available to
-it under applicable laws. In the event that any litigation is brought
-by either party in connection with this License Agreement, the
-prevailing party in such litigation shall be entitled to recover from
-the other party all the costs, attorney's fees and other expenses
-incurred by such prevailing party in the litigation.
-
-10. Limitations on License. Nothing in this License Agreement shall
-preclude you from making or authorizing the making of copies of
-the Program provided, however, that all copies are complete and exact
-copies of the original, including this license.
-
-11. Miscellaneous. This License Agreement shall be deemed to have been
-made and executed in the United Kingdom and any dispute arising
-hereunder shall be resolved in accordance with the laws of the UK. You
-agree that any claim asserted in any legal proceeding by one of the
-parties against the other shall be commenced and maintained in the
-appropriate court located in Nottingham, England, having subject
-matter jurisdiction with respect to the dispute between the
-parties. This License Agreement may be amended, altered or modified
-only by an instrument in writing, specifying such amendment,
-alteration or modification, executed by both parties. In the event
-that any provision of this License Agreement shall be held by a court
-or other tribunal of competent jurisdiction shall be unenforceable,
-such provision will be enforced to the maximum extent permissible and
-the remaining portions of this License Agreement shall remain in full
-force and effect. This License Agreement constituted and contains the
-entire agreement between the parties with respect to the subject
-matter hereof and supersedes any prior oral or written agreements. You
-hereby acknowledge that you have read and understand the forgoing
-License Agreement and agree that the action of installing the Program
-is an express acknowledgment of your agreement to be bound by the
-terms and conditions of this License Agreement. You also acknowledge
-and agree that this License Agreement is the complete and exclusive
-statement of the agreement between you and LGP and that this License
-Agreement supersedes any prior or contemporaneous agreement, either
-oral or written, and any other communications between you and LGP.
-
-Linux Game Publishing LTD
-17 Rossington Road
-Nottingham, NG2 4HX, England
diff --git a/sdk_container/src/third_party/portage-stable/licenses/PUEL-12 b/sdk_container/src/third_party/portage-stable/licenses/PUEL-12
new file mode 100644
index 0000000000..eb4d751bd3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/PUEL-12
@@ -0,0 +1,166 @@
+VirtualBox Extension Pack Personal Use and Educational License (PUEL)
+
+License version 12, 22 July 2024
+
+PLEASE READ THE FOLLOWING ORACLE VIRTUALBOX EXTENSION PACK PERSONAL USE
+AND EDUCATIONAL LICENSE CAREFULLY BEFORE DOWNLOADING OR USING THE ORACLE
+SOFTWARE. THESE TERMS AND CONDITIONS CONSTITUTE A LEGAL AGREEMENT BETWEEN
+YOU AND ORACLE.
+
+ORACLE AMERICA, INC. ("ORACLE") IS WILLING TO LICENSE THE PRODUCT DEFINED
+IN SECTION 1 BELOW ONLY ON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS
+CONTAINED IN THIS VIRTUALBOX EXTENSION PACK PERSONAL USE AND EDUCATIONAL
+LICENSE AGREEMENT ("AGREEMENT").
+
+IF YOU ARE AGREEING TO THIS LICENSE ON BEHALF OF AN ENTITY (RATHER THAN
+AS AN INDIVIDUAL HUMAN BEING), YOU REPRESENT THAT YOU HAVE THE APPROPRIATE
+AUTHORITY TO ACCEPT THESE TERMS AND CONDITIONS ON BEHALF OF SUCH ENTITY.
+
+1 SUBJECT OF AGREEMENT. This Agreement governs your use of the binary
+software package called "Oracle VirtualBox Extension Pack" (the
+"Product"), which contains a set of additional features for "Oracle
+VirtualBox" that enhance the operation of multiple virtual machines
+("Guest Computers") on a single physical computer ("Host Computer"). The
+Product consists of executable files in machine code, script files, data
+files, and all documentation and updates provided to You by Oracle.
+
+2 GRANT OF LICENSE. Oracle grants you a personal, non-exclusive,
+non-transferable, limited license without fees to reproduce, install,
+execute, and use internally the Product on Host Computers for your
+Personal Use, or Educational Use. "Personal Use" is noncommercial use
+solely by the person downloading the Product from Oracle on a single Host
+Computer, provided that no more than one client or remote computer is
+connected to that Host Computer and that client or remote computer is used
+solely to remotely view the Guest Computer(s). "Educational Use" is any
+use by teachers or students in an academic institution (schools, colleges
+and universities) as part of the institution's educational curriculum.
+Personal Use and/or Educational Use expressly exclude any use of the
+Product for commercial purposes or to operate, run, or act on behalf of or
+for the benefit of a business, organization, governmental organization, or
+educational institution.
+
+Oracle reserves all rights not expressly granted in this license.
+
+3 RESTRICTIONS AND RESERVATION OF RIGHTS.
+
+(1) The Product and copies thereof provided to you under this Agreement
+are copyrighted and licensed, not sold, to you by Oracle.
+
+(2) You may not do any of the following: (a) modify any part of the
+Product, except to the extent allowed in the documentation accompanying
+the Product; (b) rent, lease, lend, re-distribute, or encumber the
+Product; (c) remove or alter any proprietary legends or notices contained
+in the Product; or (d) decompile, or reverse engineer the Product
+(except to the extent permitted by applicable law).
+
+(3) The Product is not designed, licensed or intended for use in the
+design, construction, operation or maintenance of any nuclear facility
+and Oracle and its licensors disclaim any express or implied warranty
+of fitness for such uses.
+
+(4) No right, title or interest in or to any trademark, service mark, logo
+or trade name of Oracle or its licensors is granted under this Agreement.
+
+4 TERMINATION. The Agreement is effective on the date you receive the
+Product and remains effective until terminated. Your rights under this
+Agreement will terminate immediately without notice from Oracle if
+you materially breach it or take any action in derogation of Oracle's
+and/or its licensors' rights to the Product. Oracle may terminate this
+Agreement immediately should any part of the Product become or in Oracle's
+reasonable opinion likely to become the subject of a claim of intellectual
+property infringement or trade secret misappropriation. Upon termination,
+you will cease use of and destroy all copies of the Product under your
+control and confirm compliance in writing to Oracle. Neither termination
+of this Agreement nor any deletion or removal of the Product shall limit
+any obligations you may have to Oracle, or any rights and/or remedies that
+Oracle may have with respect to any past or future infringing use of the
+Product (including but not limited to any use of the Product outside the
+scope of the license provided in the Agreement). Sections 3-9, inclusive,
+will survive termination of the Agreement.
+
+5 DISCLAIMER OF WARRANTY. TO THE EXTENT NOT PROHIBITED BY APPLICABLE LAW,
+ORACLE PROVIDES THE PRODUCT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
+EXPRESS OR IMPLIED. WITHOUT LIMITING THE FOREGOING, ORACLE SPECIFICALLY
+DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. The entire risk as
+to the quality and performance of the Product is with you. Should it
+prove defective, you assume the cost of all necessary servicing, repair,
+or correction.
+
+6 LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED BY APPLICABLE LAW,
+IN NO EVENT WILL ORACLE OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE,
+PROFIT, DATA, OR DATA USE, OR FOR SPECIAL, INDIRECT, CONSEQUENTIAL,
+INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER CAUSED REGARDLESS OF THE THEORY
+OF LIABILITY, ARISING OUT OF OR RELATED TO THE USE OF OR INABILITY TO
+USE THE PRODUCT, EVEN IF ORACLE HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES. In no event will Oracle's liability to you, whether in
+contract, tort (including negligence), or otherwise, exceed the amount
+paid by you for the Product under this Agreement.
+
+7 SEPARATELY LICENSED THIRD PARTY TECHNOLOGY. The Product may contain
+or require the use of third party technology that is provided with
+the Product. Oracle may provide certain notices to you in the Product's
+documentation, readmes or notice files in connection with such third party
+technology. Third party technology will be licensed to you either under
+the terms of this Agreement or, if specified in the documentation, readmes
+or notice files, under Separate Terms. Your rights to use Separately
+Licensed Third Party Technology under Separate Terms are not restricted
+in any way by this Agreement. However, for clarity, notwithstanding the
+existence of a notice, third party technology that is not Separately
+Licensed Third Party Technology shall be deemed part of the Product and
+is licensed to You under the terms of this Agreement. "Separate Terms"
+refers to separate license terms that are specified in the Product's
+documentation, readmes or notice files and that apply to Separately
+Licensed Third Party Technology. "Separately Licensed Third Party
+Technology" refers to third party technology that is licensed under
+Separate Terms and not under the terms of this Agreement.
+
+8 EXPORT. Export laws and regulations of the United States and any other
+relevant local export laws and regulations apply to the Product. You
+agree that such export laws govern your use of the Product (including
+technical data) provided under this Agreement, and you agree to comply
+with all such export laws and regulations (including "deemed export" and
+"deemed re-export" regulations). You agree that no data, information,
+and/or Product (or direct product thereof) will be exported, directly or
+indirectly, in violation of these laws, or will be used for any purpose
+prohibited by these laws including, without limitation, nuclear, chemical,
+or biological weapons proliferation, or development of missile technology.
+
+9 U.S. GOVERNMENT END USERS. Oracle programs, including the Product,
+any operating system, integrated software, any programs installed on
+hardware, and/or documentation, delivered to U.S. Government end users
+are "commercial computer software" pursuant to the applicable Federal
+Acquisition Regulation and agency-specific supplemental regulations. As
+such, use, duplication, disclosure, modification, and adaptation of
+the programs, including any operating system, integrated software,
+any programs installed on the hardware, and/or documentation, shall
+be subject to license terms and license restrictions applicable to the
+programs. No other rights are granted to the U.S. Government.
+
+10 MISCELLANEOUS. This Agreement is the entire agreement between you
+and Oracle relating to its subject matter. It supersedes all prior or
+contemporaneous oral or written communications, proposals, representations
+and warranties and prevails over any conflicting or additional terms
+of any quote, order, acknowledgment, or other communication between
+the parties relating to its subject matter during the term of this
+Agreement. No modification of this Agreement will be binding, unless in
+writing and signed by an authorized representative of each party. If any
+provision of this Agreement is held to be unenforceable, this Agreement
+will remain in effect with the provision omitted, unless omission would
+frustrate the intent of the parties, in which case this Agreement will
+immediately terminate. This Agreement is governed by the laws of the
+State of California, USA, and you and Oracle agree to submit to the
+exclusive jurisdiction of, and venue in, the courts of San Francisco
+or Santa Clara counties in California in any dispute arising out of or
+relating to this Agreement. Upon 45 days written notice, Oracle may
+audit your use of the Product to confirm that you are in compliance
+with the terms of this Agreement. You agree to cooperate with Oracle's
+audit and provide reasonable assistance and access to information. Any
+such audit shall not unreasonably interfere with your normal business
+operations. You agree to pay within 30 days of written notification
+any fees applicable to your unlicensed use of the Product. You agree
+that Oracle shall not be responsible for any of your costs incurred in
+cooperating with the audit. If a legal action or proceeding is commenced
+by either party in connection with the enforcement of this Agreement,
+the prevailing party shall be entitled to its costs and attorneys'
+fees actually incurred in connection with such action or proceeding.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/namd b/sdk_container/src/third_party/portage-stable/licenses/namd
deleted file mode 100644
index c1e9d54aa8..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/namd
+++ /dev/null
@@ -1,144 +0,0 @@
-+--------------------------------------------------------------------+
-|                                                                    |
-|                      University of Illinois                        |
-|                 NAMD Molecular Dynamics Software                   |
-|             Non-Exclusive, Non-Commercial Use License              |
-|                                                                    |
-+--------------------------------------------------------------------+
-
-Upon execution of this Agreement by the party identified below ("Licensee"), 
-The Board of Trustees of the University of Illinois  ("Illinois"), on behalf 
-of The Theoretical and Computational Biophysics Group ("TCBG") in the Beckman
-Institute, will provide the NAMD molecular dynamics software ("NAMD") in
-Executable Code and/or Source Code form ("Software") to Licensee, subject to
-the following terms and conditions. For purposes of this Agreement,
-Executable Code is the compiled code, which is ready to run on Licensee's
-computer. Source code consists of a set of files which contain the actual
-program commands that are compiled to form the Executable Code.
-
-1. The Software is intellectual property owned by Illinois, and all right, 
-title and interest, including copyright, remain with Illinois.  Illinois 
-grants, and Licensee hereby accepts, a restricted, non-exclusive, 
-non-transferable license to use the Software for academic, research and 
-internal business purposes only, e.g. not for commercial use (see Clause 7 
-below), without a fee.
-
-2. Licensee may, at its own expense, create and freely distribute 
-complimentary works that interoperate with the Software, directing others to 
-the TCBG server to license and obtain the Software itself. Licensee may, at 
-its own expense, modify the Software to make derivative works.  Except as 
-explicitly provided below, this License shall apply to any derivative work 
-as it does to the original Software distributed by Illinois.  Any derivative 
-work should be clearly marked and renamed to notify users that it is a 
-modified version and not the original Software distributed by Illinois.  
-Licensee agrees to reproduce the copyright notice and other proprietary 
-markings on any derivative work and to include in the documentation of such 
-work the acknowledgement:
-
-"This software includes code developed by the Theoretical and Computational
- Biophysics Group in the Beckman Institute for Advanced Science and
- Technology at the University of Illinois at Urbana-Champaign."
-
-Licensee may redistribute without restriction works with up to 1/2 of their 
-non-comment source code derived from at most 1/10 of the non-comment source 
-code developed by Illinois and contained in the Software, provided that the 
-above directions for notice and acknowledgement are observed.  Any other 
-distribution of the Software or any derivative work requires a separate 
-license with Illinois.  Licensee may contact Illinois (namd@ks.uiuc.edu) to 
-negotiate an appropriate license for such distribution.
-
-3. Except as expressly set forth in this Agreement, THIS SOFTWARE IS PROVIDED 
-"AS IS" AND ILLINOIS MAKES NO REPRESENTATIONS AND EXTENDS NO WARRANTIES OF 
-ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES 
-OR MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, OR THAT THE USE OF 
-THE SOFTWARE WILL NOT INFRINGE ANY PATENT, TRADEMARK, OR OTHER RIGHTS. 
-LICENSEE ASSUMES THE ENTIRE RISK AS TO THE RESULTS AND PERFORMANCE OF THE 
-SOFTWARE AND/OR ASSOCIATED MATERIALS.  LICENSEE AGREES THAT UNIVERSITY SHALL 
-NOT BE HELD LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, OR INCIDENTAL 
-DAMAGES WITH RESPECT TO ANY CLAIM BY LICENSEE OR ANY THIRD PARTY ON ACCOUNT 
-OF OR ARISING FROM THIS AGREEMENT OR USE OF THE SOFTWARE AND/OR ASSOCIATED 
-MATERIALS.
-
-4. Licensee understands the Software is proprietary to Illinois. Licensee  
-agrees to take all reasonable steps to insure that the Software is  
-protected and secured from unauthorized disclosure, use, or release and  
-will treat it with at least the same level of care as Licensee would use to  
-protect and secure its own proprietary computer programs and/or information, 
-but using no less than a reasonable standard of care.  Licensee agrees to 
-provide the Software only to any other person or entity who has registered 
-with Illinois. If licensee is not registering as an individual but as an 
-institution or corporation each member of the institution or corporation 
-who has access to or uses Software must agree to and abide by the terms 
-of this license. If Licensee becomes aware of any unauthorized licensing, 
-copying or use of the Software, Licensee shall promptly notify Illinois 
-in writing. Licensee expressly agrees to use the Software only in the 
-manner and for the specific uses authorized in this Agreement.
-
-5. By using or copying this Software, Licensee agrees to abide by the  
-copyright law and all other applicable laws of the U.S. including, but not  
-limited to, export control laws and the terms of this license. Illinois  
-shall have the right to terminate this license immediately by written  
-notice upon Licensee's breach of, or non-compliance with, any
-terms of the license. Licensee may be held legally responsible for any  
-copyright infringement that is caused or encouraged by its failure to  
-abide by the terms of this license. Upon termination, Licensee agrees to  
-destroy all copies of the Software in its possession and to verify such  
-destruction in writing.
-
-6. The user agrees that any reports or published results obtained with  
-the Software will acknowledge its use by the appropriate citation as  
-follows:
-
-"NAMD was developed by the Theoretical and Computational Biophysics Group in
- the Beckman Institute for Advanced Science and Technology at the University
- of Illinois at Urbana-Champaign."
-
-Any published work which utilizes NAMD shall include the following reference:
-
-"Laxmikant Kale, Robert Skeel, Milind Bhandarkar, Robert Brunner,
- Attila Gursoy, Neal Krawetz, James Phillips, Aritomo Shinozaki,
- Krishnan Varadarajan, and Klaus Schulten. NAMD2: Greater scalability
- for parallel molecular dynamics.  J. Comp. Phys., 151:283-312, 1999."
-
-Electronic documents will include a direct link to the official NAMD page  
-at http://www.ks.uiuc.edu/Research/namd/
-
-7. Commercial use of the Software, or derivative works based thereon,  
-REQUIRES A COMMERCIAL LICENSE.  Should Licensee wish to make commercial 
-use of the Software, Licensee will contact Illinois (namd@ks.uiuc.edu) to 
-negotiate an appropriate license for such use. Commercial use includes: 
-(1) integration of all or part of the Software into a product for sale, 
-lease or license by or on behalf of Licensee to third parties, or 
-(2) distribution of the Software to third parties that need it to 
-commercialize product sold or licensed by or on behalf of Licensee.
-
-8. Government Rights. Because substantial governmental funds have been  
-used in the development of NAMD, any possession, use or sublicense of the  
-Software by or to the United States government shall be subject to such  
-required restrictions.
-
-9. NAMD is being distributed as a research and teaching tool and as  
-such, TCBG encourages contributions from users of the code that might, at  
-Illinois' sole discretion, be used or incorporated to make the basic  
-operating framework of the Software a more stable, flexible, and/or useful  
-product.  Licensees who contribute their code to become an internal  
-portion of the Software agree that such code may be distributed by  
-Illinois under the terms of this License and may be required to sign an  
-"Agreement Regarding Contributory Code for NAMD Software" before Illinois  
-can accept it (contact namd@ks.uiuc.edu for a copy).
-
-UNDERSTOOD AND AGREED.
-
-
-Contact Information:
-
-The best contact path for licensing issues is by e-mail to  
-namd@ks.uiuc.edu or send correspondence to:
-                             NAMD Team
-                             Theoretical and Computational Biophysics Group
-                             Beckman Institute
-                             University of Illinois
-                             405 North Mathews MC-251
-                             Urbana, Illinois 61801 USA
-                             FAX: (217) 244-6078
-
diff --git a/sdk_container/src/third_party/portage-stable/licenses/olivia b/sdk_container/src/third_party/portage-stable/licenses/olivia
deleted file mode 100644
index f8e85f490e..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/olivia
+++ /dev/null
@@ -1,8 +0,0 @@
-Relating organizations and author have No liability for any loss of profits
-whatever arising from the use of this product. Permission to use and copy this
-software and its documentation is hereby granted.
-This software is free to be modified only for academic purpose and personal use.
-However, We do Not assume responsibility for any personally customized versions.
-
-                  Copyright (c) 2010 Olivia Developer Team, Hokkaido University.
-
diff --git a/sdk_container/src/third_party/portage-stable/licenses/procheck b/sdk_container/src/third_party/portage-stable/licenses/procheck
deleted file mode 100644
index 793379cc3c..0000000000
--- a/sdk_container/src/third_party/portage-stable/licenses/procheck
+++ /dev/null
@@ -1,230 +0,0 @@
-
-
-	  PROCHECK - Stereochemical Quality of Protein Structures
-          -------------------------------------------------------
-			and AQUA for PROCHECK-NMR
-                        -------------------------
-
-			CONFIDENTIALITY AGREEMENT
-			-------------------------
-
-
-
-In regard to the PROCHECK suite of programs, specified in Appendix 1
-herewith and the AQUA suite of programs specified in Appendix 2 herewith
-(the Software) supplied to us, the copyright and other intellectual
-property rights to which belong to the authors, we
-
-    __________________________________________________________________
-
-undertake to the authors that we shall be bound by the following terms and
-conditions:-
-
-1. We will receive the Software and any related documentation in confidence
-and will not use the same except for the purpose of the department's own 
-research. The Software will be used only by such of our officers or
-employees to whom it must reasonably be communicated to enable us to
-undertake our research and who agree to be bound by the same confidence.
-The department shall procure and enforce such agreement from its staff for
-the benefit of the authors.
-
-2. The publication of research using the Software must reference
-
-   "Laskowski R A, MacArthur M W, Moss D S & Thornton J M (1993). PROCHECK:
-   a program to check the stereochemical quality of protein
-   structures. J. Appl.  Cryst., 26, 283-291."
-
-and
-
-   "Rullmann J A C (1996). AQUA, Computer Program, Department of NMR
-   Spectroscopy, Bijvoet Center for Biomolecular Research, Utrecht
-   University, The Netherlands."
-
-
-3. Research shall take place solely at the department's premises at
-
-    __________________________________________________________________
-
-4. All forms of the Software will be kept in a reasonably secure place to
-prevent unauthorised access.
-
-5. Each copy of the Software or, if not practicable then, any package
-associated therewith shall be suitably marked (and such marking maintained) 
-with the following copyright notice: " Copyright 1992 M W MacArthur, R A
-Laskowski, D S Moss, J A C Rullmann & J M Thornton All Rights Reserved".
-
-6. The Software may be modified but any changes made shall be made
-available to the authors.
-
-7. The Software shall be used exclusively for academic teaching and
-research. The Software will not be used for any commercial research or
-research associated with an industrial company.
-
-8. The confidentiality obligation in paragraph one shall not apply:
-
-   (i)  to information and data known to the department at the time of
-	receipt hereunder (as evidenced by its written records);
-
-  (ii)	to information and data which was at the time of receipt in the 
-	public domain or thereafter becomes so through no wrongful act of
-	the department;
-
- (iii)	to information and data which the department receives from a third
-	party not in breach of any obligation of confidentiality owed to
-	the authors.
-
-
-
-Please sign this Undertaking and return a copy of it to indicate that you 
-have read, understood and accepted the above terms.
-
-
-
-		      For and on behalf of _____________________________
-
-		      _________________________________________________
-		     
-		      ..................................................
-
-		      Dated ............................................
-
-
-
-
-APPENDIX 1 - DETAILS OF THE PROCHECK SUITE OF PROGRAMS PROVIDED (v.3.4.3)
----------------------------------------------------------------
-
-Files to be included
---------------------
-
-         1. anglen.f            }
-         2. anglen.inc          }
-         3. bplot.f             }
-         4. bplot.inc           }
-         5. brkcln.par          }
-         6. clean.f             }
-         7. gfac2pdb.f          }
-         8. gfac2pdb.inc        }
-         9. mplot.f             }
-        10. mplot.inc           } Source program files
-        11. nb.c                }
-        12. pplot.f             }
-        13. pplot.inc           }
-        14. ps.f                }
-        15. rmsdev.f            }
-        16. rmsdev.inc          }
-        17. secstr.f            }
-        18. sstruc.par          }
-        19. tplot.f             }
-        20. tplot.inc           }
-        21. viol2pdb.f          }
-        22. viol2pdb.inc        }
-        23. vplot.f             }
-        24. vplot.inc           }
-        25. gfac2pdb.scr        }
-        26. procheck.com      }
-        27. procheck.scr      }
-        28. procheck_comp.com }
-        29. procheck_comp.scr }
-        30. procheck_nmr.scr  }
-        31. proplot.com       }
-        32. proplot.scr       } Script files
-        33. proplot_comp.scr  }
-        34. proplot_nmr.scr   }
-        35. proplot_comp.com  }
-        36. prosub.com        }
-        37. setup.com         }
-        38. setup.scr         }
-        39. viol2pdb.scr      }
-        40. convax.for         }
-        41. procomp.com        } Installation files
-        42. procomp.scr        }
-        43. maninst.ps       }
-        44. manual.tar.Z     } Documentation files
-        45. nmr_manual.tar.Z }
-        46. procheck.dat       }
-        47. procheck.prm       } Data
-        48. procheck_comp.prm  } files
-        49. procheck_nmr.prm   }
-
-
-APPENDIX 2 - DETAILS OF THE AQUA SUITE OF PROGRAMS PROVIDED (v.0.40)
------------------------------------------------------------
-
-Files to be included
---------------------
-
-Source files:-
-------------
-
-AquaCalc.c            AquaCalc.h
-                      AquaData.h
-AquaDist.c            AquaDist.h    
-AquaFiles.c           AquaFiles.h     
-AquaFuncts.c          AquaFuncts.h      
-AquaFuncts_biosym.c   AquaFuncts_biosym.h             
-AquaFuncts_cv.c       AquaFuncts_cv.h         
-AquaFuncts_io.c       AquaFuncts_io.h         
-AquaFuncts_pdb.c      AquaFuncts_pdb.h          
-AquaFuncts_pdbmr.c    AquaFuncts_pdbmr.h            
-AquaHow.c             AquaHow.h
-                      AquaMacros.h   
-AquaPseudo.c          AquaPseudo.h      
-AquaStrucset.c        AquaStrucset.h
-                      AquaTypes.h        
-AquaWhat.c            AquaWhat.h    
-Qext.c                Qext.h
-Range.c               Range.h
-                      cv_subs.h 
-
-Script files:-
-------------
-ReadNrv.pm*           convDIANAtorsrestr    qdbext*
-aqdrst*               convDISGEOdistrestr   qguessc*
-aqpc*                 convDISGEOtorsrestr   qguessr*
-aqpcsel               convMRTABLE           qhelp*
-aquanal.pl*           convXPLORdistrestr    qmodr*
-clean0*               convXPLORtorsrestr    qsplitr*
-convBIOSYMdistrestr   makecmm*              qsumm*
-convBIOSYMtorsrestr   qconvert*             qsumm_aux1*
-convDIANAdistrestr    qconvr*               qsumm_aux2*
-
-Documentation:-
--------------
-README                 models.txt             qconvr.txt
-aqpc.txt               mr.txt                 qdbext.txt
-aqua_setup.txt         names.txt              qext.txt
-biosym.txt             overview.txt           qhelp.txt
-chains.txt             perl.txt               qsumm.txt
-conversion.txt         procheck.txt           restraint_format.txt
-dbas.txt               qanal.txt              setup.txt
-intro.txt              qclean.txt             torsion.txt
-log.txt                qconvert.txt           xplor.txt
-
-Extras:-
-------
-joinpdb*               splitpdb*
-
-
-
-Please complete the above form, sign it, and then send or fax to:-
-
-
-Roman Laskowski
-European Bioinformatics Institute,
-Wellcome Trust Genome Campus,
-Hinxton,
-Cambridge, CB10 1SD,
-United Kingdom
- 
-Fax:- +44 (0)1223 494 468
-
-If you have any problems either installing the software or running it,
-please e-mail your problems to:-
-
-    roman@ebi.ac.uk
-
-Questions about AQUA should be directed to Ton Rullmann at
-
-      rull@nmr.chem.ruu.nl
-
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
index 38fa8e4185..832ff99c2f 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
@@ -8,3 +8,5 @@ DIST c-ares-1.32.0.tar.gz 1021855 BLAKE2B b60c924581ba7db1d87350929d22b5e1568448
 DIST c-ares-1.32.0.tar.gz.asc 228 BLAKE2B d9cf726e42d79ccdaeca2aafc028c1d03aa56acd1cf03b118070968a31655046a3d609e8ea529f03465341d6decaa7f8eace4310487e7028e3a1ad355d25fa4c SHA512 7554b37e470a57ad0175050c1966e1b72bf67791aa860b113a66688ac28e525b93a633a472dd43c8a16bddb366e918b202760efab5ab311c4b6ee63e72869552
 DIST c-ares-1.32.1.tar.gz 1022052 BLAKE2B 662f15e7f1ae39614f0212745fe7883bbf831da667905e4595e011922b37c95b2037423dde96b0a62122a304d6edd04d36e99e428bdbf8f89d6ff9ecb4cfd712 SHA512 20339b92c5355c01f71a0ab5fe4b823b41ad09269dbdaf4f1567324735d7e90812c9f3f7ce197247be0bd793df35b85aa1747675762a2344e4f506346466d349
 DIST c-ares-1.32.1.tar.gz.asc 228 BLAKE2B d3d44263673c79b2dae594f5a2b3be076528c9c9f3c672e9c5cf3db68eb1b7da6ba74f8ae44605d783440f3bbada4033073e4feeee8ed9833226f76068022dc4 SHA512 3a1dc1f1066bb4d35024ef9e7246c2f630d309a1843e32574f29c07ce01e0461176dd9d53b1a7d2df279959a8b13c10cb4396ee7fafbac534e1b4d44bcefc47a
+DIST c-ares-1.32.2.tar.gz 1026293 BLAKE2B 1acd4d90d0e9d8abcbc49561db8ae2e55295398353896a7ab0108c1ac8718eb08c655dff8aa6c0efa138524805972ac4033d0c49cfcebaeca1a019021073e981 SHA512 f552dbe9cb7f7b28ed05d93ee866a161e77c841453cde3659cb1e0bf6d501894bf5f6b8db308f7397e6ead4b42f34ce17e1c2ef307352de50f2aad25e4610de8
+DIST c-ares-1.32.2.tar.gz.asc 228 BLAKE2B 6a09ff532d1334f994f9e9365ce6074aae4227b27c0a5ef40e441192b6b23c728772278fec7c8c34fc93d20309b04b9e31802d4491dc3e1313818eadbe8a4afc SHA512 385ca9bd72a2131f2eb51c035e50d21d816361872a0db42c6a9dc60a1a3971d464f34c2518c759e01e6c88b5bf100ddaa87862e877187a9b59800070b2bef7af
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.29.0.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.29.0.ebuild
index f57d48f92b..2e6982838c 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.29.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.29.0.ebuild
@@ -17,7 +17,7 @@ SRC_URI="
 LICENSE="MIT ISC"
 # Subslot = SONAME of libcares.so.2
 SLOT="0/2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.32.2.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.32.2.ebuild
new file mode 100644
index 0000000000..8268e2db33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.32.2.ebuild
@@ -0,0 +1,109 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Both Daniel and Brad are listed as possible signers on the homepage
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradhouse.asc
+inherit edo multilib-minimal verify-sig
+
+DESCRIPTION="C library that resolves names asynchronously"
+HOMEPAGE="https://c-ares.org/"
+SRC_URI="
+	https://github.com/c-ares/c-ares/releases/download/v${PV}/${P}.tar.gz
+	verify-sig? ( https://github.com/c-ares/c-ares/releases/download/v${PV}/${P}.tar.gz.asc )
+"
+
+# ISC for lib/{bitncmp.c,inet_ntop.c,inet_net_pton.c} (bug #912405)
+LICENSE="MIT ISC"
+# Subslot = SONAME of libcares.so.2
+SLOT="0/2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="static-libs test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( dev-cpp/gtest )
+	verify-sig? ( sec-keys/openpgp-keys-bradhouse )
+"
+
+DOCS=( AUTHORS README.md RELEASE-NOTES.md )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ares_build.h
+)
+
+A__QA_CONFIG_IMPL_DECL_SKIP=(
+	# Checking for obsolete headers
+	malloc
+	calloc
+	free
+
+	# Non-existent on Linux
+	closesocket
+	CloseSocket
+	ioctlsocket
+	bitncmp
+	ConvertInterfaceIndexToLuid
+	ConvertInterfaceLuidToNameA
+)
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# warnings are default, but enable -std=c90 which doesn't define
+		# 'bool' which is a type used/assumed in macOS system headers
+		sed -i -e 's/-std=c90/& -Dbool=int/' configure{.ac,} || die
+		# sysconfig integration requires deep framework compatibility
+		# and is not really desired in Prefix
+		sed -i -e 's/__APPLE__/__DISABLED__/' \
+			src/lib/ares_sysconfig_mac.c || die
+		sed -i -e '/elif defined(__APPLE__)/s/__APPLE__/__DISABLED__/' \
+			src/lib/ares_sysconfig.c || die
+	fi
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-symbol-hiding
+		$(use_enable static-libs static)
+		$(use_enable test tests)
+	)
+
+	# Needed for running unit tests only
+	# Violates sandbox and tests pass fine without
+	export ax_cv_uts_namespace=no
+	export ax_cv_user_namespace=no
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	cd "${BUILD_DIR}"/test || die
+
+	# We're skipping the "real" network tests with the filter
+	# see https://github.com/c-ares/c-ares/tree/main/test
+	local network_tests=(
+		# Most live tests have Live in the name
+		*Live*
+		# These don't but are still in ares-test-live.cc => live
+		*GetTCPSock*
+		*TimeoutValue*
+		*GetSock*
+		*GetSock_virtualized*
+		*VerifySocketFunctionCallback*
+		# Seems flaky, even run manually
+		# https://github.com/c-ares/c-ares/commit/9e542a8839f81c990bb0dff14beeaf9aa6bcc18d
+		*MockUDPMaxQueriesTest.GetHostByNameParallelLookups*
+	)
+
+	# The format for disabling test1, test2, and test3 looks like:
+	# -test1:test2:test3
+	edo ./arestest --gtest_filter=-$(echo $(IFS=:; echo "${network_tests[*]}"))
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r6 b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r6
deleted file mode 100644
index 949bdad760..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r6
+++ /dev/null
@@ -1,105 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2013 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-extra_commands="save"
-extra_started_commands="reload"
-
-IPSET_SAVE=${IPSET_SAVE:-/var/lib/ipset/rules-save}
-
-depend() {
-    before iptables ip6tables
-}
-
-checkconfig() {
-    if [ ! -f "${IPSET_SAVE}" ] ; then
-        eerror "Not starting ${SVCNAME}. First create some rules then run:"
-        eerror "/etc/init.d/${SVCNAME} save"
-        return 1
-    fi
-    return 0
-}
-
-start() {
-    checkconfig || return 1
-    ebegin "Loading ipset session"
-    ipset restore < "${IPSET_SAVE}"
-    eend $?
-}
-
-stop() {
-    # check if there are any references to current sets
-
-    if ! ipset list | gawk '
-        ($1 == "References:") { refcnt += $2 }
-        ($1 == "Type:" && $2 == "list:set") { set = 1 }
-        (scan) { if ($0 != "") setcnt++; else { scan = 0; set = 0 } }
-        (set && $1 == "Members:") {scan = 1}
-        END { if ((refcnt - setcnt) > 0) exit 1 }
-    '; then
-        eerror "ipset is in use, can't stop"
-        return 1
-    fi
-
-    if [ "${SAVE_ON_STOP}" = "yes" ] ; then
-        save || return 1
-    fi
-
-    ebegin "Removing kernel IP sets"
-    ipset flush
-    ipset destroy
-    eend $?
-}
-
-reload() {
-    ebegin "Reloading ipsets"
-
-    # Loading sets from a save file is only additive (there is no
-    # automatic flushing or replacing). And, we can not remove sets
-    # that are currently used in existing iptables rules.
-    #
-    # Instead, we create new temp sets for any set that is already
-    # in use, and then atomically swap them into place.
-    #
-    # XXX: This does not clean out previously used ipsets that are
-    # not in the new saved policy--it can't, because they may still
-    # be referenced in the current iptables rules.
-    
-
-    # Build a list of all currently used sets (if any).
-    running_ipset_list=$(ipset save | gawk '/^create/{printf "%s ",$2}')
-	running_ipset_list="${running_ipset_list% }"
-
-    # Check the configured suffix, and make sure there are no collisions
-    if test -z "${TEMP_SUFFIX}" ; then
-      eend 1 "TEMP_SUFFIX cannot be empty"
-      return 1
-    elif echo "$running_ipset_list" | grep -q -E "${TEMP_SUFFIX}( |$)" ; then
-      eend 1 "Existing set(s) match TEMP_SUFFIX pattern ('${TEMP_SUFFIX}'), cannot continue"
-      return 1
-    fi
-
-    # Build a regular expression that matches those set names.
-    running_ipset_list_regex="$(echo "$running_ipset_list" | tr -s ' ' '|' )"
-
-    # Load up sets from the save file, but rename any set that already
-    # exists to a temporary name that we will swap later.
-    if ! cat ${IPSET_SAVE} | sed -r "s/^(create|add) (${running_ipset_list_regex}) /\1 \2${TEMP_SUFFIX} /" | ipset restore ; then
-        eend $? "Failed to load new ipsets"
-    fi
-
-    # Now for every set name that currently exists, atomically swap it
-    # with the temporary new one we created, and then destroy the old set.
-    for ipset_name in ${running_ipset_list} ; do
-        ipset swap ${ipset_name} ${ipset_name}${TEMP_SUFFIX} || eend $? "Failed to swap in new ipset $ipset_name"
-        ipset destroy ${ipset_name}${TEMP_SUFFIX} || eend $? "Failed to delete obsolete ipset ${ipset_name}${TEMP_SUFFIX}"
-    done
-    eend 0
-}
-
-save() {
-    ebegin "Saving ipset session"
-    checkpath --file --mode 0600 "${IPSET_SAVE}"
-		ipset -output save list > "${IPSET_SAVE}"
-    eend $?
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6-r1.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6.ebuild
rename to sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6-r1.ebuild
index 19002c1972..939e7b1932 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.6-r1.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnutls.asc
-inherit libtool multilib-minimal verify-sig
+inherit libtool multilib-minimal verify-sig flag-o-matic
 
 DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
 HOMEPAGE="https://www.gnutls.org/"
@@ -22,10 +22,11 @@ IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
 
+# >=nettle-3.10 as a workaround for bug #936011
 RDEPEND="
 	>=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
 	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
-	>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
+	>=dev-libs/nettle-3.10:=[gmp,${MULTILIB_USEDEP}]
 	>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
 	brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
 	dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
@@ -100,6 +101,8 @@ multilib_src_configure() {
 	#   GNU-stack (as doesn't support that) and when that's removed ld
 	#   complains about duplicate symbols
 	[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
+	# should be gone on next release, for gnulib memset_s breakage
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -D__STDC_WANT_LIB_EXT1__=1
 
 	# -fanalyzer substantially slows down the build and isn't useful for
 	# us. It's useful for upstream as it's static analysis, but it's not
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index a42c74f10c..531b8c0600 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -2,3 +2,5 @@ DIST curl-8.7.1.tar.xz 2707016 BLAKE2B a2a9f48d0b69c0d92fcbbda535ce55082a5243abe
 DIST curl-8.7.1.tar.xz.asc 488 BLAKE2B 1c91d116aecc8e98d8ec3aad68b7c96f11151e6c2716f531e5d2989e9b6b1199e180603673891d7967cdcdaee1d6b5e15160ccabe9b51590e2887022db03c2ed SHA512 f98c393997c4a32f545a8982226e8cd612395210915a4576c2ce227d0f650cff341be7bf15e989d1789abf32ac4fd9c190b9250b81e650b569e8532048746b37
 DIST curl-8.8.0.tar.xz 2748860 BLAKE2B c14903bad4cbd1752a5335afa6bcc78be1a484692fce0e0a6c2061963e0e6b4e56defb8332cef32d0dbddb481ad0443b71faf3a52a6e9d945c89ecbce373d2a3 SHA512 9d2c0d3a0d8f6c31ba4fabe48f801910f886fde43dc198dc4213708d6967ed5e040a1bb7348aa1cb126577ee508a3ec36fe65256d027d861d6ffb70f6383967a
 DIST curl-8.8.0.tar.xz.asc 488 BLAKE2B d80c0ff357b344d7ec2b975a92f1eeb7557993b61a69e7adaaeab89c9b5a53ddade5104fe1a0ad260145db9c90fc0aae36dfc22320492db6696f290da9ff675b SHA512 37b501770225dff6b1e7bde1157f556f10ec1c597fcbbb5c8b8c370efb97a3a70f585f2f5c201b96380d68466696474a5f65a07da59b704678d6927567d25359
+DIST curl-8.9.0.tar.xz 2781828 BLAKE2B 3302ce98d937bb398fc1abcc1c403796503099e06919ea3b104c873a6fb6cd79328ea9684f5118f63ebb20bad18b94ebfbe92e87716fc24b91dcc92ff2d304b7 SHA512 922c726cfa3a73954927a32f485248d7a53a3348638a6a01add1bc0a67a7d2ee9cdb7c78b6db84bb7e2fab9d2d5487a96d9071832198b63a86d2caaef85c9310
+DIST curl-8.9.0.tar.xz.asc 488 BLAKE2B 7f35383fd98fe0947be9cb0bfb4737a185f40bb3c3e7ab001cb1bef026dec654a01059e225c0d9774c2c5a57a6ee00a4ccf4be8eb1a2db17fe7b2cdbdd06b2f1 SHA512 44cc7053ac0fddcb5131e7806fcd793d70bd49c5549b2548bbcbe60fdf913f450e45861ff6497b30eb00fd84483302ff9b6c3aea6b66728d6e54dd7ffc388408
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.0.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.0.ebuild
new file mode 100644
index 0000000000..b42cca9c51
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.9.0.ebuild
@@ -0,0 +1,368 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should subscribe to the 'curl-distros' ML for backports etc
+# https://daniel.haxx.se/blog/2024/03/25/curl-distro-report/
+# https://lists.haxx.se/listinfo/curl-distros
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/danielstenberg.asc
+inherit autotools multilib-minimal multiprocessing prefix toolchain-funcs verify-sig
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.se/"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/curl/curl.git"
+else
+	SRC_URI="
+		https://curl.se/download/${P}.tar.xz
+		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="BSD curl ISC test? ( BSD-4 )"
+SLOT="0"
+IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
+IUSE+=" +psl +progress-meter quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
+# These select the default tls implementation / which quic impl to use
+IUSE+=" curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
+RESTRICT="!test? ( test )"
+
+# Only one default ssl / quic provider can be enabled
+# The default provider needs its USE satisfied
+REQUIRED_USE="
+	quic? (
+		^^ (
+			curl_quic_openssl
+			curl_quic_ngtcp2
+		)
+		http3
+	)
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_mbedtls
+			curl_ssl_openssl
+			curl_ssl_rustls
+		)
+	)
+	curl_quic_openssl? ( openssl )
+	curl_quic_ngtcp2? ( gnutls )
+	curl_ssl_gnutls? ( gnutls )
+	curl_ssl_mbedtls? ( mbedtls )
+	curl_ssl_openssl? ( openssl )
+	curl_ssl_rustls? ( rustls )
+	http3? ( alt-svc quic )
+"
+
+# cURL's docs and CI/CD are great resources for confirming supported versions
+# particulary for fast-moving targets like HTTP/2 and TCP/2 e.g.:
+# - https://github.com/curl/curl/blob/master/docs/INTERNALS.md (core dependencies + minimum versions)
+# - https://github.com/curl/curl/blob/master/docs/HTTP3.md (example of a feature that moves quickly)
+# - https://github.com/curl/curl/blob/master/.github/workflows/quiche-linux.yml (CI/CD for TCP/2)
+# However 'supported' vs 'works' are two entirely different things; be sane but
+# don't be afraid to require a later version.
+# ngtcp2 = https://bugs.gentoo.org/912029 - can only build with one tls backend at a time.
+RDEPEND="
+	>=sys-libs/zlib-1.1.4[${MULTILIB_USEDEP}]
+	adns? ( >=net-dns/c-ares-1.16.0:=[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	http2? ( >=net-libs/nghttp2-1.12.0:=[${MULTILIB_USEDEP}] )
+	http3? ( >=net-libs/nghttp3-1.1.0[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	ldap? ( >=net-nds/openldap-2.0.0:=[static-libs?,${MULTILIB_USEDEP}] )
+	psl? ( net-libs/libpsl[${MULTILIB_USEDEP}] )
+	quic? (
+		curl_quic_openssl? ( >=dev-libs/openssl-3.3.0:=[quic,${MULTILIB_USEDEP}] )
+		curl_quic_ngtcp2? ( >=net-libs/ngtcp2-1.2.0[gnutls,ssl,-openssl,${MULTILIB_USEDEP}] )
+	)
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( >=net-libs/libssh2-1.0.0[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			app-misc/ca-certificates
+			>=net-libs/gnutls-3.1.10:=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:=[${MULTILIB_USEDEP}]
+		)
+		mbedtls? (
+			app-misc/ca-certificates
+			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
+		)
+		openssl? (
+			>=dev-libs/openssl-0.9.7:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+		)
+		rustls? (
+			>=net-libs/rustls-ffi-0.13.0:=[${MULTILIB_USEDEP}]
+		)
+	)
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
+		http3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
+
+DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	__builtin_available
+	closesocket
+	CloseSocket
+	getpass_r
+	ioctlsocket
+	IoctlSocket
+	mach_absolute_time
+	setmode
+	_fseeki64
+	# custom AC_LINK_IFELSE code fails to link even without -Werror
+	OSSL_QUIC_client_method
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-prefix-2.patch
+	"${FILESDIR}"/${PN}-respect-cflags-3.patch
+)
+
+src_prepare() {
+	default
+
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	if use ssl; then
+		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
+
+		if use gnutls; then
+			multilib_is_native_abi && einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls )
+		fi
+		if use mbedtls; then
+			multilib_is_native_abi && einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use openssl; then
+			multilib_is_native_abi && einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use rustls; then
+			multilib_is_native_abi && einfo "SSL provided by rustls"
+			myconf+=( --with-rustls )
+		fi
+		if use curl_ssl_gnutls; then
+			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_mbedtls; then
+			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_openssl; then
+			multilib_is_native_abi && einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_rustls; then
+			multilib_is_native_abi && einfo "Default SSL provided by rustls"
+			myconf+=( --with-default-ssl-backend=rustls )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+		fi
+
+	else
+		myconf+=( --without-ssl )
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	myconf+=(
+		$(use_enable alt-svc)
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-digest-auth
+		--enable-kerberos-auth
+		--enable-negotiate-auth
+		--enable-aws
+		--enable-dict
+		--disable-ech
+		--enable-file
+		$(use_enable ftp)
+		$(use_enable gopher)
+		$(use_enable hsts)
+		--enable-http
+		$(use_enable imap)
+		$(use_enable ldap)
+		$(use_enable ldap ldaps)
+		--enable-ntlm
+		$(use_enable pop3)
+		--enable-rt
+		--enable-rtsp
+		$(use_enable samba smb)
+		$(use_with ssh libssh2)
+		$(use_enable smtp)
+		$(use_enable telnet)
+		$(use_enable tftp)
+		--enable-tls-srp
+		$(use_enable adns ares)
+		--enable-cookies
+		--enable-dateparse
+		--enable-dnsshuffle
+		--enable-doh
+		--enable-symbol-hiding
+		--enable-http-auth
+		--enable-ipv6
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-netrc
+		$(use_enable progress-meter)
+		--enable-proxy
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-pthreads
+		--enable-threaded-resolver
+		--disable-versioned-symbols
+		--without-amissl
+		--without-bearssl
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with http2 nghttp2)
+		--without-hyper
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		--without-libgsasl
+		$(use_with psl libpsl)
+		--without-msh3
+		$(use_with http3 nghttp3)
+		$(use_with curl_quic_ngtcp2 ngtcp2)
+		$(use_with curl_quic_openssl openssl-quic)
+		--without-quiche
+		$(use_with rtmp librtmp)
+		--without-schannel
+		--without-secure-transport
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
+		$(use_enable websockets)
+		--without-winidn
+		--without-wolfssl
+		--with-zlib
+		$(use_with zstd)
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+	)
+
+	if use debug; then
+		myconf+=(
+			--enable-debug
+		)
+	fi
+
+	if use test && multilib_is_native_abi && ( use http2 || use http3 ); then
+		myconf+=(
+			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
+		)
+	fi
+
+	if [[ ${CHOST} == *mingw* ]] ; then
+		myconf+=(
+			--disable-pthreads
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# Avoid building the client (we just want libcurl for multilib)
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts
+	fi
+}
+
+# There is also a pytest harness that tests for bugs in some very specific
+# situations; we can rely on upstream for this rather than adding additional test deps.
+multilib_src_test() {
+	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
+	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
+	# -v: verbose
+	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
+	# -k: keep test files after completion
+	# -am: automake style TAP output
+	# -p: print logs if test fails
+	# Note: if needed, we can skip specific tests. See e.g. Fedora's packaging
+	# or just read https://github.com/curl/curl/tree/master/tests#run.
+	# Note: we don't run the testsuite for cross-compilation.
+	# Upstream recommend 7*nproc as a starting point for parallel tests, but
+	# this ends up breaking when nproc is huge (like -j80).
+	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
+	# as most gentoo users don't have an 'ip6-localhost'
+	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p -j$((2*$(makeopts_jobs))) !241 !1083"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts DESTDIR="${D}" install
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+	rm -rf "${ED}"/etc/ || die
+}
+
+pkg_postinst() {
+	if use debug; then
+		ewarn "USE=debug has been selected, enabling debug codepaths and making cURL extra verbose."
+		ewarn "Use this _only_ for testing. Debug builds should _not_ be used in anger."
+		ewarn "hic sunt dracones; you have been warned."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/no-multilib/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/no-multilib/package.mask
index 2157355bab..5778ea9ddd 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/no-multilib/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/no-multilib/package.mask
@@ -80,7 +80,6 @@ games-server/etqw-ded
 games-strategy/darwinia
 games-strategy/dominions2
 games-strategy/knights-demo
-games-strategy/majesty-demo
 games-strategy/spaz
 media-sound/aucdtect
 media-video/binkplayer
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index 67bacefa97..332e381217 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# orbea <orbea@riseup.net> (2024-07-19)
+# Unmask the dynarec flag which has amd64 asm.
+games-emulation/rmg -dynarec
+
 # Zen <dev@pyl.onl> (2024-07-01)
 # Unmask the ugrd flag for installkernel. It is keyworded here
 sys-kernel/installkernel -ugrd
@@ -126,7 +130,7 @@ net-libs/ngtcp2 -ssl
 
 # Matt Jolly <kangie@gentoo.org> (2023-08-10)
 # nghttp3 has been tested to work on amd64
-net-misc/curl -nghttp3
+net-misc/curl -nghttp3 -http3 -quic
 
 # Sam James <sam@gentoo.org> (2023-07-18)
 # dev-cpp/cppdap is not keyworded in most places
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index 3fabf46299..be06ceb658 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-07-24)
+# No stable versions of ROCm at the moment
+sys-apps/hwloc rocm
+
 # Zen <dev@pyl.onl> (2024-07-01)
 # UGRD support is still experimental, no stable keywords for now
 sys-kernel/installkernel ugrd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 00ccc92304..1244b0353f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-24)
+# Full testing requires www-client/firefox.
+dev-python/selenium test-rust
+
+# Matt Jolly <kangie@gentoo.org> (2023-08-10)
+# nghttp3 has been tested to work on amd64
+net-misc/curl -http3 -quic curl_quic_ngtcp2
+
+# orbea <orbea@riseup.net> (2024-07-19)
+# Unmask the dynarec flag which has arm asm.
+games-emulation/rmg -dynarec
+
 # matoro <matoro_gentoo@matoro.tk> (2024-07-14)
 # Abandoned upstream, does not take bug reports, unsupported in Gentoo.
 # Only remaining use is as a requirement for dev-lang/go on arm{,64}.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
index a6edf3ad99..7a8455431a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-07-23)
+# kde-frameworks/kservice, dev-qt/qtpaths not stable here
+x11-misc/xdg-utils plasma
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-06-29)
 # media-libs/libplacebo is not stable here
 media-video/ffmpeg libplacebo
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index 84303ae986..d2412f8063 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# orbea <orbea@riseup.net> (2024-07-19)
+# Unmask the dynarec flag which has arm64 asm.
+games-emulation/rmg -dynarec
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-07-16)
 # Unmask the ugrd flag for installkernel. It is keyworded here
 sys-kernel/installkernel -ugrd
@@ -91,6 +95,7 @@ dev-libs/botan -cpu_flags_arm_neon
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Jon Janzen <jon@jonjanzen.com> (2023-09-11)
 # librttopo has not been tested on this arch
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index eccb6c4c75..9498b47f34 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -297,7 +297,7 @@ app-emulation/aranym jit
 
 # Craig Andrews <candrews@gentoo.org> (2019-10-08)
 # net-libs/nghttp3 net-libs/ngtcp2[ssl] are not available on all arches
-net-misc/curl nghttp3
+net-misc/curl nghttp3 http3 quic
 
 # Luke Dashjr <luke-jr+gentoobugs@utopios.org> (2019-09-21)
 # Moved from arch/powerpc/ppc64 as it applies to most architectures.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index 2128712aef..1c52bcaee7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -12,12 +12,6 @@ media-video/ffmpeg quirc liblc3
 # kde-frameworks/kservice not keyworded here
 x11-misc/xdg-utils plasma
 
-# Sam James <sam@gentoo.org> (2024-06-19)
-# The systemd implementation of installkernel doesn't currently support
-# updating the 'initramfs.img' and 'vmlinuz' symlinks that palo needs,
-# and palo is the only bootloader for HPPA.
-sys-kernel/installkernel systemd
-
 # Holger Hoffstätte <holger@applied-asynchrony.com> (2024-05-19)
 # media-libs/jasper not yet keyworded here: https://bugs.gentoo.org/921559
 media-gfx/graphicsmagick jpeg2k
@@ -71,6 +65,7 @@ dev-qt/qtgui vulkan
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Sam James <sam@gentoo.org> (2023-09-24)
 # Qt not keyworded here.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
index c12bd0c48c..0c4f80d3fb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
@@ -17,6 +17,14 @@
 
 #--- END OF EXAMPLES ---
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-07-25)
+# Moved to stable.mask, issue is fixed in unstable v40
+# Sam James <sam@gentoo.org> (2024-06-19)
+# The systemd implementation of installkernel doesn't currently support
+# updating the 'initramfs.img' and 'vmlinuz' symlinks that palo needs,
+# and palo is the only bootloader for HPPA.
+sys-kernel/installkernel systemd
+
 # Eli Schwartz <eschwartz93@gmail.com> (2024-02-05)
 # Mask pdf support so net-print/cups-filters stabilisation
 # can go ahead (bug 627392)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
index cbac15e9d0..3d3e6d11f6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
@@ -4,9 +4,9 @@
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in use.mask
 
-# Hans de Graaff <graaff@gentoo.org> (2024-05-20)
-# Allow ruby32 stabling: https://bugs.gentoo.org/932285
-ruby_targets_ruby32
+# matoro <matoro_gentoo@matoro.tk> (2024-07-16)
+# dev-lang/ruby now unstabled on hppa
+ruby
 
 # Ionen Wolkens <ionen@gentoo.org> (2024-01-27)
 # Qt6 is not stable here yet
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
index 3681018251..8963aeb70e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
@@ -81,6 +81,7 @@ app-alternatives/ninja samurai
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Sam James <sam@gentoo.org> (2023-09-24)
 # Qt not keyworded here.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index 851c55b9da..d4e6ebe6b2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2022-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-24)
+# Full testing requires www-client/firefox.
+dev-python/selenium test-rust
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-07-01)
 # USE="kf6compat,kaccounts" depends on kde-frameworks/purpose:6[webengine]
 # which is package.use.mask'ed on these arches. We cannot mask the
@@ -74,6 +78,7 @@ dev-db/postgresql llvm
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # WANG Xuerui <xen0n@gentoo.org> (2023-09-29)
 # no luajit for now
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
index a92babc251..6fdd3e3d52 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
@@ -81,7 +81,6 @@ cblas-external
 
 # Samuli Suominen <ssuominen@gentoo.org>
 # Media cannot be tested for MIPS at the moment.
-# media-libs/libmpeg3
 # media-libs/portaudio
 # dev-libs/libcdio
 # media-libs/musicbrainz
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index 9b8ff7889b..c734289ee9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -67,6 +67,7 @@ media-libs/libaom cpu_flags_ppc_vsx
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2023-09-21)
 # dtrace/systemtap not availabie on ppc platform for jdk
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index c0c8e3380d..b065d2533d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-24)
+# Full testing requires www-client/firefox.
+dev-python/selenium test-rust
+
 # Sam James <sam@gentoo.org> (2024-07-03)
 # kde-frameworks/kservice not keyworded here
 x11-misc/xdg-utils plasma
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index e3bcc07a89..289258c837 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -43,6 +43,7 @@ media-libs/libplacebo -shaderc
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-08-30)
 # Avoid keywording more Qt stuff
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index 81ae78eec6..4c7d8026ed 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-24)
+# Full testing requires www-client/firefox.
+dev-python/selenium test-rust
+
 # Sam James <sam@gentoo.org> (2024-07-03)
 # kde-frameworks/kservice not keyworded here
 x11-misc/xdg-utils plasma
@@ -66,6 +70,7 @@ app-alternatives/ninja samurai
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Sam James <sam@gentoo.org> (2023-09-24)
 # Qt not keyworded here.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/s390x/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/s390x/package.use.mask
index 2db48ad88c..56e0148ca3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/s390x/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/s390x/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2024-07-27)
+# Once again, assembler is broken (too high baseline)
+=dev-libs/openssl-3.3* asm
+
 # Michał Górny <mgorny@gentoo.org> (2022-06-18)
 # media-libs/librsvg not keyworded yet.
 media-libs/freetype svg
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index b94b2a1601..7cbf72b519 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-24)
+# Full testing requires www-client/firefox.
+dev-python/selenium test-rust
+
 # Sam James <sam@gentoo.org> (2024-07-03)
 # kde-frameworks/kservice not keyworded here
 x11-misc/xdg-utils plasma
@@ -110,6 +114,7 @@ dev-qt/qtgui vulkan
 # Patrick McLean <chutzpah@gentoo.org> (2023-10-03)
 # sys-apps/s6-linux-init has not been tested on this arch
 sys-apps/openrc s6
+sys-apps/openrc-navi s6
 
 # Sam James <sam@gentoo.org> (2023-09-22)
 # Qt 6 not keyworded here.
@@ -374,7 +379,6 @@ app-misc/tracker-miners test
 dev-ruby/rack-cache test
 dev-ruby/activemodel test
 dev-ruby/activerecord test
-dev-ruby/activesupport test
 dev-ruby/globalid test
 
 # Rolf Eike Beer <eike@sf-mail.de> (2020-04-18)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index cd23f6c3ef..ed4627a768 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,12 +1,19 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-07-12)
-# Need as-yet-unkeyworded KF6-based counterparts (bug #934361)
-kde-apps/libkcddb kf6compat
-kde-apps/libkcompactdisc kf6compat
-kde-apps/libksane kf6compat
-net-misc/kio-zeroconf kf6compat
+# Matt Jolly <kangie@gentoo.org> (2023-08-10)
+# http3 is avilable via openssl[quic] on this arch.
+net-misc/curl -http3 -quic curl_quic_ngtcp2
+
+# orbea <orbea@riseup.net> (2024-07-19)
+# Unmask the dynarec flag which has x86 asm.
+games-emulation/rmg -dynarec
+
+# Matt Turner <mattst88@gentoo.org> (2024-07-17)
+# We only want to support spirv-llvm-translator >= 17 on x86, which is a
+# dependency of mesa.
+>=media-libs/mesa-24.1 llvm_slot_15 llvm_slot_16
+>=dev-util/intel_clc-24.1 llvm_slot_15 llvm_slot_16
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-07-12)
 # KDE PIM 6 is not being keyworded here
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
index e3117529b9..4689d96039 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
@@ -17,6 +17,13 @@
 
 #--- END OF EXAMPLES ---
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-07-21)
+# Need as-yet-unkeyworded KF6-based counterparts (bug #934361)
+kde-apps/libkcddb kf6compat
+kde-apps/libkcompactdisc kf6compat
+kde-apps/libksane kf6compat
+net-misc/kio-zeroconf kf6compat
+
 # Matt Turner <mattst88@gentoo.org> (2024-07-14)
 # spirv-llvm-translator < 17 is not stable on x86.
 <dev-libs/libclc-17 spirv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 6b773b6253..b3d6e7f547 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,14 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Viorel Munteanu <ceamac@gentoo.org> (2024-07-26)
+# Branch 7.1 needs a new BDEPEND for doc
+>=app-emulation/virtualbox-7.1 doc
+
+# orbea <orbea@riseup.net> (2024-07-19)
+# The dynarec is only supported upstream for amd64, arm, arm64 and x86.
+games-emulation/rmg dynarec
+
 # Maciej Mrozowski <reavertm@gentoo.org> (2024-07-14)
 # Fails with newer ffmpeg, bug #831486
 # Not needed by reverse deps as of 2024-07-14. Re-enable when
@@ -24,10 +32,6 @@ dev-lang/python jit
 # bug #887223, bug #891367, bug #903891, bug #917139
 dev-lang/ruby static-libs
 
-# Alfredo Tupone <tupone@gentoo.org> (2024-05-28)
-# Not working, bug #931046
->=sci-libs/caffe2-2.3.0 rocm
-
 # Sam James <sam@gentoo.org> (2024-05-09)
 # Experimental option upstream which seems undertested and underdocumented.
 # Fails to build with stricter C compilers too (bug #919685).
@@ -571,13 +575,9 @@ dev-php/fedora-autoloader test
 dev-php/json-schema test
 dev-php/jsonlint test
 dev-php/recaptcha test
-dev-php/symfony-config test
-dev-php/symfony-dependency-injection test
-dev-php/symfony-event-dispatcher test
 dev-php/symfony-filesystem test
 dev-php/symfony-finder test
 dev-php/symfony-process test
-dev-php/symfony-yaml test
 dev-php/theseer-Autoload test
 dev-php/twig test
 
@@ -645,10 +645,6 @@ dev-python/autobahn xbr
 # Dependency pam_wrapper missing for tests, and RESTRICT=test is already set
 net-fs/samba test
 
-# Mike Gilbert <floppym@gentoo.org> (2020-04-23)
-# Tests are very sensitive to the host environment.
-dev-build/meson test
-
 # Alfredo Tupone <tupone@gentoo.org> (2020-04-04)
 # Ada support is not yet ready for sys-devel/gcc
 sys-devel/gcc ada
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index 8d78931262..02af998f91 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -19,10 +19,6 @@ media-gfx/freecad qt6
 # Bug #910229, #920713
 >=mail-client/thunderbird-115.0 system-icu
 
-# Sam James <sam@gentoo.org> (2023-10-23)
-# Requires llvm-17.
->=www-client/chromium-118 libcxx lto pgo
-
 # Michał Górny <mgorny@gentoo.org> (2023-06-11)
 # xfce-base/libxfce4windowing is not ready to go stable (4.19 branch).
 xfce-extra/xfce4-pulseaudio-plugin libxfce4windowing
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
index 63704adbe4..de017f0c28 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.stable.mask
@@ -15,10 +15,6 @@ python_single_target_python3_13
 python_targets_pypy3
 python_single_target_pypy3
 
-# Michał Górny <mgorny@gentoo.org> (2024-04-04)
-# LLVM slots without stablekeywords.
-llvm_slot_18
-
 # Hans de Graaff <graaff@gentoo.org> (2023-12-25)
 # Currently in testing and not ready to go stable yet.
 ruby_targets_ruby33
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 504e286229..a31c693465 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -132,6 +132,7 @@ sys-apps/noexec
 dev-db/pg-gvm
 net-analyzer/notus-scanner
 net-analyzer/greenbone-feed-sync
+net-analyzer/boreas
 
 # Petr Vaněk <arkamar@atlas.cz> (2022-09-23)
 # Musl does not implement rresvport function, bugs #713810 and #713376.
@@ -270,7 +271,6 @@ games-server/ut2004-ded
 games-simulation/slime-rancher
 games-strategy/darwinia
 games-strategy/knights-demo
-games-strategy/majesty-demo
 games-util/heroic-bin
 gnome-extra/nautilus-dropbox
 kde-apps/dolphin-plugins-dropbox
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index 9cb4b9e5ab..fc7357eef0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-07-25)
+# Requires systemd-detect-virt
+app-emulation/virt-firmware test
+
 # Sam James <sam@gentoo.org> (2024-06-03)
 # Poor rendering performance otherwise (bug #931215) but it doesn't
 # work on musl.
@@ -54,6 +58,11 @@ sys-devel/gcc cet
 sys-libs/binutils-libs cet
 sys-libs/glibc cet
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2024-03-05)
+# gprofng is still somewhat messed up with musl-1.2.4, does not build
+# bug 912284
+sys-devel/binutils gprofng
+
 # Violet Purcell <vimproved@inventati.org> (2024-01-25)
 # f16c support in gtk4 requires the ifunc attribute, which
 # is not available on musl. There is a configure check for
@@ -138,6 +147,7 @@ www-client/qutebrowser widevine
 net-analyzer/wireshark sdjournal
 sys-apps/ipmitool openbmc
 sys-auth/pambase homed
+dev-qt/qtbase journald
 
 # Petr Vaněk <arkamar@atlas.cz> (2022-03-15)
 # musl package does not currently provide gencat binary, which is needed for
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.stable.mask
index 0a42768ac4..a903356e7e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.stable.mask
@@ -1,16 +1,10 @@
-# Copyright 2022 Gentoo Authors
+# Copyright 2022-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2024-03-07)
 # This doesn't work yet with musl-1.2.4, bug 906603
 sys-libs/compiler-rt-sanitizers msan
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2024-03-05)
-# gprofng is still somewhat messed up with musl-1.2.4, does not build
-# let's hope this is fixed with the next release
-# bug 912284
-<sys-devel/binutils-2.43 gprofng
-
 # Sam James <sam@gentoo.org> (2022-10-04)
 # libxcrypt migration isn't yet stable on musl.
 sys-auth/pambase yescrypt
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 543cee5a3b..f0b525fb70 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -176,7 +176,9 @@ net-p2p/deluge
 sci-geosciences/gnome-maps
 >=sys-apps/bat-0.18.1
 >=sys-block/thin-provisioning-tools-1.0.6
+>=sys-process/glances-4.1.2.1
 sys-fs/bcachefs-tools
 virtual/rust
 www-apps/radicale
 >=x11-themes/adwaita-icon-theme-3.36
+x11-themes/adwaita-icon-theme-legacy
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 7ea5cbd4f2..166c9d825c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -81,7 +81,7 @@ OSI-APPROVED @OSI-APPROVED-FREE @OSI-APPROVED-NONFREE
 
 # License agreements that try to take away your rights. These are more
 # restrictive than "all-rights-reserved" or require explicit approval.
-EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
+EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics Dell-EULA ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-azurevpnclient microsoft-edge Microsoft-vscode Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 PUEL-12 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
 
 # Deprecated license labels, used by repoman and pkgcheck
 #DEPRECATED (currently none)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index 0477231a60..d3b1657bff 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -17,6 +17,12 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2024-07-23)
+# Abandoned and broken with pytest-8.  Superseded
+# by dev-python/pytest-lazy-fixtures (plural), which requires small
+# changes in code.
+dev-python/pytest-lazy-fixture
+
 # Michał Górny <mgorny@gentoo.org> (2024-06-15)
 # Stop-gap compatibility package.  Upstreams really need to move away
 # from the removed cgi module rather than rely on this.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 7556d7eeaa..a07e0d3b8b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,103 @@
 
 #--- END OF EXAMPLES ---
 
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-07-27)
+# Stable version stuck on EAPI=6.
+# Lacks maintainer capacity for dev-lang/scala.
+# Removal on 2024-08-26.  Bugs #932012, #932737, #933607.
+dev-lang/scala
+dev-lang/mozart
+dev-lang/mozart-stdlib
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-07-27)
+# EAPI=6 package, awaits version bump.
+# Removal on 2024-08-26.  Bug #936756.
+www-apps/rt
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-07-27)
+# EAPI=6, awaits version bump. This is *-macos prefix only package, so
+# hard to verify EAPI bump without the maintainer.
+# Removal on 2024-08-26.  Bug #936755.
+dev-debug/gdb-apple
+
+# Alfred Wingate <parona@protonmail.com> (2024-07-24)
+# Includes change that breaks firewalld notably.
+#
+# https://git.netfilter.org/nftables/commit/?id=93560d0117639c8685fc287128ab06dec9950fbd
+# https://github.com/firewalld/firewalld/issues/1366
+# https://lore.kernel.org/netfilter-devel/Zp7FqL_YK3p_dQ8B@egarver-mac/
+=net-firewall/nftables-1.1.0
+
+# Sam James <sam@gentoo.org> (2024-07-24)
+# Fails to build with GCC 15, several open bugs
+# including test failures. Unpackaged by others.
+# Removal on 2024-08-23.  Bug #936581.
+app-accessibility/epos
+
+# David Seifert <soap@gentoo.org> (2024-07-22)
+# Unmaintained, replaced by app-portage/pram which has more features
+# and works better for merging PRs. Removal on 2024-08-21.
+dev-perl/Gentoo-App-Pram
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-07-21)
+# No more revdeps after net-libs/telepathy-accounts-signon last-rites.
+# Removal on 2024-08-20.
+net-libs/libsignon-glib
+
+# Hans de Graaff <graaff@gentoo.org> (2024-07-21)
+# Obsolete slots that are no longer used by any cucumber
+# version. Removal on 2024-08-21.
+dev-util/cucumber-core:10
+dev-util/cucumber-cucumber-expressions:16
+dev-util/cucumber-gherking:22
+dev-util/cucumber-html-formatter:20
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-07-20)
+# EAPI=6, fails to apply patch during src_prepare.
+# Removal on 2024-08-19.  Bugs #936398, #908957, #908959.
+media-video/raspberrypi-omxplayer
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-07-19)
+# EAPI=6 games. Feel free to drop any package after bumping it's EAPI.
+# Removal on 2024-08-18.  Bug #936299.
+games-arcade/sdl-sopwith
+games-arcade/syobon
+games-arcade/wop
+games-mud/crystal
+games-mud/gmudix
+games-mud/kildclient
+games-puzzle/color-lines
+games-puzzle/einstein
+games-puzzle/hangman
+games-puzzle/magiccube4d
+games-puzzle/scramble
+games-puzzle/zaz
+games-simulation/cannonsmash
+games-strategy/crimson
+
+# Ionen Wolkens <ionen@gentoo.org> (2024-07-18)
+# Explicit sync currently causes firefox to crash[1][2][3] (should be
+# improved in >=firefox-130 or so) among others like obs-studio[3],
+# and is still to be considered experimental. So keeping masked for
+# the time being while issues are ironed out.
+#
+# Feel free to unmask if not affected as it should improve the
+# experience esp. with Plasma 6 + wayland + nvidia, but please try
+# 1.1.13 before reporting crashes, freezes, or visual issues (and
+# bugs should go upstream).
+#
+# [1] https://github.com/NVIDIA/egl-wayland/issues/110
+# [2] https://github.com/NVIDIA/egl-wayland/issues/117
+# [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1898476
+# [4] https://github.com/NVIDIA/egl-wayland/issues/118
+# and: https://bugzilla.mozilla.org/show_bug.cgi?id=1908825
+~gui-libs/egl-wayland-1.1.14
+
+# Hans de Graaff <graaff@gentoo.org> (2024-07-17)
+# Obsolete slot. Please use a newer slot instead. No reverse
+# dependencies left. Removal on 2024-08-17.
+dev-ruby/rmagick:4
+
 # Eli Schwartz <eschwartz@gentoo.org> (2024-07-15)
 # FreeWnn has no activity upstream on its (very slow!) development site
 # since 2015. Website is gone. Various build failures, fails to build
@@ -132,128 +229,11 @@ games-puzzle/seatris
 # The symbol versioning "fix" breaks anything built with 3.0.0.
 =dev-libs/libassuan-3.0.1
 
-# NHOrus <jy6x2b32pie9@yahoo.com> (2024-06-24)
-# Masked for removal in 30 days.
-# It's a dependency of cinelerra, written for cinelerra.
-# We don't ship cinelerra. It should be removed when we removed cinelerra
-#
-# Bugs #871387, #907261, #712480, #931765.
-media-libs/libmpeg3
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-22)
-# EAPI=6, no reverse-dependencies, various issues with modern C,
-# installs libtools files.
-# Removal on 2024-07-22.  Bugs #934689, #741440, #849920, #832789, #862714, #828579.
-sci-libs/h5hut
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-22)
-# EAPI=6, failing tests, fails to compile in various envs, various
-# QA issues.
-# Removal on 2024-07-22.  Bugs #934687, #928028, #862687, #836104, #741430, #811561, #526442.
-sci-libs/coinor-os
-
-# Michał Górny <mgorny@gentoo.org> (2024-06-21)
-# An obsolete timezone distribution for Python.  No revdeps left.
-# Removal on 2024-07-21.  Bug #934681.
-dev-python/pytzdata
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-21)
-# EAPI=6, not maintained in gentoo for a long time, fails to
-# configure.
-# Removal on 2024-07-21.  Bugs #934680, #677444, #898100.
-sci-astronomy/aatm
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-21)
-# Last dev-php/* EAPI=6 packages, and reverse dependencies of them.
-# composer has active security vulnerabilities. Others are waiting
-# for version bumps, and unbundling of dependencies.
-# Removal on 2024-07-21.  Bugs #934666.
-dev-php/phpDocumentor
-dev-php/phpcov
-dev-php/phpdepend
-dev-php/phpdocumentor-reflection-common
-dev-php/phpdocumentor-reflection-docblock
-dev-php/phpdocumentor-type-resolver
-dev-php/stringparser_bbcode
-dev-php/symfony-config
-dev-php/symfony-console
-dev-php/symfony-dependency-injection
-dev-php/symfony-event-dispatcher
-dev-php/symfony-yaml
-dev-php/composer
-
 # Hans de Graaff <graaff@gentoo.org> (2024-06-21)
 # Obsolete slot. Please use a newer slot instead.
 # Masked for removal on 2024-07-21.
 dev-ruby/public_suffix:4
 
-# Martin Dummer <martin.dummer@gmx.net> (2024-06-21)
-# Upstream dead, was an optional package for a reverse dependency
-# which is gone.
-# Removal on 2024-07-21.  Bug #791904
-media-video/vdr2jpeg
-
-# James Le Cuirot <chewi@gentoo.org> (2024-06-20)
-# Ancient, dead upstream, X11-based, probably doesn't work any more, and there
-# are better ways of running games in different sessions now.
-# Removal on 2024-07-20.  Bug #934640.
-games-util/xgame
-games-util/xgame-gtk2
-
-# James Le Cuirot <chewi@gentoo.org> (2024-06-20)
-# Apparently a good game, but you cannot buy the full Linux version any more.
-# Get the HD version from Steam or the Windows original from GOG instead.
-# Removal on 2024-07-20.  Bug #934637.
-games-strategy/majesty-demo
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-20)
-# EAPI=6, keyworded for x86 only (making it hard to debug), has
-# open bugs for modern C and not using correct toolchain commands.
-# Removal on 2024-07-20.  Bugs #934621, #925090, #724078, #727438.
-dev-debug/ald
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-20)
-# EAPI=6, no reverse dependencies, waiting for a version bump.
-# Removal on 2024-07-20.  Bugs #934619, #730758, #713760.
-media-gfx/dawn
-
-# Jakov Smolić <jsmolic@gentoo.org> (2024-06-18)
-# Outdated by several versions, very difficult to package due to the
-# complicated Cargo dependency management.
-# Removal on 2024-07-18. Bug #922378.
-app-emulation/cloud-hypervisor
-
-# Michał Górny <mgorny@gentoo.org> (2024-06-17)
-# A compatibility shim for ancient versions of flake8.  Upstream project
-# is gone.  No revdeps.
-# Removal on 2024-07-17.  Bug #934466.
-dev-python/flake8-polyfill
-
-# Hans de Graaff <graaff@gentoo.org> (2024-06-17)
-# Obsolete slot with failing tests. Use the newer slot instead. No
-# reverse dependencies. Masked for removal on 2024-07-17.
-dev-ruby/net-imap:0
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-06-16)
-# No release since 2021-06-10 and effectively declared unmaintained by
-# upstream since then; now conflicting with Plasma 6 by pulling in old
-# kde-plasma/libksysguard:5. Removal on 2024-08-24.
-kde-plasma/ksysguard
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-06-16)
-# After most protocol support is gone, there is barely anything usable
-# left in kde-apps/kopete. It is also unmaintained and still depends on
-# kf5-portingaids, as well as conflicting kde-apps in slot 5. bug #760555
-# Removal on 2024-07-24.
-kde-apps/kopete
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-15)
-# EAPI=6, no reverse dependencies, not packaged on other distributions,
-# waiting for a version bump (which is hard since ebuild used debian
-# patches). Not really maintained in Gentoo for a long time.
-# Removal on 2024-07-15.  Bugs #934366, #871378, #716084, #924302.
-sci-astronomy/predict
-
 # Cédric Krier <cedk@gentoo.org> (2023-06-15)
 # critical regression with potential data loss:
 # https://lists.mercurial-scm.org/pipermail/mercurial-devel/2024-June/297954.html
@@ -263,43 +243,6 @@ sci-astronomy/predict
 ~dev-vcs/mercurial-6.7.2
 ~dev-vcs/mercurial-6.7.3
 
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, no reverse dependencies, maintainer-needed, installation
-# blocked by iproute2.
-# Removal on 2024-07-14.  Bugs #934242, #430816.
-net-misc/arpd
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, many compilation issues, upstream is gone, not maintained for
-# many years.
-# Removal on 2024-07-14.  Bugs #934240.
-sci-electronics/vbs
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, dead upstream website, Gentoo is last distribution to
-# package it.
-# Removal on 2024-07-14.  Bug #934232.
-sci-chemistry/xyza2pipe
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, not maintained for ~7 years in gentoo, waiting for version
-# bump. Fetch restricted, and fails to build after manual fetch.
-# Removal on 2024-07-14.  Bugs #934228, #686860, #686858, #686856.
-sci-chemistry/namd
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, not maintained in Gentoo for a long time. procheck is
-# fetch restricted, and the file you download from upstream
-# doesn't match size and manifests. aqua depends on procheck.
-# Removal on 2024-07-14.  Bugs #928067, #928068.
-sci-chemistry/aqua
-sci-chemistry/procheck
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-06-14)
-# EAPI=6, maintainer-needed, no reverse dependencies.
-# Removal on 2024-07-14.  Bugs #934227, #898840.
-www-misc/log-toolkit
-
 # Viorel Munteanu <ceamac@gentoo.org> (2024-06-11)
 # dev-php/pear, dev-php/PEAR-* and their reverse dependencies: mask for removal
 # in 30 days.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
index 962e14e44e..709360d865 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
@@ -1,10 +1,6 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Fabian Groffen <grobian@gentoo.org> (2024-05-28)
-# Fails to compile on any macOS, bug #932809, pending investigation
-=net-dns/c-ares-1.29.0
-
 # Benda Xu <heroxbd@gentoo.org> (2023-08-20)
 # Does not play well with linkers under macOS.
 # Undefined symbols for architecture x86_64:
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.mask
index 752f5b30f1..b388ebc3be 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2024-07-19)
+# misdetects and results in a broken (trapping) library e.g. breaks gpg
+dev-libs/libgcrypt asm
+
 # Fabian Groffen <grobian@gentoo.org> (2024-03-08)
 # -z,now is not something Darwin linkers understand
 sys-devel/gcc default-znow
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.use.mask
index 740b644ecf..c7843ea3d5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.use.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2024-07-21)
+# Python integration breaks over C++ standards conflict(s) that Python
+# headers try to change
+dev-debug/gdb python
 
 # Fabian Groffen <grobian@gentoo.org> (2022-12-27)
 # Solaris must keep system libelf, else things break down
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
index 1d3f79e891..ae28b8b9cf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
@@ -70,6 +70,7 @@ media-libs/libsdl2 gles2
 
 # Required by kde-plasma/kwin
 media-libs/mesa wayland
+x11-base/xwayland libei
 
 # Required by kde-apps/kdenlive
 media-libs/mlt ffmpeg frei0r rubberband
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
index 8076671c9f..761222bbaf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2024
@@ -47,7 +47,6 @@ move dev-util/scons dev-build/scons
 move sys-devel/qconf dev-build/qconf
 move dev-util/b2 dev-build/b2
 move dev-util/kbuild dev-build/kbuild
-move dev-util/ald dev-debug/ald
 move dev-util/ddd dev-debug/ddd
 move dev-util/edb-debugger dev-debug/edb-debugger
 move dev-util/kdbg dev-debug/kdbg
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
index ac2d01ee86..a439af1564 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2024
@@ -1,2 +1,3 @@
 move sci-libs/rtree dev-python/rtree
 move dev-python/mapbox_earcut dev-python/mapbox-earcut
+move dev-qt/kdsingleapplication dev-libs/kdsingleapplication
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240226-r2.ebuild
index f9e01b16f6..9afff17a04 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base-policy/selinux-base-policy-2.20240226-r2.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == 9999* ]]; then
 else
 	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
 			https://dev.gentoo.org/~perfinion/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2"
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
 
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240226-r2.ebuild
index 4fa0e038ce..1d65f2c542 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-base/selinux-base-2.20240226-r2.ebuild
@@ -17,7 +17,7 @@ else
 	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
 			https://dev.gentoo.org/~perfinion/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2"
 
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
 
 IUSE="doc +unknown-perms systemd +ubac +unconfined"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240226-r2.ebuild
index cc89d9b4cf..6daac99c52 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-container/selinux-container-2.20240226-r2.ebuild
@@ -10,5 +10,5 @@ inherit selinux-policy-2
 DESCRIPTION="SELinux policy for container"
 
 if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240226-r2.ebuild
index 5f4046cd2d..737321b68d 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dbus/selinux-dbus-2.20240226-r2.ebuild
@@ -10,5 +10,5 @@ inherit selinux-policy-2
 DESCRIPTION="SELinux policy for dbus"
 
 if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240226-r2.ebuild
index ba2905635a..e64098f650 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-policykit/selinux-policykit-2.20240226-r2.ebuild
@@ -10,5 +10,5 @@ inherit selinux-policy-2
 DESCRIPTION="SELinux policy for policykit"
 
 if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240226-r2.ebuild
index cf822a6a9c..3fcb478329 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sssd/selinux-sssd-2.20240226-r2.ebuild
@@ -10,5 +10,5 @@ inherit selinux-policy-2
 DESCRIPTION="SELinux policy for sssd"
 
 if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240226-r2.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240226-r2.ebuild
index 0d59c0010c..379cec1fcf 100644
--- a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240226-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-unconfined/selinux-unconfined-2.20240226-r2.ebuild
@@ -10,5 +10,5 @@ inherit selinux-policy-2
 DESCRIPTION="SELinux policy for unconfined"
 
 if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="amd64 arm arm64 ~mips x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.5.ebuild
index e3ad0c610f..938ef02c35 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -25,12 +25,11 @@ LICENSE="GPL-2"
 SLOT="0"
 IUSE="debug"
 
-DEPEND=">=sys-libs/libsepol-${PV}"
+RDEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]"
+DEPEND="${RDEPEND}"
 BDEPEND="sys-devel/flex
 	sys-devel/bison"
 
-RDEPEND=">=sys-libs/libsepol-${PV}"
-
 src_compile() {
 	emake \
 		CC="$(tc-getCC)" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.6.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.6.ebuild
index 35e87a3521..938ef02c35 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.6.ebuild
@@ -25,12 +25,11 @@ LICENSE="GPL-2"
 SLOT="0"
 IUSE="debug"
 
-DEPEND=">=sys-libs/libsepol-${PV}"
+RDEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]"
+DEPEND="${RDEPEND}"
 BDEPEND="sys-devel/flex
 	sys-devel/bison"
 
-RDEPEND=">=sys-libs/libsepol-${PV}"
-
 src_compile() {
 	emake \
 		CC="$(tc-getCC)" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7-r1.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7-r1.ebuild
index 35ff8c551e..3e839ede55 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-3.7-r1.ebuild
@@ -25,12 +25,11 @@ LICENSE="GPL-2"
 SLOT="0"
 IUSE="debug"
 
-DEPEND=">=sys-libs/libsepol-${PV}"
+RDEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]"
+DEPEND="${RDEPEND}"
 BDEPEND="sys-devel/flex
 	sys-devel/bison"
 
-RDEPEND=">=sys-libs/libsepol-${PV}"
-
 src_compile() {
 	emake \
 		CC="$(tc-getCC)" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-9999.ebuild
index 35ff8c551e..3e839ede55 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/checkpolicy/checkpolicy-9999.ebuild
@@ -25,12 +25,11 @@ LICENSE="GPL-2"
 SLOT="0"
 IUSE="debug"
 
-DEPEND=">=sys-libs/libsepol-${PV}"
+RDEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]"
+DEPEND="${RDEPEND}"
 BDEPEND="sys-devel/flex
 	sys-devel/bison"
 
-RDEPEND=">=sys-libs/libsepol-${PV}"
-
 src_compile() {
 	emake \
 		CC="$(tc-getCC)" \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.9.ebuild
index e2e14f39f0..68d44d2fc6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.9.ebuild
@@ -9,7 +9,7 @@ SRC_URI="https://www.kernel.org/pub/software/network/ethtool/${P}.tar.xz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
 IUSE="+netlink"
 
 RDEPEND="netlink? ( net-libs/libmnl )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/findutils/findutils-4.10.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/findutils/findutils-4.10.0.ebuild
index fd41806616..29503c6d58 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/findutils/findutils-4.10.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/findutils/findutils-4.10.0.ebuild
@@ -16,7 +16,7 @@ SRC_URI="
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="nls selinux static test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.383.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.383.ebuild
index aa8f1bb9c7..2945849191 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.383.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.383.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/vcrhonek/hwdata/archive/refs/tags/v${PV}.tar.gz -> $
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 
 RESTRICT="test"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 2a9a6839c2..88ced78286 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -1,3 +1,4 @@
+DIST iproute2-6.10.0.tar.xz 920812 BLAKE2B 66332ea333ab2cdc4a2c71000fa2d06fd87cfdf5237dae458aff60ce606155302eb9d0ffaf87107255ab04c02f2b773dc040abb08bb89afb53091396dfc8a3ad SHA512 706479aa37a25fcf30c525c6abd85e0861e484d046e0636a28dbc52b958d45c9dba70b912f530dedd4b0b496e4b98969e23501bbbb41d3de50810bae014fcb41
 DIST iproute2-6.6.0.tar.xz 917964 BLAKE2B 9d20f19c04c2bbde7a3ae53e61e4623b119570c8446f34b93ddadd64677caa432e00ee085498bc277e0842cc2124340c7100925106d0ef2c11dd8002aacac08f SHA512 21c99a3ba8e1d0047933e99b48fb00901eef18899cd5854000ae910d9d84d13aeafa48b32184775531285782909f4d283d0784491691a1f10462dab147de359d
 DIST iproute2-6.8.0.tar.xz 913512 BLAKE2B d30cdff8522627c27c9165f068f42adbec38f15548a8f2cd31276f283880dc402e10c5989e7227e80cdc891bcc4a574b330d634ae550e689758b849c0506c31f SHA512 54e50340a73c8810d69bfd54704b469149731634a97d94da08b5a305592a812131a441e5b646e32b480d61840e2ade29387e54b934effeee8ded4f06e557a5c0
 DIST iproute2-6.9.0.tar.xz 918144 BLAKE2B a7434a2537a55b4875db0e3cc35383dfe4d0c8a118a8a1102c4076bfb154c9c2ab0781dcff324fa18ce7cfde798bf332a9e0ff08003ff39acbb8129b597a93a6 SHA512 1cbb234cb8f94213c3529f0b74fed5a575ff1fb838e783b8d2b440643c2e91246eda42e9b26e9775897aadb8b8133d199b2851b8ea0df06a899dc02acf403325
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.10.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.10.0.ebuild
new file mode 100644
index 0000000000..3d0c9ec799
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.10.0.ebuild
@@ -0,0 +1,212 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!net-misc/arpd
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( dev-libs/libbpf:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	edo ./configure --color=auto --libbpf_force $(usex bpf on off)
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index bfc78c186a..94334695f4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -18,7 +18,7 @@ HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux split-usr"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
 # Needs root
 RESTRICT="test"
 
@@ -48,10 +48,10 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-6.5.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
 	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
-	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
 	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+	"${FILESDIR}"/${PN}-6.6.0-musl-c99.patch # bug #922622 & #932617
 )
 
 src_prepare() {
@@ -192,6 +192,7 @@ src_install() {
 
 	dodir /bin
 	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
 
 	dolib.a lib/libnetlink.a
 	insinto /usr/include
@@ -201,13 +202,6 @@ src_install() {
 	# https://bugs.gentoo.org/868321
 	mv "${ED}"/sbin/ifstat{,-iproute2} || die
 
-	if use split-usr ; then
-		# Can remove compatibility symlink in a year: 2023-05-28.
-		# bug #547264
-		mv "${ED}"/sbin/ss "${ED}"/bin/ss || die
-		dosym -r /bin/ss /sbin/ss
-	fi
-
 	if use berkdb ; then
 		keepdir /var/lib/arpd
 		# bug #47482, arpd doesn't need to be in /sbin
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/Manifest
index 223a21a840..a064ecc472 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/Manifest
@@ -1,3 +1,2 @@
-DIST kexec-tools-2.0.22.tar.xz 303564 BLAKE2B 977c741eabf9b6b882550713ba59b18289b4f997fb382e96338efce6d04a9390fea952fc46ca72fd0a0b782261841ab2002da84b1819f955e63996eac900b0f7 SHA512 7580860f272eee5af52139809f12961e5a5d3a65f4e191183ca9c845410425d25818945ac14ed04a60e6ce474dc2656fc6a14041177b0bf703f450820c7d6aba
-DIST kexec-tools-2.0.24.tar.xz 303808 BLAKE2B 8188602f1b843c1dccc0307131f8c9ec0426c6cb3de898040352c1fed5f6d4bd7c58a0c2bf54290b91c8fe3401180df682959ee6c41693d07acc199c087c7db2 SHA512 ef7cf78246e2d729d81a3649791a5a23c385353cc75cbe8ef279616329fdaccc876d614c7f51e1456822a13a11520296070d9897467d24310399909e049c3822
 DIST kexec-tools-2.0.28.tar.xz 312524 BLAKE2B b2ab25c632cd2bad21751940acee1816f9cd930e1bb5af1052f9f6c4979dcd62d82c487a88fa8015e3ce7c843de9f47a3f6ccf7efa9270b5f24c79ba30a82a91 SHA512 889a7bf1d26bb309e4ff7ce1c8dbcf48c01e47221ea3acf1c4ef2a98a652c496e31bddcdb627d3adebd85f7541d1fb9122c60e741e10b3726e31a9733cadc753
+DIST kexec-tools-2.0.29.tar.xz 314576 BLAKE2B 3cb94015d0bcd8ab13f25e23835758fc305093c4d1a81c590830ced852e61da66321617f04bda847e26c95ec44bd101eb235fa1d34f397e22ed4e80426efa162 SHA512 4c9e0b3df47b240f0eac2c31e8b515465f626ce043f64daa32b0b032d7132e54dada5d70875dab256345f66cf94a25dc3c160a9009ba60addd8dcb1e5205f5ca
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.22.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.22.ebuild
deleted file mode 100644
index 2f8eea8c0d..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.22.ebuild
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit libtool linux-info optfeature systemd
-
-if [[ ${PV} == "9999" ]] ; then
-	inherit git-r3 autotools
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git"
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/kernel/kexec/${P/_/-}.tar.xz"
-	[[ "${PV}" == *_rc* ]] || \
-	KEYWORDS="amd64 ~arm64 ~ppc64 x86"
-fi
-
-DESCRIPTION="Load another kernel from the currently executing Linux kernel"
-HOMEPAGE="https://kernel.org/pub/linux/utils/kernel/kexec/"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="booke lzma xen zlib"
-
-REQUIRED_USE="lzma? ( zlib )"
-
-DEPEND="
-	lzma? ( app-arch/xz-utils )
-	zlib? ( sys-libs/zlib )"
-RDEPEND="${DEPEND}"
-
-S="${WORKDIR}/${P/_/-}"
-
-CONFIG_CHECK="~KEXEC"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.0.4-disable-kexec-test.patch
-	"${FILESDIR}"/${PN}-2.0.4-out-of-source.patch
-)
-
-pkg_setup() {
-	# GNU Make's $(COMPILE.S) passes ASFLAGS to $(CCAS), CCAS=$(CC)
-	export ASFLAGS="${CCASFLAGS}"
-}
-
-src_prepare() {
-	default
-
-	# Append PURGATORY_EXTRA_CFLAGS flags set by configure, instead of overriding them completely.
-	sed -e "/^PURGATORY_EXTRA_CFLAGS =/s/=/+=/" -i Makefile.in || die
-
-	if [[ "${PV}" == 9999 ]] ; then
-		eautoreconf
-	else
-		elibtoolize
-	fi
-}
-
-src_configure() {
-	local myeconfargs=(
-		$(use_with booke)
-		$(use_with lzma)
-		$(use_with xen)
-		$(use_with zlib)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	# Respect CFLAGS for purgatory.
-	# purgatory/Makefile uses PURGATORY_EXTRA_CFLAGS variable.
-	# -mfunction-return=thunk and -mindirect-branch=thunk conflict with
-	# -mcmodel=large which is added by build system.
-	# Replace them with -mfunction-return=thunk-inline and -mindirect-branch=thunk-inline.
-	local flag flags=()
-	for flag in ${CFLAGS}; do
-		[[ ${flag} == -mfunction-return=thunk ]] && flag="-mfunction-return=thunk-inline"
-		[[ ${flag} == -mindirect-branch=thunk ]] && flag="-mindirect-branch=thunk-inline"
-		flags+=("${flag}")
-	done
-	local -x PURGATORY_EXTRA_CFLAGS="${flags[*]}"
-
-	default
-}
-
-src_install() {
-	default
-
-	dodoc "${FILESDIR}"/README.Gentoo
-
-	newinitd "${FILESDIR}"/kexec-r2.init kexec
-	newconfd "${FILESDIR}"/kexec.conf-2.0.4 kexec
-
-	insinto /etc
-	doins "${FILESDIR}"/kexec.conf
-
-	insinto /etc/kernel/postinst.d
-	doins "${FILESDIR}"/90_kexec
-
-	systemd_dounit "${FILESDIR}"/kexec.service
-}
-
-pkg_postinst() {
-	if systemd_is_booted || has_version sys-apps/systemd; then
-		elog "For systemd support the new config file is"
-		elog "   /etc/kexec.conf"
-		elog "Please adopt it to your needs as there is no autoconfig anymore"
-	fi
-
-	local n_root_args=$(grep -o -- '\<root=' /proc/cmdline 2>/dev/null | wc -l)
-	local has_rootpart_set=no
-	if [[ -f "${EROOT}/etc/conf.d/kexec" ]]; then
-		if grep -q -E -- '^ROOTPART=' "${EROOT}/etc/conf.d/kexec" 2>/dev/null; then
-			has_rootpart_set=yes
-		fi
-	fi
-
-	if [[ ${n_root_args} -gt 1 && "${has_rootpart_set}" == "no"  ]]; then
-		ewarn "WARNING: Multiple root arguments (root=) on kernel command-line detected!"
-		ewarn "This was probably caused by a previous version of ${PN}."
-		ewarn "Please reboot system once *without* kexec to avoid boot problems"
-		ewarn "in case running system and initramfs do not agree on detected"
-		ewarn "root device name!"
-	fi
-
-	optfeature "automatically updating /etc/kexec.conf on each kernel installation" \
-		"sys-kernel/installkernel[-systemd]"
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.28.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.28.ebuild
index e87b00d0d9..c559e6328f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.28.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.28.ebuild
@@ -17,6 +17,8 @@ fi
 DESCRIPTION="Load another kernel from the currently executing Linux kernel"
 HOMEPAGE="https://kernel.org/pub/linux/utils/kernel/kexec/"
 
+S="${WORKDIR}/${P/_/-}"
+
 LICENSE="GPL-2"
 SLOT="0"
 IUSE="booke lzma selinux xen zlib"
@@ -32,8 +34,6 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-kdump )
 "
 
-S="${WORKDIR}/${P/_/-}"
-
 CONFIG_CHECK="~KEXEC"
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.24.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.29.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.24.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.29.ebuild
index 924cf21eef..bedde55d96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.24.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-2.0.29.ebuild
@@ -11,12 +11,14 @@ if [[ ${PV} == "9999" ]] ; then
 else
 	SRC_URI="https://www.kernel.org/pub/linux/utils/kernel/kexec/${P/_/-}.tar.xz"
 	[[ "${PV}" == *_rc* ]] || \
-	KEYWORDS="amd64 ~arm64 ~ppc64 x86"
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
 fi
 
 DESCRIPTION="Load another kernel from the currently executing Linux kernel"
 HOMEPAGE="https://kernel.org/pub/linux/utils/kernel/kexec/"
 
+S="${WORKDIR}/${P/_/-}"
+
 LICENSE="GPL-2"
 SLOT="0"
 IUSE="booke lzma selinux xen zlib"
@@ -32,8 +34,6 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-kdump )
 "
 
-S="${WORKDIR}/${P/_/-}"
-
 CONFIG_CHECK="~KEXEC"
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-9999.ebuild
index c107633e4b..bedde55d96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kexec-tools/kexec-tools-9999.ebuild
@@ -17,6 +17,8 @@ fi
 DESCRIPTION="Load another kernel from the currently executing Linux kernel"
 HOMEPAGE="https://kernel.org/pub/linux/utils/kernel/kexec/"
 
+S="${WORKDIR}/${P/_/-}"
+
 LICENSE="GPL-2"
 SLOT="0"
 IUSE="booke lzma selinux xen zlib"
@@ -32,8 +34,6 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-kdump )
 "
 
-S="${WORKDIR}/${P/_/-}"
-
 CONFIG_CHECK="~KEXEC"
 
 PATCHES=(
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/files/conf.d-pciparm b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/files/conf.d-pciparm
index f036b15ad2..a1b0876418 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/files/conf.d-pciparm
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/files/conf.d-pciparm
@@ -1,6 +1,3 @@
-# PCI tweaking article:
-# http://www.gentoo.org/doc/en/articles/hardware-stability-p2.xml
-#
 # Apply to all devices:
 # PCIPARM_ALL="...."
 # Cards also can be addressed by vid:pid or by bus:slot.func
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.13.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.13.0.ebuild
index dd3c7a0562..57b9f333b1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.13.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pciutils/pciutils-3.13.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://mj.ucw.cz/download/linux/pci/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="dns +kmod static-libs +udev zlib"
 REQUIRED_USE="static-libs? ( !udev )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
index e00f04eb47..6f2636f746 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/Manifest
@@ -1,6 +1,6 @@
 DIST pv-1.8.10.tar.gz 328069 BLAKE2B 03e2c6717954e55b9ce2bdb7462e83c07a3d1d71799aa20a225a3140a0cdda4b3b8a7b038e065ee939bfd881392471f24846422e751f07909c6ca2fb1d4f515c SHA512 4bb60d55f7c8e5453793ec6771f70b791b25324f07a673f111afdfdb79225f28987265f736b9dd5d5bdfa279634be46b8db2cb774f78c91c88f25d254cd9be78
 DIST pv-1.8.10.tar.gz.asc 691 BLAKE2B 5425cbac5a3212a9f13222d8e8de28fc60a3418acdd32e094394afe59e3f69dedc9101e56a9888d39baf68e0f0f7482b57f74544d20bb6919a05597f7954b325 SHA512 ab9b1ed2a58a25eba30f48d6b176464ae6fd93e14b55571b7db7c815dc1810c022eff9b92885f64002a12c341b640bb2fdda3b0495dfb6e65d5b1ec4564e0b86
-DIST pv-1.8.5.tar.gz 327072 BLAKE2B ef7fcf64430a72e04ca3a922115e7012c999109bb7e1a52f480c27eeb6c49952f4be52e6041a063c710d934c68555cfb65796103920fd240e4ebde2fa6a323c7 SHA512 6d7a0f785ace5e25c5677af4cf38a003386774e60563865de7f1dae60f1785685541da93e1f88236b8b2e14431584bc2cb2adb3a575fb90dc774bc6bacf22e21
-DIST pv-1.8.5.tar.gz.asc 691 BLAKE2B ac5bd2b05e145d4ea5aedbb148b39a317d68329787f06f39f808be75951da0e0f460254b4a5049a8eafabad07edfbe936be00154f5dfa660628c8a3dfa3b7ffd SHA512 8414b2485347579a54233a2f241c080ab6461799c149567ab1063ce812b08ab2293f55bf8a24bcadabf94d12ce3dce36fe57277d822d115db9e53c957fe99c20
+DIST pv-1.8.12.tar.gz 328897 BLAKE2B 0de9376b6fd07e81229d281f7f1b7d64de27d4ed71dfed15a86b77e841a3fc066c8aeb4b4a6d15b2dbe8bc0fc9a439464cefd0f34e378c12adda41d856332029 SHA512 d3b912f424fd14e4819a04f2c2492b8e24f52ded55c47bcc924c5ef3f0f27c6f50e43fb0188551ea2d415e2c9aef3a58f13bfd11e1d2bf0bb3cba34a88ffea40
+DIST pv-1.8.12.tar.gz.asc 691 BLAKE2B eef421c6ed950e6330f341d3b9c6f5223d9f7ea2030bccf8d41c48f4a11ea49dda5ba67ec2d7b7abed0dba79720ba26b3360aab57132e9e100af8700fe6f13f1 SHA512 453fedbaf70b1e2d837096427832c15d504c63fc67f3214bb263d7069d756ccf45f933cccdd7309f50a05493b84a7ca7bdeb8c03bcafd1c412a4889b98a11d10
 DIST pv-1.8.9.tar.gz 330129 BLAKE2B a8e8b567a0e9eed9fa9b938b5ef52623adda8907b26d6dc3664fb0e3c8bee193e615ad0f357f688a53fa0014d978bf98a157a072d0159e9aaded447d3e4b16e0 SHA512 d6e483d2cb5ef3def1df9c72774ab70a5210e7a45f165d3d1527f11366e7bbab57320f1987d460783eda94605a17c5ef2a027fa4a7e9d58b529f4b1b05ec07a8
 DIST pv-1.8.9.tar.gz.asc 691 BLAKE2B 24640b3ba4d3306175f6e63d5efe86bc4a29da3b822417098f66892c0c59ddab713b202ebcc6e8fbe97de104b0583221ee12b4ef72adb2402912e3f799403e92 SHA512 ad4791b094caacc05485ee817c3162c65110c46bd7feaf06617fcf7d42c0d407e5696cf35ff881aa19340a13d02e04183c5e4db51cc68bb443fa524d9573ce57
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.12.ebuild
similarity index 80%
rename from sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.5.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.12.ebuild
index 3a5e84a8c4..89cf567ffe 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/pv/pv-1.8.12.ebuild
@@ -18,7 +18,7 @@ else
 		verify-sig? ( https://www.ivarch.com/programs/sources/${P}.tar.gz.txt -> ${P}.tar.gz.asc )
 	"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 fi
 
 LICENSE="GPL-3+"
@@ -38,6 +38,13 @@ pkg_setup() {
 src_prepare() {
 	default
 
+	# Valgrind isn't reliable within sandbox.
+	cat <<-EOF > tests/run-valgrind.sh || die
+	#!/bin/sh
+	exit 77
+	EOF
+	chmod +x tests/run-valgrind.sh || Die
+
 	[[ ${PV} == 9999 ]] && eautoreconf
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.7.ebuild
index 088b9f48cc..eb2433901e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/semodule-utils/semodule-utils-3.7.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == *9999 ]] ; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
index e61811263e..5b7975b7b3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.4-r1.ebuild
@@ -22,7 +22,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
index 1205062fed..857fb9418a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.40.1-r3.ebuild
@@ -110,10 +110,10 @@ pkg_pretend() {
 }
 
 src_unpack() {
-        if [[ ${PV} == 9999 ]] ; then
-                git-r3_src_unpack
-                return
-        fi
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
 
 	# Upstream sign the decompressed .tar
 	if use verify-sig; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
index de1dcd4ed1..afe18bfe07 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
@@ -1 +1,2 @@
+DIST binutils-config-5.5.2.tar.xz 7548 BLAKE2B a4fe6f2039c4963ba09fb63b52bf3707b91eed36b514132c0c23da2474b9af6d2fd5b8eaef2dd8f44827f5d38095c936685765d3c4cc7404d06c4ac069cf1102 SHA512 c53118c1ce4b87c0446b1b9993fadabe2bd7447dafc9a2bf795a5e3b802348b4fa8aede06284a0c86f80f23b221b037a0404d5424f2f5aa796e8a3ea6945328c
 DIST binutils-config-5.5.tar.xz 7344 BLAKE2B decef43013ca2f7c6d36c12d08d55f499d866b6b1b55ed58f8b2df3761077b5e2c4d09d1f2c40762d42c2d3b9827575833a502b79180ef13b845f1a39a5f2feb SHA512 6f6e21799b47e38cd61621e4ec018dc0db4811f363c0817025c3e3be651d3790b30a0cab233f35fe40b1d57c88daa246037f24a7488187f4e47cca589d87d45b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild
new file mode 100644
index 0000000000..293dcd3622
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.2.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/binutils-config.git"
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~dilfridge/distfiles/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Utility to change the binutils version being used"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Toolchain"
+
+LICENSE="GPL-2 GPL-2+"
+SLOT="0"
+IUSE="+native-symlinks"
+
+# We also RDEPEND on sys-apps/findutils which is in base @system
+RDEPEND="sys-apps/gentoo-functions"
+
+src_compile() {
+	emake PV="${PV}" USE_NATIVE_LINKS="$(usex native-symlinks)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" PV="${PV}" install
+}
+
+pkg_postinst() {
+	# Re-register all targets. USE flags or new versions can change
+	# installed symlinks.
+	local x
+	for x in $(binutils-config -C -l 2>/dev/null | awk '$NF == "*" { print $2 }') ; do
+		binutils-config ${x}
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
index 5e6ae95311..7b0f6ea29f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r2.ebuild
@@ -500,7 +500,7 @@ src_install() {
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
-	binutils-config ${CTARGET}-${PV}
+	binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
 }
 
 pkg_postrm() {
@@ -517,12 +517,12 @@ pkg_postrm() {
 		choice=${choice//$'\n'/ }
 		choice=${choice/* }
 		if [[ -z ${choice} ]] ; then
-			binutils-config -u ${CTARGET}
+			binutils-config -u ${CTARGET} || eerror binutils-config returned an error
 		else
-			binutils-config ${choice}
+			binutils-config ${choice} || eerror binutils-config returned an error
 		fi
 	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
-		binutils-config ${CTARGET}-${PV}
+		binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
 	fi
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index ec36fb66e1..ccf31a1014 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -494,7 +494,7 @@ src_install() {
 pkg_postinst() {
 	# Make sure this ${CTARGET} has a binutils version selected
 	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
-	binutils-config ${CTARGET}-${PV}
+	binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
 }
 
 pkg_postrm() {
@@ -511,12 +511,12 @@ pkg_postrm() {
 		choice=${choice//$'\n'/ }
 		choice=${choice/* }
 		if [[ -z ${choice} ]] ; then
-			binutils-config -u ${CTARGET}
+			binutils-config -u ${CTARGET} || eerror binutils-config returned an error
 		else
-			binutils-config ${choice}
+			binutils-config ${choice} || eerror binutils-config returned an error
 		fi
 	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
-		binutils-config ${CTARGET}-${PV}
+		binutils-config ${CTARGET}-${PV} || eerror binutils-config returned an error
 	fi
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 758ed046e1..6a3f720038 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,59 +1,44 @@
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
 DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
-DIST gcc-11-20240111.tar.xz 76240620 BLAKE2B dcf3b2493ca6ba1a9cd0137186cfbf1b96296ff9c5625e40ec7b89e5903b07dc151b61ad54b885fc57ccc02214e2cfa7b9249cbd755ac2554c6ca0008f0704d8 SHA512 aaed094cb6dd99166e0ec59886014108574ddab52701581f0f8e7f0abb966320d01f1bce6ff646170618ca7c2819d20523a23615f20114dbe412de43b937caf4
 DIST gcc-11-20240501.tar.xz 76267628 BLAKE2B 31674f1fbaacac3bc8d4f0553b42569128c978b7153eb867387ff2cedd11ba29e2877a66eefbb41b93745e9ff3da7db18c00aacff5766a34b020cb82252da3a4 SHA512 b4fd43b02ddf60dd933f86813cf4c5e2abf4d3344adcffc4166ad2463b2aa37603eb85df642e952a1c72a6356fc41d80567096ddc4e46d4b4589ade34ae77b2d
-DIST gcc-11-20240612.tar.xz 76291200 BLAKE2B 150e7e8fd3f5d9748a68c548985261696b375650117a9dc656c715aca9cb6923bd7621d3e5769118759b9ab58f13729013be48723ae4b3caf7f574d22d5a1805 SHA512 61f760a29e6a0f183eac0ee8443b6f44d2b5e7d256b3c4b5c3a25ef930c2541803f7cca8b48ee34d780616b00f7e8f616cc6355e3ef49d806d686e93d5a4d6f9
-DIST gcc-11-20240619.tar.xz 76267052 BLAKE2B 21cdd2a569667f142e55959f1a8d0d46735c3480f7108307e5b2b719379494bca02701c363f9888738d3e7ee06e6dc3202c9657e555823369ab8139130958f09 SHA512 94120a4d9de06ceae239e8ea6c0da6d09e05400d37e5baed529ce715da3e3b49c16ce341ea84c165d85fb417bf236676bc82a637c4ecce4e613b96d979771dd8
-DIST gcc-11-20240626.tar.xz 76282132 BLAKE2B ff4934566462df8a4041ac7749d17f1bdba45396cc5f95f4f42043b794ab70c72465e5602b954ebbe787deaa8e4a0bde8344c37793da21ba0707e0d67264568e SHA512 2d1a34e02a87e27d71395aa91e8ed01721fcc22f5039f6da35f981099c6e9adad2c22ab43f6909a71e520b07cf3eee229a3a4860fb586898a77aca97aa4abc32
-DIST gcc-11-20240703.tar.xz 76281780 BLAKE2B 63a1e5ce1dfd572a2dad69cf45b77a9ee361886e8e391f3e5c47ebd4faa9938260c958c27f0503c30c596e5d2f62aebb1dff521dec08a2d487820d450387a484 SHA512 3ab37094a1a626c050caf039189eff1f3d1fb9dd36c9205088bcd6d828e1556219fe41de34053a55c220f76ac3431c44a15b37c5b11e3c59d0123b4c1d5fbc26
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
 DIST gcc-11.4.0-patches-12.tar.xz 13824 BLAKE2B e4df9e0dc9512882022aaf325ebf65c540169454c91dd31f913c6f57f6eb291c79ae919671b53db1549799d4a70c09298bf45ed82ad05eb1f961443cc958369d SHA512 87fed0c3f8e28c9f702443db58350bb615110b27ebe334b5de2ea60678e2548c56cd75cffade210d69634e2ac0a9311f5100ddb45d97645aa76d5688bc421a61
-DIST gcc-11.5.0-RC-20240712.tar.xz 82514756 BLAKE2B 075512da838b9e71961519ee5f99e8fd5dbc119594278859064c9137b7ad91e3a31fa07fd2f04f2117d53b163d195da9e8231adc4faf6887858d057337af8605 SHA512 fcf0dbfa1cd044afc4a5773deb7b4b64700877d6917b5b95b726429e15a1dc489fe9be4ea40e5876b6d84924817ff170c6b306b3392ccb198c92a8c32d3c2571
+DIST gcc-11.5.0.tar.xz 82399864 BLAKE2B f4a61faad32aac9e9cb553c1a1a011df0a057f6e2cac92a13cc7e285d08191dd4a117f41a8faac2359c0e2a16f954c7fef354dda9df8c63bff1c5cefda82602c SHA512 88f17d5a5e69eeb53aaf0a9bc9daab1c4e501d145b388c5485ebeb2cc36178fbb2d3e49ebef4a8c007a05e88471a06b97cf9b08870478249f77fbfa3d4abd9a8
 DIST gcc-12-20240209.tar.xz 79824868 BLAKE2B 1ae5a646da470f06648c4766c77475ceb287c5f6647d5102f1aef6590f973233d5e7f83b5e0241488d49dba59dd605c211938379e68a393a2dccb3834103ae4b SHA512 9f9a04f4477f41bb2a5662aedef2af75b039de50c2dc99310e504e6080cb7aae06a1255337ea2e563975cb108ddc6766adbbaf4e3d5d5712801d7ba9a5209dbd
-DIST gcc-12-20240502.tar.xz 79851984 BLAKE2B e3ed4f4fb20ce2ed421fadd40dfd1c6831759228925002146c316683cd0aef47792f433dc9ab120fb79e2afa2aa83cbf68f6b82e97615cac500322d4f0d1cce9 SHA512 c46e6b00f65d96afc65ce6cc9f7591ff81d5789aff9f49fc6fed96047fe27e24a8a103f0b96485e4a717600aeb9b45933ccbb2191eb087275fc1350629c9b842
-DIST gcc-12-20240613.tar.xz 79875076 BLAKE2B 48b57f834df842c72e08dc9ae3637fdc5fb381f0f50a045a43ff3003271b7e8fa3c92a420447911a71df1184b25c2aad084d80bef8194a6468ddc21b1730b69e SHA512 1d149f6347f314a414bb279e20ae48bea2c9baa03257e3636515a74b389065a7cb6e5257f62334a307ebf6ef7ff142362e69967acc33b92a7fe21eea2bd52ee5
-DIST gcc-12-20240627.tar.xz 79897928 BLAKE2B fa1d1bdc3f309a915fa9ec9bc4f0a04ac8d0ad70f6ca9ebd5fb8907e3c81f84f0045bfb3d2c6650465a21464d21453519b15251153efa281579e0eaff450268b SHA512 4042f36bf265d8302bbdad7046717743e52b505ca0a8d495b5a4d495f6bd558226499587f24680900b7860a3899384cfdf7f966e84773f2a71b14fa07bbf09ff
-DIST gcc-12-20240704.tar.xz 79892516 BLAKE2B 1dc31bdb8d37073a819a0b590cf6517b384d2985f12103ee52a2dc5c877a9a8aadc05814c94f0e420575950d891aa9fca33939fc67585471ae841255018de781 SHA512 caf7094a196c24805526834bd66b2ee240ee3828b94f85a174618082dc591249bfb4a04375a890c6e286b81ffe1c2a14bc0ae1d69dec6c1ee13ad1cd1d0bac36
 DIST gcc-12-20240711.tar.xz 79899144 BLAKE2B e1dad8f14ac0413c31ebb516551ef6891c43ffb2161efc6224a59a758cb5936a8b6a5db3ee0ea84c9a013dc3e7a3cca2abdec138cfb17b430d1ea926811f632a SHA512 e3a9b14edb7cf8f5a1d27652b60a4bd9b6aa553ffc5bfa6dc53113e327a4a1f2cfedd3ea5a3a1c074f47d7008cad89d721844a863d762343fad8b37d3ec55083
+DIST gcc-12-20240725.tar.xz 79899056 BLAKE2B 299edcf3a8fa35f15bcc850a5fd3be12c2d0e464ea8d78454333a3462d182be61923e38fe1ead5ca0e8d647941e897e4c3e37f03cf80e9aeedc32370bdf12f25 SHA512 6169e54e6e4c7017d7b9138fef341387a1fc8e3634b974364daef7bdff5809d0156012e25bfb533e255b0f3198aae7c667321bc11ac9ad71302f06be5b31c6b2
 DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
 DIST gcc-12.3.0-patches-3.tar.xz 14852 BLAKE2B 7a5f1f43063b15f424099afd72096212fbbbc5151ff01f2de15dfb6e7cf274981c8cfaedba9ef61576c9096fb172fc550a7deb5cd7d9366fd249fd5dd3951f76 SHA512 aa89e4c2ae02f4fb42229ad5167f2eaa3a8fae51118645bf07199fe2124b9c83948590662b053d08002ef709fa870ea88315fd4ccbe4441a74e9cb62edcb82fb
 DIST gcc-12.4.0.tar.xz 83377372 BLAKE2B 0d5aa9995bf53fa2dc976a846240cfb8fafd125ad6c54f45dc9d770215eae3e9ea0db82a9a4f79c51b4d5f8461a1d730c17db6841bc31bd96dba11d9ed7544ae SHA512 5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853
 DIST gcc-13-20240210.tar.xz 84354416 BLAKE2B 5807623d3f7dd751b6dfe164cfd50d57b2f93485c23c3c2228a4a846a9a94cdad52a5e6f2806e5e7ee2a7b5526386ebdb339c44c7ea023d69f8652088a1b114d SHA512 14a01ced7ac2bfd9fc93de4e3819b4d0823fbe129d3f1faabeb707e9e3e2613b4173321b58b3648a7250e3b7ff5d94edfee60e6c38682f31a1f7b57b1c01433f
-DIST gcc-13-20240503.tar.xz 84417232 BLAKE2B 4024852c3252667054e6086263b2a0e21dfa1e56a7adf4edb2fee4841dc2b41eb3f02dee7b15c5de3a1ac7c438929da4ca584cab07724086f6eb315a331c4a44 SHA512 32b74972ba94d1016e052eb7c7dc976b32d679e40aeafb406bbbc69d34ade3fe0f35d8941ef678eaf0bb33aea1aaba8fbce9122733b12920a470763a18aa6514
 DIST gcc-13-20240614.tar.xz 84463660 BLAKE2B a1b551ff633c31d6972fed173f248ba5f6696eb1566801e180b78a7c7e20933b1aaae40839b4f1529d61166de55125395d4f9a812511c088e73f975bf1d2167f SHA512 1a543ddfb56e793367a43895a7ce4f97daeca6ffd5234ce50e8a7ae0f8db1071e01bdd653fda40d00eb7a680faead8f1d8d1295f983086a33a4c75e4affa2ea5
-DIST gcc-13-20240628.tar.xz 84470032 BLAKE2B fa8edc817636e9c54bf88f35f22f15e07a2fe951867ac042aa73b1176ee1dab6c3ac5ab050db42dd53fc494193a2aa604b2aa492b8b96f0f957fd636f9a39322 SHA512 fdd6c67aaf45c23d922f4aded5eb8ede91f7d427112db2780d47de7b10dabf15a9e05d17296d286eed567d045ffe4816765254191f5610f08312f85e1ddce68d
-DIST gcc-13-20240705.tar.xz 84476408 BLAKE2B be3d0222e6f555278ae8ae5893a5d4018a19cf5ac6687b2e78e199d73bb7acb55ec277917d0a76eef84c11b489329db913398c4f061810eb4cac8667502a5726 SHA512 9b8310c65edbb35f8e94755aeb5d7be76bc72ce129d1c585cff785283ca3e3a8c787e290fbd07a6cc709eb1639ace3328868316a08cab1259a1f970e050d0f8c
 DIST gcc-13-20240712.tar.xz 84486436 BLAKE2B 4e82fadcec0258471e8a1a055136a67565230d6bfef719ef07a01286bdbb7963878b05622a68627a8f5885c2ee994d879155002f07ad2e53872f082b3dfb5e18 SHA512 1544e71e28a9d93d485a5b74e5910211da68d39af4389f9216f246090d2edb23805648f3528659b02d9db0bc7ee625b8f6a34c3775f41e7aa8a3760b2988b273
+DIST gcc-13-20240719.tar.xz 84474136 BLAKE2B 729596dec948360c2724fa46bcd18756c03606b093c4cd9f3841d6264a17d03b70db7722af805a564fa50144f71d1d88242de52cb257adf327cb2a4f97ea90d0 SHA512 eb63678540bded7798d475a5c8c7d10fd13571bade2e96c6c04e464b80c58d15e78a391e79e7643075e0ed43b7cc2ba2529fd82aa071cd55a57bbc259425d567
+DIST gcc-13-20240726.tar.xz 84475052 BLAKE2B d4a9d0d8957f9e728769af4a2c151eed833542ce12ed154a556093d01021428876f76e653709dc4fe96a89b686dd9b9506d6296b9481484d245e8cbdaf82b5f0 SHA512 89d2333c353e72fb0f87d2c9f43cc7b9e22b87d452e82747a9870cd5feabca43f2b223d5e1a9416e040595a733484ff75244bb449f36d7ae62fe69531ae4113d
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-14.tar.xz 46928 BLAKE2B fce23bc5315f35b04a4976550c4b44578944a1b17e40c7553351eeb8a1ef0f3a2538da5a5e1ae6f37b784ff11bbd8a44b8f6eec542be63e34d984dee69e1cd81 SHA512 d7d52bb2915fd89c06b0134bede8db939cadbb1f2dcddf923bee2c3f9f577ff9e5e986b60420d892539edf82867a0d1bd635807814bc618b06a2b37cdaca893a
-DIST gcc-13.2.0-patches-15.tar.xz 47052 BLAKE2B f145341813d6baf9cbcc3e8421c7f427148503d2aeddd6a2eaac1ad3d470a818292392861542a7915d8b0f2f9b3255603f394b2e6833141658fc035bcd2b5366 SHA512 c89a3fccd944f03d25e076a967c3b220803ee9a6fbedec1daf2c20f629dd6162ce6be4f259522bd193169f0e8307daa9895b5d8581cf975ee086e5abfd675e34
 DIST gcc-13.2.0-patches-16.tar.xz 44792 BLAKE2B 0b6b584d68e69685638695596b780249ca0119ad362747a82d886fd10f77ceb05d02e033e906a090c67f44b1977f40df6a95206d81a32dd15e2f5413c6c92496 SHA512 324d9e63d16c35d55edde20de049162c01b0d487b4548d06c49f0da04a761ec255bc5e020cc2e7f60d12f5d129768afdcf7c86a59126f71f388ab375c34be6de
 DIST gcc-13.2.0-patches-17.tar.xz 45036 BLAKE2B 85fe5e6b0da7a4477f0026aaf397d93421503780ef3c91e0a5e3c6897ab73884d4fbc9d2f5f41ce3f3f172fa7eb98e45c348ce41d852457c472360eb2e48691c SHA512 ebe77a32af38df15bc4034e88fb6e90c84b3c0a172d854cabef789cc29bedba14ec0c27fbeae0959027587e02bc882a944ef68a1bb471432d021d11b4b037562
+DIST gcc-13.2.0-patches-18.tar.xz 44820 BLAKE2B 077ca09a3687e23e4ab633cf4a7e57df6293935d89a9b4d3f6234018d5da8d37896463b3bee136addadc86e1b5923157cfbbeed1801837fc92770d6622bbb0ec SHA512 c73512dcf313016b1dda3deb8222734f5e9c4888970801ea6398195b8f3916eaa20d32001a73fb9b8942d7a2e38616428ca4efd54f92ded9f3219679fbff026e
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
-DIST gcc-13.3.0.tar.xz 87909952 BLAKE2B 0f3728b026bd8aab0e469dda54facf157a4b753d3405a74b0be6105a6e3a493d26df4007d90ae4e05d86277d41873312638f9589d1757cee80ca84de7f2099e3 SHA512 ed5f2f4c6ed2c796fcf2c93707159e9dbd3ddb1ba063d549804dd68cdabbb6d550985ae1c8465ae9a336cfe29274a6eb0f42e21924360574ebd8e5d5c7c9a801
-DIST gcc-14-20240518.tar.xz 87946040 BLAKE2B 83e567d680b1463cc672fb461aa180cf46555911f0e91a3fb89b11fe8b81d12d64b3a3419953849cf2deb38f1cdf0defc05169c145964f74c1105d942b5519f9 SHA512 73dae806add90e8b3cdfe1c56754ae886f6f6150ef4ef217664b48507ff19d20933648bb6a19ab62756146e83e4df037ced30e4504d562966c40b3750475f28f
-DIST gcc-14-20240615.tar.xz 87972240 BLAKE2B 19b8ed044595393c507ed8b9c6a4a4fde0cf6bc1647f16bdd73e9190303a7bd8441602d73ffeeb75e5232113010a30b8ea848691befd21de5a591c9d56a398b7 SHA512 d8d757cfbedb7342443ce8de4439653537c46d25e552d88cea0ba9f7aa43ad14fb2b42a32a1dce5ae4eb2ac3849024f6b4e700f2c39330a00a65caa3f5fe29e7
 DIST gcc-14-20240622.tar.xz 87978376 BLAKE2B 8fb56057e6a84f941822c58aaee8c7c562a665295db6a1c708eda9457ac38723ab7e8ccdab9768bed888468f01f9a2b42527f9ab5475bd1a55f9e9ef694c8ee0 SHA512 9dd7747488b69378c96e6296332152035358a3091d904bd99f1aca6371a8f4d7ed50d4eca85e99d539849526165f2a4250a3dcf77be29a796a6e030167e7dde8
-DIST gcc-14-20240629.tar.xz 87970788 BLAKE2B 3fd03c67ebcc14ec85df7c1d9c34669ceecb957270179862f12ef2e5aac00e1331d9a33c679d27a400895d4790cc94e151d7de85485f4f48ca61d2573eb86a15 SHA512 da7ae7c8844f56492dcb41b7ab3da071bcd65561561d0d4197cfc3c11090a7b84bd3e3af7d8c5a44da034a37f9b82056b5c8c0bcc7a52bfd39a8399f0d0a70fa
-DIST gcc-14-20240706.tar.xz 87988236 BLAKE2B 032a5174d39e72b59d8fb141f837cade44b1b026fcd8206bf5ca5b3d5fade021de65597a1ddd3fc571265477795cd69660e3ffc68fa01d08be5ef49b2b066400 SHA512 c134535c1514d749bba3a33bf90790c55d1c222cee7661fbed798795523189e877e323d57428fa16b72498643de42ada56976710d4970ba1039dfe92a9fdbd2a
 DIST gcc-14-20240713.tar.xz 88005804 BLAKE2B eca74526c29a1080e6801a7db720752fc48c6dbbc5f904b7be7f74070b34a727ddae38ebfb7cb419d3a1717e93e3b9c425f251668473427548ba4eb31cca72b2 SHA512 6ea6b4a20e69a309cdd112001622cfe582d94986636f2084dbddc77cdb2b7e19ace45da0beb09b52d06ba2e0e09369b4db5a24aae6fd2deaeb6bdceb4d467198
+DIST gcc-14-20240720.tar.xz 88005248 BLAKE2B 9d0d3b8806e81660e66982fbda4efc3ea0611cede296f421c7a2769ba4c555ab08730320046f7b84f0d094ceb214c8c22610bd7389c7d93a226c47ea29f32ddf SHA512 b436057f3e17f86c0562000780271e1b848dfcf2b540d7ec0a12b235ea3327c1a577fc22c279808e55ad1a57fa1e6361f73374f71c451973123b87efd991bfe4
+DIST gcc-14-20240727.tar.xz 88051096 BLAKE2B bb447e728275539688ba19d1f50c4f4936ffc162a3670718f9b0ce0bc906c6d32cc950dc6277cc559459838dec0f98bb09a1274e4aa28733eb2bb0353a6a9d64 SHA512 dafc1ebce15d37a8bcadbf05b09d74114e85223be29ccbe8fb3c37bdad2a9e17a7150cf18110cd201c1a02203da51eba4cfc55ddb3d7ff4131b7dd4f90c9a375
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
-DIST gcc-14.1.0-patches-1.tar.xz 11584 BLAKE2B d483f4e3324acdc26b9837028d5e20ad0cdcf3ef4bcc78a6902d63ceebc7e5ff70c8163f6a8c8e36405df47c59dd2df506147c53ce51a8ec73494e65b5902647 SHA512 3d7aea113b594d1896c93e9e6be85f467488fa75de2800ed76eab2f87cef26829b235d1f361b187e38cf13b0fb9518cd4431c3106ec1e49d0f744e7eb703eaa0
-DIST gcc-14.1.0-patches-2.tar.xz 11400 BLAKE2B 8698d9521b193a03df20b68b70bc8d2dc083e246542d95e510b86f152a4d13818162985d4728d87f74be784870595a238d195f617427ec0905919cce0ed23476 SHA512 17e97aec43dea0c131fc6c829d05b7ab56d3164a7d79715f08f54cc2cff81747d1554ca2644edcc1cbd7db3d87dba6a1c2fb71896950bd9b54c4c5c10daa3e7f
 DIST gcc-14.1.0-patches-3.tar.xz 11868 BLAKE2B 06d079766bfbaddd066cd70f2d3f5e9ef17f3617fe90de4cb0a9562e6c3b2dc46d94dce03649f2e530c21e3fa0e0e6e5aae3c7b768bd08717c4f29ff29b00a04 SHA512 636a2853b5bf057fef262d54bcb250f3ebf63c600bc184cfea499783d254c462f6c0ecf5f0c5dac6634110ba0d11193fbfb96850ac27fc5a318f1d810f2231cc
-DIST gcc-15-20240609.tar.xz 88288628 BLAKE2B 25ee6b2071fd189d5099160a1b9594cd0cdf6075a733258a61c3586f043d65a3e8ec22f1c2084c50694008d647ffa43895ed58dc655c41f296b98d136951c57a SHA512 058fae65f7cd398cff43282b9697497dead93401a7da47e63561bf029284b4b890f57f2ec74ef7e3ce7d170a2e69dfd5090b6465029360ab872222db037a9127
-DIST gcc-15-20240616.tar.xz 88348980 BLAKE2B 3b2cc25b55167e371687b7325de14f088cda4cef72566ffcb243cfd7584234e60fe0fa69a3b70eccd02e30dff3980ab76507fdc9003195ba806ced2aef4feade SHA512 f5ce6785f3dc17493945e48787274ce338b32e7bce95f94b17bc28ce680eb092067d065843202e1449179da09ec3b23246d7a3aa6fc61cce3cce96e1e7ba576f
-DIST gcc-15-20240623.tar.xz 88407680 BLAKE2B 4916850739131edff5a144f9c75a95d45819ce236f079096ecf2e81a63dd1760a2c761a5db822f4a643f67e85efd10e63490b88fd099c3663fa5bc05417a0b8c SHA512 e0cd49b0852841c290d8a190d75740047aa87ba2c614adc575433d3d1f2e975f5795d78af8b9c125dd600eab233abbc1e2ec4ef71abd017fa3b1c4b2a72bc601
-DIST gcc-15-20240630.tar.xz 88427396 BLAKE2B 641f8c3622749d80cc9cbe7e2365b3366422cb1561e2fc88a890b933649b76a0326bc8d211e0629c39b12e7c9bf5e005d83f0d674cfefd4e32f8414ffaa04920 SHA512 d7e50f13e4e8045d3ea9169cabb5a15eb1b2b5a99d0a418dbb1231f615b7c4cd55ad2c65945a808b2743f508cad8b2100c40fb750de5ccaefb251328adfb7856
-DIST gcc-15-20240707.tar.xz 88446948 BLAKE2B ef0e1b91a971e71a8128b9c1732aabfa1004a44dd7764f527d8b00e4b71e66fdac5d0ae09aa3b69fc561b8b66b06e7dcf2b8ac49385e49b3de317da046132ece SHA512 44a8cf370c8fa187724ff52f3441110a53712a42eab855c592afea5ca35d31880561535eba5d78e6e50fe311c95886ce622c7d2c7965bbd6c42d05c79178fa99
+DIST gcc-14.1.0-patches-4.tar.xz 11620 BLAKE2B c819fbdea1f3bf10c8d4214d4c33cf28c1410171d2833b6f8c1225eeefe749ddb815067b3fdb750e5839761aee8d39ffc51ffb492f88e630076818a61b18362b SHA512 0d6e1b04591607dfc8022124b186ce499467c32db7667ee1a640fe2e07706597edc0e4ad5c7ebcb75c8f5fc6e45e9b9ef715402c71ff9ab21fe380007fe5d84f
+DIST gcc-14.2.0-RC-20240723.tar.xz 92320472 BLAKE2B 1003e19e65b9b3093193b5eb9997236ce445cca65c701111268b5c14b8cdde5b22f74556eb30698ae8646114558539874934ff0794d73f4083425c2867989dd9 SHA512 b3ead9ea661f07606225cc0053054f9f8a1267b0b476a86168a3524ea36c623b87c4ebefdbb95a01172b267cdf387cf909f8a9fa7dfaa1e754ca3dba1267c859
 DIST gcc-15-20240714.tar.xz 88493908 BLAKE2B d11436fcbdf3c106e3de706514d4a48a33255ab1ac03d1ae25531415dc418007f391d92a502e12ab6ed31f573431cafdbbc97d153d7481b7455e380582f4518b SHA512 e2b9f3765002b670a1cc3be88e0e99ce710fe9cc1fa06d43026bbb2e2795c9955b0283a1a18d32311e82dc28efe6c67a93c1fd7ad5ffeef18f260c6aa69cab6a
-DIST gcc-15.0.0-musl-patches-1.tar.xz 3596 BLAKE2B 48fddc723ec8282cc2704c795a50fb37a46738a555151e0430180dda61d039fe96b29a6c3e8a543386d69690302bf46dfc89aad572082b7e47c928c0ccefdeb0 SHA512 e43284d02e25b77b911ce90d57520897751e86c631bdd6beb7d2e4429000156801b8c11bd9a737ec11bc966812f13ae44b88c1893645f8e6c6f8dfddc636ec39
+DIST gcc-15-20240721.tar.xz 88534600 BLAKE2B c057709e193fafa22cc753805e48cf092e0e3c29b656265b1f51e1e84d3d1b5bc07e0633b87e952199d3a885ce981bbecf07a9f00355c43aaad71c6f62250f54 SHA512 c689893f16ec88643854b53e3cc6e8ff49d44d7a4840f95b31aa5f82567c70a080651cc9e5cbaa19b7b099ea52687cfbd88fc1771e52f3c3cd1fe84048060955
+DIST gcc-15-20240728.tar.xz 88642832 BLAKE2B 388c921b90ff71c0aa3313479bef9c39e53ba4a4b772ef21975c60451fe9beb7d49cb8ff9c3b14aace2976b528bf70e98c6af71c1cd9f6d6c8c8a4820159a6de SHA512 a8ae49eb8a831e0e3fd01b6933318a7c44002cc3cf8b3b157b39ea9a3db933b5feed183ead02181425540294c08d5e36a7bf1e012011fe1b9289f3cb03e75811
 DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
-DIST gcc-15.0.0-patches-3.tar.xz 15668 BLAKE2B 99c332c7302bba0a790192bfcd81b8a273002884a2a89fc03f61d46ef669d9ba49496806400f86131c127b960862b97296148b6a0956946cc98470397c02579e SHA512 f0effdadff0fc553835c13f0dedb903374f021d172a20f01e6e3e0a39495ead96229665ba1a82f0aa1e9b49c6ff367f5c6e2c3e336a84ca02efb96f1a373f18a
 DIST gcc-15.0.0-patches-4.tar.xz 11440 BLAKE2B 8b7379f91ac14dd1e496de744d221cb0ba1802c14ce32cb90e6311ca7a60cbaf488a57060673e2e9d407eed6d3c5b092c1ba6da27036d35e0c78a7ac8a5f5ec4 SHA512 92e8895ec1c6054b46581867f3e49bd2d574043ae82ca441e2b48d9ed0e2dd5c58baa53ba605ce59a5c1d59473ac0d79c0287e5b47d06f0a661c655a19a4a5df
 DIST gcc-15.0.0-patches-5.tar.xz 11840 BLAKE2B 9af335f7e1795e600eae742ac32f5ff737f157aaa35902227ba29b28013c95bcf5b2b1345a21c433bc10f4cfbfc267a595b6ca90ec2723f7f24fccac3f7c0355 SHA512 8cc8ec574640470780711bb5f6163f382c23999152c229d86e1143e03275a3147bd1fc0cd9bf3642a2402333ec565d30b90a6e367284b78ccc580c6721aeac23
+DIST gcc-15.0.0-patches-6.tar.xz 11588 BLAKE2B 7846d77859b297a892a23b995c9aa06410c484a8f6e11fa9c9692de0f1b0a03aa1f35c4b88f164623a600bf2012fff25567075203c57fdbcb26bbc95f94d1cf9 SHA512 837ed8b5f6901715862951726e85eea043aec192f854db23201326fd6bedb7552c95527d253736c0164153b75ec487b4644fd269f9f6815b4489416602ebfe78
+DIST gcc-15.0.0-patches-7.tar.xz 12928 BLAKE2B 4f46a2c2fbdd714bebfce85bad8e80fa7d3939f83ddbc279f20f448bfe17c33c6fe94a21a82a5c9efae619ceaf50dc5ac339850373e05c6556cc65c72cef812c SHA512 c3e756cefd205c818856cb4c17d15194267c566d4758f2f4a2bf3ccb1cf00151286c10a7b2c36bede7a5f27d5a482f9489545078bcf45d55d28e3e67a694f6d6
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240111.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240111.ebuild
deleted file mode 100644
index 957334ac71..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240111.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild
index 119967765e..957334ac71 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240501.ebuild
@@ -38,7 +38,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240612.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240612.ebuild
deleted file mode 100644
index 5c623032d3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240612.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240619.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240619.ebuild
deleted file mode 100644
index 5c623032d3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240619.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240626.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240626.ebuild
deleted file mode 100644
index 5c623032d3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240626.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240703.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240703.ebuild
deleted file mode 100644
index 5c623032d3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240703.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240712.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240712.ebuild
deleted file mode 100644
index dfb802cd1b..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240712.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-TOOLCHAIN_GCC_RC=1
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="12"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 9c787a4143..119967765e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -5,6 +5,8 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="11.4.0"
+PATCH_VER="12"
+MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
 PYTHON_COMPAT=( python3_{10..12} )
 
@@ -37,6 +39,7 @@ if tc_is_live ; then
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
 fi
 
 if [[ ${CATEGORY} != cross-* ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240502.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240502.ebuild
deleted file mode 100644
index f6a06143f4..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240502.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
index f6a06143f4..8f82e921af 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
@@ -38,7 +38,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240627.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240627.ebuild
deleted file mode 100644
index e645c4d53b..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240627.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240704.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240704.ebuild
deleted file mode 100644
index e645c4d53b..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240704.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="3"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240613.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240725.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240613.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20240725.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240503.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240503.ebuild
deleted file mode 100644
index a63d0eba20..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240503.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="15"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.0.ebuild
deleted file mode 100644
index 955cdd4948..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.0.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-MUSL_GCC_VER="13.2.0"
-PATCH_VER="16"
-MUSL_VER="2"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
index b45c4b97a0..0a401deb8a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240614.ebuild
@@ -38,7 +38,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240628.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240719.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240628.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240719.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240705.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240726.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240705.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240726.ebuild
index cda893d3b3..bb142a8fd1 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240705.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20240726.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="13.2.0"
 MUSL_GCC_VER="13.2.0"
-PATCH_VER="17"
+PATCH_VER="18"
 MUSL_VER="2"
 PYTHON_COMPAT=( python3_{10..12} )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240615.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240615.ebuild
deleted file mode 100644
index e2c5108f29..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240615.ebuild
+++ /dev/null
@@ -1,55 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.1.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.1.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	# m68k doesnt build (ICE, bug 932733)
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240518.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240720.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240518.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240720.ebuild
index 241cf66254..6e09c541c2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240518.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240720.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="14.1.0"
-PATCH_VER="1"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
@@ -25,8 +25,6 @@ if tc_is_live ; then
 	# Needs to be after inherit (for now?), bug #830908
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	# m68k doesnt build (ICE, bug 932733)
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240629.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240723.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240629.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240723.ebuild
index 30e9b4a563..5dbd6fa364 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240629.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240723.ebuild
@@ -4,8 +4,9 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="14.1.0"
-PATCH_VER="3"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
@@ -25,8 +26,6 @@ if tc_is_live ; then
 	# Needs to be after inherit (for now?), bug #830908
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	# m68k doesnt build (ICE, bug 932733)
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240706.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240727.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240706.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240727.ebuild
index 30e9b4a563..a4285b216d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240706.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.1.1_p20240727.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="14.1.0"
-PATCH_VER="3"
+PATCH_VER="4"
 MUSL_VER="1"
 MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..12} )
@@ -25,8 +25,6 @@ if tc_is_live ; then
 	# Needs to be after inherit (for now?), bug #830908
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	# m68k doesnt build (ICE, bug 932733)
 	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240609-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240609-r1.ebuild
deleted file mode 100644
index 98e4309557..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240609-r1.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="3"
-MUSL_VER="1"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240616.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240616.ebuild
deleted file mode 100644
index 0e7089de68..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240616.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="4"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240623-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240623-r1.ebuild
deleted file mode 100644
index 516e5e3abf..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240623-r1.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="4"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
-PYTHON_COMPAT=( python3_{10..12} )
-
-if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${P}-PR115602.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240707.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240721.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240707.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240721.ebuild
index 0e7089de68..2ef3a44f1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240707.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240721.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="4"
+PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240630.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240728.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240630.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240728.ebuild
index 0e7089de68..5efcce931c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240630.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.0_pre20240728.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="4"
+PATCH_VER="7"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..12} )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
index 0f0de646e3..2341e5d0c0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.5.ebuild
@@ -7,6 +7,7 @@ EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gettext.asc
 inherit java-pkg-opt-2 libtool multilib-minimal verify-sig toolchain-funcs
+inherit flag-o-matic
 
 DESCRIPTION="GNU locale utilities"
 HOMEPAGE="https://www.gnu.org/software/gettext/"
@@ -156,6 +157,9 @@ multilib_src_configure() {
 		ECONF_SOURCE+=/gettext-runtime
 	fi
 
+	# should be gone on next release, for memset_s breakage
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -D__STDC_WANT_LIB_EXT1__=1
+
 	econf "${myconf[@]}"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240101.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240101.ebuild
index 04e57c23b5..adda5729bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20240101.ebuild
@@ -9,7 +9,7 @@ if [[ ${PV} == 99999999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	S="${WORKDIR}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode-systemd.install b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode-systemd.install
index 7ad7b8c49e..58593a675b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode-systemd.install
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode-systemd.install
@@ -35,13 +35,18 @@ opts=(
 	--no-downgrade
 )
 
-if [[ ${KERNEL_INSTALL_VERBOSE} == 1 ]]; then
-	echo "Generating Intel CPU Microcode early initramfs image..."
-	opts+=(
-		--list-all
-		--list
-	)
-fi
+if [[ -d /lib/firmware/intel-ucode ]]; then
+	if [[ ${KERNEL_INSTALL_VERBOSE} == 1 ]]; then
+		echo "Generating Intel CPU Microcode early initramfs image..."
+		opts+=(
+			--list-all
+			--list
+		)
+	fi
 
-iucode_tool /lib/firmware/intel-ucode "${opts[@]}" ||
-	{ echo "iucode_tool failed" && exit 1; }
+	iucode_tool /lib/firmware/intel-ucode "${opts[@]}" ||
+		{ echo "iucode_tool failed" && exit 1; }
+else
+	[[ ${KERNEL_INSTALL_VERBOSE} == 1 ]] && echo \
+		"No Intel CPU Microcode installed, nothing to do here."
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode.install b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode.install
index d4e9ef19d5..513b3a84d0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode.install
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/files/35-intel-microcode.install
@@ -41,9 +41,13 @@ main() {
 		--list
 	)
 
-	einfo "Generating Intel CPU Microcode early initramfs image..."
-	iucode_tool /lib/firmware/intel-ucode "${opts[@]}" ||
-		die "iucode_tool failed"
+	if [[ -d /lib/firmware/intel-ucode ]]; then
+		einfo "Generating Intel CPU Microcode early initramfs image..."
+		iucode_tool /lib/firmware/intel-ucode "${opts[@]}" ||
+			die "iucode_tool failed"
+	else
+		einfo "No Intel CPU Microcode installed, nothing to do here."
+	fi
 }
 
 main
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r2.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r2.ebuild
index 55f66f3080..947e22ff9b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20240531_p20240526-r2.ebuild
@@ -45,16 +45,24 @@ LICENSE="intel-ucode"
 SLOT="0"
 KEYWORDS="-* ~amd64 ~x86"
 IUSE="dist-kernel hostonly +initramfs +split-ucode vanilla"
-REQUIRED_USE="!dist-kernel? ( || ( initramfs split-ucode ) )"
+REQUIRED_USE="
+	|| ( initramfs split-ucode )
+	dist-kernel? ( split-ucode )
+"
 RESTRICT="binchecks strip"
 
 BDEPEND=">=sys-apps/iucode_tool-2.3"
 # !<sys-apps/microcode-ctl-1.17-r2 due to bug #268586
 RDEPEND="
-	dist-kernel? ( virtual/dist-kernel )
-	hostonly? ( sys-apps/iucode_tool )
+	dist-kernel? (
+		virtual/dist-kernel
+		initramfs? (
+			sys-apps/iucode_tool
+		)
+	)
 "
 IDEPEND="
+	hostonly? ( sys-apps/iucode_tool )
 	dist-kernel? (
 		initramfs? ( sys-kernel/installkernel )
 	)
@@ -84,10 +92,10 @@ MICROCODE_SIGNATURES_DEFAULT=""
 
 pkg_pretend() {
 	if use initramfs; then
-		if [[ -z ${ROOT} ]] && use dist-kernel; then
+		if use dist-kernel; then
 			# Check, but don't die because we can fix the problem and then
 			# emerge --config ... to re-run installation.
-			nonfatal mount-boot_check_status
+			[[ -z ${ROOT} ]] && nonfatal mount-boot_check_status
 		else
 			mount-boot_pkg_pretend
 		fi
@@ -302,8 +310,8 @@ pkg_postrm() {
 
 pkg_postinst() {
 	if use initramfs; then
-		if [[ -z ${ROOT} ]] && use dist-kernel; then
-			dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
+		if use dist-kernel; then
+			[[ -z ${ROOT} ]] && dist-kernel_reinstall_initramfs "${KV_DIR}" "${KV_FULL}"
 		else
 			# Don't forget to umount /boot if it was previously mounted by us.
 			mount-boot_pkg_postinst
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
new file mode 100644
index 0000000000..8b3b53c764
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/Manifest
@@ -0,0 +1,12 @@
+DIST btrfs-progs-v6.6.3.tar.sign 566 BLAKE2B 9f8a14405f78c8eb5a92d59f9ca776cd15bfd43bc323a0f5a98cc2d9a6f782e999a792ddb266fef4dfe189e1cb8eebbd021a12b615e22bdd4097a74bf3b277a9 SHA512 07f062cf66c0e5f0bd833f0a1c9901ec06ac4eb258acec8e96ffbb0b85007a67bdc992492b25f6039fcf603352131fca8c57162fa61007e8ccf1f4edf71dab97
+DIST btrfs-progs-v6.6.3.tar.xz 2557216 BLAKE2B 274fad52bcab45bd0f6496c1bc10e1736e7b766f53b712790996a8a38f74eedcc570783599bed62cd4f84e5629f2216340a66941d9fbe0c7890f1c56ed66df8a SHA512 93e1defacf0f280fc02e10a20fd2bc3775c52956a0339e30b829cc3bef85629d565cf3f6a9af126e38bbb73e8e9b9a0069abbe0e57957a56ca1a8826f5de624a
+DIST btrfs-progs-v6.7.1.tar.sign 566 BLAKE2B e5aba64e199f26cef84a8cbbb034c0a5c24572e43fef2fdce79f0dbd892b1609876f681bf79de53e6473345f3de8b8fee6aac2d33673e0b080ab33fb935bd32d SHA512 8fad1c2c47356a04434e12621c526603bf651bdcb0a08deb4022d83953d8c501b8aaa2da05cbf94e0bde43b48a4135fff78a5746423466036ff4899dd79b9589
+DIST btrfs-progs-v6.7.1.tar.xz 2565576 BLAKE2B 4e05e9dd80e5531425490970318389aef280f61cc636a80aa2bbc630399afd4f1f3ce649d194822ff93ff4b1774d65a504e3bed6f1426ff60830e4c0d0ac87b0 SHA512 8a2e735f036a0778a2482d42c813012269903174232bc2924af41b72bbcfb49783d5f3b7d0af085285a68754748bd76b6534a498a47cdcea94020f4262281ffc
+DIST btrfs-progs-v6.8.1.tar.sign 566 BLAKE2B 843eada2b00a2370522edc95d79bcfed88bd24233e647946d4807322550593e4d5f5bb5efa6652c754dd0965dc3e389bc97698a0bd8fc5d0e850bea94de98e72 SHA512 84ebaa6ec27aa5bc87a323f5c6cc82a860fada7311ab8319127de3592294c1076d25959e412f8387d54bad3b8ff838ce39c4db4b04a658b2de2eaa7c976e2b09
+DIST btrfs-progs-v6.8.1.tar.xz 2652968 BLAKE2B 34406dedc6d97bd94a498c3bbb424d34a59b8251b37f9a40a87740f96db77780a4cd76c88055b4d9e4f673b4a3621503a6bedb67ceaf20870fb26c10f49b74e0 SHA512 b5f0694e56eecf1956313b3406610c2e22658ace51a636d79efe996780bb0b03fed95e68a8c9a11dd8649958c0e7dbc7417bb479859365d47b52e478f6830d46
+DIST btrfs-progs-v6.9.1.tar.sign 566 BLAKE2B 4735411485669e37558adda62e168f22a09c11d085dd4adc5db4cfe932745c746b373763cb70b31219908886de52544854a3e9dee0b61bbf32d5d7bf4325d2c9 SHA512 c484845ad47b1ebee666f76e5f0421f640391e205158c14e83ef960506df6b0b6d34244bdcd254e2ac47b3d758e515ffec523a773b7f6081d8b47b856bbbe09b
+DIST btrfs-progs-v6.9.1.tar.xz 2662768 BLAKE2B ed26da2c3c07082df7f1a3d2dc43981ac5375e23de44d0068d91075c8f75e03e75eef4ec5175a0c72d57511b4b9474ff3383f07f14db22e97b2b175578f1cd40 SHA512 5a6b6bbcf2d2624ba12f877485c8137d1601ed9b17bd7f05993cccbc46ff0546f8a0aaf4e221e6cb3aaaa0cec53222edc723f787b317aa551b7f4469456d9a3a
+DIST btrfs-progs-v6.9.2.tar.sign 566 BLAKE2B 4cd95496d355444c7d3e582a7e6c05fbb55683008b1585a26f38aef6cceb1afd5e80c9611518d6bd92dc1167798d4012c4bcab2f9bda752c459d94cfa6f3c477 SHA512 3fb04e1894e231abde388a39d2f0c90f43c1a1494622c2158fab9b94bb340e064404bcf96e24d913c60aaf5e06ade42fbb91a479949109b329682bb089f66bf2
+DIST btrfs-progs-v6.9.2.tar.xz 2661684 BLAKE2B 38ab189ac8271ba8d68b74e82569159c671cca1cb946f56ccab28b6b206cb6ee5b330d83afc3536b7e0d7399da3fb01e368809c1ef4a64b843ea88796ebd28bd SHA512 1df9d5456d07a035c38c17795996a4fc621eeaa244ef54383d4387205826d2a6e971910e55031d20bb1baf23193efa7439e110312ffd8471f07aaf8c0baca20a
+DIST btrfs-progs-v6.9.tar.sign 566 BLAKE2B a2e26047775bcc407b8f5aa8b08b0708a01c84a8cd649e50a935e15d04e2ee917010fc98df0dfb80320ee25a8dbfbbbabbb1f155489f32391544100956ba9636 SHA512 1e8304b3df013a841e82a8656361946914d35f680b5bc547c1599fdd98a75b66e2b1f869c8b043d7532182318c2183e699a9d6101ab4b1544618d2c8a25362e1
+DIST btrfs-progs-v6.9.tar.xz 2663052 BLAKE2B 9fad691327b6290b3ba0e1a638576b65e4e4d6c8f32549ea0f10188fdb40028315abf5e330976ff7a5efb6a258d0008e7602ae81ba0339888f474dc056791798 SHA512 e97907b377040371f4742a45345ec720e0cb8e0cf9ee5fdc60618ce2bc76f572725ec32e1a178fd57534f73affd3eeb5e6cfebf23734f04583bbbef858d913b2
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.6.3.ebuild
similarity index 57%
rename from sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.6.3.ebuild
index 9ce447f745..d2a13b5804 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/btrfs-progs-6.0.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.6.3.ebuild
@@ -1,39 +1,42 @@
-# Copyright 2008-2023 Gentoo Authors
+# Copyright 2008-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
-
+PYTHON_COMPAT=( python3_{10..12} )
 inherit bash-completion-r1 python-single-r1 udev
 
-libbtrfs_soname=0
-
-if [[ ${PV} != 9999 ]]; then
-	MY_PV="v${PV/_/-}"
-	SRC_URI="https://www.kernel.org/pub/linux/kernel/people/kdave/${PN}/${PN}-${MY_PV}.tar.xz"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
-	fi
-
-	S="${WORKDIR}"/${PN}-${MY_PV}
-else
+if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
 	EGIT_BRANCH="devel"
 	WANT_LIBTOOL="none"
 	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
 fi
 
 DESCRIPTION="Btrfs filesystem utilities"
-HOMEPAGE="https://btrfs.wiki.kernel.org https://btrfs.readthedocs.io/en/latest/"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
 
 LICENSE="GPL-2"
-SLOT="0/${libbtrfs_soname}"
+SLOT="0/0" # libbtrfs soname
 IUSE="+convert python +man reiserfs static static-libs udev +zstd"
 # Could support it with just !systemd => eudev, see mdadm, but let's
 # see if someone asks for it first.
-REQUIRED_USE="static? ( !udev )"
+REQUIRED_USE="static? ( !udev ) python? ( ${PYTHON_REQUIRED_USE} )"
 
 # Tries to mount repaired filesystems
 RESTRICT="test"
@@ -52,7 +55,8 @@ RDEPEND="
 	udev? ( virtual/libudev:= )
 	zstd? ( app-arch/zstd:= )
 "
-DEPEND="${RDEPEND}
+DEPEND="
+	${RDEPEND}
 	>=sys-kernel/linux-headers-5.10
 	convert? ( sys-apps/acl )
 	python? (
@@ -73,19 +77,48 @@ DEPEND="${RDEPEND}
 		zstd? ( app-arch/zstd[static-libs(+)] )
 	)
 "
-BDEPEND="virtual/pkgconfig
-	man? ( dev-python/sphinx )"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		dev-python/sphinx
+		dev-python/sphinx-rtd-theme
+	)
+"
 
 if [[ ${PV} == 9999 ]]; then
 	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
 fi
 
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
 pkg_setup() {
 	use python && python-single-r1_pkg_setup
 }
 
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	if in_iuse verify-sig && use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
+		xz -d ${MY_P}.tar.xz || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
 src_prepare() {
 	default
 
@@ -100,8 +133,6 @@ src_prepare() {
 		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
 		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
 	fi
-	# Flatcar: Replace udevdir variable with proper udev directory.
-	sed -i -e 's#^\(udevdir\s\+=\).*#\1 $(get_udevdir)#' Makefile.inc.in
 }
 
 src_configure() {
@@ -118,22 +149,37 @@ src_configure() {
 		$(use_enable udev libudev)
 		$(use_enable zstd)
 
-		# Could support libgcrypt, libsodium, libkcapi
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
 		--with-crypto=builtin
-		--with-convert=ext2$(usex reiserfs ',reiserfs' '')
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
 	)
 
-	econf "${myeconfargs[@]}"
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	# bash as a tepmorary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
 }
 
 src_compile() {
 	emake V=1 all $(usev static)
 }
 
+src_test() {
+	emake V=1 -j1 -C tests test
+
+	if use python ; then
+		cd libbtrfsutil/python || die
+
+		local -x LD_LIBRARY_PATH="${S}:libbtrfsutil/python:${LD_LIBRARY_PATH}"
+		${EPYTHON} -m unittest tests/test_*.py || die "Tests failed with ${EPYTHON}"
+	fi
+}
+
 src_install() {
 	local makeargs=(
-		$(usex python install_python '')
-		$(usex static install-static '')
+		$(usev python install_python)
+		$(usev static install-static)
 	)
 
 	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.7.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.7.1.ebuild
new file mode 100644
index 0000000000..d2a13b5804
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.7.1.ebuild
@@ -0,0 +1,198 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit bash-completion-r1 python-single-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert python +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev ) python? ( ${PYTHON_REQUIRED_USE} )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	python? ( ${PYTHON_DEPS} )
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	python? (
+		$(python_gen_cond_dep '
+			dev-python/setuptools[${PYTHON_USEDEP}]
+		')
+	)
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		dev-python/sphinx
+		dev-python/sphinx-rtd-theme
+	)
+"
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	if in_iuse verify-sig && use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
+		xz -d ${MY_P}.tar.xz || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		AT_M4DIR="m4" eautoreconf
+
+		mkdir config || die
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable python)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	# bash as a tepmorary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+
+	if use python ; then
+		cd libbtrfsutil/python || die
+
+		local -x LD_LIBRARY_PATH="${S}:libbtrfsutil/python:${LD_LIBRARY_PATH}"
+		${EPYTHON} -m unittest tests/test_*.py || die "Tests failed with ${EPYTHON}"
+	fi
+}
+
+src_install() {
+	local makeargs=(
+		$(usev python install_python)
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1-r1.ebuild
new file mode 100644
index 0000000000..d73ee523de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1-r1.ebuild
@@ -0,0 +1,191 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	if in_iuse verify-sig && use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
+		xz -d ${MY_P}.tar.xz || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1.ebuild
new file mode 100644
index 0000000000..d91dc0aada
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.8.1.ebuild
@@ -0,0 +1,198 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit bash-completion-r1 python-single-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert python +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev ) python? ( ${PYTHON_REQUIRED_USE} )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	python? ( ${PYTHON_DEPS} )
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	python? (
+		$(python_gen_cond_dep '
+			dev-python/setuptools[${PYTHON_USEDEP}]
+		')
+	)
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		dev-python/sphinx
+		dev-python/sphinx-rtd-theme
+	)
+"
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	fi
+
+	if in_iuse verify-sig && use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		cp "${DISTDIR}"/${MY_P}.tar.xz . || die
+		xz -d ${MY_P}.tar.xz || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		AT_M4DIR="m4" eautoreconf
+
+		mkdir config || die
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable python)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+
+	if use python ; then
+		cd libbtrfsutil/python || die
+
+		local -x LD_LIBRARY_PATH="${S}:libbtrfsutil/python:${LD_LIBRARY_PATH}"
+		${EPYTHON} -m unittest tests/test_*.py || die "Tests failed with ${EPYTHON}"
+	fi
+}
+
+src_install() {
+	local makeargs=(
+		$(usev python install_python)
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.1.ebuild
new file mode 100644
index 0000000000..b4d9a3171b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.1.ebuild
@@ -0,0 +1,181 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild
new file mode 100644
index 0000000000..0fe0ac94b9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.2.ebuild
@@ -0,0 +1,183 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with dev-python/btrfsutil
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.ebuild
new file mode 100644
index 0000000000..e9d020c160
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-6.9.ebuild
@@ -0,0 +1,181 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild
new file mode 100644
index 0000000000..de01660887
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/btrfs-progs-9999.ebuild
@@ -0,0 +1,183 @@
+# Copyright 2008-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with dev-python/btrfsutil
+
+PYTHON_COMPAT=( python3_{10..13} )
+inherit bash-completion-r1 python-any-r1 udev
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/kdave/btrfs-progs.git"
+	EGIT_BRANCH="devel"
+	WANT_LIBTOOL="none"
+	inherit autotools git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/dsterba.asc
+	inherit verify-sig
+
+	MY_PV="v${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="
+		https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.xz
+		verify-sig? ( https://mirrors.edge.kernel.org/pub/linux/kernel/people/kdave/${PN}/${MY_P}.tar.sign )
+	"
+	S="${WORKDIR}"/${PN}-${MY_PV}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+DESCRIPTION="Btrfs filesystem utilities"
+HOMEPAGE="https://btrfs.readthedocs.io/en/latest/"
+
+LICENSE="GPL-2"
+SLOT="0/0" # libbtrfs soname
+IUSE="+convert +man reiserfs static static-libs udev +zstd"
+# Could support it with just !systemd => eudev, see mdadm, but let's
+# see if someone asks for it first.
+REQUIRED_USE="static? ( !udev )"
+
+# Tries to mount repaired filesystems
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/lzo:2=
+	sys-apps/util-linux:=[static-libs(+)?]
+	sys-libs/zlib:=
+	convert? (
+		sys-fs/e2fsprogs:=
+		reiserfs? (
+			>=sys-fs/reiserfsprogs-3.6.27
+		)
+	)
+	udev? ( virtual/libudev:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	convert? ( sys-apps/acl )
+	static? (
+		dev-libs/lzo:2[static-libs(+)]
+		sys-apps/util-linux:0[static-libs(+)]
+		sys-libs/zlib:0[static-libs(+)]
+		convert? (
+			sys-fs/e2fsprogs[static-libs(+)]
+			reiserfs? (
+				>=sys-fs/reiserfsprogs-3.6.27[static-libs(+)]
+			)
+		)
+		zstd? ( app-arch/zstd[static-libs(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	man? (
+		$(python_gen_any_dep 'dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]')
+	)
+"
+
+python_check_deps() {
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" sys-devel/gnuconfig"
+else
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-dsterba )"
+fi
+
+pkg_setup() {
+	: # Prevent python-any-r1_python_setup
+}
+
+if [[ ${PV} != 9999 ]]; then
+	src_unpack() {
+		# Upstream sign the decompressed .tar
+		if use verify-sig; then
+			einfo "Unpacking ${MY_P}.tar.xz ..."
+			verify-sig_verify_detached - "${DISTDIR}"/${MY_P}.tar.sign \
+				< <(xz -cd "${DISTDIR}"/${MY_P}.tar.xz | tee >(tar -x))
+			assert "Unpack failed"
+		else
+			default
+		fi
+	}
+fi
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		local AT_M4DIR=config
+		eautoreconf
+
+		local automakedir="$(autotools_run_tool --at-output automake --print-libdir)"
+		[[ -e ${automakedir} ]] || die "Could not locate automake directory"
+
+		ln -s "${automakedir}"/install-sh config/install-sh || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.guess config/config.guess || die
+		ln -s "${BROOT}"/usr/share/gnuconfig/config.sub config/config.sub || die
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/sbin
+
+		--enable-lzo
+		--disable-experimental
+		--disable-python
+		$(use_enable convert)
+		$(use_enable man documentation)
+		$(use_enable elibc_glibc backtrace)
+		$(use_enable static-libs static)
+		$(use_enable udev libudev)
+		$(use_enable zstd)
+
+		# Could support libgcrypt, libsodium, libkcapi, openssl, botan
+		--with-crypto=builtin
+		--with-convert=ext2$(usev reiserfs ',reiserfs')
+	)
+
+	export EXTRA_PYTHON_CFLAGS="${CFLAGS}"
+	export EXTRA_PYTHON_LDFLAGS="${LDFLAGS}"
+
+	if use man; then
+		python_setup
+	fi
+
+	# bash as a temporary workaround for https://github.com/kdave/btrfs-progs/pull/721
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1 all $(usev static)
+}
+
+src_test() {
+	emake V=1 -j1 -C tests test
+}
+
+src_install() {
+	local makeargs=(
+		$(usev static install-static)
+	)
+
+	emake V=1 DESTDIR="${D}" install "${makeargs[@]}"
+
+	newbashcomp btrfs-completion btrfs
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/metadata.xml
similarity index 85%
rename from sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/metadata.xml
index 53a0e4c3fe..e0d9388ce7 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-fs/btrfs-progs/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/btrfs-progs/metadata.xml
@@ -10,4 +10,7 @@
     <flag name="reiserfs">Enable reiserfs support in btrfs-convert tool.</flag>
     <flag name="static">Build static binaries in addition to the dynamic ones</flag>
   </use>
+  <upstream>
+    <remote-id type="github">kdave/btrfs-progs</remote-id>
+  </upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.2.ebuild
index 14f76fc36f..143ba8992d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.2.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}"/${P/_/-}
 LICENSE="GPL-2+"
 SLOT="0/12" # libcryptsetup.so version
 if [[ ${PV} != *_rc* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.3.ebuild
index 14f76fc36f..71d96dacde 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/cryptsetup/cryptsetup-2.7.3.ebuild
@@ -25,7 +25,7 @@ RESTRICT="!test? ( test )"
 # bug #496612, bug #832711, bug #843863
 REQUIRED_USE="
 	^^ ( ${CRYPTO_BACKENDS//+/} )
-	static? ( !gcrypt !ssh !udev !fips )
+	static? ( !ssh !udev !fips )
 	fips? ( !kernel !nettle )
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.1.ebuild
index 2ccc0b3b1d..4853a3a74b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="archive cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.44.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.44.ebuild
index 1d70d80df8..ff718fe084 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.44.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.44.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://gnu/${PN}/${P}.tar.lz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86 ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ppc ppc64 ~riscv sparc x86 ~x64-macos ~x64-solaris"
 IUSE="gui"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
index 26e21fcfc5..a635a3c7f3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/Manifest
@@ -1,2 +1 @@
-DIST squashfs-tools-ng-1.3.0.tar.xz 585800 BLAKE2B 658ff825b2cda63116c29d8c582f54df5bd511a6da98e737527d54720ed95a541edc39b94f61195f4c99d125cbcc8db824ea9d1e2a7a7a557fb647f5e795d623 SHA512 10ddff837464227d97c3c2dabeefa408a63fbab4ddc8ca184f4ecce7288ac47c0c6baf6d10146f7e29e4a845592720e39281f779420f5ba0b1e7736c0dea73d7
 DIST squashfs-tools-ng-1.3.1.tar.xz 585916 BLAKE2B 697131ddb9959bed388534f90c93e2e7495ef5aec9facf97e7d17475cff64d7a4badb709a16ae5e6da3ee89b1a1e3a49833bd15b9a0b4b364e15a565bd18e480 SHA512 0a433f7c3633cd5d8646d990744e31ed59c7012d5f8bb4fdb7892b892631f22a8fd0969f7d81de68f53e44670e71cb8e29729cd925a93b98ab3b6942bbc30662
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.0.ebuild
deleted file mode 100644
index a4168be5e3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-fs/squashfs-tools-ng/squashfs-tools-ng-1.3.0.ebuild
+++ /dev/null
@@ -1,57 +0,0 @@
-# Copyright 2019-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="A new set of tools for working with SquashFS images"
-HOMEPAGE="https://github.com/AgentD/squashfs-tools-ng"
-if [[ ${PV} = 9999* ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://github.com/AgentD/${PN}.git"
-else
-	inherit libtool
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	SRC_URI="https://infraroot.at/pub/squashfs/${P}.tar.xz"
-fi
-
-LICENSE="LGPL-3+ BSD-2 MIT tools? ( GPL-3+ )"
-SLOT="0"
-IUSE="lz4 +lzma lzo selinux +tools zstd"
-
-DEPEND="
-	app-arch/bzip2:=
-	sys-libs/zlib:=
-	lz4?     ( app-arch/lz4:= )
-	lzma?    ( app-arch/xz-utils )
-	lzo?     ( dev-libs/lzo:2 )
-	selinux? ( sys-libs/libselinux:= )
-	zstd?    ( app-arch/zstd:= )
-"
-RDEPEND="${DEPEND}"
-
-src_prepare() {
-	default
-	if [[ ${PV} = "9999" ]]; then
-		eautoreconf
-	else
-		elibtoolize
-	fi
-}
-
-src_configure() {
-	local myconf=(
-		--disable-static
-		$(use_with lz4)
-		$(use_with lzo)
-		$(use_with selinux)
-		$(use_with tools)
-		$(use_with lzma xz)
-		$(use_with zstd)
-	)
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	default
-	find "${D}" -name "*.la" -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.8.0.ebuild
index 1ce476e005..d082ee12b4 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.8.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/utils/fs/xfs/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="icu libedit nls selinux static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.5-r1.ebuild
index dc0b5af229..dd4272b053 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.5-r1.ebuild
@@ -30,7 +30,7 @@ IUSE="python ruby static-libs ruby_targets_ruby30 ruby_targets_ruby31 ruby_targe
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 RDEPEND="dev-libs/libpcre2:=[static-libs?,${MULTILIB_USEDEP}]
-	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP},static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	ruby? (
 		ruby_targets_ruby30? ( dev-lang/ruby:3.0 )
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.6-r1.ebuild
index 002a1bf64a..9dcde9eb59 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.6-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.6-r1.ebuild
@@ -30,7 +30,7 @@ IUSE="python ruby static-libs ruby_targets_ruby31 ruby_targets_ruby32 ruby_targe
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 RDEPEND="dev-libs/libpcre2:=[static-libs?,${MULTILIB_USEDEP}]
-	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP},static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	ruby? (
 		ruby_targets_ruby31? ( dev-lang/ruby:3.1 )
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7-r1.ebuild
index 000aae0c00..72e3b36bde 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-3.7-r1.ebuild
@@ -30,7 +30,7 @@ IUSE="python ruby static-libs ruby_targets_ruby31 ruby_targets_ruby32 ruby_targe
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 RDEPEND="dev-libs/libpcre2:=[static-libs?,${MULTILIB_USEDEP}]
-	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP},static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	ruby? (
 		ruby_targets_ruby31? ( dev-lang/ruby:3.1 )
@@ -141,7 +141,7 @@ multilib_src_install() {
 		done
 	fi
 
-	use static-libs || rm "${D}"/usr/lib*/*.a || die
+	use static-libs || rm "${ED}"/usr/$(get_libdir)/*.a || die
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-9999.ebuild
index 000aae0c00..72e3b36bde 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libselinux/libselinux-9999.ebuild
@@ -30,7 +30,7 @@ IUSE="python ruby static-libs ruby_targets_ruby31 ruby_targets_ruby32 ruby_targe
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 RDEPEND="dev-libs/libpcre2:=[static-libs?,${MULTILIB_USEDEP}]
-	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP},static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	ruby? (
 		ruby_targets_ruby31? ( dev-lang/ruby:3.1 )
@@ -141,7 +141,7 @@ multilib_src_install() {
 		done
 	fi
 
-	use static-libs || rm "${D}"/usr/lib*/*.a || die
+	use static-libs || rm "${ED}"/usr/$(get_libdir)/*.a || die
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.7.ebuild
index 4cb9db6305..95aea8cbaf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-3.7.ebuild
@@ -23,6 +23,7 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0/2"
+IUSE="+static-libs"
 
 # tests are not meant to be run outside of the full SELinux userland repo
 RESTRICT="test"
@@ -32,19 +33,23 @@ src_prepare() {
 	multilib_copy_sources
 }
 
+my_make() {
+	emake \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		SHLIBDIR="${EPREFIX}/$(get_libdir)" \
+		"${@}"
+}
+
 multilib_src_compile() {
 	tc-export CC AR RANLIB
 
 	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
 
-	emake \
-		LIBDIR="\$(PREFIX)/$(get_libdir)" \
-		SHLIBDIR="/$(get_libdir)"
+	my_make
 }
 
 multilib_src_install() {
-	emake DESTDIR="${D}" \
-		LIBDIR="\$(PREFIX)/$(get_libdir)" \
-		SHLIBDIR="/$(get_libdir)" \
-		install
+	my_make DESTDIR="${D}" install
+	use static-libs || rm "${ED}"/usr/$(get_libdir)/*.a || die
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-9999.ebuild
index 4cb9db6305..95aea8cbaf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsepol/libsepol-9999.ebuild
@@ -23,6 +23,7 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0/2"
+IUSE="+static-libs"
 
 # tests are not meant to be run outside of the full SELinux userland repo
 RESTRICT="test"
@@ -32,19 +33,23 @@ src_prepare() {
 	multilib_copy_sources
 }
 
+my_make() {
+	emake \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		SHLIBDIR="${EPREFIX}/$(get_libdir)" \
+		"${@}"
+}
+
 multilib_src_compile() {
 	tc-export CC AR RANLIB
 
 	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
 
-	emake \
-		LIBDIR="\$(PREFIX)/$(get_libdir)" \
-		SHLIBDIR="/$(get_libdir)"
+	my_make
 }
 
 multilib_src_install() {
-	emake DESTDIR="${D}" \
-		LIBDIR="\$(PREFIX)/$(get_libdir)" \
-		SHLIBDIR="/$(get_libdir)" \
-		install
+	my_make DESTDIR="${D}" install
+	use static-libs || rm "${ED}"/usr/$(get_libdir)/*.a || die
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/audit/Manifest b/sdk_container/src/third_party/portage-stable/sys-process/audit/Manifest
index 32dd6e54f4..efb7e21808 100644
--- a/sdk_container/src/third_party/portage-stable/sys-process/audit/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-process/audit/Manifest
@@ -1,3 +1,4 @@
 DIST audit-3.1.2.tar.gz 1219860 BLAKE2B dfdec470bf12cce6c570b3d260e65e2b49e8ac0761e6a6fbf7b4f4a57f92e88367cd74bfcb88e6d718619b88fea27ce963a977c9f4346c95d18a5310e217accb SHA512 a97003a294ed3671df01e2952688e7d5eef59a35f6891feb53e67c4c7eab9ae8c2d18de41a5b5b20e0ad7156fac93aec05f32f6bc5eea706b42b6f27f676446a
 DIST audit-3.1.3.tar.gz 1225761 BLAKE2B 97ee35fc722083d541e164b27fd318ec7be2a4e4e8774767d14c6a2e800092a37b7042a272db5d208c913fb36d295c5343bd6082237caf0fb561ec3c7a2883db SHA512 7d6399ca97b171d5ea3cf7f7566bdabe9d5677a3a54c75411146dc2971106809a90d1a9cd0b1ba9b8af4cc409e6bee5876c7f2a0c54c42400fdcf9cfade58a8c
 DIST audit-3.1.4.tar.gz 1225648 BLAKE2B c6875f7d031e810469511ac8f86f05b2de7f19c044dbf67bc9d66430167fcf0f031e0279ce170a496b672a6fc99ee18b8cc39943e6faf3c19a24a381d2701439 SHA512 d26c498c91e838d97d3f199630650f509bb1e82b44d364306b20db32d4116fa73d775ef56c0fed2ec8d548b19215052691cbc80c74699bc87f2a0ea08cf664f5
+DIST audit-4.0.1.tar.gz 1194961 BLAKE2B 590abf58e672921a432348f48936cfbff0b6ddfa47e77b3b20eaa00e5d1c4ce2fc8d10c1fc1cbc19d44c09a9f7dfbca76778c94d8d340485c2bb1bb3b5a3c95a SHA512 7fbc426d0ddea340a36ceab52ac090e8e3dfb3450ebf50b478324a097f19ab4bb2cf78a2532644acb17e6114b59b8fda718affda9da62fb84181e3abf76039df
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.1-r1.ebuild
new file mode 100644
index 0000000000..0757b5e964
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-process/audit/audit-4.0.1-r1.ebuild
@@ -0,0 +1,195 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# As with sys-libs/libcap-ng, same maintainer in Fedora as upstream, so
+# check Fedora's packaging (https://src.fedoraproject.org/rpms/audit/tree/rawhide)
+# on bumps (or if hitting a bug) to see what they've done there.
+
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit autotools multilib-minimal toolchain-funcs python-r1 linux-info systemd usr-ldscript
+
+DESCRIPTION="Userspace utilities for storing and processing auditing records"
+HOMEPAGE="https://people.redhat.com/sgrubb/audit/"
+SRC_URI="https://people.redhat.com/sgrubb/audit/${P}.tar.gz"
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="gssapi io-uring ldap python static-libs test"
+
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/libcap-ng
+	gssapi? ( virtual/krb5 )
+	ldap? ( net-nds/openldap:= )
+	python? ( ${PYTHON_DEPS} )
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-2.6.34
+	test? ( dev-libs/check )
+"
+BDEPEND="
+	python? (
+		dev-lang/swig
+		$(python_gen_cond_dep '
+			dev-python/setuptools[${PYTHON_USEDEP}]
+		' python3_12)
+	)
+"
+
+CONFIG_CHECK="~AUDIT"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# missing on musl. Uses handrolled AC_LINK_IFELSE but fails at link time
+	# for older compilers regardless. bug #898828
+	strndupa
+)
+
+PATCHES=(
+	"${FILESDIR}/${P}-implicit-builtin-functions.patch"
+	"${FILESDIR}/${P}-null-deref.patch"
+)
+
+src_prepare() {
+	# audisp-remote moved in multilib_src_install_all
+	sed -i \
+		-e "s,/sbin/audisp-remote,${EPREFIX}/usr/sbin/audisp-remote," \
+		audisp/plugins/remote/au-remote.conf || die
+
+	# Disable installing sample rules so they can be installed as docs.
+	echo -e '%:\n\t:' | tee rules/Makefile.{am,in} >/dev/null || die
+
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--sbindir="${EPREFIX}"/sbin
+		--localstatedir="${EPREFIX}"/var
+		--runstatedir="${EPREFIX}"/run
+		$(use_enable gssapi gssapi-krb5)
+		$(use_enable ldap zos-remote)
+		$(use_enable static-libs static)
+		$(use_with io-uring io_uring)
+		--without-golang
+		--without-libwrap
+		--without-python3
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if multilib_is_native_abi && use python; then
+		python_configure() {
+			mkdir -p "${BUILD_DIR}" || die
+			pushd "${BUILD_DIR}" &>/dev/null || die
+
+			ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" --with-python3
+
+			popd &>/dev/null || die
+		}
+
+		python_foreach_impl python_configure
+	fi
+}
+
+src_configure() {
+	tc-export_build_env BUILD_{CC,CPP}
+
+	local -x CC_FOR_BUILD="${BUILD_CC}"
+	local -x CPP_FOR_BUILD="${BUILD_CPP}"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+
+		local native_build="${BUILD_DIR}"
+
+		python_compile() {
+			emake -C "${BUILD_DIR}"/bindings/swig top_builddir="${native_build}"
+			emake -C "${BUILD_DIR}"/bindings/python/python3 top_builddir="${native_build}"
+		}
+
+		use python && python_foreach_impl python_compile
+	else
+		emake -C common
+		emake -C lib
+		emake -C auparse
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" initdir="$(systemd_get_systemunitdir)" install
+
+		local native_build="${BUILD_DIR}"
+
+		python_install() {
+			emake -C "${BUILD_DIR}"/bindings/swig DESTDIR="${D}" top_builddir="${native_build}" install
+			emake -C "${BUILD_DIR}"/bindings/python/python3 DESTDIR="${D}" top_builddir="${native_build}" install
+			python_optimize
+		}
+
+		use python && python_foreach_impl python_install
+
+		# Things like shadow use this so we need to be in /
+		gen_usr_ldscript -a audit auparse
+	else
+		emake -C lib DESTDIR="${D}" install
+		emake -C auparse DESTDIR="${D}" install
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc AUTHORS ChangeLog README* THANKS
+	docinto contrib
+	dodoc contrib/avc_snap
+	docinto contrib/plugin
+	dodoc contrib/plugin/*
+	docinto rules
+	dodoc rules/*rules
+
+	newinitd "${FILESDIR}"/auditd-init.d-2.4.3 auditd
+	newconfd "${FILESDIR}"/auditd-conf.d-2.1.3 auditd
+
+	if [[ -f "${ED}"/sbin/audisp-remote ]] ; then
+		dodir /usr/sbin
+		mv "${ED}"/{sbin,usr/sbin}/audisp-remote || die
+	fi
+
+	# Gentoo rules
+	insinto /etc/audit
+	newins "${FILESDIR}"/audit.rules-2.1.3 audit.rules
+	doins "${FILESDIR}"/audit.rules.stop*
+	keepdir /etc/audit/rules.d
+
+	# audit logs go here
+	keepdir /var/log/audit
+
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	# Security
+	lockdown_perms "${ED}"
+}
+
+pkg_postinst() {
+	lockdown_perms "${EROOT}"
+}
+
+lockdown_perms() {
+	# Upstream wants these to have restrictive perms.
+	# Should not || die as not all paths may exist.
+	local basedir="${1}"
+	chmod 0750 "${basedir}"/sbin/au{ditctl,ditd,report,search,trace} 2>/dev/null
+	chmod 0750 "${basedir}"/var/log/audit 2>/dev/null
+	chmod 0640 "${basedir}"/etc/audit/{auditd.conf,audit*.rules*} 2>/dev/null
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-implicit-builtin-functions.patch b/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-implicit-builtin-functions.patch
new file mode 100644
index 0000000000..cd0f0f7e72
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-implicit-builtin-functions.patch
@@ -0,0 +1,563 @@
+Backport of https://github.com/linux-audit/audit-userspace/commit/8c7eaa7ead6c70486623674c19d649f3831578ad
+
+diff -ur audit-4.0.1.orig/audisp/audispd-llist.c audit-4.0.1/audisp/audispd-llist.c
+--- audit-4.0.1.orig/audisp/audispd-llist.c
++++ audit-4.0.1/audisp/audispd-llist.c
+@@ -69,11 +69,13 @@ unsigned int plist_count_active(const co
+ 	return cnt;
+ }
+ 
+-void plist_append(conf_llist *l, plugin_conf_t *p)
++int plist_append(conf_llist *l, plugin_conf_t *p)
+ {
+ 	lnode* newnode;
+ 
+ 	newnode = malloc(sizeof(lnode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	if (p) {
+ 		void *pp = malloc(sizeof(struct plugin_conf));
+@@ -94,6 +96,8 @@ void plist_append(conf_llist *l, plugin_
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ void plist_clear(conf_llist* l)
+diff -ur audit-4.0.1.orig/audisp/audispd-llist.h audit-4.0.1/audisp/audispd-llist.h
+--- audit-4.0.1.orig/audisp/audispd-llist.h
++++ audit-4.0.1/audisp/audispd-llist.h
+@@ -1,6 +1,6 @@
+ /*
+ * audispd-llist.h - Header file for ausearch-conf_llist.c
+-* Copyright (c) 2007,2013 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2007,2013 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -51,7 +51,7 @@ unsigned int plist_count_active(const co
+ void plist_last(conf_llist *l);
+ lnode *plist_next(conf_llist *l);
+ static inline lnode *plist_get_cur(conf_llist *l) { return l->cur; }
+-void plist_append(conf_llist *l, plugin_conf_t *p);
++int plist_append(conf_llist *l, plugin_conf_t *p);
+ void plist_clear(conf_llist* l);
+ void plist_mark_all_unchecked(conf_llist* l);
+ lnode *plist_find_unchecked(conf_llist* l);
+diff -ur audit-4.0.1.orig/auparse/normalize-llist.c audit-4.0.1/auparse/normalize-llist.c
+--- audit-4.0.1.orig/auparse/normalize-llist.c
++++ audit-4.0.1/auparse/normalize-llist.c
+@@ -1,6 +1,6 @@
+ /*
+  * normalize-llist.c - Minimal linked list library
+- * Copyright (c) 2016-17 Red Hat Inc., Durham, North Carolina.
++ * Copyright (c) 2016-17 Red Hat Inc.
+  * All Rights Reserved. 
+  *
+  * This library is free software; you can redistribute it and/or
+@@ -61,11 +61,14 @@ data_node *cllist_next(cllist *l)
+ 	return l->cur;
+ }
+ 
+-void cllist_append(cllist *l, uint32_t num, void *data)
++// Returns 0 on success and 1 on error
++int cllist_append(cllist *l, uint32_t num, void *data)
+ {
+ 	data_node *newnode;
+ 
+ 	newnode = malloc(sizeof(data_node));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	newnode->num = num;
+ 	newnode->data = data;
+@@ -80,5 +83,6 @@ void cllist_append(cllist *l, uint32_t n
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++	return 0;
+ }
+ 
+diff -ur audit-4.0.1.orig/auparse/normalize-llist.h audit-4.0.1/auparse/normalize-llist.h
+--- audit-4.0.1.orig/auparse/normalize-llist.h
++++ audit-4.0.1/auparse/normalize-llist.h
+@@ -1,6 +1,6 @@
+ /*
+  * normalize-llist.h - Header file for normalize-llist.c
+- * Copyright (c) 2016-17 Red Hat Inc., Durham, North Carolina.
++ * Copyright (c) 2016-17 Red Hat Inc.
+  * All Rights Reserved.
+  *
+  * This library is free software; you can redistribute it and/or
+@@ -53,7 +53,7 @@ AUDIT_HIDDEN_START
+ void cllist_create(cllist *l, void (*cleanup)(void *));
+ void cllist_clear(cllist* l);
+ data_node *cllist_next(cllist *l);
+-void cllist_append(cllist *l, uint32_t num, void *data);
++int cllist_append(cllist *l, uint32_t num, void *data);
+ 
+ AUDIT_HIDDEN_END
+ 
+diff -ur audit-4.0.1.orig/auparse/normalize.c audit-4.0.1/auparse/normalize.c
+--- audit-4.0.1.orig/auparse/normalize.c
++++ audit-4.0.1/auparse/normalize.c
+@@ -179,7 +179,8 @@ static unsigned int add_subj_attr(aupars
+ 	if ((auparse_find_field(au, str))) {
+ 		attr = set_record(0, rnum);
+ 		attr = set_field(attr, auparse_get_field_num(au));
+-		cllist_append(&D.actor.attr, attr, NULL);
++		if (cllist_append(&D.actor.attr, attr, NULL))
++			return 1;
+ 		return 0;
+ 	} else
+ 		auparse_goto_record_num(au, rnum);
+@@ -224,7 +225,8 @@ static unsigned int add_obj_attr(auparse
+ 	if ((auparse_find_field(au, str))) {
+ 		attr = set_record(0, rnum);
+ 		attr = set_field(attr, auparse_get_field_num(au));
+-		cllist_append(&D.thing.attr, attr, NULL);
++		if (cllist_append(&D.thing.attr, attr, NULL))
++			return 1;
+ 		return 0;
+ 	} else
+ 		auparse_goto_record_num(au, rnum);
+@@ -360,21 +362,23 @@ static void collect_id_obj2(auparse_stat
+ 	}
+ }
+ 
+-static void collect_path_attrs(auparse_state_t *au)
++static int collect_path_attrs(auparse_state_t *au)
+ {
+ 	value_t attr;
+ 	unsigned int rnum = auparse_get_record_num(au);
+ 
+ 	auparse_first_field(au);
+ 	if (add_obj_attr(au, "mode", rnum))
+-		return;	// Failed opens don't have anything else
++		return 1;	// Failed opens don't have anything else
+ 
+ 	// All the rest of the fields matter
+ 	while ((auparse_next_field(au))) {
+ 		attr = set_record(0, rnum);
+ 		attr = set_field(attr, auparse_get_field_num(au));
+-		cllist_append(&D.thing.attr, attr, NULL);
++		if (cllist_append(&D.thing.attr, attr, NULL))
++			return 1;
+ 	}
++	return 0;
+ }
+ 
+ static void collect_cwd_attrs(auparse_state_t *au)
+diff -ur audit-4.0.1.orig/src/auditctl-llist.c audit-4.0.1/src/auditctl-llist.c
+--- audit-4.0.1.orig/src/auditctl-llist.c
++++ audit-4.0.1/src/auditctl-llist.c
+@@ -1,7 +1,7 @@
+ /*
+ * ausearch-llist.c - Minimal linked list library
+-* Copyright (c) 2005 Red Hat Inc., Durham, North Carolina.
+-* All Rights Reserved. 
++* Copyright (c) 2005 Red Hat Inc.
++* All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+@@ -15,7 +15,7 @@
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING. If not, write to the
+-* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
++* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
+ *
+ * Authors:
+@@ -59,11 +59,13 @@ lnode *list_next(llist *l)
+ 	return l->cur;
+ }
+ 
+-void list_append(llist *l, const struct audit_rule_data *r, size_t sz)
++int list_append(llist *l, const struct audit_rule_data *r, size_t sz)
+ {
+ 	lnode* newnode;
+ 
+ 	newnode = malloc(sizeof(lnode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	if (r) {
+ 		void *rr = malloc(sz);
+@@ -85,6 +87,8 @@ void list_append(llist *l, const struct
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ void list_clear(llist* l)
+diff -ur audit-4.0.1.orig/src/auditctl-llist.h audit-4.0.1/src/auditctl-llist.h
+--- audit-4.0.1.orig/src/auditctl-llist.h
++++ audit-4.0.1/src/auditctl-llist.h
+@@ -1,6 +1,6 @@
+ /*
+ * auditctl-llist.h - Header file for ausearch-llist.c
+-* Copyright (c) 2005 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2005 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -50,7 +50,7 @@ void list_first(llist *l);
+ void list_last(llist *l);
+ lnode *list_next(llist *l);
+ static inline lnode *list_get_cur(const llist *l) { return l->cur; }
+-void list_append(llist *l, const struct audit_rule_data *r, size_t sz);
++int list_append(llist *l, const struct audit_rule_data *r, size_t sz);
+ void list_clear(llist* l);
+ 
+ #endif
+diff -ur audit-4.0.1.orig/src/ausearch-avc.c audit-4.0.1/src/ausearch-avc.c
+--- audit-4.0.1.orig/src/ausearch-avc.c
++++ audit-4.0.1/src/ausearch-avc.c
+@@ -1,7 +1,7 @@
+ /*
+ * ausearch-avc.c - Minimal linked list library for avcs
+-* Copyright (c) 2006,2008,2014 Red Hat Inc., Durham, North Carolina.
+-* All Rights Reserved. 
++* Copyright (c) 2006,2008,2014 Red Hat Inc.
++* All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+@@ -15,7 +15,7 @@
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING. If not, write to the
+-* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
++* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
+ *
+ * Authors:
+@@ -62,11 +62,13 @@ static void alist_last(alist *l)
+ 	l->cur = cur;
+ }
+ 
+-void alist_append(alist *l, anode *node)
++int alist_append(alist *l, anode *node)
+ {
+ 	anode* newnode;
+ 
+ 	newnode = malloc(sizeof(anode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	if (node->scontext)
+ 		newnode->scontext = node->scontext;
+@@ -104,6 +106,8 @@ void alist_append(alist *l, anode *node)
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ int alist_find_subj(alist *l)
+diff -ur audit-4.0.1.orig/src/ausearch-avc.h audit-4.0.1/src/ausearch-avc.h
+--- audit-4.0.1.orig/src/ausearch-avc.h
++++ audit-4.0.1/src/ausearch-avc.h
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-avc.h - Header file for ausearch-string.c
+-* Copyright (c) 2006,2008 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2006,2008 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -54,7 +54,7 @@ void alist_create(alist *l);
+ static inline void alist_first(alist *l) { l->cur = l->head; }
+ anode *alist_next(alist *l);
+ static inline anode *alist_get_cur(const alist *l) { return l->cur; }
+-void alist_append(alist *l, anode *node);
++int alist_append(alist *l, anode *node);
+ void anode_init(anode *an);
+ void anode_clear(anode *an);
+ void alist_clear(alist* l);
+diff -ur audit-4.0.1.orig/src/ausearch-int.c audit-4.0.1/src/ausearch-int.c
+--- audit-4.0.1.orig/src/ausearch-int.c
++++ audit-4.0.1/src/ausearch-int.c
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-int.c - Minimal linked list library for integers
+-* Copyright (c) 2005,2008 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2005,2008 Red Hat Inc.
+ * All Rights Reserved. 
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -41,11 +41,13 @@ int_node *ilist_next(ilist *l)
+ 	return l->cur;
+ }
+ 
+-void ilist_append(ilist *l, int num, unsigned int hits, int aux)
++int ilist_append(ilist *l, int num, unsigned int hits, int aux)
+ {
+ 	int_node* newnode;
+ 
+ 	newnode = malloc(sizeof(int_node));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	newnode->num = num;
+ 	newnode->hits = hits;
+@@ -61,6 +63,8 @@ void ilist_append(ilist *l, int num, uns
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ void ilist_clear(ilist* l)
+diff -ur audit-4.0.1.orig/src/ausearch-int.h audit-4.0.1/src/ausearch-int.h
+--- audit-4.0.1.orig/src/ausearch-int.h
++++ audit-4.0.1/src/ausearch-int.h
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-int.h - Header file for ausearch-int.c
+-* Copyright (c) 2005,2008 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2005,2008 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -48,7 +48,7 @@ void ilist_create(ilist *l);
+ static inline void ilist_first(ilist *l) { l->cur = l->head; }
+ int_node *ilist_next(ilist *l);
+ static inline int_node *ilist_get_cur(const ilist *l) { return l->cur; }
+-void ilist_append(ilist *l, int num, unsigned int hits, int aux);
++int ilist_append(ilist *l, int num, unsigned int hits, int aux);
+ void ilist_clear(ilist* l);
+ 
+ /* append a number if its not already on the list */
+diff -ur audit-4.0.1.orig/src/ausearch-llist.c audit-4.0.1/src/ausearch-llist.c
+--- audit-4.0.1.orig/src/ausearch-llist.c
++++ audit-4.0.1/src/ausearch-llist.c
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-llist.c - Minimal linked list library
+-* Copyright (c) 2005-2008,2011,2016 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2005-2008,2011,2016 Red Hat Inc.
+ * Copyright (c) 2011 IBM Corp.
+ * All Rights Reserved. 
+ *
+@@ -102,11 +102,13 @@ lnode *list_prev(llist *l)
+ 	return l->cur;
+ }
+ 
+-void list_append(llist *l, lnode *node)
++int list_append(llist *l, lnode *node)
+ {
+ 	lnode* newnode;
+ 
+ 	newnode = malloc(sizeof(lnode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	if (node->message)
+ 		newnode->message = node->message;
+@@ -119,7 +121,7 @@ void list_append(llist *l, lnode *node)
+ 	newnode->type = node->type;
+ 	newnode->a0 = node->a0;
+ 	newnode->a1 = node->a1;
+-	newnode->item = l->cnt; 
++	newnode->item = l->cnt;
+ 	newnode->next = NULL;
+ 
+ 	// if we are at top, fix this up
+@@ -131,6 +133,8 @@ void list_append(llist *l, lnode *node)
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ int list_find_item(llist *l, unsigned int i)
+diff -ur audit-4.0.1.orig/src/ausearch-llist.h audit-4.0.1/src/ausearch-llist.h
+--- audit-4.0.1.orig/src/ausearch-llist.h
++++ audit-4.0.1/src/ausearch-llist.h
+@@ -107,7 +107,7 @@ void list_last(llist *l);
+ lnode *list_next(llist *l);
+ lnode *list_prev(llist *l);
+ static inline lnode *list_get_cur(llist *l) { return l->cur; }
+-void list_append(llist *l, lnode *node);
++int list_append(llist *l, lnode *node);
+ void list_clear(llist* l);
+ int list_get_event(llist* l, event *e);
+ 
+diff -ur audit-4.0.1.orig/src/ausearch-nvpair.c audit-4.0.1/src/ausearch-nvpair.c
+--- audit-4.0.1.orig/src/ausearch-nvpair.c
++++ audit-4.0.1/src/ausearch-nvpair.c
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-nvpair.c - Minimal linked list library for name-value pairs
+-* Copyright (c) 2006-08 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2006-08 Red Hat Inc.
+ * All Rights Reserved. 
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -34,9 +34,11 @@ void search_list_create(nvlist *l)
+ 	l->cnt = 0;
+ }
+ 
+-void search_list_append(nvlist *l, nvnode *node)
++int search_list_append(nvlist *l, nvnode *node)
+ {
+ 	nvnode* newnode = malloc(sizeof(nvnode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	newnode->name = node->name;
+ 	newnode->val = node->val;
+@@ -54,6 +56,8 @@ void search_list_append(nvlist *l, nvnod
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ int search_list_find_val(nvlist *l, long val)
+diff -ur audit-4.0.1.orig/src/ausearch-nvpair.h audit-4.0.1/src/ausearch-nvpair.h
+--- audit-4.0.1.orig/src/ausearch-nvpair.h
++++ audit-4.0.1/src/ausearch-nvpair.h
+@@ -1,6 +1,6 @@
+ /*
+ * ausearch-nvpair.h - Header file for ausearch-nvpair.c
+-* Copyright (c) 2006-08 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2006-08 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -46,7 +46,7 @@ typedef struct {
+ 
+ void search_list_create(nvlist *l);
+ static inline nvnode *search_list_get_cur(nvlist *l) { return l->cur; }
+-void search_list_append(nvlist *l, nvnode *node);
++int search_list_append(nvlist *l, nvnode *node);
+ void search_list_clear(nvlist* l);
+ 
+ /* Given a numeric index, find that record. */
+diff -ur audit-4.0.1.orig/src/ausearch-string.c audit-4.0.1/src/ausearch-string.c
+--- audit-4.0.1.orig/src/ausearch-string.c
++++ audit-4.0.1/src/ausearch-string.c
+@@ -44,11 +44,13 @@ snode *slist_next(slist *l)
+ 	return l->cur;
+ }
+ 
+-void slist_append(slist *l, const snode *node)
++int slist_append(slist *l, const snode *node)
+ {
+ 	snode* newnode;
+ 
+ 	newnode = malloc(sizeof(snode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	if (node->str)
+ 		newnode->str = node->str;
+@@ -75,6 +77,8 @@ void slist_append(slist *l, const snode
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ void slist_clear(slist* l)
+diff -ur audit-4.0.1.orig/src/ausearch-string.h audit-4.0.1/src/ausearch-string.h
+--- audit-4.0.1.orig/src/ausearch-string.h
++++ audit-4.0.1/src/ausearch-string.h
+@@ -49,7 +49,7 @@ void slist_create(slist *l);
+ static inline void slist_first(slist *l) { l->cur = l->head; }
+ snode *slist_next(slist *l);
+ static inline snode *slist_get_cur(const slist *l) { return l->cur; }
+-void slist_append(slist *l, const snode *node);
++int slist_append(slist *l, const snode *node);
+ void slist_clear(slist* l);
+ 
+ /* append a string if its not already on the list */
+diff -ur audit-4.0.1.orig/tools/aulastlog/aulastlog-llist.c audit-4.0.1/tools/aulastlog/aulastlog-llist.c
+--- audit-4.0.1.orig/tools/aulastlog/aulastlog-llist.c
++++ audit-4.0.1/tools/aulastlog/aulastlog-llist.c
+@@ -1,7 +1,7 @@
+ /*
+ * aulastlog-llist.c - Minimal linked list library
+-* Copyright (c) 2008 Red Hat Inc., Durham, North Carolina.
+-* All Rights Reserved. 
++* Copyright (c) 2008 Red Hat Inc..
++* All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+@@ -15,7 +15,7 @@
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING. If not, write to the
+-* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor 
++* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
+ * Boston, MA 02110-1335, USA.
+ *
+ * Authors:
+@@ -41,11 +41,13 @@ lnode *list_next(llist *l)
+ 	return l->cur;
+ }
+ 
+-void list_append(llist *l, lnode *node)
++int list_append(llist *l, lnode *node)
+ {
+ 	lnode* newnode;
+ 
+ 	newnode = malloc(sizeof(lnode));
++	if (newnode == NULL)
++		return 1;
+ 
+ 	newnode->sec = node->sec;
+ 	newnode->uid = node->uid;
+@@ -58,7 +60,7 @@ void list_append(llist *l, lnode *node)
+ 		newnode->term = strdup(node->term);
+ 	else
+ 		newnode->term = NULL;
+-	newnode->item = l->cnt; 
++	newnode->item = l->cnt;
+ 	newnode->next = NULL;
+ 
+ 	// if we are at top, fix this up
+@@ -70,6 +72,8 @@ void list_append(llist *l, lnode *node)
+ 	// make newnode current
+ 	l->cur = newnode;
+ 	l->cnt++;
++
++	return 0;
+ }
+ 
+ void list_clear(llist* l)
+diff -ur audit-4.0.1.orig/tools/aulastlog/aulastlog-llist.h audit-4.0.1/tools/aulastlog/aulastlog-llist.h
+--- audit-4.0.1.orig/tools/aulastlog/aulastlog-llist.h
++++ audit-4.0.1/tools/aulastlog/aulastlog-llist.h
+@@ -1,6 +1,6 @@
+ /*
+ * aulastlog-llist.h - Header file for aulastlog-llist.c
+-* Copyright (c) 2008 Red Hat Inc., Durham, North Carolina.
++* Copyright (c) 2008 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+@@ -53,7 +53,7 @@ static inline void list_first(llist *l)
+ lnode *list_next(llist *l);
+ static inline lnode *list_get_cur(llist *l) { return l->cur; }
+ static inline unsigned int list_get_cnt(llist *l) { return l->cnt; }
+-void list_append(llist *l, lnode *node);
++int list_append(llist *l, lnode *node);
+ void list_clear(llist* l);
+ int list_update_login(llist* l, time_t t);
+ int list_update_host(llist* l, const char *h);
diff --git a/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-null-deref.patch b/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-null-deref.patch
new file mode 100644
index 0000000000..c18322ad27
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-process/audit/files/audit-4.0.1-null-deref.patch
@@ -0,0 +1,35 @@
+From 4780cd1a790286213dda646f782fa7128fb092a9 Mon Sep 17 00:00:00 2001
+From: Yugend <77495782+Yugend@users.noreply.github.com>
+Date: Sat, 4 May 2024 00:39:36 +0300
+Subject: [PATCH] avoiding of NULL pointers dereference (#366)
+
+---
+ src/ausearch-parse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
+index 1a5b047f3..be57606bd 100644
+--- a/src/ausearch-parse.c
++++ b/src/ausearch-parse.c
+@@ -719,6 +719,10 @@ static int common_path_parser(search_items *s, char *path)
+ 			// append
+ 			snode sn;
+ 			sn.str = strdup(path);
++			if (sn.str == NULL) {
++				fprintf(stderr, "Out of memory. Check %s file, %d line\n", __FILE__, __LINE__);
++				return 8;
++			}
+ 			sn.key = NULL;
+ 			sn.hits = 1;
+ 			// Attempt to rebuild path if relative
+@@ -1217,6 +1221,10 @@ static int parse_user(const lnode *n, search_items *s, anode *avc)
+ 			saved = *term;
+ 			*term = 0;
+ 			s->hostname = strdup(str);
++			if (s->hostname == NULL) {
++				fprintf(stderr, "Out of memory. Check %s file, %d line\n", __FILE__, __LINE__);
++				return 33;
++			}
+ 			*term = saved;
+ 
+ 			// Lets see if there is something more
diff --git a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r1.ebuild b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
similarity index 83%
rename from sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
index 2f525a9cc4..f2ca7f9015 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/service-manager/service-manager-1-r2.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="Virtual for various service managers"
 
@@ -12,7 +12,10 @@ RDEPEND="
 	prefix-guest? ( >=sys-apps/baselayout-prefix-2.2 )
 	!prefix-guest? (
 		|| (
-			sys-apps/openrc
+			|| (
+				sys-apps/openrc
+				sys-apps/openrc-navi
+			)
 			kernel_linux? (
 				|| (
 					sys-apps/s6-rc